On November 1, 2023, an article was published revealing that certain information of FCPS students was accessible to, and acquired by, a parent during an in-person Family Educational Rights and Privacy Act (“FERPA”) review of records related to her own children.  On the same day, November 1, 2023, FCPS Superintendent Dr. Michelle C. Reid retained privacy law specialists at the law firm Woods Rogers Vandeventer Black PLC (“Woods Rogers”), to conduct an independent investigation of the incident and make recommendations on subsequent measures FCPS could take to guard against future incidents.  

During the course of its investigation, Woods Rogers conducted numerous witness interviews of FCPS personnel.  Woods Rogers was given open and direct access by FCPS to any requested records and FCPS personnel to conduct its independent investigation.  As a part of its independent investigation, Woods Rogers also engaged a nationally recognized cybersecurity forensic firm to assist in its investigation by conducting a forensic examination of a laptop utilized by the parent during the inspection. 

Key Findings of Fact 

The independent investigation ultimately concluded that a unique set of circumstances led to the inadvertent disclosure.  Despite preplanning for this unusual review, it appears that this incident occurred because older thumb drives containing unredacted files pulled to respond to the parent’s prior FERPA requests were unintentionally and unknowingly left within boxes accessible to the parent during her in‑person review, who copied the files and removed them from FCPS property. 

Remedial Recommendations 

The independent investigation found that certain remedial changes to the organizational structure and processes of FCPS would help protect FCPS from an event like this occurring in the future.

The Independent Investigation recommended the following:

• FERPA response related changes, including direct oversight of any in-person or nonstandard review by the Office of Division Counsel and direct review by attorneys, indexing, and labeling of all files made available prior to inspection.
• Training related changes, including additional training and education for all school-based administrators, Special Education Staff and Department of Special Services staff, regarding the importance of redacting and safeguarding confidential information and review and training on FCPS’ incident response plan. 
• Organizational structure related changes, to include placing Public Records (which includes the FERPA/FOIA office) and the Procedurals Department of Special Services, under the supervision of the Office of Division Counsel, to ensure attorney oversight of any administrative legal proceedings that may impact the rights of FCPS constituents. 

Next Steps:

Dr. Reid has directed staff to implement all recommendations of the independent investigation.  Once implemented, we are confident these new procedures, training requirements, and supervisory changes will help us prevent an incident like this from occurring in the future.  We remain committed to safeguarding personal information and will continue to evaluate additional actions to strengthen privacy protections for our students and the data with which we are entrusted.