Family Educational Rights and Privacy Act (FERPA)

20 USC S. 1232g

• Introduction |
• FERPA History |
• Legislative and Regulatory Amendments |
• FERPA Protections |
• What to Do If Your Privacy Is Violated |

Introduction

The FERPA protects the confidentiality of student educational records. The Act applies to any public or private elementary, secondary, or post-secondary school and any state or local education agency that receives federal funds. All public schools and virtually all private schools are covered by FERPA because they receive some sort of federal funding.

The Act has two parts. First, it gives students the right to inspect and review their own education records, request corrections, halt the release of personally identifiable information, and obtain a copy of their institution's policy concerning access to educational records. (20 U.S.C.S. § 1232g(a)). Second, it prohibits educational institutions from disclosing "personally identifiable information in education records" without the written consent of the student, or if the student is a minor, the student's parents. (20 U.S.C.S. § 1232g(b)). Schools that fail to comply with FERPA risk losing federal funding.

However, there are several exceptions that allow the release of student records to certain parties or under certain conditions. Records may be released without the student's consent: (1) to school officials with a legitimate educational interest; (2) to other schools to which a student seeks or intends to enroll; (3) to education officials for audit and evaluation purposes; (4) to accrediting organizations; (5) to parties in connection with financial aid to a student; (6) to organizations conducting certain studies for or on behalf of a school; (7) to comply with a judicial order or lawfully issued subpoena; (8) in the case of health and safety emergencies; and (9) to state and local authorities within a juvenile justice system. (20 U.S.C.S. § 1232g(b)(1)).

In addition, some records maintained by schools are exempt from FERPA, including: (1) records in the sole possession of school officials; (2) records maintained by a law enforcement unit of the educational institution; (3) records of an educational institution's non-student employees; and (4) records on a student who is 18 years of age or older or who attends a post-secondary institution that are maintained by a health professional. (20 U.S.C.S. § 1232g(a)(4)(B)). In addition, FERPA allows, but does not require, schools to release "directory information," including students' names and addresses, to the public. (20 U.S.C.S. § 1232g(a)(5)(A)). However, this exception was modified in 2002, and high schools are now required to provide students' names, addresses and telephone numbers to military recruiters, unless a student or parent opts out of such disclosure.

• Family Educational Rights and Privacy Act, 20 U.S.C.S. § 1232g (Law. Co-op. 2002).
• FERPA Regulations, 34 CFR Part 99.

History

The Family Educational Rights and Privacy Act (FERPA), also commonly referred to as the Buckley Amendment after its principal sponsor Sen. James Buckley, was signed into law by President Ford on August 21, 1974. Traditional legislative history for FERPA as it was first enacted is unavailable because the Act was offered as an amendment on the Senate floor to a bill extending the Elementary and Secondary Education Act of 1965 and was not the subject of committee consideration. Congress offered no opportunity to those affected by FERPA to be heard prior to its enactment. There was no legislative committee study and review nor any public hearings to receive testimony from institutions or individuals. However, in a speech explaining the Act to the Legislative Conference of Parents and Teachers, Senator Buckley said FERPA was adopted in response to "the growing evidence of the abuse of student records across the nation."

Immediately following the enactment of FERPA, higher education officials became alarmed by the Act's possible implications for colleges and universities. They voiced concern about what to do with existing records, such as letters of recommendation for college admissions, which were written under assurances of confidentiality, but open to student inspection under FERPA. These concerns led to major FERPA amendments that were enacted on December 31, 1974. Among other things, the amendments cleared up some of the law's ambiguous language and limited the right of post-secondary students to inspect and review records so that they would not have access to the financial records of their parents or to confidential letters of recommendation placed in their files before January 1, 1975.

The amendments' sponsors, Senator Buckley and Senator Claiborne Pell, also clarified the intent of FERPA by submitting a major source of legislative history for the amendments, the "Joint Statement in Explanation of Buckley/Pell Amendment." In the Joint Statement, the senators emphasized the need for parents to have access to the information contained in student education records in order to protect their children's interests.

• Legislative History of Major FERPA Provisions, Department of Education Family Policy Compliance Office.
• T. Page Johnson, Managing Student Records: The Courts and the Family Educational Rights and Privacy Act of 1974, 79 Ed. L. Rep. 2 (1993).
• Address to the Legislative Conference of the National Congress of Parents and Teachers, March 12, 1975, 121 Cong. Rec. S7974 (daily ed. May 13, 1975).
• Pupil Power, The Economist, Feb. 1, 1975, at 46.

Legislative and Regulatory Amendments

Including the 1974 amendments, FERPA has been amended a total of nine times since its enactment. Through these amendments, Congress and the Department of Education have continually recognized new circumstances under which personally identifiable information contained in education records can be disclosed without the consent of parents or students.

• December 31, 1974: In addition to limiting post-secondary students access to their parents' financial records and to confidential letters of recommendation submitted on the student's behalf prior to Jan. 1, 1975, the amendments strengthened the right of students to a hearing to challenge the content of records they believe are inaccurate, misleading, or otherwise in violation of their privacy or other rights. The amendments also provided an opportunity to correct any inaccurate or misleading information. Finally, the amendments also gave students the right to insert a written explanation regarding the contents of records.
• August 6, 1979: Congress clarified that FERPA does not prohibit state and local educational officials from having access to student or other records that might be necessary in connection with the audit or evaluation of any federal- or state-supported education program. The amendments were enacted to correct an "anomaly" caused by the Department of Education's interpretation of FERPA as precluding state auditors from requesting student records in order to conduct state audits of local and state-supported programs.
• November 8, 1990 (Campus Security Act or Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act): Amendments allowed post-secondary institutions to disclose to the alleged victim of a violent crime the results of any disciplinary proceeding conducted by the institution against the alleged perpetrator of the crime, regardless of the outcome of the proceeding.
• July 23, 1992: FERPA was amended to exempt records created for law enforcement purposes and maintained by law enforcement units of educational institutions from the definition of education records. This means that law enforcement records, such as police crime logs, are not protected from disclosure by FERPA. In fact, the Clery Act requires any educational institution receiving federal funds to keep their police logs available for public inspection during normal business hours.
• October 20, 1994 (Improving America's Schools Act): Amendments extended the right to inspect and review education records maintained by state educational agencies that are not otherwise subject to FERPA.
• October 7, 1998 (Higher Education Amendments of 1998): Congress amended FERPA to clarify that schools may disclose to the public the final results of any disciplinary proceeding in which a student has been found responsible for a crime of violence or nonforcible sex offense. Although FERPA does not require schools to release this information, many public schools may have to release it under their state open-records laws. However, private schools are not required to release this information, and some states' educational privacy laws protect it from disclosure as well. Congress added nonforcible sex offenses to the list of crimes in which the victim is entitled to learn the outcome of any disciplinary proceeding against the perpetrator and clarified that only "final results" of disciplinary proceedings (the name of the student who was found responsible for the offense, the violated committed and the sanction imposed by the school) may be disclosed. Congress also added an amendment that allows post-secondary institutions to inform parents if their child has violated a law or school rule governing the use or possession of alcohol or illegal drugs. This amendment applies to post-secondary students under 21 years old regardless of whether the student is a financial dependent for tax purposes. However, the amendment does not supersede any state laws that may prohibit such disclosure. The regulations issued following the 1998 amendments added two new categories of potential student directory information to the list of information about a student that can be disclosed without his or her consent: photographs and e-mail addresses. The regulations also clarified that student "dates of attendance" that may be released as directory information includes the academic terms during which a student was enrolled, not the student's daily presence in school.
• October 28, 2000: Congress added an amendment clarifying that FERPA does not prohibit educational institutions from disclosing information about registered sex offenders on their campuses. In fact, the Clery Act requires schools beginning in 2003 to notify the campus community about where public information about registered sex offenders on campus may be obtained.
• October 26, 2001 (USA PATRIOT Act): Congress added an amendment allowing the attorney general or a designated representative of the attorney general to request a court order requiring an educational institution to permit the attorney general to collect, retain, disseminate and use education records relevant to an authorized investigation or prosecution of an act of domestic or international terrorism.
• January 8, 2002: Congress made technical corrections to the text of the statute.
• December 9, 2008: The Education Department issued regulations amending the FERPA. These amendments made several significant changes to the FERPA regulations. For example, in light of the Supreme Court decision in Owasso Independent School Dist. No. I011 v. Falvo (534 U.S. 426 (2002)), the regulations exclude "grades on peer-graded papers before they are collected and record by a teacher" from the definition of "education records." The amendments also changed the definition of "personally identifiable information" to include a definition for "biometric record." Under the regulations, biometric information includes "fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting." Additionally, the 2008 regulations permit educational agencies and institutions to disclose education records without consent to "contractors, consultants, volunteers, and other outside parties providing institutional services and functions or otherwise acting for an agency or institution."
• December 2, 2011: The Education Department issued regulations amending FERPA. Among other changes, the regulations reinterpreted the statutory terms "authorized representative," "education program," and "directory information." The regulations defined a previously undefined term, "authorized representative," to include non-governmental actors as "representatives" of state educational institutions. The agency also defined "education program" as any program that is "principally engaged in the provision of education, including, but not limited to early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, regardless of whether the program is administered by an education authority." Under FERPA, authorized representatives have access to "student or other records which may be necessary in connection with the audit and evaluation of Federally-supported education programs." The regulations also authorize schools to publicly disclose student ID numbers that are displayed on individual cards or badges. The regulations went into effect on January 3, 2012.

Protections Offered by FERPA

Parents and Eligible Students

FERPA extends certain privacy rights to parents with regard to their children's education records. These rights transfer to the child when he or she reaches the age of 18, thus becoming a student eligible for rights under FERPA.

Parents have the right to inspect their children's education records, and eligible students have the right to inspect their own education records. A school must accommodate any inspection request within 45 days of receipt.

If a parent or eligible student is circumstantially unable to exercise the right to review the records, the school must provide copies of the records or otherwise make arrangements for the parents or eligible student to inspect the records. A school cannot charge a fee merely to search for a student's records, but may charge a copying fee. Parents and eligible students also have the right to request that education records be amended if the records contain information thought to be inaccurate, misleading, or in violation of the student's privacy. If school denies such a request, parents and eligible students have a right to a hearing to review the school's decision.

Schools are required to inform parents and eligible students of their rights under FERPA. The method of providing such information is left to the discretion of the school. Generally, schools must obtain written consent from parents and eligible students before disclosing any personally identifiable information from a student's education record other than "directory information." But there are many exceptions to this general rule. A school may disclose personally identifiable information from education records without consent under the following circumstances:

• Education records may be disclosed to school officials within the school, such as teachers, who have a legitimate educational interest in the information. It is the school's responsibility to determine when there is a legitimate educational interest. For example, a teacher concerned about a student's performance may have a legitimate educational interest in looking at the student's standardized test scores, but a teacher who just wanted to find out the IQ scores of his or her students probably would not.
• Education records may be disclosed to another school, school district, or post-secondary institution where the student is planning to enroll.
• Education records may be disclosed to representatives of the Comptroller General of the United States, the Attorney General of the United States, the Secretary of the United States Department of Education, or other state or local authorities for purposes of audit or evaluation.
• Education records may be disclosed for purposes related to financial aid for which the student has applied, as long as the information is necessary to make determinations of eligibility for aid, amount or conditions of aid, or enforcement of terms of aid.
• Education records may be disclosed to state or local officials or authorities within a juvenile justice system, as long as the disclosure is made pursuant to a state law.
• Education records may be disclosed to organizations that are conducting studies for educational agencies or institutions in connection with the development or administration of predicative tests or student aid programs, or studies that are intended to improve educational instruction. Such studies must not permit identification of parents or students by anyone other than representatives of the organization. Furthermore, the personally identifiable information must be destroyed when no longer needed for the study.
• Education records may be disclosed to accrediting organizations for purposes of conducting accreditation procedures.
• Education records may be disclosed to the parents of a dependent student as defined by the IRS.
• Education records may be disclosed in connection with a health or safety emergency.
• Education records may be released in compliance with a court order, such as a subpoena, but schools must first make a "reasonable effort" to provide notice to parents or students. In the case of law enforcement or federal grand jury subpoenas, the issuing court or agency may, for good cause, order the school not to disclose the existence or contents of the subpoena or the records released pursuant to the subpoena. However, absent an emergency, schools cannot provide non-directory student information to police without a subpoena.
• Student "directory information" may also be disclosed without the student or parent's consent. Directory information can include the student's name, address, telephone number, date and place of birth, major field of study, dates of attendance, participation in school-sponsored extracurricular activities, height and weight of student athletes, degrees earned, honors and awards earned, the educational institution last attended, photographs and e-mail addresses. Schools do not have to release directory information, but if they do they must give public notice of the categories of information they classify as "directory information." The school must then give parents and eligible students a reasonable amount time to inform the school that they do not want some or all of their directory information disclosed without consent. Since 2002, secondary schools must provide students' names, addresses, and telephone numbers to military recruiters upon request, but must have first given students and parents the opportunity to opt out of such disclosure.

Every school is required to notify parents and eligible students annually of their rights under FERPA. The notice can take any form the institution or agency considers appropriate, but must explain how a parent or eligible student may:

• Exercise the right to review education records.
• Correct inaccurate, misleading, or privacy-violating information in their education records.
• Consent to disclosure of a student's personally identifiable information.
• File a complaint concerning the failure of a school to comply with FERPA's requirements.

Schools are required to maintain a list of all individuals or organizations that have requested or obtained a student's education records. These records can only be accessed by a parent or eligible student, the school official responsible for education records and authorized auditing personnel. This list, which must be kept with the education record to which it pertains, must state the specific interest each requesting party has in the student's information. Third parties who obtain access to student education records must agree not to disclose the information to anyone else without a parent or eligible student's written consent.

Post-Secondary Students

Students enrolled in post-secondary schools are considered eligible students under FERPA and have the right to review their own education records. However, post-secondary students may not review:

• Their parents' financial records.
• Confidential letters of recommendation included in their education records before January 1, 1975.
• Confidential letters of recommendation included in their education records after January 1, 1975, that pertain to the student's admission to the school, application for employment, or receipt of an honor if the student has waived to right to inspect those statements.

The education records of post-secondary students are also less secure. In addition to the circumstances under which personally identifiable information may be disclosed without consent, listed above, post-secondary schools may also disclose:

• The final result of a disciplinary proceeding to the victim of an act of violence or nonforcible sex offense allegedly perpetrated by the subject of the records, regardless of the outcome of the proceeding. Schools may not disclose the names of other students connected with the proceedings, including the victim or any witnesses, without the written consent of those students. Disclosure under this exception may be made only regarding disciplinary proceedings in which a result was reached on or after October 7, 1998.
• The student's violation of a law or school rule pertaining to the use or possession of alcohol or drugs to the student's parent. Such disclosure may be made only when the student is under the age of 21.

What To Do If Your School Has Violated Your Rights Under FERPA:

If you think your or your child's FERPA rights have been violated, you can file a complaint with the Department of Education's Family Policy Compliance Office (FPCO). Complaints should contain specific allegations of fact giving reasonable cause to believe that a violation of the Act or this part has occurred. Complaints must be filed within 180 days of the alleged violation, or at the time the complainant knew of the violation or reasonably should have known of the violation. If you fail to report a violation within this time period, you may request an extension from the FPCO.

After the FPCO receives a complaint, it will then notify the student and the school in writing if it initiates an investigation of the complaint. The notice to the school includes the substance of the alleged violation and asks the school to submit a written response to the complaint. The FPCO will notify the complainant if it does not initiate an investigation of a complaint because the complaint is untimely or otherwise defective.

If the FPCO initiates an investigation, it may permit the parties to submit further written or oral arguments or information. There is no deadline under FERPA for processing complaints, so it may take many months before the FPCO makes a finding. However, once the FPCO concludes its investigation, it will provide to both the complainant and the school written notice of its findings and the basis for its findings.

If the FPCO finds that the school has violated FERPA, it will include in its findings a statement of the specific steps the school must take to comply and provide a reasonable period of time during which the school may voluntarily comply. If the school does not comply during the time period set out by the FPCO, the Secretary of the Department of Education may withhold payments to the school under any applicable federal program, issue a complaint to compel compliance through a cease-and-desist order, or terminate the school's eligibility to receive federal funding. If the Secretary finds that an educational agency or institution has complied voluntarily, the Secretary will provide the complainant and the school written notice of the decision and its basis for the decision.

• Department of Education's Family Policy Compliance Office (FPCO).

No Private Cause of Action

Courts are unanimous in holding that FERPA does not provide the right to file a private lawsuit to challenge alleged violations. The Supreme Court held in June 2002 that students may not file a Section 1983 civil rights action against a school for alleged FERPA violations because the Act's nondisclosure provisions did not create any enforceable rights.