FTC Finalizes Settlement with Illuminate Education, Heeding EPIC’s Call to Strengthen Data Minimization Requirements

On Friday the FTC finalized a revised consent order with Illuminate Education that incorporates many of EPIC’s recommendations to strengthen the data minimization section of the order. Late last year, the FTC filed a complaint against the educational technology provider after a major data breach exposing the personal data of 10 million students. The complaint alleged that insufficient security measures led to the breach.

EPIC filed comments urging the FTC to strengthen the proposed order with Illuminate Education, focusing on data minimization measures. To make the order meaningful and effective, EPIC warned that the privacy provisions must set down real, enforceable limits on the processing of personal data. Data minimization is an essential pillar of data security. While other data security safeguards are important for limiting risk, the best way to prevent and lessen data security risk to consumers is to minimize the data that companies collect, process, and retain in the first place.

EPIC routinely files comments in response to proposed FTC consent orders regarding business practices that violate privacy rights. EPIC has long advocated for the inclusion of robust data minimization in privacy laws and regulations.