GDPR For Administrators

Jump to: navigation, search

Overview

GDPR stands for General Data Protection Regulation and refers to the European Union regulation for data protection for all individuals within the European Union. The regulation (Regulation (EU) 2016/679)2 becomes enforceable on 25 May 2018 and replaces the data protection directive (officially Directive 95/46/EC)3 from 1995.

Who does it affect?

Any individual or organisation that stores or processes personal information on an identifiable person from an EU member state (regardless if the processing or storage of information occurs in the EU or not). It also applies if the individual or organisation themselves is located in an EU member state.

What kind of information comprises personal data in a Moodle site?

It is all information that can be associated with a natural person. Each user account and all the activity associated with that user account is classified as personal information. This extends to information stored in backups, as well as associated information such as web server log files.

What are the penalties for non-compliance with the regulations?

Severe!

Disclaimer

The advice in this document is provided for informational purposes only, and not be construed as legal or professional advice. Moodle Pty Ltd does not warrant that the advice is accurate, complete, reliable, current or error-free.

Checklist

  1. Is the Moodle site hosted in an EU member state, or is it possible that any user of the Moodle site is an individual from an EU member state?
    • If you answered no to this question, you are not affected by this regulation. However, the benefits of data protection afforded by the regulation are universally applicable and you may consider voluntarily complying with this legislation for the benefit of your site users.
  2. Do you require your site users to accept a site policy document before using your site (either in Moodle or something outside of Moodle, like a paper form)?
    • If you answered no to this question, you must start doing so. Users need to be aware of their rights and the processes with which they can exercise their rights.
    • If you answered yes to this question you must review your privacy policy to make sure it covers all requirements of the new regulations (see “Site policy” below). If you change your privacy policy you must get all site users to accept the new policy before they can continue using the site.
  3. Is it possible that your site is used by minors? (Under 16 in most member states, but some states may reduce this as low as 13 years).
    • If you answered yes to this question, you must ensure that the consent is obtained from their legal guardian. Keep in mind that collecting and processing personal information on minors is may impact your risk assessment. You should take extra care to adequately secure this information, and retain it for as short a period as is necessary.
  4. Is it the collection or storage of personal data from your site users likely to result in a high risk to their rights and freedoms?
    • Some examples that would indicate high risk are:
      • a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person
      • processing on a large scale of special categories of data including
        • Racial or ethnic origin
        • Political opinions
        • Religious or philosophical beliefs
        • Trade union membership
        • Genetic data
        • Biometric data
        • Data concerning health
        • Sexual orientation
        • Data concerning a natural person’s sex life
        • Criminal convictions
      • This is not an exhaustive list and if you are unsure if you should consider the data collected from your users as “High risk” you should refer to the legislation and seek professional advice.
    • If the answer is “Yes”, you should perform a Data Protection Impact Assessment. Refer to the legislation and seek professional advice.
  5. Do you use any of the collected personal information for the purposes of marketing?
    • If you answered yes to this question - you must obtain a separate consent from each user to use this data for this purpose. Consent to use the data for marketing must be separately withdrawable by the user.
  6. Do you use any of the collected personal information for the purposes of research?
    • If you answered yes to this question, you must either obtain a specific consent from each user to use the data for this purpose, or completely anonymise the data before using it for research.

      https://github.com/moodlehq/moodle-local_anonymise is an example of a tool designed to anonymise all the data on a moodle site.
  7. Do you share any of the collected data with any third parties? This includes sites and services that integrate with Moodle such as: Google analytics, LTI, Repositories (Google Docs, OneDrive etc), Authentication systems etc. This also includes sites and services used in the provision of your own Moodle site such as hosting providers.
    • If you answered yes to this question then you are responsible for all data that is shared with a third party. You must obtain the user’s consent to share this data with each third party. If the list of third party services changes you must re-obtain consent from all site users for each new third party site/service. You should also take reasonable steps to ensure that each third party will adequately protect users personal data including:
      • Reviewing the third party privacy policy to make sure it is congruent with your own
      • Monitoring and notifying your site users about changes to the third party privacy policy
      • Identify the mechanism for processing requests to erase or correct personal data with each third party so that you can follow this process when you receive one of these requests for your own site
      • Identify and list the data protection officer, and privacy policy for each third party site as part of your own privacy policy
    • Google analytics for example has not yet provided clear updated instructions on how to comply with the new GDPR when using their service. It is probable that they will issue guidance on how to use Google Analytics in compliance with the GDPR before it becomes enforceable, but this example demonstrates that it is your responsibility to ensure the protection of privacy of the users of your site and it is not legal to use cloud services without considering the privacy implications of each and every service provider.
  8. Do you follow best practice policies and procedures to ensure data security?
    • If you answered no to this question then you have must review your policies and procedures to ensure you are not placing your sites users personal data at risk.
      • “Best practices” includes but is not limited to organisational and technical measures to ensure a level of security appropriate to the risk such that:
        • pseudonymisation and encryption of personal data
        • the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
        • the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
        • a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing
      • Examples:
        • Appropriate use of encryption (https)
        • Maintaining all systems and software with relevant security updates.
        • Deletion of personal data as soon as possible, once it is no longer required for the purpose it was collected.
  9. Do you have defined policies and procedures for disclosing data breaches?
    • If you answered no this question then you must define some
    • If you have existing policies and procedures they should be reviewed
    • These policies and procedures must include notifying the Supervisory Authority within 72 hours of the data breach and notifying all affected users if they have been adversely affected (personal data disclosed).
  10. Have you appointed a data protection officer, and listed them in your privacy policy?
    • If you answered no to this question then you must appoint one and list them in your sites privacy policy. The data protection officer is expected to be “proficient at managing IT processes, data security (including dealing with cyber-attacks) and other critical business continuity issues around the holding and processing of personal and sensitive data 1.
  11. Do you have a mechanism with with your site users can request their personal data is erased, corrected or made available to the requesting user on your site?
    • If you answered yes to this question then must ensure it is listed in your sites privacy policy
    • If you answered no to this question then you define one and list it in your sites privacy policy
      • For a Moodle site a suitable mechanism would be an email address, reserved for this purpose that is monitored by an administrator for your Moodle site. Once a request is received, reasonable steps should be taken to ensure the authenticity of the request and the identity of the user making the request
      • Corrections to personal data can be processed by changing the data in Moodle directly using an administrator account
      • Erasures of personal data can be processed by either deleting the user account, or by editing the user account to remove all identifying information and making it inactive
      • Records of personal data can be obtained from the “Site Administration -> Reports -> Logs” by downloading all the logs for a single user as a CSV file. There will likely be additional personal data about a user that is stored outside of Moodle, such as web server access logs.
  12. Does your organisation have more than 250 employees?
    • If you answered yes to this question then you must maintain detailed records on all processing of personal data. Refer to the regulation for details of the records that must be maintained

Site policy

Moodle site policy can be used to collect consent for the purposes of GDPR compliance. The site policy document should be reviewed carefully to make sure it covers all the information listed below, in succinct, simple language.

Site policies can be enabled in Moodle via the “Site policy URL (sitepolicy)” setting on the “Site Administration -> Security -> Site policies” page. This setting should be set to a public page that contains all of the information listed below. The site policy will be displayed in an iframe as part of the login process, so it does not require headers and footers.

A recommended practice is to create a file resource on the frontpage of the Moodle site and copy the url for this resource to use as the site policy. This means the site policy is always available for your users to access, and can be updated easily from within Moodle. Note that this technique is incompatible with the “Force users to log in (forcelogin)” setting, also on the “Site Administration -> Security -> Site policies” page as the file resource will no longer be visible until the user has logged into the site.

For more information on the “sitepolicy” setting in Moodle see:

https://docs.moodle.org/33/en/Site_policies#Site_policy_URL

The site policy must include all of the following information in simple language:

  1. What information is collected.
  2. The purpose of all processing to be performed on the users data. Marketing must be listed separately with a separate revocable “consent”.
  3. The identity of the data controller and contact information
  4. List of rights
  5. The period the data is stored
  6. The mechanism for withdrawing consent
  7. The mechanism for requesting corrections, or erasures of personal data
  8. The mechanism for requesting a record of all personal data
  9. List of third parties that data will be shared with (This includes integrations such as LTI, portfolios, plagiarism, repositories, authentication etc.) including:
    1. The contact details of the data protection officer for each
    2. The privacy policy for each.
  10. Whether the personal data will be used for any automated decision making process, including the significance and details of the process (e.g. analytics).

Sample Site Policy

Privacy and personal data

At Company XYZ we take your privacy very seriously. In order to provide access to the service we must collect and store some personal information about you.

Minors

Children under 16 years of age are not permitted to access the services provided by https://example.com/. By agreeing to this privacy policy you are also agreeing that you are 16 years of age or older.

What is collected?

Basic profile information is collected from you when you create your account including your full name and email address.

As you use the site, information about the users, courses, activities and resources you interact with will also be stored and linked to your profile information.

How is this information used?

This information is only used to provide you access to the online courses at https://example.com/. Statistical information about usage of the site is also used to improve the site and services provided on the https://example.com/ website.

Who can I contact?

The data protection officer for Company XYZ is John Smith and they may be contacted at privacy@example.com

Who is my data shared with?

In order to provide access to LTI content provided by https://www.awesomeltis.com, we may share your basic profile information with Awesome LTI Ltd. The data protection officer for Awesome LTI Ltd is Mrs Jane Smith and she may be contacted at privacy@awesomeltis.com. The privacy policy for Awesome LTI Ltd is available at https://www.awesomeltis.com/privacy. In order to protect your privacy Company XYZ has entered into a data sharing agreement with Awesome LTI Ltd. The terms of this agreement are available here: https://example.com/data-sharing.html.

How long is my data stored?

Your personal data is stored as long as you are enrolled in one or more online courses at https://example.com/. Course data is deleted 6 months after the end date for each course and profile information will be anonymised when an account has not been accessed for 12 consecutive months.

How do I withdraw my consent for Company XYZ to store and process my personal data?

If you have previously consented to allow Company XYZ to store and process your personal data in accordance with this privacy policy, and you wish to withdraw your consent, please send an email to the data protection officer at privacy@example.com. You will no longer be able to access the services provided by https://example.com/ if your consent is withdrawn.

How do I request that my personal data is corrected or erased?

You may make corrections to your basic profile information by logging into the https://example.com/ and editing your own profile. If you have questions, or would like any other data to be corrected or erased, please send an email to the data protection officer at privacy@example.com.

How do I request a record of all my personal data that has been collected?

You may request a record of all of the personal data relating to you that has been collected in accordance with this privacy policy. To do so, please send an email to the data protection officer at privacy@example.com.

References

  1. Wikipedia
  2. GDPR Regulation
  3. Directive 95/46/EC

See also