As previously written about in this blog, student privacy figured prominently in a few campaigns for the Virginia House of Delegates this past Fall. A progressive special interest group utilized Virginia’s Freedom of Information Act to request and receive student identifying information, including cell numbers, from numerous public colleges and universities in Virginia (Roanoke Times). That information was then used by a variety of Democrat campaigns for the House of Delegates to text registration, campaign and “get-out-the-vote” messages to the students in an effort to mobilize them to vote in the November elections.
As a consequence of this tactic, the first bill introduced (House Bill 1) for the 2018 General Assembly legislative session deals with student privacy. The legislation is sponsored by a Republican whose district includes a state university.
Currently, unless a student affirmatively “opts-out,” The Family Education Rights and Privacy Act of 1974 does not prohibit universities and colleges from releasing student directory information provided proper notice was given to the student. Current Virginia law prohibits public institutions of higher education from selling a student’s personal information. See § 23.1-405(C). The statute delineates personal information as name, address, phone number and email address. Id. While Virginia law prohibits the selling of such information, it does not explicitly prohibit releasing the information through Virginia’s Freedom of Information Act.
House Bill 1 changes the current “opt-out” consent scheme to an “opt-in” process. Under the bill, students will need to affirmatively “opt-in” to allow their student directory information to be disclosed by the institution through Virginia’s Freedom of Information Act.
House Bill 1 also amends Virginia law to clarify that “scholastic records” includes student directory information. In October, most of the universities and colleges that received the Freedom of Information Act request produced the requested information, in part, because it was not viewed as a “scholastic record.” The proposed legislation also makes clear that “directory information” includes more than contact information. Specifically, the bill sets forth that directory information also encompasses “date and place of birth, major field of study, participate in officially recognized activities and sports, weight and height as a member of athletic teams, dates of attendance, degrees and awards received, and most recent previous education agency or institution attended.”
The recent major credit bureau breach got the attention of several legislators. Del. Sam Rasoul (D) and Senator Jeremy McPike (D) have introduced legislation (HB 6; SB 38) eliminating the authority of credit bureaus to charge the current $10 fee for a Virginia consumer to freeze her credit report. Under Virginia law, victims of identity theft are not required to pay the credit freeze fee. While “all politics is local,” it appears some legislation is personal. Del. Rasoul was recently a victim of identity theft and he believes is it is connected to the major credit bureau data breach that occurred earlier this year (See Roanoke Times Article). The legislation will be likely be heard in late-January. With the new make-up of the Virginia General Assembly being virtually tied (currently 51 Republicans – 49 Democrats, with four races undergoing a recount) in addition to the breath of the Equifax data breach, the chances of this legislation passing may be higher than in year’s past.
Legislators have until mid-January to introduce legislation and the legislative is expected to end in early-March.
