June 29, 2021, Fairfax County Public Schools (FCPS) breached the privacy of thousands of students attending South County High School, Hayfield Secondary School, Edison High School, West Potomac High School, Lake Braddock Secondary School, and FCPS Online Campus. The breach includes the students’ names, their FCPS identification numbers, their FCPS email addresses, the schools at which they are enrolled, the names of their parents and/or guardians, and the email addresses of their parents and/or guardians.
June 29, 2021, FCPS provided me a thumb drive with documents it stated were in response to FERPA requests I submitted. The thumb drive includes 12 unredacted reports with personally identifiable information related to students and their families. I did not request these reports or any of the personally identifiable information.
Seven of the reports relate to almost 500 South County High School (SCHS) students who appear to be in the class of 2022. These reports include the names of the students and their FCPS email addresses. FCPS email addresses include student identification numbers, which means student IDs were released, too. For example, if a student’s FCPS ID is 12345, his or her FCPS email address would be 12345@fcpsschools.net.
The other five reports appear to be email distribution reports for five emails sent from South County High School. These five reports include thousands of students’ names, their FCPS identification numbers, their FCPS email addresses, the schools at which they are enrolled, the names of their parents and/or guardians, and the email addresses of their parents and/or guardians. The list includes students from other schools, too. Within FCPS, high school students have the option to attend classes at other high schools if those classes aren’t offered at the high school at which the student is enrolled. My assumption is that this type of enrollment at SCHS is why they appear on these reports. South County Principal Gary Morris did not respond to questions about this issue in advance of the publication of this article.
The first 20 pages of one of the five reports appears below. I redacted personally identifiable information in advance of this article being published. The other four reports are similar, but with a different “broadcast name”, date, and so on.
Click on image below to view it at a larger size.
The U.S. Department of Education’s (USDOE) Student Privacy Policy Office (SPPO) has been made aware of this breach.
Per regulations, FCPS is supposed to make parents aware of privacy breaches. If your student is enrolled in a class or classes at South County High School, and you’ve not been contacted by FCPS, please contact FCPS immediately.
If your child’s privacy is breached by FCPS—or whatever school district your child attends—please file a complaint with the SPPO office. Click on this link to access the complaint form.
If you’re aware of any privacy violations, please let me know and I’ll add them to the “FERPA Violation Report Card: Fairfax County Public Schools“,
Related Reading: “South County High School Breaches Student Confidentiality Again” and “FERPA Violation Report Card: Fairfax County Public Schools“
0 comments on “Fairfax County Public Schools Breaches Privacy of Thousands of Students; FERPA Noncompliance Continues”