Blackbaud’s 2024 FTC Settlement: Data Retention and Security
Original article date: February 6, 2024
Data kept beyond its useful life became a central issue in the Federal Trade Commission’s 2024 case against Blackbaud. On February 1, the agency announced a proposed settlement requiring the software company to delete personal information it no longer needed and strengthen its safeguards.
The FTC alleged that security failures allowed a hacker to access a network containing sensitive information about millions of consumers. Its complaint concerned a 2020 breach. Those statements describe the agency’s allegations, rather than a court finding of liability.
What the proposed order addressed
The agency’s case materials connect information security with retention: limiting what remains in a system limits what a breach can expose. The proposed order addressed deletion and safeguards. It was a company-specific enforcement action, not a newly enacted rule applying automatically to every organization.
Blackbaud’s February 2 filing with the Securities and Exchange Commission described the proposed settlement and said the company agreed without admitting or denying the allegations, except as expressly stated in the order. The filing also said the proposed order did not impose a fine or other payment.
The historical timeline
The earlier Norly News article was published on February 6, 2024, when the proposal had been announced but the final order had not yet been issued. The FTC subsequently finalized its order on May 20, 2024. That later development is identified here separately so the original date does not suggest the final decision already existed in February.