Canvas Exposed: The little problem with UBC’s big, expensive new tool

The little problem with UBC’s big, expensive new tool

Last year, UBC introduced a new learning management system. Canvas by Instructure was rolled out to replace the aging and underperforming Blackboard Connect. When classes begin this September, UBC’s more than 60,000 students will only be using the new Canvas system.

Learning management systems are useful because they allow students to submit assignments from home, interact with their peers and professors remotely, and grant access to additional learning materials. But with these benefits there are also some concerns. The digital exhaust that students create while navigating these systems is collected, stored, and analyzed.

As previously discussed, this process may unjustly colour the perception of students in the eyes of instructors and administrators, creating the potential for unfair grading practices based on arbitrary behavioural data.

But not only that, there’s now a very real concern about who has access to all of the data that these systems collect about students, including sensitive personal information. Previously, with Blackboard Connect, the data was stored on UBC servers. Now, with Canvas, that data is being stored on cloud computing servers owned and operated by Amazon in Quebec.

Access to the personal information of UBC students is granted to international companies that operate and maintain the Canvas system. Although access is restricted to specific uses outlined in the service contract, personal information flowing outside of Canada is something that B.C.’s Freedom of Information and Protection of Privacy Act protects against.

According to section 30.1 of the act, the storage and access of personal information can only happen outside of Canada if the individual who the information is about has provided consent. Meaning, that Canvas requires every UBC student to provide informed consent to their personal information flowing across international borders.

For this to happen, each UBC student must knowingly agree to the Canvas contract with a full understanding of exactly what personal information is being accessed and stored outside of Canada. It would be reasonable to assume that this includes:

• the names of the companies who have access to UBC student personal information
• the location(s) of access
• the duration the data is being stored
• the specific types of personal information being accessed
• how the data is being used
• and why the use of personal information is necessary in the operation and maintenance of the system

In theory, there would be no issue if every UBC student precisely understood all of those things and if all of that information was available. Yet, it’s unlikely that all students (if any) understand what exactly they’re consenting to in the Canvas contract (this is unrelated to questions of if they would care if they did understand) and, as it stands, that information is not available for students.

So it would appear, then, that students are not being presented with opportunity to provide informed consent to the cross border flow of their personal information unless they were to know this information. Or, at the very least, if UBC would provide students with access to this information.

But, as you’ll soon discover, UBC representatives aren’t able to tell students what international companies have access to their personal information or any of these other, necessary things.

Informed consent vs forced consent: When saying ‘No’ isn’t an option

For many, these types of potential privacy violations are not a palpable concern. It’s understandable that students wouldn’t have the time to worry about the terms of use and privacy policies for internal systems that are required for their post-secondary studies. They agree to these policies because the use of Canvas is a necessary step in completing their education.

They don’t really have a choice in the matter.

After the arduous process of applying to a university, perhaps moving a significant distance, isolating oneself from an established support network, investing heavily in education, and facing the new challenge of university studies, contracts like Canvas’ privacy policy and terms of use are often and understandably overlooked in comparison to other situational matters.

It has become a very regrettable common practice for consumers to feel pressured to consent with contracts like Canvas’ without properly understanding their implications and without, ultimately, really having a choice in the matter. Canvas’ contract is designed like the take-it-or-leave-it contracts that the European Union General Data Protection Regulations have made illegal.

But here in Canada, if a student were to observe a problem with a contract like Canvas’, what reasonable options would they have to disagree, to not consent to their personal information flowing across international borders, for example?

Could that student still achieve success at a university like UBC without consenting to the use of a system like Canvas? Could they complete their studies without using the system? Would it be reasonable to expect that student to enroll at another institution that uses a different system?

Last year, during the final year of my graduate studies, I decided not to consent to the terms of use and privacy policy for Canvas. I chose not to accept the terms of use and privacy policy for UBC’s new learning management system because I felt that the contract may be in violation of our provincial privacy laws.

Over the year, I’ve been proactively working towards a solution where I’d be able to consent to the Canvas contract. But, as previously stated, I couldn’t do this without knowing the answers to the questions that were posed earlier: Where does this information travel, who has access to it, how long is it stored, and what is it, exactly?

Because that’s how meaningful, informed consent is generated between two parties entering into contract together and that’s how we avoid systemic privacy violations like the Facebook / Cambridge Analytica data scandal.

But I was unable to get access to the information that I needed to make that informed decision. I was not provided with a reasonable alternative to using the Canvas system. And it very quickly became apparent that there are no alternatives for privacy conscious UBC students.

And for these reasons, I suggest that, for an incoming student beginning at UBC this year, it would be impossible not to consent to the use of Canvas.

No choice means no contract 

For the past year, I’ve been investigating what exactly happens when a student doesn’t consent to the Canvas contract. I’ve had meetings with student government, UBC administrators, and the ombudsperson for students; I’ve had phone calls with lawyers from both inside and outside of UBC; and I’ve filed freedom of information requests for records that explicitly show where the personal information of UBC students is accessed and stored, and for the contracts that UBC holds with these companies.

At this time, despite the legally mandated timeframe for producing these documents having expired, UBC representatives have failed to share with me what companies have access to my personal information, where they are located, what personal information they have access to, how long they keep it for, and how they use it. So in response to my previous question: Even if an incoming student wished to follow the law in providing informed consent to the Canvas contract, which requires these things be known, they wouldn’t be able to find them out, as I’ve spent a year attempting to do.

After consulting the law, speaking with experts, filing requests, it seems that I’m still not able to provide informed consent to the Canvas contract because I still don’t know what personal information is flowing where.

It is literally impossible for a UBC student to provide meaningful and informed consent to the terms of use and privacy policy for Canvas. For this reason, contract that exists today between students and UBC can only be described as forced consent.

Under the General Data Protection Regulations in the European Union, and the 126 other countries around the word who have adopted similar legislation that’s modeled after the E.U.’s, there would be a straightforward legal process to oppose a contract such as Canvas’. (In Canada, it’s only be a matter of time before our laws begin to resemble the E.U.’s GDPR: The Standing Committee on Access to Information, Privacy, and Ethics tabled a PIPEDA reform in February of this year, and M.P. Brian Masse also tabled motion 175 in the House of Commons in April of this year.)

Throughout the past year, I’ve grown more concerned about the way that the personal information of UBC students is being treated. My concerns have only increased as I’ve uncovered documents that show that these companies appear to be unable to operate within our provincial privacy laws.

What students can do

My time as a student at UBC has come to a close. But for students continuing their studies, or beginning them next month, the fight for your digital rights isn’t over. If you would like answers to the questions that I’ve been asking, like who has access to your sensitive personal information, in what countries, and why they need it, I’d suggest the following things:

1. Contact your student government representatives at the Alma Mater Society (AMS). I’ve met with a couple members of the student government to voice my concerns and was met with varying degrees of interest and ability. Student government won’t view this as an issue unless more students tell them it’s an issue.
2. Voice your concerns to the UBC Ombudsperson for students. I’ve had several meeting with the Ombudsperson and she has expressed a willingness to understand the issue and search for viable solutions.
3. Request access to your data. Under our provincial privacy laws, you’re entitled to receive access to the data that UBC collects about you. These requests can be submitted through the Office of Counsel. If UBC denies your access to this data, like they did with me, you can file a complaint with the Office of the Information and Privacy Commissioner of British Columbia.
4. Open up a dialogue with your instructors. UBC faculty might be surprised to learn about the data concerns related to Canvas and be sympathetic. After all, their information is also at risk.
5. Contact the British Columbia Civil Liberties Association. If you’re concerned about your personal information and don’t feel like you have a choice about using Canvas, you might want to get some legal help. The B.C. Civil Liberties Association may see merit in defending more than 60,000 students against a potential systemic privacy violation.
6. Don’t use Canvas. If you’ve already agreed to the terms of use and privacy policy, you can contact the UBC Access and Privacy Manager (access.and.privacy@ubc.ca or 604-822-2451) and inform them that you’re withdrawing your consent. If you haven’t “given” your consent yet, then don’t. You can cite the concerns described in this blog when discussing why you’re not able to consent.