  The education technology (EdTech) landscape is expanding rapidly in higher
education institutes (HEIs). This growth brings enormous complexity. Protecting
the extensive data collected by these tools is crucial for HEIs. Privacy
incidents of data breaches and misuses can have dire security and privacy
consequences on the data subjects, particularly students, who are often
compelled to use these tools. This urges an in-depth understanding of HEI and
EdTech vendor dynamics, which is largely understudied.
  To address this gap, we conduct a semi-structured interview study with 13
participants who are in the EdTech leadership roles at seven HEIs. Our study
uncovers the EdTech acquisition process in the HEI context, the consideration
of security and privacy issues throughout that process, the pain points of HEI
personnel in establishing adequate security and privacy protection mechanisms
in service contracts, and their struggle in holding vendors accountable due to
a lack of visibility into their system and power-asymmetry, among other
reasons. We discuss certain observations about the status quo and conclude with
recommendations to improve the situation.
