Judge Halts FTC from Accessing Thousands of Grand Canyon University Students’ Personal Data

A federal judge has ruled against a request from the Federal Trade Commission (FTC) for personally identifying information from more than 10,000 students at Grand Canyon University (GCU) in Phoenix. U.S. District Judge Dominic Lanza characterized the request as overly burdensome during a hearing on Wednesday.

While no formal written ruling was issued, Lanza advised both parties to collaborate on a resolution. The dispute arises from the FTC’s lawsuit filed earlier in 2023, which accuses GCU of deceptive marketing practices related to its graduate programs.

The FTC’s request for student data aims to bolster its claim that Grand Canyon Education, which manages GCU and garners 60% of the university’s profits for various support services, engaged in misleading marketing. The agency is seeking records from students who enrolled post-June 2019.

Furthermore, the FTC alleges that Grand Canyon Education violated the Telemarketing Sales Rule by contacting individuals who opted out of communication and those on the National Do Not Call Registry. The request includes records of over 110 million outbound calls made since 2018, involving a minimum of 400,000 unique students.

In response, Grand Canyon Education expressed willingness to provide most of the requested data, provided that names and student ID numbers are redacted. Failing this, compliance with the Family Educational Rights and Privacy Act would require notifying each student about the data sharing.

During the hearing, attorney Derin Dickerson argued that notifying students would take thousands of hours of labor, asserting that the FTC had not justified the necessity of disclosing identities. “These burdens are simply not warranted,” Dickerson said, emphasizing the lack of relevance in the FTC’s demand.

FTC attorney Carlton Mosley countered by asserting the importance of student identities for their case, claiming that they are needed to demonstrate instances of deception in marketing.

Though Judge Lanza acknowledged the relevance of student identities, he noted that the burden of sending out over 10,000 notices would be excessive. He expressed concern about the implications for student privacy and the potential for increased inquiries to the court.

Mosley suggested that if the FTC limits its student data requests, GCU should also adhere to the same parameters when collecting evidence. Lanza indicated he would review this aspect but reaffirmed existing rules regarding evidence collection.

The FTC initially filed the lawsuit against GCU and Grand Canyon Education in December 2023, alleging improper advertising of the university as a non-profit entity. However, Lanza dismissed that portion of the case in 2024 along with the university’s involvement on March 6.

Currently under scrutiny are claims that Grand Canyon Education misleads prospective Ph.D. students regarding course and credit requirements for obtaining a doctoral degree. The FTC also alleges misleading practices by the university’s telemarketers.

According to the university’s information, students are told completing a doctorate requires only 20 courses, equating to 60 credits. However, the FTC highlights that most students end up needing additional coursework, with 50% taking at least 31 courses.

The FTC acknowledged in its response that the university does inform students of the minimum requirements but argues that this representation could still be misleading. The discovery phase of the case has been ongoing since at least April 2024, with no trial date set yet.