A judge will require ConnectEDU, a bankrupt college and career advising startup that holds the personal information of millions of students, to abide by its privacy policy in the sale of student data, according to Jamie Hine, a lawyer for the Federal Trade Commission.
The FTC announced last week that it was attempting to halt the sale of troves of user data by ConnectEDU, including the names, contact information, birthdays, and academic histories of some 20 million students. In a letter, the FTC alleged that the sale was in violation of ConnectEDU's own privacy policy, which promised to alert users to a sale and allow them the opportunity to remove the data from the site.
In a hearing late Thursday, Judge Shelley Chapman said she would require ConnectEDU to notify its users of a sale and let them delete their data, according to Hine. The language of the bankruptcy documents will be changed officially early next week.
Bankruptcy judges have wide leeway in what policies they can require companies to follow, and often cast aside concerns in order to facilitate a speedy sale.
"We were very encouraged by the result," Hine said. "It was very unexpected. The judge could have ignored the issue, but she really got it."
The judge's order could be a product of the heated debate around the importance of protecting students' information, which has become accessible to more and more private companies in the form of websites and apps used in classrooms. ConnectEDU was used by 5,000 educational institutions and more than 100,000 prospective employers. It had also recently received a $500,000 grant from the Bill and Melinda Gates Foundation related to mastery of the Common Core, which would have brought it further into the K-12 education sphere.
While the FTC enforces the Child Online Protection Act, which applies only to students under 13, Hine said it also prioritizes protection of the information of teenagers. "The data belonging to minors requires more protection," he said. "We think it's even more important."
Bankruptcy cases such as ConnectEDU's can make private data even more vulnerable than in traditional sales, Hine said, because pieces of companies are sold off to the highest bidder, and the companies themselves have little control over who gets data and what happens to it.