澳门跑狗论坛

When the education technology company ConnectEDU Inc. sought protection under Chapter 11 bankruptcy law earlier this year, 20 million student records hung in the balance, raising many questions for educators and parents alike.

What would happen to the data the company had amassed in its college- and career-ready technology platform for students from middle school through college? Who would own the records? How would they be secured?

Because of the bankruptcy court proceedings, the action played out on a public stage, revealing a transfer that usually goes on in a more private way when one company purchases another and data change hands. Ultimately, the sale of ConnectEDU occurred without the company abiding strictly to its privacy policy, creating a cautionary tale for school districts, and a complex challenge for the ed-tech industry.

Founded in 2002, ConnectEDU had amassed millions of records from school districts, as well as individual students and their parents. Depending on what a district or individual specified, a record could include a student鈥檚 test scores, grade point average, learning disability, email and home addresses, phone number, and date of birth鈥攁mong other information. The contracts with various education entities and a trove of individual student records were a substantial part of the company鈥檚 remaining value as it dissolved.

The 鈥渃ompany sale鈥� portion of ConnectEDU鈥檚 privacy policy opened with: 鈥淚nformation collected through our website is considered a trade secret of ours.鈥� In that same policy, ConnectEDU had promised its users that they could delete their personally identifiable records before any sale.

The Federal Trade Commission鈥檚 Consumer Protection Bureau brought this to the attention of the bankruptcy judge in the case in May. It asked the court to have ConnectEDU destroy all personal data; or to notify users that their personal information was about to be sold and that they could have it deleted; or to appoint a privacy ombudsman to ensure protection of the users鈥� privacy.

But none of those scenarios happened, because ConnectEDU had no employees as of the filing date, according to Wojciech F. Jung, a partner in Lowenstein Sandler LLP, the New York City law firm that acted as lead bankruptcy counsel for ConnectEDU in the case.

Instead of registrants receiving notice before the sale, it was left to the acquiring companies that bought the failed company鈥檚 assets鈥�Graduation Alliance of Salt Lake City, and Symplicity Corporation of Arlington, Va.鈥攖o carry out the notifications after the records had been transferred.

鈥淭his is a significant red flag for the treatment of student information by education technology companies,鈥� said Joel R. Reidenberg, a law professor at Fordham and Princeton universities. 鈥淢any ed-tech companies today are small startups, collecting lots of data. Many of them are not going to succeed. What鈥檚 the protection when these companies go bankrupt?鈥�

For those that do succeed, grow, and become part of an acquisition, he expressed similar concerns: 鈥淲hat鈥檚 the protection when they merge?鈥�

Seattle Schools鈥� Concerns

ConnectEDU was sold in pieces. In June, Symplicity purchased Experience, a ConnectEDU company that delivers career services to college students and alumni. That same month Graduation Alliance acquired contracts, key team members, and several of ConnectEDU鈥檚 educational products and services, including the Connect! college- and career-planning platform and the Epsilen collaborative learning environment. Agreements with the Texas Education Agency, and the Miami-Dade, Fla., and Seattle school systems were among the contracts conveyed in the Graduation Alliance sale.

On Oct. 1, 2014, Graduation Alliance announced that 鈥攖he day before鈥攕tudents, parents, and educators who had established accounts with ConnectEDU鈥檚 platform since 2002 had been 鈥渋nformed of their rights to request all personally identifiable data be removed and promptly destroyed,鈥� and that Graduation Alliance had 鈥渆nacted all data privacy measures as required by the U.S. Federal Trade Commission.鈥� That included the notification of all Connect! users, past and present, whose post-secondary accounts had been transferred to the company.

Fewer than 1 percent of those notified by Graduation Alliance requested that their records be destroyed, according to Ray Kelly, the CEO of the company, which was founded in 2007 and has specialized in dropout recovery and prevention.

But when parents in Seattle received emails directly from Graduation Alliance indicating that they could request that all personally identifiable information be purged from the system, it raised some questions and concerns, according to Carmen A. Rahm, the chief information officer for the district.

Seattle schools had demanded that all records be deleted under its contract when ConnectEDU declared bankruptcy in the spring, but the district had to wait until Graduation Alliance received the data for that order to be carried out, according to a statement from the school system, which pointed out that it had been assured that all student data were 鈥渇ully secured鈥� throughout the process.

鈥淭he ConnectEDU Chapter 11 story demonstrates that student data is treated as a marketable asset,鈥� said Sue Peters, a member of the Seattle school board. 鈥淧art of the problem is that parents have their children鈥檚 information transferred around, and it鈥檚 up to the parents to actively retrieve and protect it.鈥�

Issues of Trust

Possessing data about students is central to using education technology effectively, and protecting that information is paramount, industry leaders say.

To that end, nearly 50 companies that sell products in the K-12 marketplace have signed a 鈥淪tudent Privacy Pledge,鈥� which goes into effect on January 1, 2015. Among the pledge鈥檚 dozen provisions is one about acquisitions. It states that, in the case of a merger or acquisition, the company signing the pledge will 鈥渁llow a successor entity to maintain the student personal information 鈥� provided the successor entity is subject to these same commitments for the previously collected student personal information.鈥�

Mark Schneiderman, the senior director of education policy for the Software & Information Industry Association, an organization that co-authored the pledge, has said that it is enforceable by the Federal Trade Commission because the companies are making a public pledge.

The student-privacy pledge 鈥渋s a great step in the direction of having these ed-tech vendors step up and make a public commitment鈥� about how they鈥檙e safeguarding student information, said Paige Kowalski, the director of state policy and advocacy for the Washington-based Data Quality Campaign, whose goal is to help schools harness data to make better decisions.

She called the ConnectEDU story a case study in what can happen when trust is broken, and the importance of re-establishing that trust with an acquiring company. 鈥淚t鈥檚 incumbent upon the new organization to establish the same level of trust that was there when the first company signed up with them,鈥� she said. 鈥淭hey鈥檙e going to have to prove by their actions that they are reliable and worthy of the trust that was placed in them.鈥�

鈥淐onnectEDU was not the first, and certainly will not be the last, ed-tech company to be sold or merged or go bankrupt,鈥� said James P. Steyer, the CEO and founder of Common Sense Media, a San Francisco-based nonprofit that advocates for safe technology use for children. 鈥淵ou cannot always leave it up to the industry to do the right thing or even stand by their own privacy policies.鈥�

Mr. Steyer, whose organization pushed for the passage this year of California鈥檚 Student Online Personal Information Protection Act, which will regulate ed-tech providers in their handling of student data privacy, called for 鈥渃lear state and national regulation of student data and personal information鈥� to deal with the issue.