Frequently Asked Questions

This section is designed to allow stakeholders easy access to all Frequently Asked Questions about student privacy.  All of the questions contained on this page have been tagged for easy browsing by either topic or audience.  This section is regularly updated as new questions are received.  You may also search the FAQs by using the search box on the top right of the page.

Are educational agencies and institutions required to notify parents and eligible students of their rights under FERPA?

Yes. Educational agencies and institutions must annually notify parents and eligible students of their rights under FERPA. Specifically, schools must notify parents and eligible students of the right:  to inspect and review education records and the procedures to do so; to seek amendment of records the parent or eligible student believes are inaccurate and the procedures to so do; to consent to disclosures of education records, except to the extent that FERPA authorizes disclosure without consent; and to file a complaint with SPPO concerning potential violations. Postsecondary institutions are only required to notify eligible students of their rights under FERPA.34 CFR § 99.7

Are law enforcement records considered education records?

“Law enforcement unit records” (i.e., records created by the law enforcement unit, created for a law enforcement purpose, and maintained by the law enforcement unit) are not “education records” subject to the privacy protections of FERPA. As such, the law enforcement unit may refuse to provide a parent or eligible student with an opportunity to inspect and review law enforcement unit records, and it may disclose law enforcement unit records to third parties without the parent or eligible student’s prior written consent. However, education records, or personally identifiable information from education records, which the school shares with the law enforcement unit, do not lose their protected status as education records just because they are shared with the law enforcement unit.

Are law enforcement records protected under FERPA?

“Law enforcement unit records” (i.e., records created by a law enforcement unit at the educational agency or institution, created for a law enforcement purpose, and maintained by the law enforcement unit) are not “education records” subject to the privacy protections of FERPA. As such, the law enforcement unit may refuse to provide a parent or eligible student with an opportunity to inspect and review law enforcement unit records, and it may disclose law enforcement unit records to third parties without the parent’s or eligible student’s prior written consent.

Resources:

FERPA General Guidance for Parents

Are LEAs or schools required to have written agreements with the Child Welfare Agency (CWA) or tribal organization prior to disclosing personally identifiable information (PII) from education records to the welfare agency or tribal organization?

No. The written agreement requirements in the FERPA regulations do not apply to a disclosure of PII from education records made under this exception by an LEA or school. However, LEAs and schools may want to consider a written agreement, data sharing agreement, or memorandum of understanding (MOU) with a CWA or tribal organization to ensure that the CWA or tribal organization is aware of its responsibility under FERPA to protect PII from education records from unauthorized disclosure. 

Are School Resource Officers (SROs) or other outside local law enforcement officials who serve as a school’s law enforcement unit automatically considered school officials?

No, not automatically. These officials may be considered “school officials” with “legitimate educational interests” and have access to students’ education records, but only if they:

  1. Perform an institutional service or function for which the agency or institution would otherwise use employees;
  2. Are under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Are subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meet the criteria specified in the school or LEA’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

Are schools required to record the disclosure of personally identifiable information (PII) from students’ education records whenever they make disclosures?

Subject to certain exceptions addressed below, schools must maintain a record of each request for access to, and each disclosure of PII from, the education records of each student, as well as the names of state and local educational authorities and federal officials and agencies listed in § 99.31(a)(3) that may make further disclosures of PII from students’ education records without consent. The school must maintain this record with the education records of the student as long as the education records are maintained. 

Schools do not have to record disclosures of PII from education records that were made to: 1) the parent or eligible student; 2) a school official under § 99.31(a)(1); 3) a party with written consent from the parent or eligible student; 4) a party seeking directory information; or 5) a party seeking or receiving records in accordance with the provisions in FERPA related to disclosures pursuant to certain types of subpoenas or court orders as set forth in § 99.31(a)(9)(ii)(A)-(C). See § 99.32(d).

Are SEAs required to have written agreements with the Child Welfare Agency (CWA) or tribal organization prior to redisclosing education records to the CWA or tribal organization?

No. The written agreement requirement of FERPA does not apply to disclosures of education records made under this exception to FERPA’s general consent requirement including the redisclosure of education records by an SEA. The written agreement requirement applies only in the context of other exceptions to FERPA’s general consent requirement (e.g.., the studies exception and the audit/evaluation exception). See §§ 99.31(a)(6) and 99.35(a)(3).

Are there any limitations as to what education records may be disclosed to a community-based organization to which a school has outsourced an institutional service under the school official exception?

Yes.

FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

It is a best practice to enter into a written agreement with the community-based organization prior to sharing any PII from education records.

Are there any limitations to sharing information based on personal knowledge or observations?

FERPA applies to the disclosure of personally identifiable information (PII) from education records that are maintained by the school.  Therefore, FERPA does not prohibit a school official from releasing information about a student that was obtained through the school official’s personal knowledge or observation unless that knowledge is obtained through his or her official role in making a determination maintained in an education records about the student. For example, under FERPA a principal or other school official who took official action to suspend a student may not disclose that information, absent consent or an exception under § 99.31 that permits the disclosure.

Are there any restrictions on how a community-based organization can use and protect the personally identifiable information (PII) from education records it receives to conduct a study?

Yes. Under the studies exception, the school or LEA may non-consensually disclose PII from education records to the community-based organization only if

  1. The study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of the organization that have legitimate interests in the information;
  2. The information is destroyed when no longer needed for the purposes for which the study was conducted; and
  3. The school or LEA enters into a written agreement with the community-based organization.

Are there limitations as to how the community-based organization may use the personally identifiable information (PII) from education records it receives from a school under the school official exception?

Yes

FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

It is a best practice to enter into a written agreement with the community-based organization prior to sharing any PII from education records.

Are there situations in which school officials may non-consensually disclose personally identifiable information from education records of students who have been disciplined for conduct that posed a significant risk to the safety of the school community?

Yes. Under FERPA, a school may share PII from education records with school officials within the school whom the school has determined to have legitimate educational interests in the behavior of a student who has been disciplined for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community. See § 99.36(b)(2) and Q&A 9 and § 99.36(b)(1) and (2). 

The school may also disclose PII from education records about a student who has been disciplined for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community, to school officials at another school who have been determined to have legitimate educational interests in the behavior of the student, if deemed necessary. 

For instance, if a school official knows that a student, who has been disciplined for bringing a gun or knife to school or threatened to hurt students and/or teachers, is planning to attend a school-sponsored activity at another high school, FERPA would allow that school official to notify school officials at the other high school who have been determined to have legitimate educational interests in the behavior of the student. See § 99.36(b)(3). 

Can a school’s law enforcement unit officials be considered schools officials with legitimate educational interests?

Yes, if certain conditions apply.   These officials may be considered “school officials” with “legitimate educational interests” and have access to students’ education records, but only if they:

  1. Perform an institutional service or function for which the agency or institution would otherwise use employees;
  2. Are under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Are subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meet the criteria specified in the school or LEA’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

Can off-duty police officers or School Resource Officers (SROs) be considered school officials under FERPA and, therefore, have access to students’ education records?

Yes, if certain conditions are met.  FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

Can parents view a child’s post-secondary education record?

FERPA generally prohibits the nonconsensual disclosure of information derived from education records, except in certain specified circumstances. One of these exceptions permits the nonconsensual disclosure of information derived from education records to that student's parent if the student is a dependent for tax purposes. Neither the age of the student, nor the parent's status as custodial parent, is relevant to determining whether disclosure of information from the education records of eligible students to a parent without written consent is permissible under FERPA. If a student is claimed as a dependent by either parent for tax purposes, then either parent may have access under this provision, absent a court order specifically prohibiting it.

Can schools disclose education records to community-based organizations performing outsourced tutoring programs using the school official exception?

Yes.  If a school chooses to outsource to a community-based organization a tutoring program that it would otherwise use school employees to provide, then the school may disclose the education records without the consent of the parents or eligible students under the school official exception. 

FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

It is a best practice to enter into a written agreement with the community-based organization prior to sharing any PII from education records.

Can stepparents, grandparents, and other caregivers be considered parents under FERPA?

In some cases, a stepparent may be considered a “parent” under FERPA if the stepparent is present on a day-to-day basis with the natural parent and child and the other parent is absent from that home.  Conversely, a stepparent who is not present on a day-to-day basis in the home of the child does not have rights under FERPA with respect to the child’s education records.  A grandparent or other caregiver who is acting in the absence of the parent(s) may also be considered a “parent” under FERPA.

Source: 34 CFR § 99.3

Colleges and the 2020 Census

The U.S. Department of Education (ED) is working with Census to share updates on the 2020 Census.

Census has posted an updated document here.

Given that many students who usually reside on college campuses may not currently be on campus, Census has 3 updates/reminders:

Colleges that chose the paper (drop off/pick up) method are urged to move to e-response;
In most cases, students who would ordinarily be on campus full-time but are living away from home at school should be counted at school, even if they are temporarily elsewhere (such as home) due to the COVID-19 pandemic; and
Off-campus students can complete a response through the Internet at my2020census.gov.
The Student Privacy Policy Office or SPPO has provided information on the implications of FERPA under each of the enumeration methods here.

Please contact SPPO at FERPA@ed.gov if you have questions.

 

The Department recently issued techncial assistance on the applicability of the Family Educational Rights and Privacy Act (FERPA) to the disclosure by IHEs or postsecondary institutions of certain personally identifiable information (PII) from student education records to representatives of the U.S. Census Bureau (Bureau) in connection with the 2020 Census.

Department of Education Resources

Census Resources

 

Do students under the age of 18, not in college, and not in the physical custody of a parent or guardian have rights under FERPA?

FERPA does not specifically afford minors who are separated from their parents the rights that are afforded to parents and eligible students under the law.  However, schools may use their judgment in determining whether an unaccompanied minor is responsible enough to exercise certain privileges, such as inspecting and reviewing education records and providing consent for disclosure. 34 CFR § 99.5(b).

Does a school have to use only employees to staff its law enforcement unit?

The manner in which a school establishes its law enforcement unit is outside the scope of FERPA.  Accordingly, FERPA does not require a school to use only employees to staff its law enforcement unit.  Local police officers and other law enforcement personnel employed by local or state authorities also may serve as the “law enforcement unit” of an educational agency or institution. 

Does FERPA distinguish between School Resource Officers (SROs) and other local police officers who work in a school?

No. An SRO typically serves as an on-site law enforcement officer and as a liaison with the local police or sheriff’s department.  An SRO also works with teachers and school administrators to promote school safety and to help ensure physical security.  An SRO may be designated by the school as a “law enforcement unit” official under FERPA (§ 99.8).  However, in order for a school to disclose personally identifiable information (PII) from education records to an SRO, the SRO must be considered a “school official” under FERPA in accordance with § 99.31(a)(1)(i)(B) concerning outsourcing.  A school may only non-consensually disclose PII from students’ education records to its law enforcement unit if those individuals in the law enforcement unit meet the requirements set forth in FERPA’s school official exception or if some other FERPA exception to the general consent rule applies. 

A school must have direct control over an SRO’s maintenance and use of education records in providing SRO services in order for the SRO to be considered a school official.  Further, under the school official exception (as well as any FERPA exception to consent), SROs may only use the PII from education records for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of the students.  See §§ 99.31(a)(1)(i)(B)(3) and 99.33(a)(2).  In addition, SROs are subject to the redisclosure requirements of § 99.33(a).  This means that an SRO who is serving as a “school official” under FERPA may not disclose PII from education records to others, including other employees of his or her local police department who are not acting as school officials, without consent unless the redisclosure fits within one of the exceptions to FERPA’s consent requirement.

Does FERPA permit educational agencies and institutions to disclose PII from education records to CWAs or tribal organizations, without consent, when the student reaches 18 years of age or attends a postsecondary institution but remains in foster care?

Yes.  Once a student reaches 18 years old or attends a postsecondary institution at any age, the student becomes an eligible student and the rights under FERPA transfer to that student.  FERPA governs the disclosure of PII from the education records of an eligible student in the same fashion as it governs the disclosure of PII from the education records of a student under the age of 18.  As a practical matter, most States consider an individual who has reached the age of 18 to be an adult; therefore, the individual would generally not remain in foster care placement.  However, if under State or tribal law an individual is who is 18 or older or is attending a postsecondary institution remains in a foster care placement, then the educational agency or institution may choose to disclose education records to the CWA that is legally responsible for the care and protection of the eligible student without the consent of the eligible student.

Does FERPA permit educational agencies and institutions turn over videos to the police upon request or following an incident that may warrant police involvement?

If the law enforcement unit of an educational agency or institution creates and maintains videos for a law enforcement purpose, then the videos would not be education records and FERPA would not prohibit the law enforcement unit of an educational agency or institution from disclosing the videos to the police. If the videos are education records, however, educational agencies and institutions may not turn over videos to the police upon request without having first either obtained the written consent of the parent or eligible student or determined that the conditions of an exception to the general requirement of consent have been met, such as if the disclosure is made in connection with a health or safety emergency (20 U.S.C. 1232g(b)(1)(I) and 34 CFR §§ 99.31(a)(10) and 99.36) or the law enforcement officer has presented the educational agency or institution with a judicial order or a lawfully issued subpoena (20 U.S.C. 1232g(b)(1)(J) and (b)(2) and 34 CFR § 99.31(a)(9)).

Does FERPA permit legal representatives of parents or eligible students to inspect and review videos with the parent or eligible student?

Yes. FERPA permits legal representatives of a parent or an eligible student to inspect and review videos with the parent or eligible student. While FERPA does not require educational agencies and institutions to allow parents or eligible students to bring their attorney or other legal representative with them when they exercise their right to inspect and review the student’s education records, nothing in FERPA prevents educational agencies and institutions from allowing parents or eligible students to bring their attorney or other legal representative with them when they exercise their right to inspect and review the student’s education records under FERPA.

Does FERPA permit school officials to release information that they personally observed or of which they have personal knowledge?

FERPA applies to the disclosure of education records and of personally identifiable information (PII) from education records that are maintained by the school.  Therefore, FERPA does not prohibit a school official from releasing information about a student that was obtained through the school official’s personal knowledge or observation, rather than from the student’s education records.  For example, if a teacher overhears a student making threatening remarks to other students, FERPA does not protect that information from disclosure.  Therefore, a school official may disclose what he or she overheard to appropriate authorities, including disclosing the information to local law enforcement officials, school officials, and parents.

Does FERPA permit schools to disclose a student’s education records to the state or local Child Welfare Agency (CWA) or tribal organization?

There are exceptions to consent in FERPA that permit, but do not require, local educational agencies (LEAs) and schools to disclose personally identifiable information (PII) from education records under certain conditions without the written consent of the parent or eligible student.  FERPA permits LEAs and schools to disclose education records of students placed in foster care, without consent of the parent or eligible student, to an agency caseworker or other representative of a state or local child welfare agency (CWA) or tribal organization authorized to access a student’s case plan, when such agency or organization is legally responsible, in accordance with state or tribal law, for the care and protection of the student. 

A “case plan” is defined at 42 U.S.C. 675(1) as a written document that must include a number of specified items that, among other things, must address both the proper care of children in foster care placement.  The plan also addresses the services that are provided to children in foster care placement, their parents, and their foster parents.  The plan also includes, but is not limited to, ensuring the educational stability of children in foster care. 

This exception to FERPA only applies to those children for whom the CWA or tribal organization is legally responsible, in accordance with state or tribal law, for the care and protection of a child in foster care placement.  FERPA would not permit LEAs and schools and to disclose PII from education records to the CWA or tribal organization for children who are not in foster care placement, even if those children  are receiving other services through the CWA or tribal organization (e.g., vocational and skill assessments, training, tutoring, educational services, family services, and community enrichment activities). 

Does FERPA permit schools to disclose any and all education records on a student to another school where the student seeks or intends to enroll?

Yes.  FERPA states a school may disclose education records, without parental consent (§ 99.31(a)(2)), to another school in which a student seeks or intends to enroll, subject to conditions set forth in § 99.34.  This exception to FERPA’s general consent requirement also permits a school to disclose education records when a student is being placed in a juvenile justice facility that is considered a school. 

Does FERPA permit the disclosure of personally identifiable information (PII) from education records to officials of a state’s juvenile justice system?

FERPA permits schools to non-consensually disclose PII from education records to state and local officials or other authorities if the disclosure is allowed by a state law adopted after November 19, 1974, and if the disclosure concerns the juvenile justice system and its ability to serve, prior to adjudication, the student whose records are disclosed.  See §§ 99.31(a)(5) and 99.38.  The officials and authorities to whom such information is disclosed must certify in writing to the school that the information will not be provided to any other party, except as provided for under state law without written consent.  

Does FERPA permit the sharing of education records with outside law enforcement officials, mental health officials, and other experts in the community who serve on a school’s threat assessment team?

Yes.  Under FERPA, a school or school district may disclose personally identifiable information (PII) from education records without consent to threat assessment team members who are not employees of the school or school district if they qualify as “school officials” with “legitimate educational interests.”

In establishing a threat assessment team, the school must follow the FERPA provisions in § 99.31(a)(1)(i)(B) concerning outsourcing this function if team members will be privy to PII from students’ education records.  While not a requirement of FERPA, one way to ensure that members of the team do not redisclose PII obtained from education records would be to have a written agreement with each of the team members specifying their requirements and responsibilities. 

Schools are reminded that members of the threat assessment team may only use PII from education records for the purposes for which the disclosure was made, i.e., to conduct threat assessments, and must be subject to FERPA’s redisclosure requirements in § 99.33(a).  For example, a representative from the city police who serves on a school’s threat assessment team generally could not give the police department any PII from a student’s education records to which he or she was privy as a member of the team.  However, if the threat assessment team determines that a health or safety emergency exists, then the police officer may disclose, on behalf of the school, PII from a student’s education records to appropriate officials under the health or safety emergency exception under §§ 99.31(a)(10) and 99.36, as discussed below.

Does FERPA protect the education records of students that are deceased?

Consistent with our analysis of FERPA and common law principles, we interpret the FERPA rights of eligible students to lapse or expire upon the death of the student.  Therefore, FERPA would not protect the education records of a deceased eligible student (a student 18 or older or in college at any age) and an educational institution may disclose such records at its discretion or consistent with State law.  However, at the elementary/secondary level, FERPA rights do not lapse or expire upon the death of a non-eligible student because FERPA provides specifically that the rights it affords rest with the parents of students until that student reaches 18 years of age or attends an institution of postsecondary education.  Once the parents are deceased, the records are no longer protected by FERPA.

Does FERPA require educational agencies and institutions to disclose personally identifiable information (PII) from education records to Child Welfare Agencies (CWAs) or tribal organizations whenever requested?

No. Under 20 U.S.C. § 1232g(b)(1)(L), FERPA permits, but does not require, LEAs and schools to disclose PII from the education records of a student who is in foster care placement to CWAs or tribal organizations.  Further, under FERPA, an LEA or school may choose to disclose all or part of the education records it maintains on a student who is in foster care placement.  We encourage LEAs and schools to disclose the information from education records that a child’s welfare caseworker would need to effectively implement a child’s case plan and to ensure the child’s education needs are met.

FAQs on Photos and Videos under FERPA

 

1. When is a photo or video of a student an education record under FERPA?

As with any other “education record,” a photo or video of a student is an education record, subject to specific exclusions, when the photo or video is:  (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. (20 U.S.C. 1232g(a)(4)(A); 34 CFR § 99.3 “Education Record”)[1]

Directly Related to a Student:

FERPA regulations do not define what it means for a record to be “directly related” to a student. In the context of photos and videos, determining if a visual representation of a student is directly related to a student (rather than just incidentally related to him or her) is often context-specific, and educational agencies and institutions should examine certain types of photos and videos on a case by case basis to determine if they directly relate to any of the students depicted therein. Among the factors that may help determine if a photo or video should be considered “directly related” to a student are the following:

  • The educational agency or institution uses the photo or video for disciplinary action (or other official purposes) involving the student (including the victim of any such disciplinary incident);
  • The photo or video contains a depiction of an activity:
    • that resulted in an educational agency or institution’s use of the photo or video for disciplinary action (or other official purposes) involving a student (or, if disciplinary action is pending or has not yet been taken, that would reasonably result in use of the photo or video for disciplinary action involving a student);
    • that shows a student in violation of local, state, or federal law;  
    • that shows a student getting injured, attacked, victimized, ill, or having a health emergency;
  • The person or entity taking the photo or video intends to make a specific student the focus of the photo or video (e.g., ID photos, or a recording of a student presentation); or
  • The audio or visual content of the photo or video otherwise contains personally identifiable information contained in a student’s education record.

A photo or video should not be considered directly related to a student in the absence of these factors and if the student’s image is incidental or captured only as part of the background, or if a student is shown participating in school activities that are open to the public and without a specific focus on any individual.

Examples of situations that may cause a video to be an education record:

  • A school surveillance video showing two students fighting in a hallway, used as part of a disciplinary action, is directly related to the students fighting.   
  • A classroom video that shows a student having a seizure is directly related to that student because the depicted health emergency becomes the focus of the video. 
  • If a school maintains a close-up photo of two or three students playing basketball with a general view of student spectators in the background, the photo is directly related to the basketball players because they are the focus of the photo, but it is not directly related to the students pictured in the background. Schools often designate photos or videos of students participating in public events (e.g., sporting events, concerts, theater performances, etc.) as directory information and/or obtain consent from the parents or eligible students to publicly disclose photos or videos from these events.
  • A video recording of a faculty meeting during which a specific student’s grades are being discussed is directly related to that student because the discussion contains PII from the student’s education record.

Maintained by an educational agency or institution:

To be considered an education record under FERPA, an educational agency or institution, or a party acting for the agency or institution, also must maintain the record. Thus, a photo taken by a parent at a school football game would not be considered an education record, even if it is directly related to a particular student, because it is not being maintained by the school or on the school’s behalf. If, however, the parent’s photo shows two students fighting at the game, and the parent provides a copy of the photo to the school, which then maintains the photo in the students’ disciplinary records, then the copy of the photo being maintained by the school is an education record.

Exclusion for Law Enforcement Unit Records

The FERPA statute and regulations (20 U.S.C. 1232g(a)(4)(B)(ii) and 34 CFR §§ 99.3 and 99.8) exclude from the definition of education records those records created and maintained by a law enforcement unit of an educational agency or institution for a law enforcement purpose. Thus, if a law enforcement unit of an educational agency or institution creates and maintains the school’s surveillance videos for a law enforcement purpose, then any such videos would not be considered to be education records. If the law enforcement unit provides a copy of the video to another component within the educational agency or institution (for example, to maintain the record in connection with a disciplinary action), then the copy of the video may become an education record of the student(s) involved if the video is not subject to any other exclusion from the definition of “education records” and the video is:  (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. 

 

2. Can the same recorded image be the education record of more than one student under FERPA?

Yes. For example, a surveillance video that shows two students fighting on a school bus that the school uses and maintains to discipline the two students, would be “directly related to” and, therefore, the education record of both students.

 

3. If a video is an education record for multiple students, can a parent of one of the students or the eligible student view the video? 

When a video is an education record of multiple students, in general, FERPA requires the educational agency or institution to allow, upon request, an individual parent of a student (or the student if the student is an eligible student) to whom the video directly relates to inspect and review, or "be informed of" the content of the video, consistent with the FERPA statutory provisions in 20 U.S.C. § 1232g(a)(1)(A) and regulatory provisions at 34 CFR § 99.12(a). FERPA generally does not require the educational agency or institution to release copies of the video to the parent or eligible student.

In providing access to the video, the educational agency or institution must provide the parent of the student (or the student if the student is an eligible student) with the opportunity to inspect and review or "be informed of" the content of the video. If the educational agency or institution can reasonably redact or segregate out the portions of the video directly related to other students, without destroying the meaning of the record, then the educational agency or institution would be required to do so prior to providing the parent or eligible student with access. On the other hand, if redaction or segregation of the video cannot reasonably be accomplished, or if doing so would destroy the meaning of the record, then the parents of each student to whom the video directly relates (or the students themselves if they are eligible students) would have a right under FERPA to inspect and review or "be informed of" the entire record even though it also directly relates to other students.

For a fuller legal analysis and explanation of this issue, please see the 2017 Letter to Wachter.

 

4. If a video is an education record for multiple students, can the parent of one of the students (or the eligible student) receive a copy of the video? 

While we do not advise on an educational agency’s or institution’s obligations under any state open records laws that may apply, we note that FERPA does not generally require an educational agency or institution to provide copies of education records to parents and eligible students[2]. That said, it would not violate FERPA for an educational agency or institution to non-consensually disclose to an eligible student or to his or her parents copies of education records that the eligible student or his or her parents otherwise would have the right to inspect and review under FERPA.

For a fuller legal analysis and explanation of this issue, please see the 2017 Letter to Wachter.

 

5. If redaction or segregation of an education record of multiple students can be reasonably accomplished without destroying the meaning of the education record, can educational agencies and institutions charge parents or eligible students for the costs of the redaction or segregation?

No. FERPA provides parents and eligible students with the right to inspect and review the student’s education records, and nothing in the FERPA statute or regulations permits educational agencies and institutions to charge parents or eligible students for fees or costs associated with exercising that right.

If a school elects to provide a parent or eligible student with a copy of the education records, then the FERPA regulations (34 CFR § 99.11(a)) generally permit (with the exception noted below) the school to charge for the costs required to make the copy. FERPA regulations (34 CFR § 99.11(b)) also provide that the school may not charge a parent or eligible student for the costs to search for or retrieve the education records. We view the costs, if any, to the school of redacting, or segregating, education records of multiple students as being like the costs of search and retrieval that may not be charged to parents or eligible students, rather than like the costs for copies that generally may be charged to parents and eligible students. As noted above, if an educational agency or institution can reasonably redact or segregate out portions of an education record that is directly related to other students, without destroying the meaning of the record, then the educational agency or institution must do so and therefore cannot charge parents or eligible students for the costs associated with exercising their right to inspect and review such education records.

In contrast, parents and eligible students generally may be charged for the costs of making copies of education records precisely because FERPA generally does not require the school to provide them with such copies. Thus, where the redaction or segregation of education records of multiple students can be reasonably accomplished without destroying the meaning of the education records, nothing in FERPA permits educational agencies or institutions to charge parents or eligible students for the costs of making the required redactions or segregation. Please note that the FERPA regulations (34 CFR § 99.11(a)) similarly provide that if a fee for copies effectively prevents a parent or an eligible student from exercising the right to inspect and review his or her education records, an educational agency or institution would be required to provide copies without payment. Such cases would be limited to a parent or an eligible student providing evidence of the inability to pay for the copies due to financial hardship.

 

6. Does FERPA permit legal representatives of parents or eligible students to inspect and review videos with the parent or eligible student?

Yes. FERPA permits legal representatives of a parent or an eligible student to inspect and review videos with the parent or eligible student. While FERPA does not require educational agencies and institutions to allow parents or eligible students to bring their attorney or other legal representative with them when they exercise their right to inspect and review the student’s education records, nothing in FERPA prevents educational agencies and institutions from allowing parents or eligible students to bring their attorney or other legal representative with them when they exercise their right to inspect and review the student’s education records under FERPA.

 

7. Does FERPA permit educational agencies and institutions turn over videos to the police upon request or following an incident that may warrant police involvement?

If the law enforcement unit of an educational agency or institution creates and maintains videos for a law enforcement purpose, then the videos would not be education records and FERPA would not prohibit the law enforcement unit of an educational agency or institution from disclosing the videos to the police. If the videos are education records, however, educational agencies and institutions may not turn over videos to the police upon request without having first either obtained the written consent of the parent or eligible student or determined that the conditions of an exception to the general requirement of consent have been met, such as if the disclosure is made in connection with a health or safety emergency (20 U.S.C. 1232g(b)(1)(I) and 34 CFR §§ 99.31(a)(10) and 99.36) or the law enforcement officer has presented the educational agency or institution with a judicial order or a lawfully issued subpoena (20 U.S.C. 1232g(b)(1)(J) and (b)(2) and 34 CFR § 99.31(a)(9)).

 

 

 

[1] The Individuals with Disabilities Education Act (IDEA) also contains privacy protections that apply to children with disabilities. 20 U.S.C. 1417(c) and 34 CFR §§ 300.610-300.626 and 34 CFR §§ 303.401-303.416. Under the IDEA, participating agencies must protect the personally identifiable information (PII), data, or records that are collected, maintained, or used by the participating agency. While the definition of “education record” under Part B of the IDEA cross-references the FERPA definition in 34 CFR § 99.3, the application of IDEA requirements may raise different questions.

[2] If circumstances effectively prevent the parent or eligible student from otherwise exercising their right to inspect and review the student’s education records (e.g., if the parent lives outside of commuting distance to the school), then the educational agency or institution would be required to either provide a copy of the records or to make other arrangements for the parent or eligible student to inspect and review the records. 34 CFR § 99.10(d)

How are Military Recruiter requirements under 10 U.S.C. § 503 enforced?

In addition to the potential for loss of funds under ESEA for failure to comply with § 9528 of the ESEA, an LEA that denies a military recruiter access to the requested information on students after July 1, 2002, will be subject to specific interventions under 10 U.S.C. § 503.  

In this regard, the law requires that a senior military officer (e.g., Colonel or Navy Captain) visit the LEA within 120 days.  If the access problem is not resolved with the LEA, the Department of Defense must notify the state’s Governor within 60 days.  Problems still unresolved after one year are reported to Congress, if the Secretary of Defense determines that the LEA denies recruiting access to at least two of the armed forces (Army, Navy, Marine Corps, etc.).  The expectation is that public officials will work with the LEA to resolve the problem.  

Additionally, the Department of Defense has developed a national high school data base to document recruiter access.  Presently, 95 percent of the nation’s 22,000 secondary schools provide a degree of access to military recruiters that is consistent with current law. 

How does § 544 of the National Defense Authorization Act for Fiscal Year 2002 amend the former Military Recruiter requirements under 10 U.S.C. § 503?

The law’s recruiting provisions apply only to LEAs (including private secondary schools) that receive funds under the ESEA.  These provisions require access by military recruiters to students, under certain conditions, and to secondary school students’ names, addresses, and telephone listings.  They also require LEAs to notify parents of their right to opt out of the disclosure of their children’s names, addresses, and telephone numbers and to comply with any such requests from the parents or the students.

How does a school know when a health or safety emergency exists so that a disclosure may be made under this exception to consent?

An educational agency or institution must make this determination on a case-by-case basis, taking into account the totality of the circumstances pertaining to a threat to the health or safety of a student or others.  If the school determines that there is an articulable and significant threat to the health or safety of a student or other individuals and that a third party needs personally identifiable information (PII) from education records to protect the health or safety of the student or other individuals, it may disclose that information to appropriate parties without consent. 

How long does an educational agency or institution have to comply with a request to view records?

FERPA requires that educational agencies and institutions comply with a request by a parent or eligible student for access to education records within a reasonable period of time, but not more than 45 days after receipt of a request.  Some States have laws that may require that parents and eligible students be granted access in a shorter time period.  34 CFR § 99.10(b).

How long must the Child Welfare Agency (CWA) or tribal organization maintain the education records of a child, and what must the CWA or tribal organization do with the education records when no longer needed?

Some of the FERPA exceptions to consent require the recipient of education records to destroy personally identifiable information (PII) from education records when it is no longer needed.  We recommend that the school or LEA and the CWA or tribal organization work together to determine how long the CWA or tribal organization should maintain the education records disclosed under the exception.  For example, the CWA or tribal organization could use its standard records retention and destruction guidelines or return the records to the disclosing school or LEA.  Further, CWA and tribal organizations should be aware of the potential consequences of improperly redisclosing PII from the education records that are received from the school or LEA under the FERPA exception. 

How may a parent or eligible student file a FERPA complaint with the Department of Education?

A parent or eligible student may file a written complaint with the Family Policy Compliance Office regarding an alleged violation under of FERPA.  The complaint must be timely (submitted to the office within 180 days of the date that the complainant knew or reasonably knew of the violation) and state clearly and succinctly specific allegations of fact giving reasonable cause to believe that the school has violated FERPA.

I want to use online tool or application as part of my course. However, I am worried that it is a violation of FERPA. What should I do?

A teacher should first check with their school/district administration to see if that application or service is approved for use in the classroom.  Any applications or services that collect personally identifiable information (PII) from students’ education records under the school officials exception to prior consent in FERPA must:

  • Provides a service or function that the school would otherwise use its own staff
  • Be under the direct control of the school with regard to the use and maintenance of the PII from education records
  • Collection and use of the PII must be consistent with the school or district’s annual notification of rights under FERPA
  • Not re-disclose or use the education data for unauthorized purposes.

Remember that the use of some applications or services may introduce security or privacy vulnerabilities into the school or districts IT systems.  Teachers should always consult their IT representatives to discuss the use of these types of software tools prior to use to ensure compliance with FERPA requirements and promote a safe, secure computing environment. 

If a parent opts out of the public, non-consensual disclosure of directory information (or any subset of such information), must the three data elements be released to military recruiters upon their request?

If a parent opts out of providing directory information to third parties, the opt-out relating to name, address, or telephone number applies to requests from military recruiters as well.  For example, if the opt-out states that telephone numbers will not be disclosed to the public, schools may not disclose telephone numbers to military recruiters.

If a school or LEA discloses personally identifiable information (PII) from education records to a community-based organization under a FERPA exception to consent, what and how much PII from education records can it disclose to the organization?

The school or LEA has discretion under FERPA to decide what and how much PII from education records to disclose to community-based organizations (except in certain cases such as a court order or a subpoena).  The school or LEA should determine which data elements are necessary for the activity in question and provide only those elements.  Often LEAs and schools will discover that the organization can do the work in question without receiving PII from education records.

If a student under 18 is enrolled in both high school and a local college, do parents have the right to inspect and review his or her education records?

If a student is attending a postsecondary institution - at any age - the rights under FERPA have transferred to the student.  However, in a situation where a student is enrolled in both a high school and a postsecondary institution, the two schools may exchange information on that student.  If the student is under 18, the parents still retain the rights under FERPA at the high school and may inspect and review any records sent by the postsecondary institution to the high school.  Additionally, the postsecondary institution may disclose personally identifiable information from the student’s education records to the parents, without the consent of the eligible student, if the student is a dependent for tax purposes under the IRS rules. Dual Enrollment Dually Enrolled

 

If a video is an education record for multiple students, can a parent of one of the students or the eligible student view the video?

When a video is an education record of multiple students, in general, FERPA requires the educational agency or institution to allow, upon request, an individual parent of a student (or the student if the student is an eligible student) to whom the video directly relates to inspect and review the video. FERPA generally does not require the educational agency or institution to release copies of the video to the parent or eligible student. 

In providing access to the video, the educational agency or institution must provide the parent of the student (or the student if the student is an eligible student) with the opportunity to inspect and review the video. If the educational agency or institution can reasonably redact or segregate out the portions of the video directly related to other students, without destroying the meaning of the record, then the educational agency or institution would be required to do so prior to providing the parent or eligible student with access. On the other hand, if redaction or segregation of the video cannot reasonably be accomplished, or if doing so would destroy the meaning of the record, then the parents of each student to whom the video directly relates (or the students themselves if they are eligible students) would have a right under FERPA to access the entire record even though it also directly relates to other students.

For a fuller legal analysis and explanation of this issue, please see the 2017 Letter to Wachter.

If a video is an education record for multiple students, can the parent of one of the students (or the eligible student) receive a copy of the video?

While we do not advise on an educational agency’s or institution’s obligations under any state open records laws that may apply, we note that FERPA does not generally require an educational agency or institution to provide copies of education records to parents and eligible students[1]. That said, it would not violate FERPA for an educational agency or institution to non-consensually disclose to an eligible student or to his or her parents copies of education records that the eligible student or his or her parents otherwise would have the right to inspect and review under FERPA.

For a fuller legal analysis and explanation of this issue, please see the 2017 Letter to Wachter.


[1] If circumstances effectively prevent the parent or eligible student from otherwise exercising their right to inspect and review the student’s education records (e.g., if the parent lives outside of commuting distance to the school), then the educational agency or institution would be required to either provide a copy of the records or to make other arrangements for the parent or eligible student to inspect and review the records. 34 CFR § 99.10(d)

If an LEA has not provided notice relating to directory information, may it release a students name, address, and telephone number when requested by a military recruiter?

An LEA may provide a single notice regarding both directory information and information disclosed to military recruiters.  If an LEA does not disclose “directory information” under FERPA, then it must still provide military recruiters access to secondary students’ names, addresses, and telephone listings.  In addition, the LEA must notify parents that they may opt out of this disclosure.  In other words, an LEA that does not disclose “directory information” must nonetheless provide a notice that it discloses information to military recruiters.  The notice must be reasonably calculated to inform parents.

If redaction or segregation of an education record of multiple students can be reasonably accomplished without destroying the meaning of the education record...

can educational agencies and institutions charge parents or eligible students for the costs of the redaction or segregation?

No. FERPA provides parents and eligible students with the right to inspect and review the student’s education records, and nothing in the FERPA statute or regulations permits educational agencies and institutions to charge parents or eligible students for fees or costs associated with exercising that right.

If a school elects to provide a parent or eligible student with a copy of the education records, then the FERPA regulations (34 CFR § 99.11(a)) generally permit (with the exception noted below) the school to charge for the costs required to make the copy. FERPA regulations (34 CFR § 99.11(b)) also provide that the school may not charge a parent or eligible student for the costs to search for or retrieve the education records. We view the costs, if any, to the school of redacting, or segregating, education records of multiple students as being like the costs of search and retrieval that may not be charged to parents or eligible students, rather than like the costs for copies that generally may be charged to parents and eligible students. As noted above, if an educational agency or institution can reasonably redact or segregate out portions of an education record that is directly related to other students, without destroying the meaning of the record, then the educational agency or institution must do so and therefore cannot charge parents or eligible students for the costs associated with exercising their right to inspect and review such education records.

In contrast, parents and eligible students generally may be charged for the costs of making copies of education records precisely because FERPA generally does not require the school to provide them with such copies. Thus, where the redaction or segregation of education records of multiple students can be reasonably accomplished without destroying the meaning of the education records, nothing in FERPA permits educational agencies or institutions to charge parents or eligible students for the costs of making the required redactions or segregation. Please note that the FERPA regulations (34 CFR § 99.11(a)) similarly provide that if a fee for copies effectively prevents a parent or an eligible student from exercising the right to inspect and review his or her education records, an educational agency or institution would be required to provide copies without payment. Such cases would be limited to a parent or an eligible student providing evidence of the inability to pay for the copies due to financial hardship.

If the school does not list one or more of name, address, and telephone listing among its directory information, may it release that information to military recruiters?

If a school does not designate one or more of the three items as “directory information” under FERPA, it still must provide all three items to military recruiters upon request.  Also, in that case, the school would have to send a separate notice to parents about the missing “directory information” item(s), noting an opportunity to opt out of disclosure of the information to military recruiters.  An easier method, of course, would be for the school to designate all three items – name, address, and telephone listing – as “directory information.”

In the case of a divorce, do both parents have rights under FERPA?

Generally, yes.  Unless a school is provided with evidence that there is a court order, state law, or other legally binding document relating to such matters as divorce, separation, or custody that specifically provides to the contrary, FERPA gives custodial and noncustodial parents alike certain rights with respect to their children’s education records. A school may ask for legal certification denoting parenthood, such as a birth certificate or court order, from the parent requesting access.

Source: 34 CFR § 99.4

Is prior written consent of the parent or eligible student required to disclose information to community-based organizations?

In most cases, yes.  Written consent is generally required before personally identifiable information (PII) from students’ education records may be disclosed to community-based organizations.  Except as set forth in § 99.31 of the regulations and in the statutory exceptions to consent at 20 U.S.C. 1232g, FERPA requires written consent from parents or eligible students before PII from education records are disclosed (34 CFR § 99.30).  For activities that do not fit within the statutory exceptions to consent, we recommend that schools, local educational agencies (LEAs), and/or community-based organizations build written consent into the registration process so that when parents sign students up for services offered by a community-based organization, the organization obtains the consent needed to access those education records of the student that will be needed to provide its services to that student.  

May a Child Welfare Agency (CWA) or tribal organization redisclose personally identifiable information (PII) from education records to other individuals or entities?

In some cases, FERPA does permit a CWA or tribal organization to redisclose PII from education records for a limited purpose.  Specifically, it provides that redisclosures may only be made to an individual or entity “engaged in addressing the student’s education needs” and authorized by such agency or organization to receive such disclosure and such disclosure must be consistent with the state or tribal laws applicable to protecting the confidentiality of a student’s education records.  20 U.S.C. § 1232g(b)(1)(L).

May a Child Welfare Agency (CWA) or tribal organization that receives personally identifiable information (PII) from education records through the exception in FERPA use the PII for purposes other than addressing the education needs of the child?

No.  FERPA is clear that the PII from education records disclosed to the CWA or tribal organization under the 2013 exception to FERPA must only be used to address the educational needs of children in foster care placement. 

May a postsecondary institution disclose financial aid records without written consent?

FERPA permits institutions to disclose, without consent, personally identifiable information from students’ education records when the disclosure is in connection with a student's application for, or receipt of, financial aid. Disclosures under this exception to consent may be made if the information is necessary for such purposes as to:  (a) determine eligibility for the aid; (b) determine the amount of the aid; (c) determine the conditions for the aid; or (d) enforce the terms and conditions of the aid.

May a postsecondary institution disclose information about a disciplinary proceeding to the victim of a crime of violence or a non-forcible sex offense?

Yes, a postsecondary institution may disclose only the final results of the disciplinary proceeding to a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense. The institution may disclose to the victim the final results of the disciplinary proceeding regardless of whether the institution concluded a violation was committed.

May a school disclose directory information to a community-based organization without written consent?

Generally, yes.  FERPA allows schools that have adopted directory information policies to disclose properly designated directory information without consent on students whose parents (or eligible students) have not opted out of the disclosure of directory information.  See § 99.37(a).  However, if a school adopts a directory information policy specifying that disclosure of directory information will be limited to specific parties, for specific purposes, or both, then the school is required to limit its directory information disclosures to those specified in its public notice.  See § 99.37(d).

May a social security number or other student identification number be listed as directory information?

A school may not designate a student’s social security number as directory information.  However, directory information may include a student’s user ID or other unique identifier used by the student to access or communicate in electronic systems, but only if the electronic identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the student’s identity, such as a personal identification number (PIN), password, or other factor known or possessed only by the student or authorized user. 34 CFR § 99.3

May an educational agency or institution disclose directory information without prior consent?

Education records that have been appropriately designated as "directory information" by the educational agency or institution may be disclosed without prior consent.  See 34 CFR §§ 99.31(a)(11) and 99.37.  FERPA defines directory information as information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed.  34 CFR § 99.3. 

FERPA provides that a school may disclose directory information if it has given public notice of the types of information which it has designated as "directory information," the parent or eligible student’s right to restrict the disclosure of such information, and the period of time within which a parent or eligible student has to notify the school in writing that he or she does not want any or all of those types of information designated as "directory information."  34 CFR § 99.37(a).  A school is not required to inform former students or the parents of former students regarding directory information or to honor their request that directory information not be disclosed without consent.  34 CFR § 99.37(b).  However, if a parent or eligible student, within the specified time period during the student's last opportunity as a student in attendance, requested that directory information not be disclosed, the school must honor that request until otherwise notified.

May an educational agency or institution disclose information over the phone?

While FERPA does not specifically prohibit a school from disclosing personally identifiable information from a student’s education records over the telephone, it does require that the school use reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom the school discloses personally identifiable information from education records. 34 CFR § 99.31(c).

May an educational agency or institution disclose personally identifiable information from students education records for the purpose of a specified audit, evaluation, or for compliance and enforcement purposes under FERPA?

FERPA permits schools to disclose PII from students’ education records, without consent, to authorized representatives of state and local educational authorities, the Secretary of Education, the Comptroller General of the United States, and the Attorney General of the United States for specified purposes.  Disclosures may be made under this exception as necessary in connection with the audit or evaluation off federal- or state-supported education programs, or in connection with the enforcement of federal legal requirements that relate to those programs. 34 CFR §§ 99.31(a)(3) and 99.35.

May an educational agency or institution disclose personally identifiable information from students education records to third parties for the purpose of conducting a study on its behalf?

FERPA contains an exception to its general consent rule under which an educational agency or institution may disclose personally identifiable information from education records without consent to organizations conducting studies for, or on its behalf.  Studies must be only for the purpose of: developing, validating, or administering predictive tests; administering student aid programs; or improving instruction. A written agreement with the organization is required, specifying the purposes of the study and the use and destruction of the information. 34 CFR § 99.31(a)(6)

May an LEA non-consensually disclose personally identifiable information (PII) from education records to a community-based organization in order to conduct an audit or evaluation of the school system’s education programs?

Yes.  FERPA’s audit or evaluation exception allows an LEA to designate a community-based organization as its authorized representative and disclose PII from education records without consent of parents or eligible students to audit or evaluate a federal- or state-supported education program, or to enforce or comply with federal legal requirements that relate to those education programs (audit, evaluation, or enforcement or compliance activity).  See 34 CFR § 99.35.  (This provision does not apply to individual schools that are not considered local educational authorities under state or local law.)  

May an SEA redisclose, on behalf of its LEAs, the education records of students in foster care placement to the students’ Child Welfare Agencies (CWAs) or tribal organizations that are legally responsible for their care and protection?

Yes.  An SEA may redisclose personally identifiable information (PII) from the education records of students in foster care placement to a CWA or tribal organization that is legally responsible for the care and protection of the student.  The disclosure must be made on behalf of the LEA, as permitted under § 99.33(b)(1) of the FERPA regulations. 

May postsecondary institutions disclose results of disciplinary proceedings?

Postsecondary institutions may disclose the final results of disciplinary proceedings if the institution has found that the student has violated the institution’s rules or policies in regard to a crime of violence or a non-forcible sex offense.  However, the institution may not disclose the name of any other student, including a victim or witness, without the prior written consent of that student.

May the community-based organization receiving personally identifiable information (PII) from education records redisclose PII from education records without written consent?

No.  Regardless of whether the community-based organization received the PII under the school official, studies, or audit/evaluation exception, the answer is the same – the community-based organization may not redisclose it unless such redisclosure is on behalf of the disclosing entity and is consistent with FERPA.  (34 CFR § 99.33).  If further redisclosure is contemplated, we recommend that provisions addressing authorized redisclosures be included in any agreement with the community-based organization.

May the LEA disclose personally identifiable information (PII) from education records to a community-based organization under the audit or evaluation exception for the purpose of the community-based organization evaluating its own program?

Generally, no.  The audit or evaluation by an community-based organization of its own program (i.e., to determine whether or not the organization’s program is effective) in most cases would not be permitted under the audit or evaluation exception because the audit or evaluation exception only permits the audit or evaluation of federal- or state-supported education programs, which FERPA defines as any program principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, and any program that is administered by an educational agency or institution. 

May the school or LEA non-consensually disclose personally identifiable information (PII) from education records to a community-based organization that is conducting a study for the school or LEA?

Yes.  The studies exception allows for the disclosure of PII from education records without consent to community-based organizations conducting studies for, or on behalf of, the school or LEA.  FERPA limits the purpose of the studies conducted under this exception to: (1) developing, validating, or administering predictive tests; (2) administering student aid programs; or (3) improving instruction.  See 34 CFR § 99.31(a)(6)(i).  

Must a school have a written agreement or contract with a community-based organization to which it non-consensually discloses education records to outsource an institutional service under the school official exception?

No.  While FERPA does not require written agreements or contracts when a school chooses to outsource an institutional service or function to a community-based organization under the “school official” exception, it is a best practice to do so.  Written agreements help ensure that the community-based organization understands its obligations and responsibilities with respect to the use of and privacy protections accorded to the FERPA protected information.  Further, appropriate contractual provisions can establish the direct control required by FERPA under this exception.  Additionally, local or state policies or laws may require the use of written agreements or contracts for procurement. 

Must a school inform parents and eligible students if the school non-consensually discloses personally identifiable information from their education records to a community-based organization to which the school has outsourced an institutional service?

No.  While there is no specific notification requirement regarding disclosures under the exceptions to consent, FERPA does require that each school or LEA annually notify parents and eligible students of their rights under FERPA.  34 CFR § 99.7.  As a part of the annual notice, the school or LEA must include in the notification a specification of the criteria for determining who constitutes a school official and what constitutes a legitimate educational interest.  34 CFR § 99.7(3)(iii).    

Must a school or LEA record the non-consensual disclosure of personally identifiable information (PII) from education records to a community-based organization?

Yes.  Generally, when a school or LEA discloses without consent PII from education records to a community-based organization, with the exception of disclosures made under the “school official” exception, the disclosure must be recorded.  FERPA require schools to record all requests for access to, and all disclosures of, PII from the education records of each student, except for disclosures to school officials, disclosures related to some judicial orders or lawfully issued subpoenas, disclosures of directory information, and disclosures to the parent or eligible student.  See 34 CFR § 99.32(d).  Schools and LEAs must maintain these records with the student’s education records for as long as the student’s records are maintained.  The recorded information must include the parties who have requested or received PII and their legitimate interests in requesting or obtaining the information. Parents and eligible students have a right to inspect and review the record of disclosures.  See 34 CFR § 99.32 for the full list of recordation requirements.

Must an educational agency or institution have a written agreement to disclose personally identifiable information (PII) from education records without consent for the purposes of conducting a study or an audit or evaluation of an education program?

Yes. Both the studies exception and the audit or evaluation exception specifically require that the parties execute a written agreement when disclosing PII from education records without consent.

Must educational agencies and institutions record any disclosure of personally identifiable information (PII) from education records to the Child Welfare Agencies (CWAs) or tribal organization?

Yes.  FERPA requires recordkeeping on requests for access to and disclosures of education records.  See § 99.32.  Thus, if a school discloses education records to the Child Welfare Agency (CWA) or tribal organization under this exception, the school must be compliant with the recordation requirements under FERPA and also must include:  (1) the parties who have requested or received PII from the education records, and (2) the legitimate interests the parties had in requesting or obtaining the information.  If an educational agency or institution discloses PII from education records with the understanding that further disclosures will be made, the educational agency’s or institution’s record of disclosure must include the names and legitimate interests of the additional parties.

Must postsecondary institutions provide a parent with access to an eligible student’s education records?

While the rights under FERPA transfer from the parents to the student when the student turns 18 or enrolls in a postsecondary institution at any age, FERPA provides ways in which an institution can share education records on the student with his or her parents.  Schools may disclose any and all information to parents, without the consent of the eligible student, if the student is a dependent for tax purposes under the IRS rules.  FERPA also permits a school to disclose information from an eligible student’s education records to parents if a health or safety emergency involves their son or daughter.  Another provision in FERPA permits a college or university to let parents of students under the age of 21 know when the student has violated any law or policy concerning the use of possession of alcohol or a controlled substance.  School officials may also share information with a parent about an eligible student that is based on that official’s personal knowledge or observation and that is not based on information contained in an education record.

Must the Child Welfare Agency (CWA) or tribal organization record any redisclosure of personally identifiable information (PII) from education records made by the welfare agency or tribal organization to an individual or entity?

No.  FERPA does not require the CWA or tribal organization to record any redisclosure of PII from education records that it may make to an individual or entity, such as a contractor providing services to address a student’s education needs.  However, if the CWA or tribal organization does redisclose PII from an education record on a student in foster care placement to anyone other than an agency- or organization-employed caseworker or other representative who has the right to access a student’s case plan, the Department recommends, as a good data management practice, that the CWA or tribal organization record the redisclosure and inform the school of the redisclosure for record keeping purposes. 

Must the LEA ensure that a community-based organization designated as its authorized representative complies with FERPA?

Yes.  Before the LEA discloses personally identifiable information (PII) from education records to a community-based organization designated as an authorized representative, the LEA is required to use “reasonable methods” to ensure to the greatest extent practicable that the community-based organization is FERPA-compliant. This specifically means ensuring that the community-based organization:

  1. Uses PII from education records only to carry out an audit or evaluation of federal- or state-supported education programs, or for the enforcement of or compliance with, federal legal requirements related to these programs.  The LEA should make sure that the proposed audit or evaluation is legitimate, and require in the written agreement that the community-based organization use the PII from education records only for that audit, evaluation, or enforcement or compliance activity. 
  2.  Protects the PII from education records from further disclosures or other uses, except as authorized by the LEA in accordance with FERPA. The agreement must specify that the community-based organization may not further disclose the PII from education records, unless authorized.
  3.  Destroys the PII from education records when no longer needed for the audit, evaluation, or enforcement or compliance activity.  The agreement must specify that the community-based organization is required to destroy the PII from education records when it is no longer needed and specify the time period in which the PII must be destroyed.  See 34 CFR § 99.35(a)(2).

Must the LEA have a written agreement with the community-based organization prior to disclosing personally identifiable information (PII) from education records under the Audit Evaluation Exception?

Yes.  The LEA must use a written agreement to designate the community-based organization as its authorized representative.  The written agreement must include certain mandatory components as described in § 99.35(a)(3)(ii) of the regulations.  The specific policies and procedures outlined in the agreement should be consistent with FERPA and all other applicable laws.)  For additional information, see § 99.35 of the regulations

Must the school or LEA have a written agreement with the community-based organization conducting the study?

Yes.  Written agreements are required under the studies exception, §99.31(a)(6)(iii)(C), and must

  1. Specify the purpose, scope, and duration of the study and the information to be disclosed. 
  2. Require the community-based organization to use personally identifiable information (PII) from education records only to meet the purpose(s) of the study as stated in the written agreement.
  3. Require the community-based organization to conduct the study in a manner that does not permit the personal identification of parents and students by anyone other than representatives of the organization with legitimate interests.  This typically means that the organization should allow internal access to PII from education records only to individuals with a need to know, and that the organization should take steps to maintain the confidentiality of the PII from education records at all stages of the study.
  4. Require the community-based organization to destroy all PII from education records when the information is no longer needed for the purposes for which the study was conducted, and specify the time period in which the information must be destroyed.

Must the SEA record the redisclosure of education records to the Child Welfare Agency (CWA) or tribal organization?

Yes.  Section 99.32(b)(2)(i) of the FERPA regulations generally requires that an SEA that makes further disclosures of personally identifiable information (PII) from education records must record the names of the additional parties (e.g., the CWA) to which it discloses PII from education records on behalf of the LEA and their legitimate interests in the information under FERPA.  However, the SEA would not have to make a record of the redisclosure if the LEA had made a record of the disclosure to the SEA and included in that record the name of the CWA or tribal organization and its legitimate interest (i.e., to permit the CWA or tribal organization to address the education needs of the child) to which the additional disclosure of the education records would be made.

Should the school or LEA contact SPPO if the community-based organization has violated FERPA?

While FERPA does not require that you notify us, we recommend that you contact SPPO if a community-based organization violates FERPA and provide us with information concerning the violation and any actions that you have taken.  SPPO has the authority to impose what is informally known as “the five-year rule ban” against the community-based organization if SPPO determines that it has violated certain provisions under FERPA.  The five-year rule means that SPPO can instruct the originating LEA or school to not provide the community-based organization with further access to PII from students’ education records for a minimum period of five years.  SPPO may impose a longer period of time in which the community-based organization may not have access to PII.  The five-year rule ban applies regardless of whether the community-based organization is a recipient of Department funds.  For more information on penalties for FERPA violations, see 34 CFR § 99.67.

To which educational agencies or institutions does FERPA apply?

FERPA applies to educational agencies or institutions that receive funds from programs administered by the U.S. Department of Education.  By “educational agencies or institutions” we mean public schools, school districts (or “local educational agencies” (LEAs)), and postsecondary institutions, such as colleges and universities.  Private and parochial schools at the elementary and secondary level generally do not receive such funding and are, therefore, not subject to FERPA. 

Under § 9528 of the ESEA, what notification must LEAs provide to parents before disclosing names, addresses, and telephone numbers of secondary students to military recruiters and officials of institutions of higher education?

Under FERPA, an LEA must provide notice to parents of the types of student information that it releases publicly.  This type of student information, commonly referred to as “directory information,” includes such items as names, addresses, and telephone numbers and is information generally not considered harmful or an invasion of privacy if disclosed.  The notice must include an explanation of a parent’s right to request that the information not be disclosed without prior written consent.  Additionally, § 9528 requires that parents be notified that the school routinely discloses names, addresses, and telephone numbers to military recruiters upon request, subject to a parent’s request not to disclose such information without written consent.  A single notice provided through a mailing, student handbook, or other method that is reasonably calculated to inform parents of the above information is sufficient to satisfy the parental notification requirements of both FERPA and § 9528.  The notification must advise the parent of how to opt out of the public, nonconsensual disclosure of directory information and the method and timeline within which to do so.

Under FERPA, may an educational agency or institution disclose education records to any of its employees without consent?

No.  FERPA permits an educational agency or institution to disclose, without consent, personally identifiable information from students’ education records only to school officials within the educational agency or institution that the educational agency or institution has determined to have legitimate educational interests in the information. 34 CFR § 99.31(a)(1).  Generally, a school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.

What actions must the agency or institution take to ensure the parent or eligible student receives a timely and fair hearing regarding the amendment of education records?

The educational agency or institution must provide the parent or eligible student notice of the date, time, and place, reasonably in advance of the hearing. The individual conducting the hearing must not have a direct interest in the hearing’s outcome. The agency or institution must give the parent or eligible student a full and fair opportunity to present relevant evidence. Finally, the agency or institution must make its decision in writing within a reasonable period of time after the hearing, and this decision must be based solely on the evidence presented at the hearing, include a summary of the evidence, and give the reasons for the decision.

What are the requirements for access by military recruiters to high school students?

Local educational agencies (LEAs) receiving assistance under the Elementary and Secondary Education Act of 1965 (ESEA) are generally required to give military recruiters the same access to secondary school students as they provide to postsecondary institutions or to prospective employers.  LEAs are also generally required to provide students’ names, addresses, and telephone listings to military recruiters, when requested.

What are the requirements of § 9528 of the ESEA, regarding access to student contact information by military recruiters or institutions of higher education?

Each LEA that receives funds under the ESEA must comply with a request by a military recruiter or an institution of higher education for secondary students’ names, addresses, and telephone numbers, unless a parent has “opted out” of providing such information.

Section 9528 also requires LEAs that receive funds under the ESEA to provide military recruiters the same access to secondary school students as they generally provide to postsecondary institutions or prospective employers.  For example, if the school has a policy of allowing postsecondary institutions or prospective employers to come on school property to provide information to students about educational or professional opportunities, it must afford the same access to military recruiters.

What constitutes de-identified records and information?

Records and information are de-identified once all personally identifiable information has been removed, including, but not limited to, any information that, alone or in combination is linkable to a specific student that a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.

What does “articulable and significant threat” mean?

The phrase “articulable and significant threat” means that a school official is able to explain, based on all the information available at the time, what the significant threat is under § 99.36 when he or she makes and records the disclosure.  For instance, if a school official believes that a student poses a significant threat, such as a threat of substantial bodily harm to any person, including to the student, then, under FERPA, the school official may disclose personally identifiable information (PII) from the student’s education records without consent to any person whose knowledge of the information will assist in protecting a person from that threat. This is a flexible standard under which school administrators may bring appropriate resources to bear on the situation. If, based on the information available at the time of the determination, there is a rational basis for the educational agency’s or institution’s decisions about the nature of the emergency and the appropriate parties to whom the information should be disclosed, the Department will not substitute its judgment for that of the school in evaluating the circumstances and making its determination. 

What federal law requires that states provide assurances to the Secretary of Education that they had procedures in place to facilitate the transfer of student disciplinary information with respect to an LEA’s suspension or expulsion of a student?

Section 4155(b) of the Elementary and Secondary Education Act (ESEA), as amended, 20 U.S.C. § 7165(b), required, in accordance with FERPA, each state receiving funds under the ESEA to provide an assurance to the Secretary that it had “a procedure in place to facilitate the transfer of disciplinary records, with respect to a suspension or expulsion, by local educational agencies to any private or public elementary school or secondary school for any student who is enrolled or seeks, intends, or is instructed to enroll, on a full- or part-time basis, in the school.”  LEAs and schools, therefore, should include a notice in their annual notification of rights under FERPA that they forward education records to other schools that have requested the records and in which the student seeks or intends to enroll (§§ 99.7, 99.31(a)(2), and 99.34(a)(1)(ii)).  Unless the school or LEA includes this notice in their annual notification of FERPA rights or the parent or eligible student initiates the transfer of records, the school or LEA otherwise would be required to make a reasonable effort to notify the parent or eligible student of the disclosure at the last known address of the parent or eligible student. 

What is a “law enforcement unit record”?

Law enforcement unit records are records that are: (1) created by a law enforcement unit; (2) created for a law enforcement purpose; and (3) maintained by the law enforcement unit.(34 CFR § 99.8(b)(1)) Law enforcement unit records are not protected by FERPA because they are specifically excluded from the definition of “education records” and, thus, from the privacy protections afforded to parents and eligible students by FERPA.(34 CFR § 99.3, “Education Records”) Therefore, investigative reports and other records created and maintained by law enforcement units that meet this definition are not considered “education records” subject to FERPA and may be released subject to school policy, State law, and other applicable laws.

When members of a school’s law enforcement unit are school officials with access to students’ education records (or to PII contained in those records), they may not re-disclose the records or PII they receive as school officials under FERPA without appropriate consent or except as permitted under FERPA (34 CFR § 99.33), such as if the re-disclosure is to other school officials, or under the health and safety emergency exception. It is, therefore, advisable for law enforcement units to maintain law enforcement unit records separately from education records.

What is a “law enforcement unit”?

Under FERPA, “law enforcement unit” means any individual, office, department, division, or other component of a school, such as a unit of commissioned police officers or noncommissioned security guards, that is officially authorized or designated by that school or school district to (1) enforce any local, state, or federal law, or refer to appropriate authorities a matter for enforcement of any local, state, or federal law against any individual or organization other than the agency or institution itself; or (2) maintain the physical security and safety of the agency or institution.  See 34 CFR § 99.8(a)(1). 

Schools vary in who they authorize or designate to be their law enforcement unit, usually depending upon their size and resources.  Some larger school districts have their own fully equipped police units, while others have smaller security offices.  Other schools designate a vice principal or other school official to act as the law enforcement unit officer.  And other schools may utilize local police officers and SROs as their law enforcement officials.

What is a threat assessment team?

A threat assessment team is a group of officials that convene to identify, evaluate, and address threats or potential threats to school security.  Threat assessment teams review incidents of threatening behavior by students (current and former), parents, school employees, or other individuals.  Some schools may need assistance in determining whether a health or safety emergency exists in order to know whether a disclosure may be made under FERPA’s health or safety emergency provision.  Accordingly, members of a threat assessment team might include officials who can assist in making such decisions, such as school principals, counselors, school law enforcement unit officials, as well as outside medical and mental health professionals and local law enforcement officers.

What is an education program?

“Education program” is defined as any program principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, and any program that is administered by an educational agency or institution. 34 CFR § 99.3    

What is an education record?

"Education records" are records that are directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of the agency or institution. These records include but are not limited to grades, transcripts, class lists, student course schedules, health records (at the K-12 level), student financial information (at the postsecondary level), and student discipline files. The information may be recorded in any way, including, but not limited to, handwriting, print, computer media, videotape, audiotape, film, microfilm, microfiche, and e-mail.

Source: 34 CFR § 99.2 

What is FERPA?

The Family Educational Rights and Privacy Act (FERPA) is a federal law that affords parents the right to have access to their children’s education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records. When a student turns 18 years old, or enters a postsecondary institution at any age, the rights under FERPA transfer from the parents to the student (“eligible student”). The FERPA statute is found at 20 U.S.C. § 1232g and the FERPA regulations are found at 34 CFR Part 99.

What is the Protection of Pupil Rights Amendment (PPRA)?

The Protection of Pupil Rights Amendment (PPRA) applies to the programs and activities of a state education agency (SEA), local education agency (LEA), or other recipient of funds under any program funded by the U.S. Department of Education.  It governs the administration to students of a survey, analysis, or evaluation that concerns one or more of the following eight protected areas:

  1. political affiliations or beliefs of the student or the student’s parent;
  2. mental or psychological problems of the student or the student’s family;
  3. sex behavior or attitudes;
  4. illegal, anti-social, self-incriminating, or demeaning behavior;
  5. critical appraisals of other individuals with whom respondents have close family relationships;
  6. legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers;
  7. religious practices, affiliations, or beliefs of the student or student’s parent; or
  8. income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).

PPRA also concerns marketing surveys and other areas of student privacy, parental access to information, and the administration of certain physical examinations to minors.  The rights under PPRA transfer from the parents to a student who is 18 years old or an emancipated minor under state law.

What must a consent to disclose education records contain?

FERPA requires that a consent for disclosure of education records be signed and dated, specify the records that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom the disclosure may be made.  34 CFR § 99.30.  As such, oral consent for disclosure of information from education records would not meet FERPA’s consent requirements.

What must educational agencies or institutions do to ensure that only school officials with a legitimate educational interest see protected education records?

An educational agency or institution must use reasonable methods to ensure that school officials obtain access to only those education records in which they have legitimate educational interests. An educational agency or institution that does not use physical or technological access controls must ensure that its administrative policy for controlling access to education records is effective and that it remains in compliance with the legitimate educational interest requirement.

What policies must a local education agency (LEA) develop under the Protection of Pupil Rights Amendment (PPRA)?

The Protection of Pupil Rights Amendment (PPRA) requires that local education agencies (LEAs), in consultation with parents, develop the following local policies concerning student privacy, parents access to information, and administration of certain physical examinations to minors:

  • The right of a parent of a student to inspect, upon the request of the parent, a survey created by a third party before the survey is administered or distributed by a school to a student, and any applicable procedures for granting a request by a parent for reasonable access to the survey within a reasonable period of time after the requires is received;
  • Arrangements to protect student privacy that are provided by the LEA in the event of the administration or distribution of a survey to a student containing one or more of the eight protected areas of information;
  • The right of a parent or student to inspect, upon the request of the parent, any instructional material used as part of the educational curriculum for the student, and any applicable procedures for granting a request by a parent for reasonable access to instructional material within a reasonable period of time after the request is received;
  • The administration of physical examinations or screenings that the school or LEA may administer to a student;
  • The collection, disclosure, or use of personal information collected from students for the purpose of marketing or for selling that information, or otherwise providing that information to others for that purpose, including arrangements to protect student privacy that are provided by the LEA in the event of such collection, disclosure, or use;
  • The right of a parent of a student to inspect, upon request, any instrument used in the collection of personal information (a student or parent’s first and last name, a home or other physical address, a telephone number, or a Social Security identification number) before the instrument is administered or distributed to a student, and any applicable procedures for granting a request by a parent for reasonable access to such instrument within a reasonable period of time after the request is received.

A model PPRA general notification for use by LEAs may also be obtained on SPPO’s website at: Model Notification of Rights Under PPRA

What records are exempted from FERPA?

Records which are kept in the sole possession of the maker of the records, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the records.

Records of the law enforcement unit of an educational agency or institution. Law enforcement unit records are records that are: (1) created by a law enforcement unit; (2) created for a law enforcement purpose; and (3) maintained by the law enforcement unit.

Records relating to an individual who is employed by an educational agency or institution that are made and maintained in the normal course of business, relate exclusively to the individual in that individual’s capacity as an employee and are not available for use for any other purpose. However, records relating to an individual in attendance at the agency or institution who is employed because of his or her status as a student are education records.

Records on a student who is 18 years of age or older, or attending a postsecondary institution, that are: (1) made or maintained by a physician or other recognized professional acting in that capacity; (2) made, maintained, or used only in connection with treatment of the student; and (3) disclosed only to individuals providing the treatment.

Records that are created or received by an educational agency or institution after an individual is no longer a student in attendance and that are not directly related to the individual’s attendance as a student.

Records that are grades on peer-graded papers, before they are collected and recorded by a teacher.

What rights does a parent or eligible student have if, as a result of the hearing, the school decides that the information in the education record is not inaccurate or misleading?

The parent or eligible student has the right to place a statement in the record commenting on the contested information in the record or stating why he or she disagrees with the decision of the agency or institution. The agency or institution must maintain the statement with the contested part of the record for as long as the record is maintained disclose the statement whenever it discloses the portion of the record to which the statement relates.

What should the school or local educational agency do if it finds that a community-based organization has misused or inappropriately redisclosed the personally identifiable information (PII) from the education records it received from the school or LEA?

If the community-based organization misuses or inappropriately rediscloses personally identifiable information (PII) from education records, the school or LEA should immediately take steps to address and mitigate any harm or damage caused by the violation. The LEA or school should evaluate its options under the penalty and termination provisions of its written agreement, contract, or arrangement with the community-based organization and check any relevant state or local laws.  Depending on the severity of the circumstance, the LEA or school may decide to terminate its relationship with the community-based organization and require the organization to destroy or return the education records to the school or LEA. 

While FERPA does not require that you notify us, we recommend that you contact SPPO if a community-based organization violates FERPA, and provide us with information concerning the violation and any actions that you have taken.  SPPO has the authority to impose what is informally known as “the five-year rule ban” against the community-based organization if SPPO determines that it has violated certain provisions under FERPA.  The five-year rule means that SPPOcan instruct the originating LEA or school to not provide the community-based organization with further access to PII from students’ education records for a minimum period of five years.  SPPO may impose a longer period of time in which the community-based organization may not have access to PII.  The five-year rule ban applies regardless of whether the community-based organization is a recipient of Department funds.  For more information on penalties for FERPA violations, see 34 CFR § 99.67

What types of notification do local educational agencies (LEAs), i.e., school districts, have to make to parents about the Protection of Pupil Rights Amendment (PPRA)?

There are three types of notification an LEA must provide parents and students.  The first one is a general notification of their rights under PPRA. 

The second notice is a notification of specific events.  The following activities require notification:

  • Activities involving the collection, disclosure, or use of personal information collected from students for marketing purposes or for selling that information, or otherwise providing it to others for that purpose;
  • The administration of any survey containing one or more of the eight protected areas listed above: and
  • Any nonemergency, invasive physical examination or screening that is: (1) required as a condition of attendance; (2) administered by the school and scheduled by the school in advance; and (3) not necessary to protect the immediate health and safety of the student, or of other students.

The third notice is a notification of the policies LEAs are required to develop, in consultation with parents, under PPRA.  The LEA shall provide the notice at least annually, at the beginning of the school year, and within a reasonable period of time after any substantive change in the policies.

When a state educational agency (SEA) or local educational agency (LEA) discloses PII from education records to a CWA or tribal organization under the exception in FERPA, may the recipient of the data use it to evaluate their own programs?

No. The PII from education records disclosed to the CWA or tribal organization under the exception in FERPA must only be used for the purpose of addressing the education needs of children in foster care placement.  Thus, the PII from education records disclosed under the exception to FERPA may not be used for any other purpose, including to audit or evaluate a federal- or state-supported education program. 

When can law enforcement unit officials serve as “school officials”?

In order for law enforcement unit officials to be considered school officials, they must meet the criteria for who constitutes a school official that are set forth in the school’s or LEA’s annual notification to parents and eligible students of their rights under FERPA.  See § 99.7(a)(3)(iii).  This notification must be distributed by a school or LEA every year through a forum that is likely to be viewed by parents and eligible students, such as a student handbook, school website, a direct letter to parents, or a combination of methods, and must inform parents and eligible students of their rights under FERPA.  These officials may be considered “school officials” with “legitimate educational interests” and have access to students’ education records, but only if they:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

When does a parent or eligible student have a right to a hearing?

An educational agency or institution must hold a hearing within a reasonable time after it has received a request from the parent or eligible student challenging the content of the student’s education records on the grounds that the information contained in the education records is inaccurate, misleading, or in violation of the privacy rights of the student.

When does the school official exception allow a school or LEA to non-consensually disclose education records to a community-based organization?

A community-based organization may be considered a “school official” only if it:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records; 
  3. Is subject to the requirements of § 99.33(a) governing the use and redisclosure of personally identifiable information (PII) from education records. and
  4. Meets the criteria specified in the school’s or LEA’s Annual Notification of FERPA rights for being a school official with a legitimate educational interest in the education records. 

Once a school determines that a community-based organization meets the above criteria, the organization may have access to PII from education records, without consent, under the school official exception, in order to perform the required institutional services and functions for the school. (See § 99.31(a)(1)(i)(B))

When is a photo or video of a student an education record under FERPA?

As with any other “education record,” a photo or video of a student is an education record, subject to specific exclusions, when the photo or video is:  (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. (20 U.S.C. 1232g(a)(4)(A); 34 CFR § 99.3 “Education Record”)[1]

 

Directly Related to a Student:

FERPA regulations do not define what it means for a record to be “directly related” to a student. In the context of photos and videos, determining if a visual representation of a student is directly related to a student (rather than just incidentally related to him or her) is often context-specific, and educational agencies and institutions should examine certain types of photos and videos on a case by case basis to determine if they directly relate to any of the students depicted therein. Among the factors that may help determine if a photo or video should be considered “directly related” to a student are the following:

  • The educational agency or institution uses the photo or video for disciplinary action (or other official purposes) involving the student (including the victim of any such disciplinary incident);
  • The photo or video contains a depiction of an activity:
    • that resulted in an educational agency or institution’s use of the photo or video for disciplinary action (or other official purposes) involving a student (or, if disciplinary action is pending or has not yet been taken, that would reasonably result in use of the photo or video for disciplinary action involving a student);
    • that shows a student in violation of local, state, or federal law;  
    • that shows a student getting injured, attacked, victimized, ill, or having a health emergency;
  • The person or entity taking the photo or video intends to make a specific student the focus of the photo or video (e.g., ID photos, or a recording of a student presentation); or
  • The audio or visual content of the photo or video otherwise contains personally identifiable information contained in a student’s education record.

A photo or video should not be considered directly related to a student in the absence of these factors and if the student’s image is incidental or captured only as part of the background, or if a student is shown participating in school activities that are open to the public and without a specific focus on any individual.

Examples of situations that may cause a video to be an education record:

  • A school surveillance video showing two students fighting in a hallway, used as part of a disciplinary action, is directly related to the students fighting.   
  • A classroom video that shows a student having a seizure is directly related to that student because the depicted health emergency becomes the focus of the video. 
  • If a school maintains a close-up photo of two or three students playing basketball with a general view of student spectators in the background, the photo is directly related to the basketball players because they are the focus of the photo, but it is not directly related to the students pictured in the background. Schools often designate photos or videos of students participating in public events (e.g., sporting events, concerts, theater performances, etc.) as directory information and/or obtain consent from the parents or eligible students to publicly disclose photos or videos from these events.
  • A video recording of a faculty meeting during which a specific student’s grades are being discussed is directly related to that student because the discussion contains PII from the student’s education record.

 

Maintained by an educational agency or institution:

To be considered an education record under FERPA, an educational agency or institution, or a party acting for the agency or institution, also must maintain the record. Thus, a photo taken by a parent at a school football game would not be considered an education record, even if it is directly related to a particular student, because it is not being maintained by the school or on the school’s behalf. If, however, the parent’s photo shows two students fighting at the game, and the parent provides a copy of the photo to the school, which then maintains the photo in the students’ disciplinary records, then the copy of the photo being maintained by the school is an education record.

 

Exclusion for Law Enforcement Unit Records

The FERPA statute and regulations (20 U.S.C. 1232g(a)(4)(B)(ii) and 34 CFR §§ 99.3 and 99.8) exclude from the definition of education records those records created and maintained by a law enforcement unit of an educational agency or institution for a law enforcement purpose. Thus, if a law enforcement unit of an educational agency or institution creates and maintains the school’s surveillance videos for a law enforcement purpose, then any such videos would not be considered to be education records. If the law enforcement unit provides a copy of the video to another component within the educational agency or institution (for example, to maintain the record in connection with a disciplinary action), then the copy of the video may become an education record of the student(s) involved if the video is not subject to any other exclusion from the definition of “education records” and the video is:  (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. 

 

[1] The Individuals with Disabilities Education Act (IDEA) also contains privacy protections that apply to children with disabilities. 20 U.S.C. 1417(c) and 34 CFR §§ 300.610-300.626 and 34 CFR §§ 303.401-303.416. Under the IDEA, participating agencies must protect the personally identifiable information (PII), data, or records that are collected, maintained, or used by the participating agency. While the definition of “education record” under Part B of the IDEA cross-references the FERPA definition in 34 CFR § 99.3, the application of IDEA requirements may raise different questions.

When is it permissible to utilize FERPA’s health or safety emergency exception for disclosures?

In some situations, school administrators may determine that it is necessary to disclose personally identifiable information (PII) from a student’s education records to appropriate parties in order to address a health or safety emergency.  FERPA’s health or safety emergency provision permits such disclosures when the disclosure is necessary to protect the health or safety of the student or other individuals.  See 34 CFR §§ 99.31(a)(10) and 99.36.  This exception to FERPA’s general consent requirement is limited to the period of the emergency and generally does not allow for a blanket release of PII from a student’s education records.  Rather, these disclosures must be related to an actual, impending, or imminent emergency, such as a natural disaster, a terrorist attack, a campus shooting, or the outbreak of an epidemic disease. 

When the organization publishes the results of the study can it publish results in a way that allows individual students to be identified?

No.  Absent the prior, written consent from the parent or eligible student, FERPA prohibits personally identifiable information (PII) from education records from being published in a way that would allow individual students and their parents to be identified.  The organization conducting the study can use PII from education records to conduct the study for the school, but results must be published in a way that protects the privacy and confidentiality of the individuals involved. For example, when publishing data tables, the organization may need to use cell suppression or other methods of disclosure avoidance so that students cannot be identified through small numbers displayed in table cells. 

Who are considered “appropriate parties” that may receive information under the health or safety emergency exception?

Typically, local or state law enforcement officials, public health officials, trained medical personnel, and parents (including parents of an eligible student) are the types of appropriate parties to whom schools may disclose information under this FERPA exception.  An appropriate party under the health or safety emergency exception to FERPA’s general consent requirement is a party whose knowledge of such information is necessary to protect the health or safety of the student or other persons.  

Who is a “school official” under FERPA?

A “school official” includes a teacher, school principal, president, chancellor, board member, trustee, registrar, counselor, admissions officer, attorney, accountant, human resources professional, information systems specialist, and support or clerical personnel.    

FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

Who is responsible for obtaining written consent from the parent or eligible student: the school or the community-based organization?

FERPA requires that the parent or eligible student “provide a signed and dated written consent” before a school or LEA discloses personally identifiable information (PII) from a student’s education record, unless one of the conditions in § 99.31 of the regulations applies.  There is nothing in FERPA that would preclude a community-based organization from obtaining a signed and dated written consent as long as the consent: (1) specifies the education records that may be disclosed, (2) states the purpose of the disclosures; and (3) identifies the organization or other parties to whom the disclosure may be made.  34 CFR § 99.30(b).  

Would a Child Welfare Agency (CWA) or tribal organization be subject to FERPA’s “five-year rule” if it improperly redisclosed personally identifiable information (PII) from education records?

Yes.  FERPA requires that entities to which educational agencies and institutions disclose PII from education records protect that information from further disclosure.  See § 99.33.  Additionally, § 99.67(e) of the FERPA regulations provides that if the Student Privacy Policy Office (SPPO) determines that a third party outside the LEA or school improperly redisclosed PII from education records in violation of § 99.33 of the FERPA regulations, then the educational agency or institution may not provide that third party access to education records for a minimum period of five years. Thus, if SPPO determines that a CWA or tribal organization improperly redisclosed PII from the education records that it had received from the school or LEA, the school or LEA then would be banned from providing the CWA or tribal organization with access to education records for a minimum of five years.