The potential bankruptcy sale of a company that stores online student data – including personally identifiable information for about 20,000 Seattle middle and high school students – has concerned the Federal Trade Commission and Seattle Public Schools.
For the past three years, the school district has uploaded middle and high school students’ names, grades, addresses and demographic data to the website ConnectEDU. Students were able to add additional information, such as where they’d like to go to college, and how much they want to spend on tuition.
Seattle Schools Chief Information Officer Carmen Rahm said that school counselors use the data stored on ConnectEDU to advise students about colleges and help them find scholarships.
"The district has really benefited from the program, and so have the students. It’s been a real asset here," Rahm said.
The ConnectEDU privacy policy said that if the company was ever sold, users would be notified and allowed to remove all personally identifiable data from the site.
After learning that the company had filed for bankruptcy and was looking to sell, Rahm said the district tried to end its contract with ConnectEDU and have all student data on the site deleted.
The company’s lawyers refused, citing bankruptcy protections.
Rahm said that’s troubling.
"I’m not concerned at this time that the sale of the company is going to result in student data being lost, or being misused, but it definitely is in violation of the agreement that all the schools had with ConnectEDU in their contract, and that’s a little bit frustrating and concerning," Rahm said.
The Federal Trade Commission shares Rahm’s concerns.
In a letter to the bankruptcy judge, the FTC said that the proposed ConnectEDU sale could violate FTC rules that bar "deceptive acts or practices."
The FTC also said that "information about teens is particularly sensitive, and may warrant even greater privacy protections than those accorded to adults."
Cecilia McCormick, a parent, said she’s been worried about the use of her eighth-grade daughter’s data ever since she realized it had been uploaded to ConnectEDU without her consent.
The potential bankruptcy sale raises even greater concerns for her.
"I don’t want any outside marketing or outside entities trying to contact my child. They have her email address now," McCormick said.
Dora Taylor, a local education blogger and president of the education organization Parents Across America, said she sees no reason for districts to use cloud data storage for students' personal information.
"Any information that’s in any cloud is vulnerable to be taken by another party for whatever use. So I don’t believe it should be happening," Taylor said. "[The data] can all be kept on computers that are supervised by the district.”
A ConnectEDU attorney has promised Seattle Public Schools that any company that buys the student data will have a privacy policy at least as strong as the original.
Still, the FTC said such a sale would likely be illegal unless the 20 million students nationwide with data on the ConnectEDU are first notified and allowed to remove their personally identifiable information from the site.
Correction 5/30/2014: A quote in this story has been shortened after Seattle Public Schools said it contained incorrect information. A district official says student data uploaded to ConnectEDU did not, in fact, include students’ free and reduced lunch enrollment, or whether students qualified for special education.
