When the education technology company ConnectEDU Inc. sought chapter 11 protection earlier this year, 20 million student records hung in the balance, Education Week reported yesterday. Ultimately, the sale of ConnectEDU occurred without the company abiding strictly to its privacy policy. The "company sale" portion of ConnectEDU's privacy policy opened with: "Information collected through our website is considered a trade secret of ours." In that same policy, ConnectEDU had promised its users that they could delete their personally identifiable records before any sale. The Federal Trade Commission's Consumer Protection Bureau brought this to the attention of the bankruptcy judge in the case in May. It asked the court to have ConnectEDU destroy all personal data; or to notify users that their personal information was about to be sold and that they could have it deleted; or to appoint a privacy ombudsman to ensure protection of the users' privacy. Instead of registrants receiving notice before the sale, it was left to the acquiring companies that bought the failed company's assets — Graduation Alliance of Salt Lake City, and Symplicity Corporation of Arlington, Va. — to carry out the notifications after the records had been transferred. Fewer than 1 percent of those notified by Graduation Alliance requested that their records be destroyed, according to Ray Kelly, the CEO of the company, which was founded in 2007 and has specialized in dropout recovery and prevention.
