On February 5, Melissa Loble, Instructure's new Chief Customer Experience Officer, published a blog post: Data Privacy: Our Current and Future Commitment. Unfortunately, her post does not even mention the possibility of a data opt-out. So, when I got to the end of the post, I had the same reaction as Bram Vantasner:
@Instructure releases a blog post about Data Privacy and @CanvasLMS. It says pretty much exactly what you'd expect from any #EdTech vendor.— Bram Vantasner (@LMSAgnostic) February 5, 2020
Me? I'm still fumbling around, looking for the "Opt Out" button.
https://t.co/13VVVxpMJk
For those of you who have not followed this long-running discussion about Canvas data, here are some references:
- March 2019. Phil Hill's blog post: Instructure: Plans to expand beyond Canvas LMS into machine learning and AI (my thoughts)
- July 2019. VP Jared Stein's blog post, Power to the People with Canvas Data and Analytics (Can You Dig It?) (my thoughts)
- January 2020. CEO Dan Goldsmith's blog post: To Our Customers (my thoughts)
Responding now to Loble's post, I first want to point to the gap between the message she is sending here and the messages coming from Instructure in the context of the Thoma Bravo acquisition. For example, compare what Loble says in her post — "we at Instructure want to do what is right for education" — with this January 19 letter from Lloyd "Buzz" Waterhouse, Lead Independent Director of the Board of Directors of Instructure: "The Board of Directors has one priority: maximizing value for our stockholders."
For some thoughtful comments on this inevitable tension between educational vision and business imperatives, I would urge everyone to read this new post from Brian Whitmer: Instructure's Acquisition is Not What I'm Worried About (February 7 2020).
I personally think it's better to acknowledge the tension rather than to pretend that it does not exist, and there is some serious tension here, which I will explore in more detail below.
Canvas in the Cloud
When Brian Whitmer and Devlin Daley created Canvas as a cloud-based LMS, I'm sure there were many factors that went into their decision to build in the cloud. At the same time, I'm also pretty sure that one of those factors was NOT the collection of massive quantities of data with which to engage in AI research and machine-learning in order to develop and then market predictive algorithms.
What has happened, though, is that because Canvas has always been cloud-based, it has accumulated data in a way that the other major LMS companies have not. I will confess that I was very naive about this: until CEO Dan Goldsmith announced that Instructure had developed predictive algorithm products, it never even crossed my mind that an LMS company would do that. (Yes, I really was totally naive.)
For me, as an instructor, Canvas was just another LMS that I accessed with my web browser in the same way that I accessed Blackboard and WebCT and Desire2Learn with my web browser, all of which were self-hosted at my school. Over two decades of using those LMSes, it never occurred to me to ask where my data ended up. I just assumed somebody somewhere was archiving my course data for legal reasons in the same way that email and other university data are archived for legal reasons. After all, once a course was over, what use could the data even be? (Yes, like I said: I was completely naive.)
But as it turns out, Canvas data are different. Canvas data go into a database at Instructure, where data from all the courses and all the schools are sitting there together in the cloud, just waiting to be turned into marketable new data products. And that is exactly what Dan Goldsmith announced to investors in March 2019, with these hyperbolic claims about DIG (Instructure's data analytics initiative):
So, no wonder there is conflict here, and it's a crucial conflict for the entire future of the LMS enterprise. I see the LMS merely as an online service to students and instructors for the purpose of conducting a course, while Instructure sees the LMS as a data-gathering mechanism they can use to develop new data products.
And how do colleges and universities view the LMS? That is an urgent discussion that needs to happen on every campus. If and when such a discussion takes place on my campus, I will be fighting hard to limit the purpose of LMS data to the needs of instructors and students within the confines of a course, rejecting the type of predictive data analytics that employ the LMS as a surveillance tool.
I'll stop there because my rule for these blog posts is not to exceed the length of the blog post to which I am replying. Loble's post afforded me the luxury of 1100 words, so I am glad to have had the chance to write more in depth this time, and I will continue to hope, even now, for a data reuse opt-out.
June 2020 Update: The new CEO of Instructure, which is now owned by the private equity firm Thoma Bravo, announced the end of DIG; details in Phil Hill's write-up: Canvas cancels Insights (née DIG). Of course, that is just the end of DIG, not the end of Instructure collecting data. We must continue to insist on real protections and a real privacy policy that will limit Instructure from using our data without permission for purposes to which we have not consented.
For some thoughtful comments on this inevitable tension between educational vision and business imperatives, I would urge everyone to read this new post from Brian Whitmer: Instructure's Acquisition is Not What I'm Worried About (February 7 2020).
I personally think it's better to acknowledge the tension rather than to pretend that it does not exist, and there is some serious tension here, which I will explore in more detail below.
Canvas in the Cloud
When Brian Whitmer and Devlin Daley created Canvas as a cloud-based LMS, I'm sure there were many factors that went into their decision to build in the cloud. At the same time, I'm also pretty sure that one of those factors was NOT the collection of massive quantities of data with which to engage in AI research and machine-learning in order to develop and then market predictive algorithms.
What has happened, though, is that because Canvas has always been cloud-based, it has accumulated data in a way that the other major LMS companies have not. I will confess that I was very naive about this: until CEO Dan Goldsmith announced that Instructure had developed predictive algorithm products, it never even crossed my mind that an LMS company would do that. (Yes, I really was totally naive.)
For me, as an instructor, Canvas was just another LMS that I accessed with my web browser in the same way that I accessed Blackboard and WebCT and Desire2Learn with my web browser, all of which were self-hosted at my school. Over two decades of using those LMSes, it never occurred to me to ask where my data ended up. I just assumed somebody somewhere was archiving my course data for legal reasons in the same way that email and other university data are archived for legal reasons. After all, once a course was over, what use could the data even be? (Yes, like I said: I was completely naive.)
But as it turns out, Canvas data are different. Canvas data go into a database at Instructure, where data from all the courses and all the schools are sitting there together in the cloud, just waiting to be turned into marketable new data products. And that is exactly what Dan Goldsmith announced to investors in March 2019, with these hyperbolic claims about DIG (Instructure's data analytics initiative):
I am guessing that many of Goldsmith's claims during that investor meeting were overblown, but it's been almost a year, and so far there has been no substantial clarification from Instructure about how many of Goldsmith's claims about DIG are accurate, and how much was just misguided marcomm.
Canvas and its Purpose(s)
Melissa Loble mentioned the proverbial "elephant in the room" in her blog post, but I would like to invoke a different elephant: the elephant being examined by the blind men. It's an ancient South Asian fable that has now spread around the world, with a Wikipedia article of its own: Blind men and an elephant.
When Dan Goldsmith feels the LMS elephant, it's all big-data and AI and ML.
When I feel the LMS elephant, it's just a clunky tool I use for communicating with students.
And I am sure others have their own take on the LMS elephant, and that means we also have our own take on what LMS data privacy should mean, and that's because we see the LMS as having different purposes. Canvas is both one thing, and also different things, based on what we experience from our own perspectives (instructor, student, Instructure shareholder, etc. etc...).
Speaking for myself as an instructor using Canvas, I think the purpose of data in an LMS should be limited to the courses in which students are enrolled, and any use of data beyond that purpose should be protected by a data privacy policy, requiring permission for reuse beyond that original purpose. (For more about purpose limitation, here are some observations from ICO.org with regard to the GDPR.)
And how do colleges and universities view the LMS? That is an urgent discussion that needs to happen on every campus. If and when such a discussion takes place on my campus, I will be fighting hard to limit the purpose of LMS data to the needs of instructors and students within the confines of a course, rejecting the type of predictive data analytics that employ the LMS as a surveillance tool.
I'll stop there because my rule for these blog posts is not to exceed the length of the blog post to which I am replying. Loble's post afforded me the luxury of 1100 words, so I am glad to have had the chance to write more in depth this time, and I will continue to hope, even now, for a data reuse opt-out.
June 2020 Update: The new CEO of Instructure, which is now owned by the private equity firm Thoma Bravo, announced the end of DIG; details in Phil Hill's write-up: Canvas cancels Insights (née DIG). Of course, that is just the end of DIG, not the end of Instructure collecting data. We must continue to insist on real protections and a real privacy policy that will limit Instructure from using our data without permission for purposes to which we have not consented.
Blind men feeling the elephant:
It's a fan! It's a spear! It's a snake! it's a wall! It's a rope! It's a tree!
