Data Privacy in Learning Management Systems: Perceptions of Students, Faculty, and Administrative Staff

Some software platforms are exempt from regulations to protect personal data privacy, including learning management systems (LMS) used by post-secondary educational institutions. LMS collect, process, and store extensive amounts of personally identifiable information. LMS use is required, but students are provided with few or no privacy management features, further compounding a highly asymmetric power relationship. The survey study presented here examines a random sample of students', faculty members', and administrators' perceptions of student data privacy in LMS with the goal of improving the design of systems with inherent power imbalances. Respondents answered access questions with some degree of accuracy, but consistently overestimated the privacy of certain types of data. All three groups assumed LMS data were protected, but differed significantly in perceptions of how frequently student data is accessed and used, including for predictive analytics. Compared to the other groups, students viewed their data as less private and secure and had less knowledge of LMS data practices. In open-ended comments, faculty and students frequently asked for the correct answers about data access. All respondent groups expressed concerns regarding the unethical use of student data, compliance with regulations, lack of knowledge of what was done with the data, and inability to withdraw consent. The findings are interpreted through the lens of Nissenbaum's theory of contextual integrity, which highlights norms of appropriateness of disclosure and distribution as informed by particular use contexts. The authors recommend that designers explicitly and visibly integrate norms of appropriateness and distribution into LMS interfaces.