Show
FERPA governs the confidentiality of student educational records.
The Family Educational and Privacy Rights Act (FERPA) protects the confidentiality of student educational records. It applies to any public or private elementary, secondary, or post-secondary school and any state or local education agency that receives federal funds under a program administered by the Secretary of Education. The Act has two parts. First, it gives students the right to inspect and review their own education records, request corrections, halt the release of personally identifiable information, and obtain a copy of their institution’s policy concerning access to educational records. (20 U.S.C.S. § 1232g(a)). Second, it prohibits educational institutions from disclosing “personally identifiable information in education records” without the written consent of the student, or, if the student is a minor, the student’s parents. (20 U.S.C.S. § 1232g(b)). Schools that fail to comply with FERPA risk losing federal funding. However, there are several exceptions that allow the release of student records to certain parties or under certain conditions. Records may be released without the student’s consent: (1) to school officials with a legitimate educational interest; (2) to other schools to which a student seeks or intends to enroll; (3) to education officials for audit and evaluation purposes; (4) to accrediting organizations; (5) to parties in connection with financial aid to a student; (6) to organizations conducting certain studies for or on behalf of a school; (7) to comply with a judicial order or lawfully issued subpoena; (8) in the case of health and safety emergencies; and (9) to state and local authorities within a juvenile justice system. (20 U.S.C.S. § 1232g(b)(1)). In addition, some records maintained by schools are exempt from FERPA, including: (1) records in the sole possession of school officials; (2) records maintained by a law enforcement unit of the educational institution; (3) records of an educational institution’s non-student employees; and (4) records on a student who is 18 years of age or older or who attends a post-secondary institution that are maintained by a health professional. (20 U.S.C.S. § 1232g(a)(4)(B)). In addition, FERPA allows, but does not require, schools to release “directory information,” including students’ names and addresses, to the public. (20 U.S.C.S. § 1232g(a)(5)(A)). However, this exception was modified in 2002, and high schools are now required to provide students’ names, addresses and telephone numbers to military recruiters, unless a student or parent opts out of such disclosure. HistoryThe Family Educational Rights and Privacy Act (FERPA), also commonly referred to as the Buckley Amendment after its principal sponsor Sen. James Buckley, was signed into law by President Ford on August 21, 1974. Traditional legislative history for FERPA as it was first enacted is unavailable because the Act was offered as an amendment on the Senate floor to a bill extending the Elementary and Secondary Education Act of 1965, meaning it was not the subject of committee consideration and there were no public hearings to receive testimony from institutions or individuals. In a speech explaining the Act to the Legislative Conference of Parents and Teachers, Senator Buckley said FERPA was adopted in response to “the growing evidence of the abuse of student records across the nation.” Senator Buckley and Senator Claiborne Pell also clarified the intent of FERPA by submitting a major source of legislative history for amendments debated and enacted later that year, the “Joint Statement in Explanation of Buckley/Pell Amendment.” In the Joint Statement, the senators emphasized the need for parents to have access to the information contained in student education records in order to protect their children’s interests. Legislative and Regulatory AmendmentsFERPA has been amended a total of eleven times since its enactment. Through these amendments, Congress and the Department of Education have continually recognized new circumstances under which personally identifiable information contained in education records can be disclosed without the consent of parents or students.
Protections Offered by FERPAParents and Eligible StudentsFERPA extends certain privacy rights to parents with regard to their children’s education records. These rights transfer to the child when he or she reaches the age of 18, thus becoming a student eligible for rights under FERPA. Parents have the right to inspect their children’s education records, and eligible students have the right to inspect their own education records. A school must accommodate any inspection request within 45 days of receipt. If a parent or eligible student is circumstantially unable to exercise the right to review the records, the school must provide copies of the records or otherwise make arrangements for the parents or eligible student to inspect the records. A school cannot charge a fee merely to search for a student’s records, but may charge a copying fee. Parents and eligible students also have the right to request that education records be amended if the records contain information thought to be inaccurate, misleading, or in violation of the student’s privacy. If a school denies such a request, parents and eligible students have the right to a hearing to review the school’s decision. Schools are required to inform parents and eligible students of their rights under FERPA. The method of providing such information is left to the discretion of the school. Generally, schools must obtain written consent from parents and eligible students before disclosing any personally identifiable information from a student’s education record, other than “directory information.” But there are many exceptions to this general rule. A school may disclose personally identifiable information from education records without consent under the following circumstances:
Every school is required to notify parents and eligible students annually of their rights under FERPA. The notice can take any form the institution or agency considers appropriate, but must explain how a parent or eligible student may:
Schools are required to maintain a list of all individuals or organizations that have requested or obtained a student’s education records. These records can only be accessed by a parent or eligible student, the school official responsible for education records, and authorized auditing personnel. This list, which must be kept with the education record to which it pertains, must state the specific interest each requesting party has in the student’s information. Third parties who obtain access to student education records must agree not to disclose the information to anyone else without a parent or eligible student’s written consent. Post-Secondary StudentsStudents enrolled in post-secondary schools are considered eligible students under FERPA and have the right to review their own education records. However, post-secondary students may not review:
The education records of post-secondary students are also less secure. In addition to the circumstances under which personally identifiable information may be disclosed without consent, listed above, post-secondary schools may also disclose:
FERPA AND THE COVID-19 PANDEMICFERPA defines “education records” as records that are directly related to a student and that are maintained by an educational agency or institution, or by a party acting for the agency or institution (20 U.S.C. § 1232g(a)(4); 34 C.F.R. § 99.3, “Education records.”). Accordingly, immunization records and other health records are classified as “education records” under FERPA. FERPA generally prohibits schools from disclosing personally identifiable information from student education records without prior consent from a parent or “eligible student.” However, in the case of the COVID-19 pandemic, a “health or safety emergency” exception applies to FERPA’s general consent rule. This exception enables educational agencies and institutions to disclose personally identifiable information from student education records to appropriate parties in connection with the emergency without prior consent—given that the party’s knowledge of the information is necessary to protect the health or safety of students or other individuals (20 U.S.C. § 1232g(b)(1)(I); 34 C.F.R. §§ 99.31(a)(10) and 99.36). Examples of appropriate parties in a health or safety emergency include public health officials, trained medical personnel, and other parties who provide medical or safety attention. The determination of an “emergency” is left to the discretion of local authorities and educational agencies or institutions themselves and is a flexible standard that may differ from case to case. However, if a disclosure is made under the health or safety emergency exception, the educational agency or institution must note in the affected students’ education records both the articulable and significant threat that formed the basis for its disclosure, and the parties to whom the students’ information was disclosed. Exposure NotificationIf a student at a school has been determined to have COVID-19, the school is permitted to notify parents and eligible students of a potential risk. Typically, it should be sufficient for a school to simply report that a student in the school community has been infected with COVID-19, without also identifying or naming the specific individual. If disclosing identifiable information about a student is necessary to protect the safety of other individuals, such as those that may have been in direct contact with an infected student, school officials should make a decision on a case-by-case basis. What To Do If Your School Has Violated Your Rights Under FERPA:
If you think your or your child’s FERPA rights have been violated, you may first seek resolution from your school or school district. You can also file a complaint here with the Department of Education’s Student Privacy Policy Office (SPPO). Complaints should contain specific allegations of fact giving reasonable cause to believe that a violation of the Act or this part has occurred. Complaints must be filed within 180 days of the alleged violation, or at the time the complainant knew of the violation or reasonably should have known of the violation. If you fail to report a violation within this time period, you may request an extension from the SPPO. U.S. Department of Education: FERPA’s Complaint Process Explained
No Private Cause of ActionCourts are unanimous in holding that FERPA does not provide the right to file a private lawsuit to challenge alleged violations. The Supreme Court held in June 2002 that students may not file a Section 1983 civil rights action against a school for alleged FERPA violations because the Act’s nondisclosure provisions did not create any enforceable rights. EPIC’S WORK ON FERPAEPIC believes that the 2008 and 2011 amendments to FERPA caused students, parents, and schools to lose substantial control of student information, fostering the current environment of educational data flowing nearly unrestricted from schools to third parties. A review of the websites of 752 local education agencies (LEAs) conducted by the Student Privacy Policy Office at the U.S. Department of Education between 2018 and 2020 also found issues with transparency around FERPA. While 54% of the LEAs reviewed had the FERPA Annual Notice posted on their websites, only 12% of the websites also included navigation menus with information on where to find data practices and student privacy information, and only 7% of websites included LEA contact information for any parents or students with questions about data sharing student privacy. New technologies are also routinely being deployed in classrooms without meaningful accountability, oversight, and transparency. EPIC has a particular interest in protecting student privacy and has worked in this field for many years. In the past, EPIC has urged Congress to strengthen FERPA, filed complaints with the Federal Trade Commission on behalf of student consumers, created a “Student Privacy Bill of Rights,” and more. |