In a memo dated 08/15/2011, the Carroll County Public School (CCPS)System indicated they are now required by the Maryland State Department of Education (MSDE) to request student Social Security numbers. After reading the memo it was noted that although the request was mandatory giving the number was optional. However it was quite disturbing to think that the MSDE was requesting information that can impact every aspect of a child’s life without fully disclosing the intended use or their rights to privacy and security of information. When reviewing the memo I began to question:
1. Why is the Maryland State Department of Education requiring school systems to collect SSNs. There was nothing in the memo that indicated why they were asking or how the SSNs would be used.
2. What does it mean that “Social Security numbers will be kept confidential?” What systems are in place to ensure that the child’s privacy and security are protected?
3. What does it mean that “this number will be reported to the Maryland State Department of Education, but will not be released to anyone else without your permission?” What happens in the event that the number would accidently be released or if there was a breach in data security?
4. Why is my child’s school identification number (that was noted on the bottom of the form) not sufficient enough for tracking purposes? The MSDE is asking a parent to tear the bottom of the form off and write in the Social Security number which now is tied to the child’s school identification number. What would happen if that slip of paper was accidently dropped as it was being transported for data entry?
The information provided by the MSDE was not satisfactory nor did it provide assurances that they had rock solid privacy and security practices about student records and highly sensitive information. I just do not believe that MSDE administration is developing policies that are based on the realities of 2011.
According to the July 25, 2011 Carroll County Times article Identify Theft High in Maryland, "Maryland ranked third in the nation for incidents of fraud, identity theft and other complaints filed with the Federal Trade Commission in 2010”
The Office Of The Inspector General Social Security Administration In The Kindergarten Through 12th Grade Schools' Collection And Use Of Social Security Numbers July 2010 A-08-10-11057 Audit Report states to limit the use of the collection of SSN and highlights that the U.S. Department of Education does not require states to utilize the SSN to setup tracking databases. They also concluded in their report:
“Despite the potential risks associated with using SSNs as primary student identifiers, many K 12 schools continue this practice. While we recognize that SSA cannot prohibit States or K 12 schools from collecting and using SSNs as student identifiers or for other purposes, we believe SSA can help reduce the threat of identity theft and SSN misuse by encouraging States and K 12 schools to reduce unnecessary collection of SSNs and improve protections and safeguards when collected. We recommend that SSA:
1. Coordinate with State Departments of Education and K 12 school systems to inform the education community about the potential risks associated with using SSNs as student identifiers or for other purposes.
2. Encourage State Departments of Education and K 12 schools to reduce unnecessary collection and use of SSNs and implement stringent safeguards to protect SSNs when collected.
3. Promote the best practices of States and K 12 schools that have taken steps to limit SSN collection and use.”
In addition the Federal Trade Commission, released a Consumer Alert, September 2011 Protecting Your Child’s Personal Information at School.
I do not understand why the Maryland State Department of Education would then mandate local school systems via the 2011 Maryland Student Record Manual to collect Social Security numbers given these facts and then develop a Social Security Number Request form that did not comply with the recommendations within the FTC Consumer Alert nor comply with the federal Family Educational Rights Privacy Act to inform the parent/guardian of the intended use of the number or their Privacy and Security rights related to the collection and use of the Social Security number.
The Carroll County Public School FAQ was created and initially revised to include the following statement but has since been updated in which the additional information was removed. The Maryland State Department of Education has yet to confirm their intended use of the Social Security numbers with both this writer and CCPS at this time.
“As Maryland has selected to become part of the Race to the Top federal initiative for school improvements, student post-secondary plans must be reported to the United States Department of Education as part of Maryland’s school improvement data. In other words, the federal government is tracking the numbers of students who go on to college, employment, military, training schools, etc… The federal government is calling this number “federal ID numbers”, not social security numbers. While Maryland discontinued using student’s SSNs as unique identifiers in favor of assigned PINs (student id number), the federal government has not. Therefore, MSDE has mandated that we have to at least ask parents to provide them so that we submit them to the State. However, locally no one sees the SSN except the person at the school who enters the data. The field is hidden to anyone who uses our student information system. Most of this is explained in the FAQ.”
If the Social Security number will be used to track student progress post-graduation, so that they comply with the grant funding ($250 million over four years) requirements of the Race to the Top program, then the request form should be updated to reflect that information and also inform the parent that the information will be shared with the U.S. State Department of Education.
It should be noted that the American Civil Liberties Union (ACLU) has concerns with student privacy related to the Race to the Top program as noted on their Website:
"As part of the its accountability in education agenda, the Obama administration has proposed new rules that would allow school administrators to circumvent the Family Educational Rights and Privacy Act and share students' personal information with other state officials and private entities for broad spectrum of activities. And they could do so without consent from either the student or his or her parents.
Under the new rules, personal student information could be shared with state officials not working directly on education and placed in state database with non-education records. Private entities – like test preparation centers or preschools – would be able to access school records they want to evaluate for their education programs. Ultimately, if this expansion continues we could soon see this information being shared between states, resulting in a database of sensitive information of most Americans. Again – none of this would require consent of parents or students."
This is not a new debate and other states are experiencing similar issues. Back in 2009 the Maine Public School system debated the issue of the collection of Social Security numbers and in response the Maine Civil Liberties Union issued a Back-to-School Privacy Alert which ""Every parent must know this is an opt-in program," said Brianna Twofoot, Field Organizer for the Maine Civil Liberties Union Foundation. "The onus lies with the schools to disseminate accurate information about the program and ensure Maine students' privacy is protected." It is disappointing that the MSDE has not learned from the wisdom of others.
I do not agree with the collection and use of the Social Security number by the Maryland State Department of Education and I do not believe they have been compliant with regulations to fully inform parents/guardians about the intended use of the number or their child’s privacy and security rights related to collection, storage and use of this highly sensitive and confidential piece of personal data. I also do not agree with tracking student progress after they graduate from the public school system and believe it is invasion of privacy.
I have become very vocal about this issue, see interview in Carroll County Times, as a result of the MSDE not responding to an email inquiry regarding the issue after I made a phone call. In addition I do not believe the issue has been adequately investigated, see Channel 11 WBAL News Story and Question of the Day. It is the lack of disclosure and transparency that is alarming regarding this request and now has me wondering about how MSDE utilizes other personal student data if they believe collecting Social Security numbers is a non-issue not deserving a public response.
If you believe the MSDE has been inadequate in addressing the issues as stated above call them today, 410-767-0462 and demand to know:
1. Why are you using Social Security numbers (in the age of identity theft) "for data matching, or tracking student progress post-graduation into post-secondary education and career pursuits" and
2. Why are you tracking student progress post-graduation?
Also advise them to update their Social Security Request Form to:
1.Keep the US Privacy Act of 1974 statement regarding student access to education
2.Include an explicit reason for the request and a complete description regarding the intended use of SSNs.
3.Statement regarding the privacy and security procedures utilized to mitigate the risk of data breaches? “Social security numbers will be kept confidential” is not sufficient response.
4.Statement that outlines how parents/students will be notified of a data security breach and what steps will be taken to remediate the issue by the Maryland State Department of Education.
5.Privacy and rights statement which outlines the parents and child’s rights in accordance to the federal Family Educational Rights and Privacy Act and:
*how to have the number removed from the system if they should no longer want that number associated to the student’s child’s record - including both processes for when the child is a student and when the child is no longer a student of the school system?
*identify the notification procedures with opt out features for parent/student to exercise when data requests or information is to be shared beyond that of the local school, county system or MSDE. “this number will be reported to the Maryland State Department of Education, but will not be released to anyone else without your permission.” Is not a sufficient response.
Indentity theft is real and the risk for data security breaches is high. Protect your children.
Does EPISD Really Need Student's Social Security Numbers?
Published on September 2, 2011
Yale Social Security Numbers Exposed In Latest Case Of 'Google Hacking'
Published August 24, 2011
Computer breach stops state from collecting social security numbers from students Published on Wednesday, Sep 29, 2010
Schools risk theft of SS numbers of children: Many states don’t require collection, but still gather data Published July 25, 2010
Sparta school official accidentally releases Social Security numbers in public records request Published: Wednesday, June 30, 2010
