Important Update on ‘Panopto’

We are writing with an important update on ‘Panopto’, UCL’s new lecture recording system. We previously reported the fact that the implementation of the system was in contradiction with UCL’s agreed policy on ‘opt-in’ and that staff were being misled about their rights.

On further investigation we have found that the implementation is beset with problems which we need to urgently draw to your attention. 

What everyone needs to know

If you use Panopto, it is essential that you are aware that – by default at least:

• All recordings are Public, i.e. available for all staff and students at UCL to watch. As of Thursday at 9am, 369 lectures were publicly available with a UCL login. 
• All recordings are automatically uploaded to the system. Since the system starts and ends at scheduled times, the system is capturing private conversations that should not be recorded. These are automatically transcribed, and potentially searchable.

These settings are by default, and changing them requires that staff be given the appropriate authorisation (as well as training, advice and  lead-in time).

This means that

• This system is not compliant with the General Data Protection Regulations (GDPR). It creates a safeguarding risk for staff and students, breaching their privacy rights.
• Where any matter of sensitivity is discussed in class, uncontrolled broadcasting to random students and staff represents a threat to academic freedom and freedom of speech. Students attending class have not agreed to comments in lectures being widely available. 
• Seminars where student participation is expected should definitely not be recorded. Some of our students come from countries where free speech is severely limited, and any recording of their participation in non-state-sanctioned discussions may lead to reprisals on their return.
• By making recordings public to the entire institution, Panopto places staff’s intellectual property at risk. Software exists to copy any video played on a desktop. Companies like WebinarTV.us are in the business of grabbing unauthorised content, the founder infamously saying that ‘copying is not theft’. It is not difficult to imagine that such tools could be used to ‘scrape’ the UCL Panopto site for content.

What UCL UCU has done

We first became aware of the extent of these problems with Panopto on Friday. We wrote to UCL on Monday asking them to implement the following steps. 

1. Limit access to existing content by Moodle module or course enrollment. Neither staff nor students should be able to view anyone else’s recordings on Panopto unless staff expressly agree to make them public.
2. Ensure staff have the ability to edit recordings before release. Automatic publication must immediately cease. Staff must be given the relevant tools, training and time to edit recordings on the new system.
3. UCL must properly inform staff of their rights, including the fact that recordings of lectures, and providing them to relevant staff and students, were only ever intended on an opt-in basis. Automatic enrollment must cease immediately and be reversed.
4. Post clear signage in rooms where lecture recordings are made, stating

1. student and staff interactions may be recorded, 
2. how they may object to a recording of themselves being distributed without their permission, and 
3. at each lecture intended for recording, that the staff will explicitly say so.

Since these breaches were so wide-ranging, and to ensure that they do not recur, we also formally requested that an oversight committee be set up, with union representation and reporting to Academic Board.

What you should do

If you are currently using Panopto, we would advise the following steps:

• Where possible, seek to opt out for now. Contact your Head of Department and say that having been made aware of the current risks to UCL, staff and students, you wish to opt out.
• We recognise that some staff may not be able to do this, e.g. where material is produced for distance learning courses.

If you can’t do this, apply caution in using it.

• Consider how you can mitigate the risks outlined above until you can control viewing rights. For example, you may wish to avoid showing students cutting-edge unpublished research results.
• Protect your students’ rights. If your lectures are interactive with students, this is a ‘seminar’ and is not normally recorded. Even where topics are not ‘controversial’, students cannot be assumed to have given permission in advance.

For existing content, our advice is to “unpublish” recordings, change viewing permissions to ‘module only’, and edit them to delete inappropriately recorded student comments before republishing them.

We would also urge departments to display signs in rooms where Panopto is still potentially ‘live’, as staff and students may be inadvertently recorded against their knowledge. If Panopto were to keep running without the next lecturer’s knowledge, it would be tantamount to a bugging device.

UCL UCU Executive Committee