By Michael D. Shear and Rosalind S. Helderman
Washington Post Staff Writers
Tuesday, June 20, 2006
RICHMOND, June 19 -- Virginia's public and private colleges and universities soon will be required to submit the names and Social Security numbers of tens of thousands of students they accept each year to state police for cross-checking against sexual offender registries.
The little-noticed but groundbreaking law is raising concerns among privacy experts about giving police access to a vast new database of student information. They say the data could be stored permanently on hard drives and mishandled, stolen or used for unrelated homeland security or law enforcement purposes.
Passed this year as part of a crackdown on sex crimes and signed by Gov. Timothy M. Kaine (D), the law also requires Department of Motor Vehicles officials to turn over personal information to police any time a Virginian applies for a license or change of address. It goes into effect July 1.
State police officials say they do not plan to retain the student data for long periods, but the provisions will give law enforcement authorities yearly access to information on tens of thousands of students that they must now request on a case-by-case basis when a crime is committed.
The Virginia law skirts federal prohibitions on disseminating student information by requiring colleges to turn over data after students have been accepted but before they have picked a school and enrolled. Advocates said it will help police track the whereabouts of those who have committed sex crimes and alert college authorities to the presence of such people among students.
"I've got two kids in college right now," said Kenneth W. Stolle (R-Virginia Beach), the bill's chief sponsor in the state Senate. "You're going to have a . . . hard time explaining to me why my daughter is living next door to a sexual offender. My guess is every parent out there would have the same expectation that I do."
The bill's provisions represent the latest attempt by authorities nationwide to use modern data collection techniques to foil criminal behavior. In 2002, for example, the Patriot Act required banks to monitor transactions by their customers after the Sept. 11, 2001, terrorist attacks.
State DMVs have long shared driver data with tax officials and routinely allow police to make requests for individual driver data. Officials said the new law is one of the few times that personal identification information automatically will be turned over to law enforcement.
Critics of the law say the information about student applicants from Virginia and across the nation is at risk. In May, a laptop containing the Social Security numbers of as many as 2.2 million veterans, including 80 percent of the nation's active-duty forces, was stolen from a Maryland home.
"It blows the privacy standards away," said Michael Froomkin, a law professor and privacy specialist at the University of Miami. "People ought to be concerned because you never know where your data is going to end up."
Froomkin and others noted that tracking sexual offenders is an important goal. But they said it can be done without casting such a wide net for information. And they questioned whether the information would someday end up being mined for other purposes.
"This is basically providing personal information to the state police for the purpose of conducting a background check on thousands of innocent students with no indication of any wrongdoing on their part," said David Sobel, a D.C. lawyer who specializes in privacy law.
Col. W. Steven Flaherty, superintendent of the Virginia State Police, said the department has no intention of keeping information about students unless an applicant appears on the sexual offender registry. In Virginia, the registry contains about 13,000 names of those convicted of such crimes as statutory rape and child sex abuse.
Authorities use the registry and a similar national one to track the movements of such felons who have served their time and moved back into society.
"Essentially, this information comes to us. We bounce it against the sex offender registry. If we don't get a hit, we don't keep the information," Flaherty said.
Not a single lawmaker in Virginia voted against House Bill 984, primarily designed to stiffen the penalties for sex crimes and add convicted nonviolent offenders to the publicly available registry. Some said they did not recall discussion about the provisions related to information sharing.
"That should have been more closely scrutinized," Senate Minority Leader Richard L. Saslaw (D-Fairfax) said. Student data "shouldn't be handed over willy-nilly like that. I don't know how that slipped through," he said.
The law requires colleges to transmit the information about students before they are enrolled and covered by the federal law known as the Family Educational Rights and Privacy Act.
"It's candidly quite a shock," said Barmak Nassirian, associate executive director of the American Association of Collegiate Registrars and Admissions Officers. "I'm not aware of any other similar release of private information."
Representatives of Virginia's colleges met Monday with state police to determine the proper format for delivering the information and to develop detailed guidelines.
College officials said they are still unsure exactly how the system will work.
"Whether we have concerns about this or not, it's the law," said Jeff Hannah, a spokesman for the University of Virginia.
Stolle said federal law does not allow state police to keep the student data indefinitely.
"You can't stop protecting people because you're afraid that efforts . . . are going to be abused," he said. "I think the benefits outweigh the inconveniences."