ANNAPOLIS — The cost of identity protection services is a small price for Maryland to pay to protect the future of students whose personal information is stolen, Delegate David E. Vogt III told a House committee on Tuesday.
Vogt, R-District 4, presented his Student Identity Protection Act to the House Ways and Means Committee on Tuesday afternoon.
The bill requires the State Board of Education to provide identity protection and credit monitoring services for at least five years to any current or former student whose personal information has been compromised by a breach of a public school’s or local school system’s computer systems.
It was developed in response to the recently revealed theft of the personal information of about 1,000 former Fredrick County Public Schools students.
The breach occurred before 2010 and affected students who attended FCPS between November 2005 and November 2006.
The names, Social Security numbers, and birth dates of the roughly 1,000 students are listed on a website as part of an offer to sell similar information for 20,000 people.
Disclosure of personally identifiable information by a public school or a local board of education is not specifically addressed in state law, but the Family Educational Rights and Privacy Act requires federally funded schools to protect the privacy of student and family information.
Under state law, public schools are prohibited from using Social Security numbers on student and teacher identification cards, but there is no prohibition on storing that information.
FCPS no longer collects students’ Social Security numbers, according to a legislative analysis.
The school system has developed new policies in the event of future data breaches and is providing credit monitoring and identity restoration services for 24 months at no cost to the former students. The school system has a contract with the New York City-based risk consulting firm Kroll, which charges FCPS $15.60 per year for each person who uses the services.
Legislative analysts estimate that the state would pay $20 per month, or $240 a year, for credit monitoring and identity protection services following data breaches in the state.
Vogt’s bipartisan bill is co-sponsored by 25 other delegates, including four members of the Ways and Means Committee and two other members of the Frederick County delegation: delegates William Folden, R-District 3B, and Karen Lewis Young, D-District 3A.
Vogt was the only witness to speak at Tuesday’s hearing, but the Maryland Parent Teacher Association submitted written testimony in support of the measure.
“Passing this legislation is the least the State of Maryland can do upon realizing that the students whom we have trained and educated have been victimized by identity theft,” wrote Elizabeth Ysla Leight, president of the Maryland PTA.