ANNAPOLIS — The cost of identity protection services is a small price for Maryland to pay to protect the future of students whose personal information is stolen, Delegate David E. Vogt III told a House committee on Tuesday.

Vogt, R-District 4, presented his Student Identity Protection Act to the House Ways and Means Committee on Tuesday afternoon.

The bill requires the State Board of Education to provide identity protection and credit monitoring services for at least five years to any current or former student whose personal information has been compromised by a breach of a public school’s or local school system’s computer systems.

It was developed in response to the recently revealed theft of the personal information of about 1,000 former Fredrick County Public Schools students.

The breach occurred before 2010 and affected students who attended FCPS between November 2005 and November 2006.

The names, Social Security numbers, and birth dates of the roughly 1,000 students are listed on a website as part of an offer to sell similar information for 20,000 people.

Disclosure of personally identifiable information by a public school or a local board of education is not specifically addressed in state law, but the Family Educational Rights and Privacy Act requires federally funded schools to protect the privacy of student and family information.

Under state law, public schools are prohibited from using Social Security numbers on student and teacher identification cards, but there is no prohibition on storing that information.

FCPS no longer collects students’ Social Security numbers, according to a legislative analysis.

The school system has developed new policies in the event of future data breaches and is providing credit monitoring and identity restoration services for 24 months at no cost to the former students. The school system has a contract with the New York City-based risk consulting firm Kroll, which charges FCPS $15.60 per year for each person who uses the services.

Legislative analysts estimate that the state would pay $20 per month, or $240 a year, for credit monitoring and identity protection services following data breaches in the state.

Vogt’s bipartisan bill is co-sponsored by 25 other delegates, including four members of the Ways and Means Committee and two other members of the Frederick County delegation: delegates William Folden, R-District 3B, and Karen Lewis Young, D-District 3A.

Vogt was the only witness to speak at Tuesday’s hearing, but the Maryland Parent Teacher Association submitted written testimony in support of the measure.

“Passing this legislation is the least the State of Maryland can do upon realizing that the students whom we have trained and educated have been victimized by identity theft,” wrote Elizabeth Ysla Leight, president of the Maryland PTA.

Follow Danielle E. Gaines on Twitter: @danielleegaines.

Danielle E. Gaines covers politics and government in Frederick County, splitting her time between Winchester Hall and The State House. Having grown up in Illinois, she lived in New York and California before settling in Maryland.

(4) comments


It is hard to take Vogt seriously on data security when his staffer was living in his basement while running a fake news site during the 2016 election.


Another state government mandate from a so-called limited government conservative.


So you are saying that the students whose identity was stolen from their school records should just have to suck it up and bear the costs for someone else's negligence for political ideology sake? Put yourself in those students and their families shoes.


Nope simply saying those school systems will likely give protection to any impacted by hacking. Why does it have to be a government mandate?

Welcome to the discussion.

Keep it clean. Please avoid obscene, vulgar, lewd, racist or sexually-oriented language.
Engage ideas. This forum is for the exchange of ideas, insights and experiences, not personal attacks. Ad hominen criticisms are not allowed. Focus on ideas instead.
Don't threaten. Threats of harming another person will not be tolerated.
Be truthful. Don't knowingly lie about anyone or anything.
Be nice. No racism, sexism or any sort of -ism that is degrading to another person.
No trolls. Off-topic comments and comments that bait others are not allowed.
No spamming. This is not the place to sell miracle cures.
Say it once. No repeat or repetitive posts, please.
Help us. Use the 'Report' link on each comment to let us know of abusive posts.