Privacy guidance for staff: Creating surveys in Canvas LMS subjects

1. Privacy considerations when creating surveys in subjects

This guidance is for academic and learning design staff who create and/or publish surveys within Canvas LMS subjects - whether using the Canvas Surveys/Quizzes tool or embedding third-party survey tools such as Qualtrics or Microsoft Forms.

This guidance explains what personal information you should not collect from students and the care you must take when phrasing survey questions so that responses do not inadvertently become personal or sensitive information under applicable privacy law.

This guidance reflects the University's obligations under:

• The Privacy and Data Protection Act 2014 (Vic) (PDP Act), which governs how public sector organisations in Victoria - including the University of Melbourne - collect, handle, and protect personal information, enforced by the Victorian Information Commissioner
• The University of Melbourne Privacy Statement (General) and Student Privacy Statement, which set out commitments about how student personal information is collected and used
• The University's Online Privacy Policy and the Canvas LMS Privacy Collection Notice, which specifically address data collected through digital systems and platforms

2. What is personal information?

Under the Privacy and Data Protection Act – Victoria (2014) (PDP Act), personal information means information or an opinion about an individual whose identity is apparent or can reasonably be ascertained from that information. This is a broad definition - it includes not just names and ID numbers, but any information that could be linked back to an identifiable person, including when combined with other data the University holds.

Sensitive information is a special category within personal information and carries higher protections. It includes information or opinions about an individual's:

• Racial or ethnic origin
• Political opinions or associations
• Religious or philosophical beliefs
• Membership of professional/trade associations or trade unions
• Sexual orientation or practices
• Criminal record

Sensitive information must not be collected unless students have explicitly consented, or the collection is required by law. Surveys in teaching contexts will rarely have a lawful basis for collecting sensitive information without consent - and even with consent, staff need to consider whether such collection is genuinely necessary for the survey's educational purpose.

3. Data collection points staff must not include

When building a survey in Canvas, staff must not include form fields or questions designed to collect the following as structured data points.

3.1 Directly identifying information (without clear necessity)

Unless there is a specific, documented educational reason:

• Full legal name (student number already identifies the respondent in Canvas; collecting name separately is redundant and increases risk)
• Date of birth or age (beyond what is necessary)
• Home address, postcode, suburb, or residential campus details
• Personal phone number or personal email address (different from university-issued email)
• Student ID number as a structured survey field - Canvas already captures this as part of submission metadata
• Financial information of any kind (income, scholarship details, employment status used to identify economic circumstances)
• Passport number, tax file number, or any government-issued identifier

3.2 Sensitive information categories

Never include survey questions asking students to disclose, as structured data collection points:

• Racial or ethnic origin (for example, 'What is your cultural background?' or 'Which ethnicity best describes you?')
• Religious beliefs or practice (for example, 'What is your religion?' or questions about religious observance)
• Sexual orientation or gender identity (unless students have explicitly opted in to a survey specifically about these topics, with clear consent and ethical approval)
• Political views or party affiliation
• Criminal or legal history
• Mental health diagnoses, psychological conditions, or wellbeing history (distinct from general questions about how students are finding the subject)
• Physical health conditions or disability status (beyond what is relevant and consented to)
• Immigration or visa status
• Membership of trade unions or professional bodies

3.3 Third-party information

Students must not be asked to provide personal information about other people - for example, questions about their family members, housemates, caregivers, or other students. This information is collected about individuals who have not consented to the University collecting it.

3.4 Location data

Do not configure surveys to capture GPS location, device location, or precise residential location. If collecting broad location information (for example, 'Do you attend classes on campus or remotely?'), keep it at the level of campus/remote and do not request suburb or address.

3.5 Device or technical fingerprinting

Be cautious with third-party tools that may capture device identifiers, IP addresses, or browser fingerprint data. Canvas itself collects some technical data as described in the Canvas Privacy Collection Notice - but adding further tracking via embedded tools without disclosure creates a privacy risk. Check the data collection policies of any tool before embedding it in Canvas.

4. Considerations when designing survey questions

Even when you avoid the categories above as explicit data collection fields, the way you phrase open-ended questions can cause students to provide personal information in their responses. Staff need to think carefully about the following.

4.1 Free-text questions can generate PII unexpectedly

Open-ended questions often prompt students to disclose personal information you did not ask for, including their health, family circumstances, financial stress, disabilities, or other sensitive matters. For example:

4.2 Apply the 'minimum necessary' test to every question

Before including any question - particularly open-ended ones - ask: 'Do I need this level of detail to achieve my educational purpose?' If you want to understand barriers to participation, you may not need to know the specific barrier - just that a barrier exists. Consider:

• Prefer closed questions (yes/no, Likert scales, multiple choice) where they can achieve your purpose without inviting disclosure
• If open-ended questions are necessary, frame them at the subject/experience level, not the personal circumstances level
• 'How challenging did you find the workload?' is less likely to generate sensitive PII than 'What personal factors made the workload hard for you?'

4.3 Anonymity vs. identifiability

Canvas surveys are not truly anonymous by default - even if you do not include a name field, Canvas captures submission metadata that can link a response to a student account. Staff should:

• Be transparent in the survey introduction about whether responses are anonymous or linked to student accounts
• If genuine anonymity is your goal, use a properly anonymised tool outside of Canvas and ensure students are not asked for any information that would re-identify them
• Consider whether anonymous responses would still serve your educational purpose - if so, prefer anonymity to reduce the privacy risk of what students disclose

4.4 Aggregation risk - when combined data becomes identifying

Even if individual questions seem innocuous, combining multiple data points can make a student identifiable - particularly in smaller cohorts. For example:

• Asking 'year of study' + 'campus location' + 'domestic/international student' + 'subject stream' may together identify a very small group or even an individual
• In postgraduate or specialist programs with small cohorts, even a single demographic question may be enough to identify a student

When designing surveys for small subjects (fewer than 30 students), apply additional caution: either do not collect demographic breakdowns or be prepared to suppress results for any cell with fewer than 5 respondents to prevent re-identification.

4.5 Questions about others

Do not ask students questions that would require them to reveal information about their peers, family members, or others. For example, questions such as 'Did your study group experience any difficulties?' may prompt students to inadvertently disclose information about other students.

4.6 Health, wellbeing, and disability

Questions about student wellbeing are common in subject-level evaluations and are often well-intentioned. However, they carry specific risks:

• General questions like 'How are you finding the workload?' are accep - they relate to the subject experience
• Questions like 'Are you managing your mental health this semester?' or 'Do you have a disability that affects your study?' are health/disability inquiries that cross into sensitive information and should not appear in subject surveys unless they are part of a formally approved research or student support process with ethics clearance
• If you are concerned about a student's wellbeing based on their survey response, do not store or forward the sensitive personal information they disclosed - instead, refer them to Student Services or follow the University's duty of care protocols

5. Obligations before you collect: Notification requirements

Under IPP 1.3 of the PDP Act, at or before the time of collecting personal information, you must take reasonable steps to ensure students are aware of:

• Who is collecting the information (the University of Melbourne, the subject/team)
• Why it is being collected (the purpose of the survey)
• Who the information will be disclosed to (for example, teaching team only, subject coordinator, Faculty, anonymous aggregate reports)
• Whether participation is voluntary or compulsory, and the consequences of not participating
• How students can access or correct information held about them

In practice, this means your survey must include a clear privacy notice at the top. This does not need to be long - but it must be present. Canvas does not automatically generate this for you.

6. Using third-party survey tools

If you embed or link to third-party tools (Qualtrics, Microsoft Forms, etc.) from within a Canvas subject, additional considerations apply:

• The Canvas Privacy Collection Notice governs data collected within Canvas, but data collected by an embedded third-party tool may be processed by that vendor under their own terms - including servers potentially located outside Australia
• Under IPP 9 (Transborder Data Flows), the University should take reasonable steps to ensure that personal information transferred outside Victoria (including overseas) is protected under comparable privacy principles
• Before using any third-party survey tool, check whether it is on the University's approved vendor/tool list, and whether a Data Processing Agreement (DPA) is in place
• Do not use personal or free-tier accounts with third-party services - use only institution-licensed accounts where the University has appropriate contractual controls
• Do not copy student personal information from Canvas into a third-party tool manually (for example, pre-populating a Qualtrics survey with student names or emails drawn from your Canvas roll) without appropriate authority

7. Surveys for research vs. surveys for teaching

This guidance primarily addresses surveys used for teaching purposes- such as mid-semester check-ins, formative feedback activities, or participation tasks. These are distinct from research surveys, which carry additional requirements.

Please note that Student Learning Surveys - end subject surveys (ESS) are conducted automatically via the SLS-ESS service, and have provisions in place to properly manage, store and redact PII data and comments.

If your survey constitutes human research (i.e. you intend to publish or report findings or systematically investigate questions beyond the immediate teaching context), it requires Human Research Ethics Committee (HREC) approval before you collect any data from students. This applies even if the survey seems simple or the findings seem modest.

The HREC approval process ensures informed consent, appropriate data management, and participant protections. Using a Canvas survey for research without HREC approval is not compliant, even if participation is framed as voluntary.

8. Quick reference summary

9. Applicable policy and legislative references

This guidance is informed by the following sources:

Questions about this guidance should be directed to Teaching and Learning Innovation or the University Privacy Office. For surveys involving human research, please contact the relevant Human Research Ethics Committee (HREC) and, if necessary, the Privacy Office before data collection begins.