Magazine article University Business
Virginia Schools in a Privacy Pickle: A Well-Intentioned State Law Raises Significant Data Privacy Risks for Institutions and Their Students
EFFECTIVE JULY 1, VIRGINIA higher education institutions have been required to electronically transmit to Virginia state police the following on each accepted applicant: name; Social Security "or other identifying number"; date of birth; and gender.
The reasoning behind the requirement is unquestionably good. It's just one statutory change to help protect Virginia citizens from sex offenders. The statute directs the police to compare the information with sex offender registries. Law enforcement officials indicate that they'll notify the institutions of any matches and keep tabs on the individuals.
Few students would not want to know that a convicted sex offender lives in the dorm room next door. However, the law puts IHEs in the middle of a situation that creates increased risk of loss or theft of personal information and, ultimately, potential mass identify theft of all applicants. It at least raises the question of whether the same objectives could be achieved with less risk to individuals and institutions.
Does an institution really have to release Social Security numbers? In a clever piece of statutory drafting, the general assembly requires the information to be transmitted before the accepted applicants become "students in attendance," subject to the federal Family Educational Rights and Privacy Act (FERPA) information transmission restrictions. Since the law also does not define "other identifying number," it seems the law requires that IHEs cull Social Security numbers from applications and transmit them to the police.
Law enforcement officials say they'll take appropriate steps to protect the data, and there's no reason to doubt that they'll try. After the data has been crosschecked, we are told it will be duly destroyed.
VIGILANCE NOT ENOUGH
The question is not the motives of legislators or law enforcement officials. The hard fact is that situations where thousands and sometimes millions of individuals' personal data has been stolen, lost, or exposed appear in the media constantly. Sometimes identities are stolen and as the Citibank television ads demonstrate when they are, lives are made miserable. …