Privacy Impact Assessments for learning technologies

A Privacy Impact Assessment (PIA) is a process to evaluate how using third-party technologies to aid teaching, learning, and student engagement may impact the privacy of individuals. It helps to identify privacy risks and enables the development of risk mitigation strategies.

Conducting a PIA can help to:

• Identify whether the third-party technology is likely to impact individual privacy and comply with relevant privacy laws
• Make informed decisions on how to mitigate or manage privacy risks
• Promote public trust by demonstrating that privacy has been considered and built into the project (‘privacy by design’).

Lodging a request for a new learning technology

You may request a new learning technology to be integrated with the LMS, or that a new tool to be considered for central deployment.

This is a two step process:

1. Complete the initiative idea form with IT Services.
2. Upon successful application, fill in the LTI request form with Teaching and Learning Innovation.
   As part of the request, you must include the PIA application number and the status of the PIA application.

What is a PIA?

When using third party technologies to aid teaching, learning and student engagement in classes, a PIA may be required.

This is important to ensure that any third party technology providers who may require the student’s personal information to provide the sought teaching and learning activities meet the University’s legal obligations under applicable privacy laws.

If the privacy risks identified through the PIA process cannot be effectively mitigated, the tool cannot be implemented—either by the Teaching and Learning Innovation team or independently by the user—as doing so may pose a high risk of breaching the University’s obligations under relevant privacy laws.

When is a PIA required?

The University’s Privacy Policy (MPF1104) requires a PIA for any project, system, or activity that collects, handles, processes, or discloses personal information. You should conduct the PIA early, as identifying risks upfront makes them easier and more cost-effective to address. A PIA is required when:

• Introducing a new system or technology that processes personal or sensitive information
• Changing or expanding an existing data collection or processing activity
• Implementing significant changes to how personal information is handled, including data sharing initiatives
• There is a high risk to individual privacy due to the nature of the data being processed.