Moodle in English: GDPR Course retention varies by qual type

GDPR Course retention varies by qual type

by Alicia Wallace - Friday, May 4, 2018, 5:22 PM

I freely admit I'm struggling with the data registry plugin. I understand the categories and purposes, but I can't see how they're assigned, what they're linked to or if the expiration date actually does anything, so if you can answer my main question, I might have follow up questions about how exactly you use the data registry.

Why I'm actually here:

We deliver a wide range of qualifications and they all have different requirements for how long we store student work.

BTEC Diplomas want us to keep it 16 weeks after the learners are certified (which may be months after they submit their final assignment) and BTEC HND want us to keep the work for years (5, according to my boss, but I can't find the evidence online to support it).

Is there a way to make the moodle courses different "types" so that we can set expiration periods correctly for the qualification being studied?

If so, when we create the retention information in the data registry, does it link to the courses with the "type" defined in the policy?

And what about students? Obviously, different students will be with us for different lengths of time, so can we categorise their data retention by the qual they're on?

Lastly, when we set a retention period (say 3 years) is that 3 years after the data is created (in the case of a user) or is it 3 years after the data was last used? For a course, is it the record of activities created that is deleted 3 years after creation, and how does that affect work done in September vs work done in June?

As you can see, I'm very confused and would love to hear your thoughts.

Re: GDPR Course retention varies by qual type

by Andrew Nicols - Friday, May 4, 2018, 8:47 PM

Hello Alicia,

The Data Privacy tool that we are releasing gives the ability to define what we have called Purposes.

You can describe as many Purposes as you like, and you can define which lawful bases each Purpose is based upon, you can define a Retention period, and you can add a description of each purpose. You can also choose to mark a purpose as Protected (more about this later).

The tool also allows you to assign a purpose to data in different parts of Moodle. For example, you can assign one purpose to an assignment, another to a forum, and another to a course. It is up to you to define the various purposes, and where they are used. You can assign purposes to each Block, Activity, Course, and Course Category.

If a Purpose is not specifically defined, the default is to inherit the parent (so an Assignment will inherit the Purpose of the Course that it is in).

The retention period currently starts at the point that the Course ends. We do hope to extend this so that different activity modules can define their own start point, but that has not yet been implemented. We base this on the Course end date configured in the course.

The retention period currently applies to all users equally.

A Moodle scheduled task runs daily to check whether any items have passed their retention period and present them to the Administrator to confirm their deletion.

In addition users can request that their data be deleted. Any user data that the user 'owns' will be deleted unless that data is in a context which is Protected. I recommend taking a peek at this ICO article on the right to erasure. You should only protect a purpose if it falls under certain Lawful bases (Public task, and Legal obligation).

Note: Institutions such as Universities may be considered to be a public authority, and therefore may use the base of Public task. See this ICO article for the ICO's reading of this.

Hope this helps,

Andrew

Average of ratings:Useful (3)

Re: GDPR Course retention varies by qual type

by Gemma Lesterhuis - Friday, May 4, 2018, 10:56 PM

Hi Andrew,

Thank you for this answer, this helps me to understand the retention period better.

Good to hear that Moodle is looking in a way to extend this feature that it can look at different activity modules with their own start point, instead of only on the course end date.

Are there any plans - or is this part of the plan - to make it able that the retention period looks at the time that a student has not visited the course? Since there would be also userstories in place of instititutions that have 1 course open where students can "pop-in" - "pop-out" when they want.

Not sure if I am clear.

Gemma

Average of ratings: -

Re: GDPR Course retention varies by qual type

by Andrew Nicols - Wednesday, May 23, 2018, 9:01 AM

At the moment we haven't yet worked out how to handle this case. It could be that we introduce an option within the data registry to indicate that a course should not be considered when calculating user retention, etc. Any suggestions will be gratefully appreciated!

Andrew

Average of ratings: -

Re: GDPR Course retention varies by qual type

by Alicia Wallace - Friday, May 4, 2018, 10:58 PM

Hi - Yes, it really does, thanks! There's a lot of things I want you to add to make my life easier, but that's my problem

Average of ratings: -

Re: GDPR Course retention varies by qual type

by mart van der niet - Tuesday, May 22, 2018, 4:26 PM

Re: GDPR Course retention varies by qual type

by Andrew Nicols - Wednesday, May 23, 2018, 8:58 AM

Hi mart van der niet,

The current GDPR solution calculates the retention period from the End date of the course. This is true for both the course, and any activities or blocks within the course.

Regarding user retention policies, this is calculated from the last login date of the user, and only applies when the user has no remaining active enrolments. When this happens we delete all data associated with that user context.

I'll speak with Helen and Mary about the best place to centralise this information within the docs too.

Andrew

Average of ratings:Useful (2)

Re: GDPR Course retention varies by qual type

by mart van der niet - Wednesday, May 23, 2018, 10:32 PM

Hi Andrew,

Thanks for the info. Centralized doc would be a good idea!

Average of ratings: -

Re: GDPR Course retention varies by qual type

by Tim Gildersleeve - Friday, May 18, 2018, 8:58 PM

I've been talking to our people about data retention for both our HE and FE courses and it seems that most of the requirements for retention seem to be more metadata. It is important (for some) to keep the data for several years, but others as you say just months.

The data that is required in the main though are things like grades, feedback, dates etc - not the actual submissions. If all your data of this type is kept in Moodle then this will have more of an effect on you I am sure but I believe most of our data of this type is actually stored in our student database and other systems external from Moodle.

Personally because of this I am aiming to only keep 4 years of Moodle and they can keep the records externally to Moodle for as long as they like.

Not sure if this is helpful at all - but it may be if you keep records of these things outside of Moodle.

Regards

Tim Gildersleeve (VLE Manager - Bradford College. UK)

Average of ratings:Useful (1)

Re: GDPR Course retention varies by qual type

by Andrew Nicols - Sunday, May 20, 2018, 12:50 PM

Hi Tim,

Unless I'm very much mistaken, the student database will be subject to the same GDPR legislation as elsewhere. There is no exemption for student records.

Average of ratings: -

Re: GDPR Course retention varies by qual type

by AL Rachels - Sunday, May 20, 2018, 11:05 PM

Makes me wonder...I predict a possible future problem due to GDPR. In the past, numerous people have been caught claiming academic degrees, that in reality, they never earned. In the future I see these same low life types blaming the GDPR right to remove data and be forgotten, as the reason no proof of their degrees can be found.

Average of ratings:Useful (1)

This forum post has been removed

The content of this forum post has been removed and can no longer be accessed.

This forum post has been removed

The content of this forum post has been removed and can no longer be accessed.

Re: GDPR Course retention varies by qual type

by Andrew Nicols - Thursday, May 24, 2018, 8:38 AM

Hi Mark,

At this time the configuration is central. We would like to make it more devolved to give certain other items the ability to configure this as appropriate - initially this will probably just be courses, activities, and blocks.

It is worth bearing in mind that you probably need to train your users as to the meaning of the various GDPR terminology before you give them access to select purposes.

One solution I have been considering would be to create new capabilities for creating purposes, selecting a purpose + category, suggesting a purpose + category.

If a user has permission to select a purpose and category then they can choose the configuration for anything they are involved with.

If a user only has permission to suggest a purpose, then they can make suggestions but these must be confirmed by the DPO before becoming active.

I suspect that these would be system level capabilities, and the user would therefore be able to make suggestions and selections at any point that they can already edit.

I have created MDL-62552 to look into this.

Hope this helps,

Andrew

Average of ratings: -

This forum post has been removed

The content of this forum post has been removed and can no longer be accessed.

Re: GDPR Course retention varies by qual type

by Andrew Nicols - Thursday, May 24, 2018, 8:31 AM

Hi Mark,

1) Yes, and No:

The actual process is that a scheduled task runs and identifies items due for deletion.

This list is presented to the DPO for confirmation, which is then run as a background task.

The teachers in the course are not informed prior to the removal at this time. If you feel that this is a requirement can I ask you raise a new issue and give details on how you would expect this to work - for example, at what point should a notification be sent out (at the time it is identified, or at the time the DPO confirms, and how should a cancellation period be).

2) Yes, and No:

Again the DPO is asked for confirmation, but not the user. Again the above applies

Average of ratings:Useful (1)

Security and privacy

GDPR Course retention varies by qual type

Why I'm actually here: