Like tens of thousands of parents, I received a letter this week indicating that FCPS inadvertently released my child’s private information to a local parent.
Like so many parents, I am angry at FCPS for being so careless when someone gave a parent access to the private information of many students besides theirs. In addition, I am angry at the parent, who not only took advantage of the blunder and copied the private data, but who now refuses to return the private information. To make matters worse, the letter to parents about the data breach was both terrifying and useless, because 1) it did not reveal what specific data was released about my child, and 2) the 1-800 number in the letter was less than useless because those who answered read from a script and provided no useful information to parents who called.
Not only is there little information about this situation, but some are sharing misinformation; therefore, here are known facts based on the November 1, 2023 74 Million report:
A parent went to her local FCPS high school over three days in mid-October 2023 to gather records on her child who had already graduated. She was supervised by a central office paralegal as she copied information to a thumb drive and scanned paper documents. Also, she was given boxes of paper files, thumb drives, and CDs with personal, sensitive data from 2019-21 on tens of thousands of FCPS students, which she has refused to return even after their return was demanded. She noticed unredacted information about other people’s students in the files, but claims she was unaware of the full extent of such data until she arrived home. She initially did not report this data breach to FCPS. Subsequently she promised that she would not publish student private information, but has contacted some parents of children named in the documents and provided children’s personal data to www.the74Million.org.
After investigating the extent of the breach, Superintendent Michelle Reid sent letters to the affected families and posted an official statement regarding future plans and her discussions with the parent who took the private data. This data breach involves private information from at least 35,000 children, most of whom receive special education services from FCPS.
It is well-known that there are nationwide concerns about student data security at all schools, public and private. Around the country, parents and guardians have accidentally received data on other students intermingled with their own child’s information. However, state and federal governments have done little to solve this issue, despite the existence of federal law on the subject (e.g., Family Educational Rights and Privacy Act and the Protection of Pupil Rights Amendment).
Many parents in the Fairfax County community are justifiably angry and scared about this breach, particularly in light of misinformation and rumors. The social media platforms Next Door and Facebook, as well as parenting and neighborhood groups, and the online forum DC Urban Moms are afire about this subject. Specifically, parents are angry that:
FCPS released this private and sensitive data to a person who is not authorized to have it. There is no excuse for this to happen, particularly in light of the fact that well-documented data breaches have happened before.
The parent took the data without permission because of inadequate monitoring.
The parent refuses to return the information for which she is not authorized
The parent is sharing information with some parents and a media company, while she is publishing redacted student information in her blogs and in a public report (74 Million). She claims she will never “publish” the private data, but that doesn’t make anyone feel safe, considering her actions to date.
It is likely that the Fairfax County School Board, Superintendent, and local schools are being inundated with calls and emails. Not surprisingly, lawsuits are being discussed against both FCPS and the parent who took the data.
This event has eroded trust in the school system because FCPS has the responsibility to protect our children and their private information. It is distracting to all involved, including our students who should be focusing on learning, because there is no way of knowing how personal information in the wrong hands may be used in the future. This is a potentially serious issue that can have ramifications many years into the future. Personally, I had trouble working yesterday, because I was consumed with fear and anger over what may happen next and whether my child’s personal information could be used against me or her.
Hopefully, this situation can be resolved by the offending parent returning all copies of the sensitive and private information on FCPS students. In addition, we must insist that FCPS solve the data retention and data sharing procedures which permitted this to happen.
On a related note....Last night, a lovely neighbor distributed cards and gifts to kids on our block. When my daughter opened hers, it contained a 50-dollar bill. Astonished at her generosity, I quickly called the neighbor, who said she meant to give $20 to each child. Immediately, I ran down the block to return the money in order to fix the mistake.
I would hope that any ethical neighbor or community member would do the same.