In a letter to the bankruptcy judge [PDF] the FTC argues that a sale would potentially be deceptive because it would violate ConnectEDU’s privacy policy.
ConnectEDU must comply with Section 363(b)(1)(A) of the Bankruptcy Code, which states that a debtor may not sell personally identifiable information about an individual covered by a privacy policy prohibiting the transfer of that information to a third party, unless the sale is consistent with the policy.The FTC refers to the Snapchat consent agreement and notes
The Commission has brought many cases alleging that the failure to adhere to promises about information privacy constitute a deceptive practice under the FTC Act.1 These cases include FTC v. Toysmart in which the Commission sued an online toy retailer that had filed for bankruptcy and sought to auction the personal information it collected from its customers. The Commission alleged that the offer for sale constituted a deceptive practice because the company had represented in its privacy policy that such information would never be shared with third parties.There's no indication on the ConnectEDU site of anything amiss. The site continues to promote the business as one that
prepares and transitions 21st Century Learners on their pathways from school to college to career, helping them realize their potential, achieve a secure financial future, and ultimately connect to life's possibilities.One of life's undisclosed possibilities is being data-mined as an outcome of corporate bankruptcy
The ConnectEDU privacy policy states that in the event of sale or intended sale of the Company its users will be given
reasonable notice and an opportunity to remove personally identifiable data from the service. In any event, any purchaser of ConnectEDU’s assets will abide by the terms of this Privacy Policy in the form effective as of any transfer.ConnectEDU, which apparently has some activity in Australia, is reported to have 200 creditors, estimated assets of US$1m to US$10m and liabilities of between US$10mn to US$50m.
The FTC notes that ConnectEDU indicates that
the personally identifiable data you submit to ConnectEDU (or that ConnectEDU obtains from your school) is not made available or distributed to third parties, except with your express consent and at your direction,
In particular, the Company will not give, sell or provide access to your personal information to any company, individual or organization for its use in marketing or commercial solicitation or for any other purpose, except as is necessary for the operation of this site.The FTC states that
Information about teens is particularly sensitive and may warrant even greater privacy protections than those accorded to adults. These users, as well as their parents, would likely be concerned if their information transferred without restriction to a purchaser for unknown uses.The FTC has recommended either that ConnectEDU give each student who had registered for its sites the choice to remove personal records from company databases in advance of a sale or that the company destroy the entirety of the personal details it had collected.
