Does selling a company mean selling its data?

This post is adapted from 7 tweets I made on December 22nd, 2019.

There is still debate within the educational technology community about whether Instructure’s acquisition (which may be falling apart) constitutes a sale of student data.

I believe it does. The data is an asset of the company, and is transferred along with the sale.

Instructure has been consistently clear, and I believe them, that they do not claim ownership over the data. But they are its stewards, and I think they have not been transparent about how it will be legally protected from unethical monetization under new ownership.

The in their updated Privacy Policy that has me most concerned is this one, which allows them to share personal information with “Affiliates”. This is the Affiliates Clause:

This screenshot shows the Affiliates Clause in Instructure's Privacy Policy.

This definition is exceptionally broad, and would seem to include all the other companies owned by Thoma Bravo (the private equity firm buying Instructure).

Instructure has bragged throughout 2019 about having the largest database of student activity in the world. Most of this comes from the 30 million users of the Canvas LMS.

When this data is transferred, it multiplies in value. When it’s transferred to a company that is then sold, all bets are off. The values and assurances of the original Instructure no longer apply. The inkling of student consent that was originally provided should be invalidated.

This sort of privacy-washing should be illegal, but it’s not. Companies like Facebook try to distance themselves from companies like Cambridge Analytica, but we all know who was responsible. Instructure is responsible for our data forever.

Leave a Reply