Skip to content

How do I comply with legal consent requirements?

Objectives and content of this instruction

As the author of a course that involves working with sensitive data, you need legal protection. This raises the following questions:
- How do I obtain legal consents?
- How do I comply with legal consent requirements?
This guide shows you where and how you can do this in OpenOlat.

Target group

[x] Authors [x] Coaches [ ] Participants

[x] Beginners [x] Advanced users [x] Experts

Expected previous knowledge

Case study of a teacher

As the coach of a course on "Managing Patient Data," you are aware that all course participants will be handling sensitive data. It is therefore essential that all participants accept a written data protection statement.

Since part of this internship takes place online, you want to ensure that, as the coach, you cannot be held liable for data protection violations in your course.

How do you proceed?

Below is a description of the available OpenOlat tools and their intended uses.

To the top of the page ^

Clarification 1: Objective

Determine which terms of use and privacy policies course participants must agree to. For example:

WHAT?

  • Do students have to submit an "affidavit"?
  • Is it necessary to submit a statement confirming that the submitted work was completed independently?
  • Is an NDA required?
  • Do specific consents regarding use and data sharing need to be confirmed?
  • ...

WHEN?

  • Do consents need to be obtained before participants can access certain content?
  • Do consents need to be obtained only when specific content is accessed? For example, before or after participants take exams, submit assignments, etc.
  • ...

To the top of the page ^

Clarification 2: OpenOlat Platform

If the terms of use of the platform are switched on, all users are asked to accept the Terms of Use and Privacy Policy the first time they open OpenOlat. You can therefore review:

  • What has already been confirmed by all users of the OpenOlat platform?
  • Would corrections need to be made at this stage?
  • What additional consents need to be obtained given the particularly sensitive nature of your course?

All users can review the Terms of Use and Privacy Policy, which they have previously agreed to, at any time in their personal menu:
Personal menu > System settings > Terms of use
More about this: Personal Configuration: Settings >

Information about the OpenOlat platform's Terms of Use and Privacy Policy, as well as the confirmation required from OpenOlat users upon their first visit, can be found here: OpenOlat Platform Terms of Use >.

To the top of the page ^

Clarification 3: Rights within OpenOlat

Within OpenOlat, you collaborate with many different people. These include administrative roles such as user administrators, learning resource administrators, and administrators, among others, who may have access to your course content and to information about the participants due to their roles.

For part of this information, restrictions can be set in the system administration:
Administration > Modules > Privacy

There you specify which system roles are allowed to view the administrative user properties, for example during account searches or in lists. Which user properties are considered administrative is configured in the user properties.

If you have any questions, please contact your administrators.
You can find more information here: Data Protection Module (Administration) >

To the top of the page ^

Clarification 4: Course

Does it turn out that additional consent must be obtained from all participants specifically for your course?

OpenOlat also allows you to create course-specific terms of use. As a course owner, you can obtain consent for your course under:
Course > Administration > Settings > Terms of use

You can find more information here:
Terms of Use for a Course >

To the top of the page ^

Clarification 5: Course internal areas

In learning path courses, you can also use the learning path's features to restrict access to certain content or obtain participants' consent in advance.

Using the learning path settings, you can, for example, make a page containing information on data protection and data use mandatory. Participants must then confirm that they have "completed" this page before they can access the subsequent course elements in the course menu. You will find the settings under:
Course > Administration > Course editor > "Course element" > Learning path

Also in the tab "Learning path", you can use exceptions to configure that a course element is visible only to specific groups of people.

To the top of the page ^

Clarification 6: Individual course elements

If privacy policies or notices apply specifically to individual course elements, OpenOlat also provides options within those elements for obtaining consent from course participants.

Example: Course element Task
The course element Task has its own workflow. It consists of several steps, ranging from the task prompt to uploading answer documents, providing feedback, and viewing the sample solution.
You can use the task assignment feature, for example, to create a message for participants with relevant instructions. ("By downloading this assignment, you agree to ...")
In the "Submission" step, the task instructions can be set as a template. A consent form could also be included this way. ("By uploading your files, other people may be able to view ... Please therefore check ...")

Example: Course element Checklist
In the course element "Checklist", you can add checkboxes for required confirmations. Points can also be awarded that count as a criterion for "passed". A checklist that has been "passed" can then be used as one of the criteria for passing the entire course.

To the top of the page ^

Clarification 7: Forms

When filling out a form, the information entered may require participants to accept the terms of use. For this reason, the "Form" learning resource includes a dedicated content element "Terms of use" that authors can insert using the form editor.

Terms of use of a form >

To the top of the page ^

Clarification 8: External tools

If external tools are used, that is, programs that are not part of OpenOlat itself but are integrated into it, OpenOlat has no way of verifying whether data transmitted to these tools is stored elsewhere or used for other purposes.

Example: Office Programs
For example, if Microsoft products such as Word, Excel, and PowerPoint are to be used and have been set up by administrators after obtaining the necessary licenses, users can collaborate on the same document. While collaborating, the files are stored on Microsoft servers and not in OpenOlat. You should simply be aware that this may have implications under data protection laws.

Example: Course element External Page
The course element "External Page" can transmit data about the current account to the external system via the HTTP header of the request in order to implement certain learning scenarios (username, email, first name, last name, and the user's current IP address). Administrators specify whether this data should be transmitted or not in the system administration under:
Administration > Modules > External page
Alternatively, this setting can also be configured under Administration > Modules > Privacy, in the section Data transmission within course element "external page".
However, OpenOlat has no control over what happens to this data on the external site.

In OpenOlat, all external tools are configured in the system administration under:
Administration > External tools

To the top of the page ^

Clarification 9: Connected platforms

With OpenOlat, it is possible to access courses that are technically hosted on a different platform (another OpenOlat instance or another LMS). The technology for this is provided by the LTI connection. This is similar to an external page. However, it is not just a single page, but entire courses that appear as if they were part of your own LMS.

Data is also exchanged between the connected platforms, subject to strict security measures. It may also be necessary to determine whether additional information and consent from participants are required for particularly sensitive data.

To the top of the page ^

Checklist

  • What general consents did participants already have to provide in order to use the OpenOlat learning platform?
  • I have the General Terms of Use and the General Privacy Policy at hand.
  • All course participants have already confirmed the General Terms of Use and the General Privacy Policy.
  • Are additional course-specific statements required?
  • Are the texts of the course-specific statements available?
  • Have the course-specific statements already been integrated into the OpenOlat course?
  • Are they integrated in such a way that working on the course without prior consent is ruled out?
  • Do the consents need to be filed and archived somewhere?
  • Are forms being used? Should a statement regarding the terms of use be included there?
  • Does the course use external tools that access other external servers?
  • Is separate consent required for these external tools?
  • Are courses shared with other learning platforms via LTI? Are there any legal issues regarding data transfer to or from those platforms?

To the top of the page ^

Further information

Mentioned on this page
How do I create my first OpenOlat course? >
Personal Configuration: Settings >
Terms of Use >
Modules: Overview >
LTI 1.3 Integrations >

Further reading
Data protection >
Course Element "Task" >
Course Element "Checklist" >
Course Element "External Page" >

youtube
Adding course elements (German)

To the top of the page ^