Virginia Probe Finds Systemic Privacy Violations after Fairfax Data Release

Get stories like these delivered straight to your inbox. Sign up for The 74 Newsletter

The Fairfax County Public Schools, Virginia’s largest district, has a systemwide problem protecting students’ privacy, the state education agency said Friday, calling for additional training of staff it said were either “not aware of the precautions that should be taken” or weren’t “sensitized” to the issues.

The finding stems from a complaint brought by a Fairfax parent and special education advocate  in December after she inadvertently received data on roughly 35,000 students, including special education records, confidential legal memos and mental health conditions. The 74 first reported the disclosure Nov. 1. The records included full names of students involved in lawsuits against the district over alleged sexual assault complaints and those seeing counselors for issues such as suicidal thoughts and depression.

The 180,000-student district has until March 25 to appeal the state’s finding or complete a “corrective action plan” that includes some steps the district has already agreed to, such as additional staff training.

That training, however, was supposed to begin Oct. 31, according to the district’s response to an earlier complaint from the same parent. But during a Feb. 6 Q&A with a parents group, a district official acknowledged the training had yet to start . 

“That is going to be launched fairly shortly,” said Dawn Schaefer, who oversees special education complaints for the district. “I don’t have an exact launch date, but I can certainly check.” 

In its decision, the state noted the district’s failure to address the repeated violations.

“A perfect policy is of no use if people ignore it,” wrote Patricia Haymes, the director of dispute resolution at the Virginia Department of Education. “Perfect procedures are meaningless if no one follows them.”

Haymes ordered the district to provide a list of all students affected by the disclosure and to verify that their parents have been notified. The district must also submit monthly progress on its implementation of recommendations of the independent investigation Superintendent Michelle Reid launched following The 74’s reporting. The state noted the article in its response to the district.

The state’s finding backs up what some Fairfax parents have been saying for years — that district staff members have a pattern of sharing confidential emails and student records with the wrong parents and educators. Experts praised the state for pushing for additional training, but one questioned whether the requirements go far enough, calling them “fairly lackluster.” 

“I don’t know that the families harmed will feel like this is sufficient oversight of the issue,” said Amelia Vance, president of the Public Interest Privacy Center. “Trust has been breached between the community and the district, and more is necessary to fix this.”

Nonetheless, she gave Fairfax’s superintendent credit for being transparent about the district’s mistake and promptly issuing an apology. The district declined to comment on the outcome of the state complaint.

‘A bigger Band-Aid’

Virginia officials previously accepted the district’s assurances that the disclosures were isolated incidents. In mid-December, a state hearing officer said “a series of mistakes” doesn’t necessarily add up to a “systemic violation.” 

The state has “always said it’s a one-off. They operate as if each incident is a silo,” said Callie Oettinger, the parent who gained access to the unredacted records in mid-October when she went to a high school to examine files on her own two children. She made the request under the federal Family Educational Rights and Privacy Act, or FERPA, which gives parents the right to examine their children’s education records.

Pointing to larger concerns in the district, her complaint noted “overlapping” privacy violations that officials were already investigating between March and mid-November last year, including the large October records release and a November incident in which Robinson Secondary School, a seventh through 12th grade school, mailed students’ report cards to the wrong parents. 

Oettinger called the remedy “a bigger Band-Aid” compared with steps the district already agreed to take, including lawyers signing off on record requests before they are released to parents. 

But Todd Reid, a spokesman for the state education department, called the corrective action plan an “intensive requirement of both federal and state special education law” to ensure districts make improvements within a specific time frame. 

‘Not letting it slide’

Another privacy expert blamed these types of mistakes on the “convergence” of more student data, new technologies and parents who want access to records electronically. Steve Smith, founder of the Student Data Privacy Consortium, a national network, said the district should be using systems that “reduce the likelihood of inadvertent sharing.”

But, he added, the backlash from parents can force a district to take better precautions. 

“These things becoming public and the school community losing confidence probably has more impact than a warning from the FERPA office or the state,” he said. “I applaud parents for not letting it slide.”

Get stories like these delivered straight to your inbox. Sign up for The 74 Newsletter