Information about personal data processing in Canvas

Personal data in Canvas

Personal data is all information that can be directly or indirectly linked to a person, such as name, username, email address and other personal information. Sensitive personal data, such as information about health, religious or philosophical beliefs, political opinions, sexual orientation or other information that requires special protection, should not be submitted to Canvas unless there is an explicit and approved need. 

Canvas is Mid Sweden University's learning platform and is used for teaching, communication, course material, submissions, examination, feedback, assessment and other activities related to the education. This may include your name, user identity, email address, course affiliation and information created when you use the learning platform, such as submissions, discussion posts, messages, feedback, assessments, results and technical activity tasks.

When logging in, information is transferred from Mid Sweden University's login service, which handles Miun ID/account, to Canvas. See more information about what personal data is processed in relation to different services below.  

Mid Sweden University is the data controller for the processing. The processing takes place in order for the university to be able to conduct teaching and educational administration. The legal basis is that the processing is necessary to perform a task of public interest according to Article 6(1)(e) of the General Data Protection Regulation and Chapter 2. Section 2 of the Data Protection Act.  

Canvas is provided by Instructure on behalf of Mid Sweden University. Instructure processes personal data in accordance with personal data processing agreements and Mid Sweden University's instructions. All data is stored in server environments in Dublin and Frankfurt.  

Think about what you write and upload in Canvas

Canvas contains many features where users can write text or upload content themselves. For example, it can be:

• Assignments and other uploaded documents  
• Discussion posts and comments  
• messages in Canvas Inbox  
• Feedback and comments from teachers  
• Free-text answers in assignments and quizzes  
• Course announcements and announcements  
  Descriptions and comments in course material  
• document titles and other information provided by the  user
• prompts, instructions, and other free-text content that the user enters into IgniteAI features  

As a user, you should therefore avoid entering or uploading more personal data than is necessary for the purpose in question.  

Sensitive personal data, such as information about health, religious or philosophical beliefs, political opinions or other information that requires special protection, should not be submitted in Canvas unless there is an explicit and approved need.

For example, if a student needs to provide information about pedagogical support, only the information that is necessary for the practical handling should be provided. There is normally no need to state the underlying reason. For teachers, the same principle applies in feedback, comments, messages and AI prompts: only information that is relevant to the purpose in question should be provided.

How Canvas interacts with other systems

Canvas needs to collaborate with other systems for the learning platform to work. In these cases, personal data may be transferred between Canvas and another system for a specific purpose.

The main integrations are:

• Ladok – information about courses, course sections and admitted and registered students is used to create course rooms and give the right users access. Grade-like results can be transferred from Canvas back to Ladok.  
• Shibboleth – used for login and authentication with Mid Sweden University's account.  
• Zoom – when meetings are created from Canvas, the teacher's identity can be transferred to Zoom.  
• Kaltura/MiunPlay – user identity is used to associate the user with video content.  
• Miun Survey – username and email can be transferred in connection with course evaluations, for example.  
• M365 - User Identity is used for features where Canvas interacts with Microsoft 365.  
• Inspera Originality – student assignments, documents and information about the assignment can be transferred for similarity checking. Similarity scores and a link to the report are returned to Canvas. The report itself remains in Inspera Originality.  
• OpenCanvas – enables users between environments to access courses where needed.  
• TimeEdit – no current personal data transfer takes place according to current usage.  

For the integrations, information flows, responsibilities and technical controls are documented in special integration documentation. Only the information needed for each function must be transferred. 

AI features in Canvas

Canvas also contains AI-based features. These are features in Canvas and should not be seen as separate integrations. The AI models are in the same GDPR-secure environment as the other Canvas functionalities. No data is transferred to another environment or shared with third parties.  

When an AI feature is used, it can process the data needed for that feature, such as course material, an assignment description, a student submission, a discussion post, or a text to be translated.

The user decides whether an AI function should be used, but teachers decide which functions should be available in each course room. The AI functions are limited to the permission that the user already has in Canvas.

AI grades are used to support them, and teachers and administrators remain responsible for their assessments and decisions, and should be able to review, modify, or disregard AI-generated grades. AI should not be used for automated decision-making about students, or for the purpose of profiling or risk classification.

For some functions, AI can process student content. For example, Grading Assistance can use student submissions as a basis for assessment support and Insights for Discussions can analyse discussion posts. It is still the teacher who makes and is responsible for the final assessment.

Mid Sweden University's data and use should not be used to train the supplier's general AI models. Prompts are logged for troubleshooting and technical analysis.  

Storage and rights

Personal data in Canvas is saved in accordance with Mid Sweden University's rules for preservation and deletion.  
You have the right to receive information about how your personal data is processed and, depending on the processing, may have the right to access, rectification, erasure, restriction or to object to the processing.