Security Principle #1: If you don't have the data in the first place, it can't be stolen

Given the fact that data protection measures in most places are sloppy at best, I question sharing this type of information in this manner:

Virginia's public and private colleges and universities soon will be required to submit the names and Social Security numbers of tens of thousands of students they accept each year to state police for cross-checking against sexual offender registries.

Link here.