Data Privacy: Our Current and Future Commitment

It's time for a bigger conversation about data privacy.

You've asked for it. And we at Instructure want to do what is right for education, especially as institutions seek to more deeply leverage technology to solve problems and innovate in teaching and learning.

The data privacy conversation is not specific to Instructure. It's time for all members of the global education community -- technology vendors, content providers, institutions, schools, administrators, librarians, teachers, students -- to come together and figure out how to best protect data privacy without abandoning the potential of data to improve education.

The numbers speak for themselves: 95%* of Americans are concerned about businesses collecting and selling personal information. Countries are implementing new guidelines for data usage, like GDPR in the EU. In the US, there is national interest in new legislation to cover perceived gaps in federal privacy laws such as FERPA and COPPA. In a recent survey, 26%* of respondents say they've never heard their local school district discuss student data privacy -- even though data may be critical to educational improvement in these districts. Last summer, the presidents from EDUCAUSE, AIR, and NACUBO issued a joint statement about the importance of responsibly gaining insights that will help students succeed:

“For every semester we don’t do everything we can to ensure student success--including using analytics to increase student progress and completion--students leave our campuses without graduating, discouraged and more indebted than when they entered.”

We want to empower you, our customers, to both protect and positively change the lives of your students through technology. That is why we freely provide Canvas Data to institutions as stewards. As an ed tech company, we also believe we should play a part in educational innovation because we want to see more students succeed as much as you do. They are our future.

Let’s start with the elephant in the room, the selling of data. Instructure has not and will not sell user data. Our perspective and commitment haven’t changed. We will always comply with privacy laws. We will be transparent and communicative about our privacy practices. And, we will encourage other vendors to take the same stance.

We also understand that our proposed acquisition has raised some questions about our position on data privacy. I can assure you that our commitment to data privacy will not change regardless of ownership. Holden Spaht, managing partner at Thoma Bravo, shares our commitment and recently issued the following statement about the importance of privacy to them:

“We commit to being transparent in our data usage, protecting user privacy, and leading by example. We do not--and we will not--sell student data. And we will never share user data with other companies in the Thoma Bravo portfolio.”

Our commitment to protect and never sell data is foundational. This year, we are going beyond the foundation. We are taking steps to elevate our own privacy practices and, we hope, ignite industry-wide discussions as we have in the past around cloud, openness, and standards, so we can set a new bar, together. Here are just a few things we are doing right now to begin this work.

Revising our Privacy Policy. Everyone should be able to read and understand a privacy policy. We want to be clear and concise so that anyone can understand our policies. We intend to revise our policy in two stages: First, we will soon be adding a paragraph to the beginning of the existing policy plainly stating our views on privacy; Second, we are working to rewrite the entire policy, using plain English, in a way that protects all users of our technologies. We expect to have our revised privacy policy in place in the next few months.

Assembling a Data Usage and Privacy Advisory Board. The Data Usage and Privacy Advisory Board will include a range of education stakeholders and experts -- teachers, researchers, data scientists, administrators, and privacy experts -- to discuss the questions that come with the use of data. While we will play an active role in the conversation, we believe the issues discussed should have a broader industry impact and not be solely about Instructure. The first Data Usage and Privacy Advisory Board meeting will take place in February, and I will share a summary of the discussions in this blog shortly thereafter.

Gathering Research. Data usage and privacy are complex issues, and we must not rush to conclusions without fully understanding all aspects. In addition to assembling an Advisory Board, we are working with a global research firm to ensure we are thinking about privacy from all angles. Our engagement with the firm began earlier this year, and we expect to share our findings this Spring.

Engaging the Community. We appreciate the thoughtful way that many members of our community, including Beth Crook from St. Andrew’s School of DE, Chris Giles from Beaverton School District, Cristina Colquhoun from Oklahoma State University, Kona Jones from Richland Community College, Marcus Painter from Twin Lakes School Corporation, and others have approached us with questions that have led to productive conversations and progress. We will continue to engage with and actively listen to constructive voices in our Canvas community. This dialogue must be constant, evolving, and future-focused.

Evaluating Product Implications. We have heard from some of you the types of features you would like to see, which we will fully evaluate, yet we need to ensure we are solving the right problems with the right approaches -- representing all of our important audiences. The ideas discussed in the Privacy Advisory Board will inform these conversations, as will our continued conversations with all of you. Internally, we have already begun considering product changes and will continue this through each iteration of our roadmap.

Reiterating Our Focus. We are focused on making teaching and learning better and easier for everyone. This is why we make software. It is why many of you chose Canvas. When it comes to data usage and privacy, it's easy to get caught up in the weeds, but we will remind ourselves of the goal we share with our educational partners, the improvement of student outcomes and the educational experience.

As I shared in my recent blog post, it is my responsibility to represent the Canvas Community to Instructure and Instructure to the Canvas Community. As I hope you can tell, we care deeply about the safety and security of the students, educators, and institutions we work with. Privacy has always been important to us, and our commitment hasn’t changed. But that doesn't mean our understanding and our practices shouldn't evolve.

Let’s do this together!

Keep Learning,
Melissa