Part III: How Does FERPA Affect Schools?

Posted by Claire E. Parsons

The first thing you have to consider when you ask how FERPA affects schools is which schools?  FERPA makes it clear that all schools or school systems are not subject to its requirements.  Instead, FERPA only applies to schools that are considered an “educational agency or institution.”  34 CFR 99.1.  Such entities have the responsibility of providing educational services to student or overseeing the provision of educational services to students and which receive federal funding.  34 CFR 99.1(a).  In general then, all public schools and universities are covered by FERPA and private schools may be covered if they receive federal funds.

As it happens, federal funds are both the carrot and stick under FERPA.  Just as funding is an essential ingredient for school to be subject to FERPA, the loss of such funding is the primary means of enforcing its requirements.  The Supreme Court has held that FERPA, like some other federal statutes, does not provide an individually enforceable privacy right for the violation of its provisions.  Gonzaga University v. Doe, 536 U.S. 273(2002).  For example, then, if a school mistakenly disclosed a student’s educational records to a third party, the affected student would not have the right to sue for damages or injunctive relief under 42 U.S.C. § 1983.  At the same time, however, that erring school could be in for worse damage, because the Department of Education retains the authority to pull funding for schools who fail to comply with FERPA.  34 CFR 99.67(a)(1) & (3).  For very practical reasons, then, schools—much like health care providers under HIPPA—have very good reason to be concerned with confidentiality.

Given these incentives, schools must take care to comply with FERPA to the greatest extent possible.  First of all, this means that schools subject to FERPA must timely respond to student and parent requests to view or challenge educational records.  To ensure that this occurs, many school districts have implemented policies and procedures to deal with FERPA requests for records or FERPA challenges.  Second, schools must ensure the privacy of student records which contain personally identifiable information.  As mentioned previously, this means that schools must deny requests for student records containing personally identifiable information from the general public unless consent is obtained or a qualifying exception applies.  In addition, schools must train their staff to avoid oral disclosures of student personally identifiable information to third parties.  See Letter to Benton Area Sch. Dist., (FPCO 10/19/99) (school official violated FERPA when it publically declared that student was a “special education student”).

With that said, this does not mean that schools are prohibited from releasing any information about their students.  If that were the case, schools would not be able to distribute programs for commencement ceremonies, athletic events, or yearbooks without violating FERPA.  Instead, FERPA makes it clear that the general information which is often publically known may be disclosed without parental or student consent.  34 CFR 99.37.  This information is called “directory information,” and examples include a student’s grade level, dates of attendance, telephone number, e-mail address, participation in activities, degrees or awards earned, or even height, weight, and numbers for participants on athletic teams.  34 CFR 99.3.  Because this information “would not generally be considered harmful or an invasion of privacy if disclosed” it can be released or disclosed under FERPA to third parties without student or parent consent.  Before disclosing this information, schools must notify students and parents of the information that they intend to designate as “directory information” and give them an opportunity to object.  34 CFR 99.7; 34 CFR 99.37(a).

In addition, new FERPA regulations allow for the disclosure of educational records from which personally identifiable information has been redacted to third parties without student or parental consent.  34 CFR 99.31(b)(1).  In essence, these regulations allow the disclosure of student records without consent if the student’s identity would not be revealed from the information that is released.  Id.  This requires the records to be “de-identified” by redacting all personally identifiable information from the documents.  Id.  In making such disclosures, school districts must take into account the other records it has already released and the information publically available to ensure that even the redacted documents do not contain enough information that the student’s identity might be guessed.  Id.

In the fourth and final section of our series on FERPA, we’ll explain the relevant exceptions under FERPA that may allow the nonconsensual release of student records containing personally identifiable information.  Stay tuned for Part IV: How Do Third Parties Get Student Records?