Data

Millions of Student Records Sold in Bankruptcy Case

By Michele Molnar — December 09, 2014 6 min read
  • Save to favorites
  • Print

When the education technology company ConnectEDU Inc. sought protection under Chapter 11 bankruptcy law earlier this year, 20 million student records hung in the balance, raising many questions for educators and parents alike.

What would happen to the data the company had amassed in its college- and career-ready technology platform for students from middle school through college? Who would own the records? How would they be secured?

Because of the bankruptcy court proceedings, the action played out on a public stage, revealing a transfer that usually goes on in a more private way when one company purchases another and data change hands. Ultimately, the sale of ConnectEDU occurred without the company abiding strictly to its privacy policy, creating a cautionary tale for school districts, and a complex challenge for the ed-tech industry.

Founded in 2002, ConnectEDU had amassed millions of records from school districts, as well as individual students and their parents. Depending on what a district or individual specified, a record could include a student’s test scores, grade point average, learning disability, email and home addresses, phone number, and date of birth—among other information. The contracts with various education entities and a trove of individual student records were a substantial part of the company’s remaining value as it dissolved.

ConnectEDU Bankruptcy: A Privacy Timeline

ConnectEDU, a college- and career- planning company, gathered data from high school and college students, counselors, and parents.

APRIL 28


ConnectEDU files for Chapter 11 protection in the U.S. Bankruptcy Court in the Southern District of New York.

MAY 23


The Federal Trade Commission announces that it will seek to protect students’ personal information as ConnectEDU’s bankruptcy moves forward.

JUNE 26


Graduation Alliance, a Salt Lake City company, announces its acquisition of key assets from ConnectEDU.

AUGUST 4


The Bill & Melinda Gates Foundation files a motion in an effort to get back the unspent part of a $500,000 grant it made to ConnectEDU in 2013.

LATE SEPTEMBER


Graduation Alliance notifies nearly 500,000 Connect! users that it has purchased the ConnectEDU data. Fewer than 1 percent ask for records to be deleted.

OCTOBER 13


Seattle school district orders Graduation Alliance to delete all student records.

OCTOBER 28


Graduation Alliance notifies Seattle schools that all student information related to Seattle public schools was destroyed.

Source: Education Week

The “company sale” portion of ConnectEDU’s privacy policy opened with: “Information collected through our website is considered a trade secret of ours.” In that same policy, ConnectEDU had promised its users that they could delete their personally identifiable records before any sale.

The Federal Trade Commission’s Consumer Protection Bureau brought this to the attention of the bankruptcy judge in the case in May. It asked the court to have ConnectEDU destroy all personal data; or to notify users that their personal information was about to be sold and that they could have it deleted; or to appoint a privacy ombudsman to ensure protection of the users’ privacy.

But none of those scenarios happened, because ConnectEDU had no employees as of the filing date, according to Wojciech F. Jung, a partner in Lowenstein Sandler LLP, the New York City law firm that acted as lead bankruptcy counsel for ConnectEDU in the case.

Instead of registrants receiving notice before the sale, it was left to the acquiring companies that bought the failed company’s assets—Graduation Alliance of Salt Lake City, and Symplicity Corporation of Arlington, Va.—to carry out the notifications after the records had been transferred.

“This is a significant red flag for the treatment of student information by education technology companies,” said Joel R. Reidenberg, a law professor at Fordham and Princeton universities. “Many ed-tech companies today are small startups, collecting lots of data. Many of them are not going to succeed. What’s the protection when these companies go bankrupt?”

For those that do succeed, grow, and become part of an acquisition, he expressed similar concerns: “What’s the protection when they merge?”

Seattle Schools’ Concerns

ConnectEDU was sold in pieces. In June, Symplicity purchased Experience, a ConnectEDU company that delivers career services to college students and alumni. That same month Graduation Alliance acquired contracts, key team members, and several of ConnectEDU’s educational products and services, including the Connect! college- and career-planning platform and the Epsilen collaborative learning environment. Agreements with the Texas Education Agency, and the Miami-Dade, Fla., and Seattle school systems were among the contracts conveyed in the Graduation Alliance sale.

On Oct. 1, 2014, Graduation Alliance announced that —the day before—students, parents, and educators who had established accounts with ConnectEDU’s platform since 2002 had been “informed of their rights to request all personally identifiable data be removed and promptly destroyed,” and that Graduation Alliance had “enacted all data privacy measures as required by the U.S. Federal Trade Commission.” That included the notification of all Connect! users, past and present, whose post-secondary accounts had been transferred to the company.

Fewer than 1 percent of those notified by Graduation Alliance requested that their records be destroyed, according to Ray Kelly, the CEO of the company, which was founded in 2007 and has specialized in dropout recovery and prevention.

But when parents in Seattle received emails directly from Graduation Alliance indicating that they could request that all personally identifiable information be purged from the system, it raised some questions and concerns, according to Carmen A. Rahm, the chief information officer for the district.

Seattle schools had demanded that all records be deleted under its contract when ConnectEDU declared bankruptcy in the spring, but the district had to wait until Graduation Alliance received the data for that order to be carried out, according to a statement from the school system, which pointed out that it had been assured that all student data were “fully secured” throughout the process.

“The ConnectEDU Chapter 11 story demonstrates that student data is treated as a marketable asset,” said Sue Peters, a member of the Seattle school board. “Part of the problem is that parents have their children’s information transferred around, and it’s up to the parents to actively retrieve and protect it.”

Issues of Trust

Possessing data about students is central to using education technology effectively, and protecting that information is paramount, industry leaders say.

To that end, nearly 50 companies that sell products in the K-12 marketplace have signed a “Student Privacy Pledge,” which goes into effect on January 1, 2015. Among the pledge’s dozen provisions is one about acquisitions. It states that, in the case of a merger or acquisition, the company signing the pledge will “allow a successor entity to maintain the student personal information … provided the successor entity is subject to these same commitments for the previously collected student personal information.”

Mark Schneiderman, the senior director of education policy for the Software & Information Industry Association, an organization that co-authored the pledge, has said that it is enforceable by the Federal Trade Commission because the companies are making a public pledge.

The student-privacy pledge “is a great step in the direction of having these ed-tech vendors step up and make a public commitment” about how they’re safeguarding student information, said Paige Kowalski, the director of state policy and advocacy for the Washington-based Data Quality Campaign, whose goal is to help schools harness data to make better decisions.

She called the ConnectEDU story a case study in what can happen when trust is broken, and the importance of re-establishing that trust with an acquiring company. “It’s incumbent upon the new organization to establish the same level of trust that was there when the first company signed up with them,” she said. “They’re going to have to prove by their actions that they are reliable and worthy of the trust that was placed in them.”

“ConnectEDU was not the first, and certainly will not be the last, ed-tech company to be sold or merged or go bankrupt,” said James P. Steyer, the CEO and founder of Common Sense Media, a San Francisco-based nonprofit that advocates for safe technology use for children. “You cannot always leave it up to the industry to do the right thing or even stand by their own privacy policies.”

Mr. Steyer, whose organization pushed for the passage this year of California’s Student Online Personal Information Protection Act, which will regulate ed-tech providers in their handling of student data privacy, called for “clear state and national regulation of student data and personal information” to deal with the issue.

Related Tags:

A version of this article appeared in the December 10, 2014 edition of Education Week as Bankruptcy Case Shines Spotlight on Data Privacy

Events

Jobs Virtual Career Fair for Teachers and K-12 Staff
Find teaching jobs and other jobs in K-12 education at the EdWeek Top School Jobs virtual career fair.
Ed-Tech Policy Webinar Artificial Intelligence in Practice: Building a Roadmap for AI Use in Schools
AI in education: game-changer or classroom chaos? Join our webinar & learn how to navigate this evolving tech responsibly.
Education Webinar Developing and Executing Impactful Research Campaigns to Fuel Your Ed Marketing Strategy 
Develop impactful research campaigns to fuel your marketing. Join the EdWeek Research Center for a webinar with actionable take-aways for companies who sell to K-12 districts.

EdWeek Top School Jobs

Teacher Jobs
Search over ten thousand teaching jobs nationwide — elementary, middle, high school and more.
View Jobs
Principal Jobs
Find hundreds of jobs for principals, assistant principals, and other school leadership roles.
View Jobs
Administrator Jobs
Over a thousand district-level jobs: superintendents, directors, more.
View Jobs
Support Staff Jobs
Search thousands of jobs, from paraprofessionals to counselors and more.
View Jobs

Read Next

Data A New Digital Divide? Low-Income Students See More Ads in the Tech Their Schools Use
Students from the lowest-income families are the most likely to attend schools that do not systematically vet their education technology.
4 min read
Group of Students in IT Class
iStock
Data What the Research Says What Does 'Evidence-Based' Mean? A Study Finds Wide Variation.
Fewer than 1 in 3 education interventions get consistent judgments on their evidence base from reviewers.
5 min read
photograph of a magnifying glass on an open book
Valiantsin Suprunovich/iStock
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Sponsor
Data Whitepaper
Use Your Data to Guide Greater Growth this Spring
Walk through steps to help your team use assessment data to set rigorous yet realistic goals that guide instruction at all tiers.
Content provided by Renaissance
Data 'Hidden Homeless': A Key Measure of Homelessness Excludes Most Students
Federal agencies differ in how they measure homelessness—and many vulnerable students are left out.
3 min read
Photograph of a low angle view of children with backpacks climbing the school staircase.
E+/Getty