The conversion of most undergraduate courses from LEARN to Canvas is scheduled for the winter semester of 2023/24. Therefore, a lot of conversion work will be done this summer.

In our last newsletter, we provided useful recommendations for the use of Canvas. Now, we would like to give an update. It’s been ten months that live operation of Canvas started in July 2022. Recently, updated terms of use have come into force. As requested by the Academic Staff Council on several occasions, these now contain important clarifications and recommendations for action that we would like to highlight here.

Lack of access control to files

This problem persists indefinitely, as the service provider behind Canvas has not yet provided a date when this will be fixed. WU has assured us that they are pushing hard for an implementation as soon as possible. Until then, the following applies (according to the terms of use in wording): "Via temporary URLs, the contents uploaded to the LMS by faculty members are freely available (without access controls) for a maximum period of 24 hours and the contents uploaded by students for a maximum period of 10 hours, if the temporary URL in question is known."

Therefore, until this situation is technically resolved, we continue to strongly recommend that files be placed on Canvas only in additional secured form at the student's discretion (e.g., password-protected files, sharing of materials via temporary and password-protected ownCloud links). This applies in particular to materials that are subject to exploitation rights of third parties (e.g. publishers), or that may touch upon spheres that are particularly worthy of protection (such as video recordings from private or office rooms not intended for this purpose).

Use of Canvas only when VPN connection is up and running.

The updated terms of use clarify that "For access from within the EU, it is ensured that all data processing activities take place within the EU. For access from outside the EU, data processing within the EU can only be ensured when using the VPN access provided by WU. Authorized Users accessing CANVAS from outside the EU are urged to actively use WU’s VPN access."

Data Retention at "Canvas Commons"

The updated Terms of Use describe the baseline as follows: "When using Canvas Commons, the data are processed based on your consent (Article 6 [1] item a of the GDPR). By using Canvas Commons, you also expressly consent to the transfer of your data to the USA (Article 49 [1] item a of the GDPR).

Please note that the USA has not been certified by the European Court of Justice as having an adequate level of data protection. In particular, there is a risk that your data may be subject to access by US authorities for control and monitoring purposes and that no effective legal remedies are available against this.

You can withdraw your consent at any time, but this does not affect the lawfulness of the data processing that took place before you withdrew your consent. The easiest way to do this is to delete the data in Canvas Commons yourself."

Accordingly, be sure to use Canvas Commons thoughtfully and only voluntarily with the use of additional confidentiality protections for your data (e.g., password-protected files or sharing of materials via temporary and password-protected ownCloud links).

Canvas mobile apps (esp: "Canvas for Teachers").

The terms of use state, "No user support is provided for these two apps."

This confirms our reporting from our last newsletter. Further, we do not recommend the use of these apps. The data privacy clarification to which the employer refers was commissioned by the service provider of Canvas and thus was not done independently or directly by WU.

^22.05.2023

back to the top