FERPA, RECENT CHANGES IN FEDERAL REGULATIONS, AND STATE COMPLIANCE
By: John Moran, Principal Analyst
1. the federal Family Educational Rights and Privacy Act (FERPA),
2. the recent changes in the federal regulations giving outside entities more access to student information and any rationale for the changes, and
3. how states comply with the law.
FERPA is a federal law enacted in 1974 that protects, with some exceptions, the privacy of student educational records. It requires schools, school districts, and federally-funded institutions to keep personally identifiable information (PII) contained in a student's records confidential unless (1) the parents (of students under age 18) or students age 18 or older (“eligible students”) consent to disclose it or (2) one of the legal exceptions to the confidentiality requirement applies. In addition to the standing exceptions to confidentiality, the law permits local school districts to adopt a policy that designates certain student information as “directory information” that may be disclosed without prior consent, but districts must notify parents of this policy and allow them to opt out of having the district disclose directory information.
The law also requires school districts and schools to (1) give parents and students access to the student's records and an opportunity to seek to have records amended if they believe the records need correcting and (2) annually notify parents and eligible students of their rights under FERPA.
The new regulations make it easier for various educational institutions, such as state education departments, to share PII with other state agencies and with outside organizations without getting the parents' or student's prior consent. The U.S. Department of Education (DOE) suggests the changes are (1) necessary for the effective use of student data to evaluate educational programs and (2) do not go beyond DOE's regulatory authority.
FERPA does not require that states demonstrate compliance, but allows any parent or student to file a complaint with DOE against any educational body they believe is in violating FERPA. By comparison, other federal education law, such as the Individuals with Disabilities Education Act (IDEA), which guarantees certain educational rights for students with disabilities, requires annual documentation from state departments of education to show compliance. As for FERPA, DOE's Family Policy Compliance Office receives and investigates complaints.
Right to Review Records
Under FERPA parents (and eligible students) have the right to review all education records that relate to their children. School districts or other education institutions must give parents access to these records within 45 days of the request. (Also, under the state FOIA law, a parent making such a request would be entitled to “prompt” access to the records.) If a copy of the education record is made for the parents, the law allows school districts to charge a reasonable fee.
Under both FERPA and state law, non-custodial parents have the right to access student records. FERPA provides this access unless the district has evidence that there is a court order, state law, or other legal requirement related to custody that specifically revokes this right.
Districts and institutions are required to provide parents with an annual notification of their rights under FERPA. The notice must inform parents that they have the right to:
1. inspect and review the student's education records;
2. seek changes to the student's education records that the parent or eligible student believes to be inaccurate, misleading, or violates the student's privacy rights;
3. consent to disclose PII from the student's education records, except to the extent that FERPA permits disclosure without consent (see below); and
4. file a complaint with DOE regarding the educational agency or institution allegedly failing to comply with the requirements (34 CFR § 99.7).
The notice must describe how parents and students may exercise these rights. The regulations do not dictate how the notice must be delivered, but states it must be in a manner that is “reasonably likely to inform the parents or eligible students of their rights.” The school districts must provide “effective” notification to parents who have a disability or whose primary language is not English (34 CFR § 99.7(b)).
Disclosure with Consent
Except for the exceptions described below, under the law parents (or eligible students) must give permission before confidential PII is disclosed.
The consent must:
1. specify the records that may be disclosed,
2. state the purpose of the disclosure, and
3. identify the party or class of parties receiving the information.
Exceptions to Consent Requirement
FERPA has always allowed a number of exceptions to the rule that an agency must obtain parental or eligible student consent before releasing PII to another entity (34 CFR § 99.31). FERPA allows PII disclosure from a student's record without consent when the PII is disclosed to:
1. school officials, including teachers, within the agency or institution, who are determined to have legitimate educational interests;
2. a contractor, consultant, volunteer, or other party that an agency or institution has outsourced institutional services or functions and meets certain requirements, including being under the agency's direct control with respect to the records;
3. school officials of another school, district, or postsecondary institution where the student is already enrolled or seeks to enroll;
4. local and state education authorities, and certain federal officials, including comptroller general, attorney general and education secretary;
5. determine financial aid eligibility;
6. state and local officials addressing a juvenile justice case if the authorizing state law was adopted before November 19,1974 (when FERPA became effective);
7. organizations conducting studies for, or on behalf of, educational agencies or institutions to develop, validate, or administer predictive tests; administer student aid programs; or improve instruction;
8. accrediting organizations carrying out accrediting functions;
9. parents, as defined in under FERPA, of a dependent student;
10. comply with a judicial order or subpoena, after the agency made a reasonable attempt to notify the parent or eligible student before disclosing the information;
11. assist with a health or safety emergency;
12. a victim of an alleged violent crime or a non-forcible sex offense, but limited to the final results of the postsecondary education disciplinary proceeding;
13. a parent of a student under age 21 at an institution of postsecondary education when it concerns the student's violation of any law, rule, or policy of the institution governing the use or possession of alcohol or a controlled substance; and
14. officials maintaining the records of a sex offender and other offenders required to register under federal Violent Crime Control and Law Enforcement Act of 1994.
Under the regulations, a school district may choose to designate certain student information as “directory information,” thus establishing a separate category of information under FERPA. In doing so, any PII that is designated as directory information does not need prior consent before being disclosed. But, if a district chooses to designate items as directory information it must include this in its annual FERPA notice to students and parents, and the notice must inform them that they can choose not to allow some or all their directory information disclosed.
Examples of directory information include: name, address, telephone listing, email address, date and place of birth, photograph, major field of study, dates of attendance, grade level, enrollment status, participation in officially recognized activities and sports, degrees and awards, and the most recent school attended. A student's Social Security number cannot be included in directory information.
A school district or institution can disclose directory information about former students (e.g., graduates) without complying with the notice and opt out conditions. However, the school district or institution must continue to honor any valid request to opt out of the disclosure of directory information made while a student is in attendance unless the student subsequently rescinds the opt out request.
Because FERPA does not require the disclosure of directory information many district refuse to disclose it to third parties that request directory information. On the other hand, the federal No Child Left Behind Act (P.L. 107-100) requires disclosure of some directory information (name, address, and telephone number) to military recruiters and colleges and universities.
SIGNIFICANT CHANGES IN THE RECENT REGULATIONS
This report focuses on the following changes made in FERPA regulations.
Under certain conditions, the new regulations allow broader access to PII. They allow education agencies or institutions with student PII to designate an authorized representative to receive PII in order to audit or evaluate (1) publicly supported education programs or (2) the federal legal compliance of these programs. The authorized representative can be another government agency that is given access to PII that would not otherwise have access.
The prior regulations used the term authorized representative but did not define it. The new regulations define the term to include individuals or entities that agencies with PII can designate to perform audits or evaluations.
The new regulations no longer require the authorized representative be under the direct control of the education agency releasing the information (the direct control requirement still exists for contractors, consultants, and others that an education agency chooses to outsource functions to; see below).
The DOE narrative that accompanies the new regulations suggests the broader use of this term may specifically apply to programs evaluations matching education data with post-graduation employment data. “We believe that our prior interpretation of the term 'authorized representative' unduly restricted state and local educational authorities from disclosing PII from education records for the purpose of obtaining data on post-school outcomes, such as employment of their
former students, in order to evaluate the effectiveness of education programs,” DOE wrote in the narrative to the regulations published in the December 2, 2011 Federal Register.
Some groups, including the National School Boards Association (NSBA), have raised questions about the changes, saying DOE had gone too far in loosening the restrictions on PII under FERPA. In a May 23, 2011 letter to DOE Secretary Arne Duncan (see attachment A), an NSBA senior attorney wrote that DOE's definition of “authorized authority” is overly broad and the definition should be limited to employees of the educational agency that possesses the information or a contractor specifically under the agency's direct control.
The DOE narrative also suggests that one government agency, such as a state Labor Department, cannot be under the director control of another agency at the same level of government, such as the state Department of Education, therefore the “direct control” principle does not make sense in that context.
Research Studies Exception
FERPA regulations allow education agencies and institutions to disclose PII without consent to organizations “conducting studies for, or on behalf of” education agencies to develop, validate, or administer predictive tests; administer student aid programs; or improve instruction if certain requirements are followed. These requirements include (1) conducting studies in a way that does not permit the personal identification of students or their parents to anyone other than those conducting the study and (2) destroying the information when it is no longer needed for the study.
The prior regulations prevented a state education department from releasing PII it received from local education agencies to a research organization unless it had specific legal authorization to do so (this is sometimes referred to as “redisclosure” as the local agency had already disclosed the information to the state agency). Under the new regulations, state education agencies can enter into agreements with research organizations for any of the previously mentioned study purposes without specific authority. The narrative accompanying the final regulations states, “the department believes this regulatory change will be beneficial because it will reduce the administrative costs of, and reduce the barriers to, using PII from education records … in order to conduct studies to improve instruction in education programs.”
In its 2011 letter to DOE, NSBA also objected to this change and suggested it exceeds the statutory authority of FERPA. NSBA urged that a state education department should be required to seek permission from the local education agency that supplies the PII before the state agrees to provide that information to a research organization. The letter states:
The studies exception to FERPA allows for disclosure of PII without consent to “organizations conducting studies for, or on behalf of, educational agencies or institutions.” The “for, or on behalf of” language indicates that the educational agency or institution to which the PII relates wants and agrees to the study being conducted and is aware of its purpose and intended use of results. NSBA suggests that if a state or local educational authority or agency… wants to turn over non-consensual PII to an organization conducting a study then it should be required to first obtain written consent from the original disclosing agency or institution….
Below are links to various websites for additional information on FERPA:
● FERPA, U.S. Department of Education
● FERPA, Electronic Code of Federal Regulations, U.S. Government Printing Office
● Federal Register, Discussion of Final Regulatory Changes
● FERPA General Guidance for Parents