By Rich Lewis, Training Specialist
How organizations and institutions use and manage individual user data has recently become a hot topic, and rightly so. People have begun to realize the immense amount of information that is stored by the systems in which they have accounts. They have growing concerns about what is done with their data after they may no longer access those systems. Social media controversies may have provided the spark for users’ interest regarding exactly what data is kept about them and how that data used, but the shock wave of concern has now spread to every aspect of our online lives, including the online education space.
Recognizing a need to give users the power to view and control their data, as well as tools to allow site administrators to manage that data (whether due to user request or organization policy), both Moodle™ 3.5 and Totara Learn 11 each contain a new suite of data management tools. The purpose of this week’s blog post is to introduce and summarize the features that both offer.
- Moodle 3.3.6+ and 3.4.3+ users also have access to data management functions via the Privacy plugin.
- Totara Learn allows additional flexibility with their site policy functionality by providing an easy way to maintain foreign language variations of a policy so that the policy will appear in the preferred language of the user. In addition, Totara Learn allows policy consents to be optional if desired, allowing for opt-in/opt-out type policies, such as email subscriptions, while allowing access to the site regardless of choice.
User Data Exports
A new feature of both platforms allows a user to request a download of all data that can be attributed to that user held by the site. This information can be anything from the data held in their account profile, to the submissions they have made to assignments, to the posts they have made in discussion forums. For both platforms, users will be able to access these new data request links from their profile page.
- Moodle™ has established a set of new permissions that are used to provide the data management functions for the site. When a user creates a request for an export of their data, the site administrator or anyone with this new permission is notified. Once the request is approved, a compressed file of all of the user’s data is generated and made available to the user for download.
- Totara Learn allows additional control over what data may be requested by the user through “export types”. For example, an export type could be created to only export user profile information. Another could be created to export course specific information. When the user makes a data export request, an export type must be selected. Data requests in Totara Learn do not require site administrator approval or intervention, and the compressed file with the information defined by the export type is automatically generated for the user and made available for download.
User Data Deletion
Another new feature of both platforms is the ability to completely delete a user from the system. Historically, the standard deletion process for an LMS user was a soft delete, meaning that the user data would stay in the database but be flagged as “deleted”, thereby preventing it from appearing in the user interface. This allowed the account to be reinstated if necessary. As the data privacy and protection rights of users have become increasingly important, Moodle™ and Totara Learn now offer functions to completely delete a user’s information from the database, whether by user request or via automated or scheduled processes.
- Moodle™ allows a user to request a complete deletion of their personal data via their profile page in a manner similar to a data export request. The site administrator will be notified of the request, and if approved, the user’s account and all its associated data will be permanently deleted from the system. In addition, data retention policies can be established so that site or course or specific activity data is automatically offered to the site administrator for complete deletion once a defined retention period passes after the course end date or the date of the user’s last login to the system.
- Totara Learn addresses user data deletion with a model similar to their data export approach in that “purge types” can be created to define the specific data that will be deleted for a user. That said, it is important to note that Totara Learn does not offer an automated way for a user to request their data be deleted. User data deletion can be manually triggered by the site administrator based on a purge type, or the site administrator can configure the system to automatically purge user data when a user’s account undergoes a status change from active to suspended or deleted. This process completely removes the data, as specified by the purge type, from the LMS database.
Users today expect transparency and control over the data that organizations and institutions hold about them. Both Moodle™ and Totara Learn appreciate that expectation and have integrated the tools necessary to accommodate the ability to share what information the system holds about a user, as well as the ability to completely purge user data from the LMS.
For detailed information on the configuration and use of these functions, please refer to the Moodle Data Management and Totara Learn Data Management training modules in Learning Spaces, or register for our upcoming webinar on this topic, “User Data Management”, taking place Wednesday, June 27th at 10:00 a.m. Central time. For more information about specific site policies, refer to the Moodle Site Policy or Totara Learn Site Policy training modules in Learning Space.