GDPR for Xerte Online Toolkit

Hi everyone,

I'm interested to hear the thoughts of the community on the implications of the General Data Protection Regulation (GDPR), that comes into force on 25th May 2018 in the EU, for Xerte. Most of the learning objects we are developing at my institution are for dissemination, so don't contain any user data. However, some learning objects are SCORM packages that produce a log within our VLE containing student data i.e. results of quizzes.

I'm also thinking about student created Xerte learning objects that are set to "public" access and the implications of those learning objects being searchable via Google etc.

Q. Has anyone looked into the implications of GDPR for Xerte?

Appreciate any input

Alison

Hi Alison
firstly I'm not a GDPR expert (although working on 2 GDPR related projects) so could be wrong but I don't thing the VLE example you describe is a Xerte issue more a VLE issue as that's where the user data is stored.

As for the student created LO's that's a different matter because they could populate those LO's with anything they wish but always have been technically able to. Clearly policies and user agreements will play a part and also any authors in Xerte their Firstname, Surname and username are stored in the Xerte database and depending on authentication method used etc possibly email address too. You should check with your DPO about all that.

Finally what will need to be considered once 3.6 and later is out is the fact that with LTI and xAPI there is the possibility to automatically exchange data with an LRS as well as VLE/LMS etc.

I wonder if there is anyone in the Xerte community who is an expert on GDPR and these topics? It would certainly be worth sharing if anyone has these conversations.

HTH
Ron

Hi Ron,

Thanks for responding. Yeah, I agree with your point about my first example, the data resides in the VLE, so what we have in place for that should apply.

We are hopefully getting an upgrade to v.3.5 soon, unless v3.6 is a game changer and we should skip v.3.5.

Many thanks,
Alison

Hi Helen
I'd say definitely skip to 3.6 if you can. A huge amount of work has gone into 3.6 and lots of benefits for everyone over 3.4 and 3.5.
Hopefully news soon...
Ron

With respect to the 3.6 functionality with storing data in the LRS:

This is similar to the LMS/VLE issue. It's not a Xerte issue, as the data is stored in the LRS. So it depends where that LRS is located and whom is maintaining that.

Yeah sorry Tom I wasn't suggesting it was a Xerte issue in terms of where the data is stored but I think it is perhaps a bit more complex than that. As I said I'm not a GDPR expert but I'm wondering about the following amongst other things...

A Xerte SCORM object in the VLE tracks Fred viewed x and scored y in the xerte quiz. Both the data and the resources is in the VLE.
A Xerte LTI/xAPI resource tracks Fred viewed x and scored y in the xerte quiz and interacted with z etc but now there are potentially 3 separate systems/servers involved and at the very least more to consider and document.

Ron