top of page

Parents Feel Doubly Violated by a Privacy Breach



Like tens of thousands of parents, I received a letter this week indicating that FCPS inadvertently released my child’s private information to a local parent.

Like so many parents, I am angry at FCPS for being so careless when someone gave a parent access to the private information of many students besides theirs. In addition, I am angry at the parent, who not only took advantage of the blunder and copied the private data, but who now refuses to return the private information. To make matters worse, the letter to parents about the data breach was both terrifying and useless, because 1) it did not reveal what specific data was released about my child, and 2) the 1-800 number in the letter was less than useless because those who answered read from a script and provided no useful information to parents who called. 



Fairfax County Public Schools (FCPS") was recently made aware of a Family Educational Rights and Privacy Act ("FERPA") request that resulted in information about your child inadvertently being made available to another FCPS parent. As described below, information involved in this matter was health-related information and other information FCPS uses to provide educational services to your student (such as your student's general mental or physical diagnosis or a student's IEP plan listed on a spreadsheet), but not, for example, your student's Social Security number. FCPS takes the privacy and security of your student's personal information very seriously and we sincerely regret any concern this incident may cause you or your student. As discussed below, FCPS has enacted new measures designed to prevent an incident like this from occurring in the future. What Happened and What Information Was Involved: This matter occurred on or about October 19, 2023. During an in-person review of information related to the reviewer's own child, information relating to other students was unknowingly made accessible to a parent who retained an electronic copy of that information. Thereafter, the parent redacted the information related-to other students and published the redacted information. Since learning of its publication on November 1, 2023, FCPS has worked to contain and secure the deletion of the information involved in this matter.
12/12/23 Letter from FCPS regarding FERPA Violation

Not only is there little information about this situation, but some are sharing misinformation; therefore, here are known facts based on the November 1, 2023 74 Million report:

A parent went to her local FCPS high school over three days in mid-October 2023 to gather records on her child who had already graduated. She was supervised by a central office paralegal as she copied information to a thumb drive and scanned paper documents. Also, she was given boxes of paper files, thumb drives, and CDs with personal, sensitive data from 2019-21 on tens of thousands of FCPS students, which she has refused to return even after their return was demanded. She noticed unredacted information about other people’s students in the files, but claims she was unaware of the full extent of such data until she arrived home. She initially did not report this data breach to FCPS. Subsequently she promised that she would not publish student private information, but has contacted some parents of children named in the documents and provided children’s personal data to www.the74Million.org

After investigating the extent of the breach, Superintendent Michelle Reid sent letters to the affected families and posted an official statement regarding future plans and her discussions with the parent who took the private data. This data breach involves private information from at least 35,000 children, most of whom receive special education services from FCPS. 

It is well-known that there are nationwide concerns about student data security at all schools, public and private. Around the country, parents and guardians have accidentally received data on other students intermingled with their own child’s information. However, state and federal governments have done little to solve this issue, despite the existence of federal law on the subject (e.g., Family Educational Rights and Privacy Act and the Protection of Pupil Rights Amendment). 

Many parents in the Fairfax County community are justifiably angry and scared about this breach, particularly in light of misinformation and rumors. The social media platforms Next Door and Facebook, as well as parenting and neighborhood groups, and the online forum DC Urban Moms are afire about this subject. Specifically, parents are angry that:

  • FCPS released this private and sensitive data to a person who is not authorized to have it. There is no excuse for this to happen, particularly in light of the fact that well-documented data breaches have happened before. 

  • The parent took the data without permission because of inadequate monitoring. 

  • The parent refuses to return the information for which she is not authorized 

  • The parent is sharing information with some parents and a media company, while she is publishing redacted student information in her blogs and in a public report (74 Million). She claims she will never “publish” the private data, but that doesn’t make anyone feel safe, considering her actions to date.

It is likely that the Fairfax County School Board, Superintendent, and local schools are being inundated with calls and emails. Not surprisingly, lawsuits are being discussed against both FCPS and the parent who took the data. 

This event has eroded trust in the school system because FCPS has the responsibility to protect our children and their private information. It is distracting to all involved, including our students who should be focusing on learning, because there is no way of knowing how personal information in the wrong hands may be used in the future. This is a potentially serious issue that can have ramifications many years into the future. Personally, I had trouble working yesterday, because I was consumed with fear and anger over what may happen next and whether my child’s personal information could be used against me or her.

Hopefully, this situation can be resolved by the offending parent returning all copies of the sensitive and private information on FCPS students. In addition, we must insist that FCPS solve the data retention and data sharing procedures which permitted this to happen.

On a related note....Last night, a lovely neighbor distributed cards and gifts to kids on our block. When my daughter opened hers, it contained a 50-dollar bill. Astonished at her generosity, I quickly called the neighbor, who said she meant to give $20 to each child. Immediately, I ran down the block to return the money in order to fix the mistake.

I would hope that any ethical neighbor or community member would do the same.

Comments


bottom of page