2017年-Talkingdata_【T112017-教育生态与人才培养分会场】科技教育领域的数据科学与数据隐私_24页_1mb

报告摘要

Data Science and Privacy in the EdTech Space

Core Content

This document explores the intersection of data science and privacy in the EdTech industry, focusing on Coursera's approach to leveraging data for educational improvement while ensuring learner privacy. It outlines the ways in which Coursera uses data science to enhance the learning experience, including personalized recommendations, content optimization, and learner motivation strategies. Additionally, it highlights the importance of privacy in a global context, discussing the challenges of compliance with varying regulations and the need for robust data protection measures.

Main Points

1. Data Science Applications in EdTech

Decision Science: Coursera uses statistical analysis to understand user behavior and inform product development.
Data Products: These are designed to improve the learning experience by matching users with relevant content and providing support.
Infrastructure: Coursera provides data resources and tools to enable and accelerate its product vision.

2. Personalized Learning and Recommendations

Learner data is used to build a common currency for skills, enabling personalized recommendations.
The skill taxonomy is initially based on Wikipedia and refined using machine learning and user feedback.
Coursera tags skills to courses using data from course titles, video transcripts, module descriptions, and assessments.
Learners can customize their learning paths by hiding familiar content and receiving tailored recommendations.

3. Privacy Challenges in EdTech

Coursera handles privacy concerns from learners, enterprise customers, universities, and governments.
It collects data to improve services and conduct research, but this data must be protected.
The key question is: How can we best ensure that our learners' data is protected?

4. Privacy Regulations Across Jurisdictions

EU (GDPR): Enforced in May 2018, GDPR imposes strict regulations on handling personal data, with heavy fines for non-compliance.
Data Localization: Some countries require data to be stored locally, which can be burdensome for global startups.
US Regulations: The Children's Online Privacy Protection Act (COPPA) and Family Educational Rights and Privacy Act (FERPA) apply to educational data. FERPA is relevant if Anna is enrolling in an online degree program.

5. Privacy Incident Response

In the event of a data breach, Coursera recommends the following steps:
- Gather information and neutralize the situation
- Create a response team
- Communicate effectively, including preparing a public relations response
- Handle the aftermath with transparency and support for affected users

6. Coursera's Privacy Management Approach

Coursera's legal team collaborates with cross-functional teams to:
- Monitor and comply with privacy laws in different jurisdictions
- Draft privacy policies and contracts that balance protection and service improvement
- Provide avenues for learners to voice privacy concerns
- Develop a data breach response plan
- Integrate privacy features into the product from the beginning

Key Information

Global Learner Base: Coursera has 28+ million learners worldwide.
Data Collection: Coursera collects both non-personally identifiable information (non-PII) and personally identifiable information (PII).
Privacy Considerations for Learners: Learners may have privacy concerns related to account creation, data collection, and potential data breaches.
Compliance and Flexibility: Coursera must balance data protection with the flexibility to improve services and innovate.
Legal and Technical Collaboration: Coursera integrates legal and technical expertise to ensure compliance and build privacy-first products.

Questions to Consider for Privacy Compliance

What type of information are you collecting? Is it PII?
Who are you collecting information from, and what countries are they from?
Have you received explicit consent from the data subject?
What privacy laws apply to your product? Have you built features that comply with these laws?
Do you have a concrete plan for responding to data breaches?