Family Educational Rights and Privacy Act (FERPA)

The Family Educational and Privacy Rights Act (FERPA) protects the confidentiality of student educational records. It applies to any public or private elementary, secondary, or post-secondary school and any state or local education agency that receives federal funds under a program administered by the Secretary of Education. 

The Act has two parts. First, it gives students the right to inspect and review their own education records, request corrections, halt the release of personally identifiable information, and obtain a copy of their institution’s policy concerning access to educational records. (20 U.S.C.S. § 1232g(a)). Second, it prohibits educational institutions from disclosing “personally identifiable information in education records” without the written consent of the student, or, if the student is a minor, the student’s parents. (20 U.S.C.S. § 1232g(b)). Schools that fail to comply with FERPA risk losing federal funding.

However, there are several exceptions that allow the release of student records to certain parties or under certain conditions. Records may be released without the student’s consent: (1) to school officials with a legitimate educational interest; (2) to other schools to which a student seeks or intends to enroll; (3) to education officials for audit and evaluation purposes; (4) to accrediting organizations; (5) to parties in connection with financial aid to a student; (6) to organizations conducting certain studies for or on behalf of a school; (7) to comply with a judicial order or lawfully issued subpoena; (8) in the case of health and safety emergencies; and (9) to state and local authorities within a juvenile justice system. (20 U.S.C.S. § 1232g(b)(1)).

In addition, some records maintained by schools are exempt from FERPA, including: (1) records in the sole possession of school officials; (2) records maintained by a law enforcement unit of the educational institution; (3) records of an educational institution’s non-student employees; and (4) records on a student who is 18 years of age or older or who attends a post-secondary institution that are maintained by a health professional. (20 U.S.C.S. § 1232g(a)(4)(B)). In addition, FERPA allows, but does not require, schools to release “directory information,” including students’ names and addresses, to the public. (20 U.S.C.S. § 1232g(a)(5)(A)). However, this exception was modified in 2002, and high schools are now required to provide students’ names, addresses and telephone numbers to military recruiters, unless a student or parent opts out of such disclosure.

• Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g (Law. Co-op. 2002).
• FERPA Regulations, 34 CFR Part 99.

History

The Family Educational Rights and Privacy Act (FERPA), also commonly referred to as the Buckley Amendment after its principal sponsor Sen. James Buckley, was signed into law by President Ford on August 21, 1974. Traditional legislative history for FERPA as it was first enacted is unavailable because the Act was offered as an amendment on the Senate floor to a bill extending the Elementary and Secondary Education Act of 1965, meaning it was not the subject of committee consideration and there were no public hearings to receive testimony from institutions or individuals.  In a speech explaining the Act to the Legislative Conference of Parents and Teachers, Senator Buckley said FERPA was adopted in response to “the growing evidence of the abuse of student records across the nation.”

Senator Buckley and Senator Claiborne Pell also clarified the intent of FERPA by submitting a major source of legislative history for amendments debated and enacted later that year, the “Joint Statement in Explanation of Buckley/Pell Amendment.” In the Joint Statement, the senators emphasized the need for parents to have access to the information contained in student education records in order to protect their children’s interests.

• Legislative History of Major FERPA Provisions, Department of Education Family Policy Compliance Office.

Legislative and Regulatory Amendments

FERPA has been amended a total of eleven times since its enactment. Through these amendments, Congress and the Department of Education have continually recognized new circumstances under which personally identifiable information contained in education records can be disclosed without the consent of parents or students.

• 1974 amendments: Following the enactment of FERPA, higher education officials became alarmed by the Act’s possible implications for colleges and universities. They voiced concerns about existing records, such as letters of recommendation for college admissions, that were written under assurances of confidentiality but would be open to student inspection under FERPA. This led to the December 1974 amendments. Among other things, the amendments cleared up some of the law’s ambiguous language and limited the right of post-secondary students to inspect and review records so that they would not have access to the financial records of their parents, or to confidential letters of recommendation placed in their files before January 1, 1975. The amendments also provided an opportunity for students to correct any inaccurate or misleading information, and they strengthened the right of students to a hearing to challenge the content of records they believe are inaccurate, misleading, or otherwise in violation of their privacy or other rights. Finally, the amendments gave students the right to insert a written explanation regarding the contents of records.
• 1979 amendments: Congress clarified that FERPA does not prohibit state and local educational officials from having access to student or other records that might be necessary in connection with the audit or evaluation of any federal- or state-supported education program. The amendments were enacted to correct an “anomaly” caused by the Department of Education’s interpretation of FERPA as precluding state auditors from requesting student records in order to conduct state audits of local and state-supported programs.
• 1990 amendments: Amendments to FERPA were enacted in 1990 as part of the Campus Security Act, or Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act. Amendments allowed post-secondary institutions to disclose to the alleged victim of a violent crime the results of any disciplinary proceeding conducted by the institution against the alleged perpetrator of the crime, regardless of the outcome of the proceeding.
• 1992 amendments: FERPA was amended to exempt records created for law enforcement purposes and maintained by law enforcement units of educational institutions from the definition of education records. This means that law enforcement records, such as police crime logs, are not protected from disclosure by FERPA. In fact, the Clery Act requires any educational institution receiving federal funds to keep their police logs available for public inspection during normal business hours.
• 1994 amendments: Amendments enacted as part of the Improving America’s Schools Actextended the right to inspect and review education records maintained by state educational agencies that are not otherwise subject to FERPA.
• 1998 amendments: Congress amended FERPA as part of the Higher Education Amendments of 1998 to clarify that schools may disclose to the public the final results of any disciplinary proceeding in which a student has been found responsible for a crime of violence or nonforcible sex offense. Although FERPA does not require schools to release this information, many public schools may have to release it under their state open-records laws. However, private schools are not required to release this information, and some states’ educational privacy laws protect it from disclosure as well. Congress added nonforcible sex offenses to the list of crimes in which the victim is entitled to learn the outcome of any disciplinary proceeding against the perpetrator and clarified that only “final results” of disciplinary proceedings (the name of the student who was found responsible for the offense, the violation committed, and the sanction imposed by the school) may be disclosed. Congress also added an amendment that allows post-secondary institutions to inform parents if their child has violated a law or school rule governing the use or possession of alcohol or illegal drugs. This amendment applies to post-secondary students under 21 years old, regardless of whether the student is a financial dependent for tax purposes. However, the amendment does not supersede any state laws that may prohibit such disclosure. The regulations issued following the 1998 amendments added two new categories of potential student directory information to the list of information about a student that can be disclosed without his or her consent: photographs and e-mail addresses. The regulations also clarified that student “dates of attendance” that may be released as directory information includes the academic terms during which a student was enrolled, not the student’s daily presence in school.
• 2000 amendments: Congress added an amendment clarifying that FERPA does not prohibit educational institutions from disclosing information about registered sex offenders on their campuses. In fact, beginning in 2003, the Clery Act required schools  to notify the campus community about where public information about registered sex offenders on campus may be obtained.
• 2001 amendments: As part of the PATRIOT Act, Congress added an amendment allowing the attorney general or a designated representative of the attorney general to request a court order requiring an educational institution to permit the attorney general to collect, retain, disseminate and use education records relevant to an authorized investigation or prosecution of an act of domestic or international terrorism.
• 2002 amendments: Congress made technical corrections to the text of the statute.
• 2008 regulations: In 2008, the Education Department issued FERPA regulations. In light of the Supreme Court decision in Owasso Independent School Dist. No. I011 v. Falvo (534 U.S. 426 (2002)), the regulations exclude “grades on peer-graded papers before they are collected and record by a teacher” from the definition of “education records.” The amendments also changed the definition of “personally identifiable information” to include a definition for “biometric record.” Under the regulations, biometric information includes “fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting.” Additionally, the 2008 regulations permit educational agencies and institutions to disclose education records without consent to “contractors, consultants, volunteers, and other outside parties providing institutional services and functions or otherwise acting for an agency or institution.”
• 2011 regulations: In 2011, the Education Department issued FERPA regulations. Among other changes, the regulations reinterpreted the statutory terms “authorized representative,” “education program,” and “directory information.” The regulations defined a previously undefined term, “authorized representative,” to include non-governmental actors as “representatives” of state educational institutions. The agency also defined “education program” as any program that is “principally engaged in the provision of education, including, but not limited to early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, regardless of whether the program is administered by an education authority.” Under FERPA, authorized representatives have access to “student or other records which may be necessary in connection with the audit and evaluation of Federally-supported education programs.” The regulations also authorize schools to publicly disclose student ID numbers that are displayed on individual cards or badges. The regulations went into effect on January 3, 2012.
• 2010 amendments: In the Healthy, Hunger-Free Kids Act of 2010, Congress amended FERPA to, under certain conditions, permit educational agencies and institutions to disclose personally identifiable information from students’ education records to the Secretary of Agriculture or authorized representatives of the Food and Nutrition Service for the purpose of conducting program monitoring, evaluations, and performance measurements of programs authorized under the Richard B. Russell National School Lunch Act of 1946 or the Child Nutrition Act of 1966 (See 20 U.S.C. 1232g(b)(1)(K)).
• 2013 amendments: In the Uninterrupted Scholars Act of 2013, Congress amended FERPA to permit educational agencies and institutions to disclose personally identifiable information from the education records of a student in foster care to an agency caseworker or other representative of a State or local child welfare agency or tribal organization that is authorized to access a student’s case plan, when said agency or organization is legally responsible for the care and protection of the student (See 20 U.S.C. 1232g(b)(1)(L)). The Act also amended the exception to FERPA’s general consent rule that allows schools to disclose personally identifiable information from students’ education records without consent if the disclosure is necessary to comply with a judicial order or lawfully issued subpoena. FERPA had generally required schools to make a reasonable effort to notify affected parents or eligible students before complying with an order or subpoena, in order to give the parent or eligible student the opportunity to seek to quash the order or subpoena, or to seek protective action. The Act amended this notification requirement by adding an exception stating that schools do not have to notify a parent if the court had already given the parent notice as a party in specified types of court proceedings unless the parent is a party to a court proceeding involving child abuse and neglect or dependency matters, and the order is issued in the context of that proceeding. (See 20 U.S.C. 1232g (b)(2)(B)).

Protections Offered by FERPA

Parents and Eligible Students

FERPA extends certain privacy rights to parents with regard to their children’s education records. These rights transfer to the child when he or she reaches the age of 18, thus becoming a student eligible for rights under FERPA.

Parents have the right to inspect their children’s education records, and eligible students have the right to inspect their own education records. A school must accommodate any inspection request within 45 days of receipt.

If a parent or eligible student is circumstantially unable to exercise the right to review the records, the school must provide copies of the records or otherwise make arrangements for the parents or eligible student to inspect the records. A school cannot charge a fee merely to search for a student’s records, but may charge a copying fee. Parents and eligible students also have the right to request that education records be amended if the records contain information thought to be inaccurate, misleading, or in violation of the student’s privacy. If a school denies such a request, parents and eligible students have the right to a hearing to review the school’s decision.

Schools are required to inform parents and eligible students of their rights under FERPA. The method of providing such information is left to the discretion of the school. Generally, schools must obtain written consent from parents and eligible students before disclosing any personally identifiable information from a student’s education record, other than “directory information.” But there are many exceptions to this general rule. A school may disclose personally identifiable information from education records without consent under the following circumstances:

• Education records may be disclosed to school officials within the school, such as teachers, who have a legitimate educational interest in the information. It is the school’s responsibility to determine when there is a legitimate educational interest. For example, a teacher concerned about a student’s performance may have a legitimate educational interest in looking at the student’s standardized test scores, but a teacher who just wanted to find out the IQ scores of his or her students probably would not.
• Education records may be disclosed to another school, school district, or post-secondary institution where the student is planning to enroll.
• Education records may be disclosed to representatives of the Comptroller General of the United States, the Attorney General of the United States, the Secretary of the United States Department of Education, or other state or local authorities for purposes of audit or evaluation.
• Education records may be disclosed for purposes related to financial aid for which the student has applied, as long as the information is necessary to make determinations of eligibility for aid, amount or conditions of aid, or enforcement of terms of aid.
• Education records may be disclosed to state or local officials or authorities within a juvenile justice system, as long as the disclosure is made pursuant to a state law.
• Education records may be disclosed to organizations that are conducting studies for educational agencies or institutions in connection with the development or administration of predicative tests or student aid programs, or studies that are intended to improve educational instruction. Such studies must not permit identification of parents or students by anyone other than representatives of the organization. Furthermore, the personally identifiable information must be destroyed when no longer needed for the study.
• Education records may be disclosed to accrediting organizations for purposes of conducting accreditation procedures.
• Education records may be disclosed to the parents of a dependent student as defined by the IRS.
• Education records may be disclosed in connection with a health or safety emergency.
• Education records may be released in compliance with a court order, such as a subpoena, but schools must first make a “reasonable effort” to provide notice to parents or students. In the case of law enforcement or federal grand jury subpoenas, the issuing court or agency may, for good cause, order the school not to disclose the existence or contents of the subpoena or the records released pursuant to the subpoena. However, absent an emergency, schools cannot provide non-directory student information to police without a subpoena.
• Student “directory information” may also be disclosed without the student or parent’s consent. Directory information can include the student’s name, address, telephone number, date and place of birth, major field of study, dates of attendance, participation in school-sponsored extracurricular activities, height and weight of student athletes, degrees earned, honors and awards earned, the educational institution last attended, photographs, and e-mail addresses. Schools do not have to release directory information, but if they do, they must give public notice of the categories of information they classify as “directory information.” The school must then give parents and eligible students a reasonable amount of time to inform the school that they do not want some or all of their directory information disclosed without consent. Since 2002, secondary schools must provide students’ names, addresses, and telephone numbers to military recruiters upon request, but must have first given students and parents the opportunity to opt out of such disclosure.  

Every school is required to notify parents and eligible students annually of their rights under FERPA. The notice can take any form the institution or agency considers appropriate, but must explain how a parent or eligible student may:

• Exercise the right to review education records.
• Correct inaccurate, misleading, or privacy-violating information in their education records.
• Consent to disclosure of a student’s personally identifiable information.
• File a complaint concerning the failure of a school to comply with FERPA’s requirements.

Schools are required to maintain a list of all individuals or organizations that have requested or obtained a student’s education records. These records can only be accessed by a parent or eligible student, the school official responsible for education records, and authorized auditing personnel. This list, which must be kept with the education record to which it pertains, must state the specific interest each requesting party has in the student’s information. Third parties who obtain access to student education records must agree not to disclose the information to anyone else without a parent or eligible student’s written consent.

Post-Secondary Students

Students enrolled in post-secondary schools are considered eligible students under FERPA and have the right to review their own education records. However, post-secondary students may not review:

• Their parents’ financial records.
• Confidential letters of recommendation included in their education records before January 1, 1975.
• Confidential letters of recommendation included in their education records after January 1, 1975, that pertain to the student’s admission to the school, application for employment, or receipt of an honor if the student has waived to right to inspect those statements.

The education records of post-secondary students are also less secure. In addition to the circumstances under which personally identifiable information may be disclosed without consent, listed above, post-secondary schools may also disclose:

• The final result of a disciplinary proceeding to the victim of an act of violence or nonforcible sex offense allegedly perpetrated by the subject of the records, regardless of the outcome of the proceeding. Schools may not disclose the names of other students connected with the proceedings, including the victim or any witnesses, without the written consent of those students. Disclosure under this exception may be made only regarding disciplinary proceedings in which a result was reached on or after October 7, 1998.
• The student’s violation of a law or school rule pertaining to the use or possession of alcohol or drugs to the student’s parent. Such disclosure may be made only when the student is under the age of 21.

FERPA AND THE COVID-19 PANDEMIC

FERPA defines “education records” as records that are directly related to a student and that are maintained by an educational agency or institution, or by a party acting for the agency or institution (20 U.S.C. § 1232g(a)(4); 34 C.F.R. § 99.3, “Education records.”). Accordingly, immunization records and other health records are classified as “education records” under FERPA. 

FERPA generally prohibits schools from disclosing personally identifiable information from student education records without prior consent from a parent or “eligible student.” However, in the case of the COVID-19 pandemic, a “health or safety emergency” exception applies to FERPA’s general consent rule. This exception enables educational agencies and institutions to disclose personally identifiable information from student education records to appropriate parties in connection with the emergency without prior consent—given that the party’s knowledge of the information is necessary to protect the health or safety of students or other individuals (20 U.S.C. § 1232g(b)(1)(I); 34 C.F.R. §§ 99.31(a)(10) and 99.36). Examples of appropriate parties in a health or safety emergency include public health officials, trained medical personnel, and other parties who provide medical or safety attention. 

The determination of an “emergency” is left to the discretion of local authorities and educational agencies or institutions themselves and is a flexible standard that may differ from case to case. However, if a disclosure is made under the health or safety emergency exception, the educational agency or institution must note in the affected students’ education records both the articulable and significant threat that formed the basis for its disclosure, and the parties to whom the students’ information was disclosed. 

Exposure Notification

If a student at a school has been determined to have COVID-19, the school is permitted to notify parents and eligible students of a potential risk. Typically, it should be sufficient for a school to simply report that a student in the school community has been infected with COVID-19, without also identifying or naming the specific individual. If disclosing identifiable information about a student is necessary to protect the safety of other individuals, such as those that may have been in direct contact with an infected student, school officials should make a decision on a case-by-case basis. 

• FERPA & Coronavirus Disease 2019 (COVID-19): FAQs, Student Privacy Policy Office, March 2020

What To Do If Your School Has Violated Your Rights Under FERPA:

• Department of Education: Protecting Student Privacy (SSPO).

No Private Cause of Action

Courts are unanimous in holding that FERPA does not provide the right to file a private lawsuit to challenge alleged violations. The Supreme Court held in June 2002 that students may not file a Section 1983 civil rights action against a school for alleged FERPA violations because the Act’s nondisclosure provisions did not create any enforceable rights.

EPIC’S WORK ON FERPA

EPIC believes that the 2008 and 2011 amendments to FERPA caused students, parents, and schools to lose substantial control of student information, fostering the current environment of educational data flowing nearly unrestricted from schools to third parties. 

A review of the websites of 752 local education agencies (LEAs) conducted by the Student Privacy Policy Office at the U.S. Department of Education between 2018 and 2020 also found issues with transparency around FERPA. While 54% of the LEAs reviewed had the FERPA Annual Notice posted on their websites, only 12% of the websites also included navigation menus with information on where to find data practices and student privacy information, and only 7% of websites included LEA contact information for any parents or students with questions about data sharing student privacy.

New technologies are also routinely being deployed in classrooms without meaningful accountability, oversight, and transparency. EPIC has a particular interest in protecting student privacy and has worked in this field for many years. In the past, EPIC has urged Congress to strengthen FERPA, filed complaints with the Federal Trade Commission on behalf of student consumers, created a “Student Privacy Bill of Rights,” and more.