EdLawConnect Blog

ConnectEDU, a college and career advising startup that holds the personal information of millions of students, declared Chapter 11 bankruptcy in April 2014. ConnectEDU developed college- and career-planning sites where students could create personal profiles. As a result, ConnectEDU held a considerable amount of personally identifiable information including students’ names, dates of birth, email addresses and telephone numbers, grades, awards, college and career goals, and more.

Despite ConnectEDU’s own privacy policy stating that users could delete personally identifiable information before any sale, and the Federal Trade Commission’s Consumer Protection Bureau expressing concern to the bankruptcy court about the treatment of student data, personally identifiable information of students was sold as an asset of ConnectEDU. The various companies that bought the assets were then responsible for notifying the students who had registered their information with ConnectEDU.

The sale of the personally identifiable information of 20 million students as a result of ConnectEDU’s bankruptcy highlights the value of student data to vendors and the importance of protecting that data. Many education technology companies that collect student data are small startups, some of which will not succeed. When these companies go bankrupt, or even when they grow and become part of an acquisition, the ownership and protection of the student data is unclear. Nonetheless, educational agencies must ensure the data they share with third-party companies is adequately protected.

Districts should confirm any agreement that grants a third party access to student data includes stringent provisions protecting the data and describing a process for the return or destruction of that data upon the termination or assignment of that agreement. Additionally, districts should review their internal policies and procedures regarding the release of various types of student data to third party vendors to ensure compliance with all applicable privacy laws and regulations.