EPIC Urges FTC to Strengthen Data Minimization Requirements in Proposed Order with Illuminate Education

EPIC filed comments yesterday to the Federal Trade Commission (FTC) recommending key modifications to strengthen the proposed consent order with Illuminate Education. The FTC’s complaint alleged that Illuminate Education violated Section 5(a) of the FTC Act by failing to secure students’ personal data, leading to a significant data breach involving the personal data of more than 10 million students.

In comments, EPIC commended the FTC for taking action against harmful data security practices, recognizing specifically that misrepresentations of data security measures and false assurances that data breaches will be timely disclosed constitute unfair and deceptive acts. Companies should not misrepresent the security of the personal data they store, why they are collecting data, or what they do with that data to consumers or their clients.

To make the proposed order meaningful and effective, EPIC encouraged the FTC to strengthen the data minimization provisions of the order. The data minimization requirements should include commonsense data collection and processing limitations, including limits on secondary data processing. Additionally, like other provisions in the order, data minimization should be an ongoing obligation for Illuminate Education.

Data minimization is an essential pillar of data security. While other data security safeguards are important for limiting risk, the best way to prevent and lessen data security risk to consumers is to minimize the data that companies collect, process, and retain in the first place.

EPIC routinely files comments in response to proposed FTC consent orders and complaints regarding business practices that violate privacy rights. EPIC has long advocated for the inclusion of data minimization in privacy laws and regulations.