FERPA & Cross-Listing: Groups Wrinkle

[G_Petruzella]

As a long-time Canvas Community member, I've been watching conversations about this topic at least as far back as this 2016 question by @John_Lowe. My working understanding has been:

• To support "convenience" combinations, manually apply (to each student) the setting "this user can only view students in their assigned course section(s)".

However, recently a colleague observed (and I've confirmed) a scenario I've not seen addressed:

• If a course uses Groups, students are able to (always) see the names of, and (sometimes) interact with, students in other Sections, even when the section-visibility setting above is applied.

Thus, limiting users' visibility to same-section members in a Canvas course seems insufficient to prevent disclosure of other-section members' identities.

The narrative and screenshots below illustrate. (Screenshots taken from a "demo" course with fictional student names/accounts.)

In a Canvas course ("DEMO-101"), there are 2 Sections ("123" and "DEMO-101") [screenshot 1]. Student Ahayuta Achi is enrolled in Section "123", and can only view students in their assigned section [screenshot 2]. However, the instructor has created Groups in the Course. Ahayuta is able to view all Group members, regardless of their Section, and regardless of whether the instructor has populated the Groups manually, or automatically with the setting "Require group members to be in the same section" [screenshot 3]. 

Thus, Ahayuta can, by viewing Groups, discover the names of students enrolled in Sections of DEMO-101 different from their own Section.

screenshot 1

screenshot 2

screenshot 3

I'd love to know how others here have evaluated and/or responded to this situation. Thanks in advance for any thoughts!

[DavidDavid8545]

Thanks for sharing. I found a lot of interesting information here. ExpressHR

[Steph_T · Accepted solution]

Hello! @G_Petruzella 

Thank you so much for proving this information for us to take a look at! 

You may want to contact Canvas Support directly so we can take a closer look into this, and get it moved to the right department for further investigation.

While testing on my end, I do see they are limited as to what they are able to see with the student that is not in their section. While they are not able to access that other student's Profile, their name is still visible.

When contacting Support, I would recommend having your test information handy. Please let us know if you have any other questions or concerns! 

Thank you!