University Business - October 2006 - (Page 32)

VIEWPOINT Virginia Schools in a Privacy Pickle A well-intentioned state law raises significant data privacy risks for institutions and their students. By William Nolan E employee negligence or hackers aided by FFECTIVE JULY 1, VIRGINIA inadequate safeguards. higher education institutions have Thus, institutions should create and been required to electronically store personal data only where they must transmit to Virginia state police the fol- and transmit it on a strict need-to-know lowing on each accepted applicant: name; basis first obtaining contractual safe- Social Security or other identifying num- guards from the receiving party about their ber ; date of birth; and gender. handling of the information and putting in The reasoning behind the requirement place internal processes to help protect it. is unquestionably good. It's just one statu- The Virginia legislature has created a tory change to help protect Virginia citi- multiple-step process for personal data. zens from sex offenders. The statute directs The Social Security numbers will travel the police to compare the information Students would want to each step of the way, likely housed on yet with sex offender registries. Law enforce- another computer during each step, in- ment officials indicate that they'll notify know that a convicted creasing the likelihood that the data will the institutions of any matches and keep sex offender lives next become the subject of tomorrow's newspa- tabs on the individuals. door in their dorm. per story on personal data theft or loss. Few students would not want to know The worst-case scenario for educational that a convicted sex offender lives in the institutions: In the additional steps on their and there's no reason to doubt that they'll dorm room next door. However, the law end, they will misstep and subject them- try. After the data has been crosschecked, puts IHEs in the middle of a situation that selves to a class-action lawsuit for negligent we are told it will be duly destroyed. creates increased risk of loss or theft of per- handling of the data on its way to police. sonal information and, ultimately, poten- Given the attention to identity theft, we VIGILANCE NOT ENOUGH tial mass identify theft of all applicants. It are likely to see extensive federal and state The question is not the motives of legisla- at least raises the question of whether the legislative activity in the months and years tors or law enforcement officials. The hard same objectives could be achieved with less ahead, as we struggle to harness the great fact is that situations where thousands and risk to individuals and institutions. electronic powers we have created against sometimes millions of individuals' per- Does an institution really have to release this unintended side effect. We will also see sonal data has been stolen, lost, or exposed Social Security numbers? In a clever piece increasingly sophisticated internal tools to appear in the media constantly. Sometimes of statutory drafting, the general assembly protect data, as entities become more vigi- identities are stolen and as the Citibank requires the information to be transmit- lant in their data-protection efforts in order television ads demonstrate when they ted before the accepted applicants become to avoid liability. In that environment, the are, lives are made miserable. Where iden- students in attendance, subject to the law that creates rather than diminishes tities are not stolen, the potential victims federal Family Educational Rights and Pri- chances for data theft will be very unusual. are left to live in fear, repeatedly checking vacy Act FERPA information transmis- It seems appropriate to ask all state legis- their account activity and credit scores in sion restrictions. Since the law also does lators to strive for solutions that address hopes that they will not become a charac- not define other identifying number, it these serious threats to citizens. ter in those advertisements. seems the law requires that IHEs cull So- Few incidents are the result of ill inten- cial Security numbers from applications tions on the part of data keepers. The more and transmit them to the police. William Nolan is a partner in the Columbus, data is created, replicated, and transmitted, Law enforcement officials say they'll Ohio, office of the law firm Squire, Sanders & Dempsey, www.ssd.com. the more likely it is to be exposed due to take appropriate steps to protect the data, 32 | October 2006 universitybusiness.com Vwpt.indd 32 9/21/06 9:51:51 AM http://www.ssd.com http://www.universitybusiness.com

Table of Contents for the Digital Edition of University Business - October 2006

Contents
College Index
Company Index
Advisory Board
Editor's Note
Behind the News
Marketing
Future Shock
Admissions
Viewpoint
Financial Aid
On the Hill
Beyond Baldrige
Made in America
Wiring the Dining Experience
Lighting The Way
Internet Technology
What's New
Calendar of Events
Direct Connect
End Note

University Business - October 2006