FERPA fundamentals

The Family Educational Rights and Privacy Act (20 U.S.C. 1232g) is the federal law that governs student education records in the United States. Its regulations live at 34 CFR Part 99, and the U.S. Department of Education enforces it through its Student Privacy Policy Office.

FERPA binds educational agencies and institutions that receive funds under programs the Department of Education administers. In practice that means almost every public K-12 district and school, and most colleges and universities. It does not bind a software vendor directly. A vendor feels FERPA through the school: the school is responsible for every disclosure it makes, so it pushes FERPA's limits into the vendor's contract and expects the vendor to honor them.

That framing matters for everything later in this course. When a vendor asks whether something is allowed under FERPA, the real question is whether the school can lawfully disclose the data to the vendor for that purpose, and whether the vendor's use stays inside what the school authorized.

FERPA protects education records: records that are directly related to a student and maintained by the school or by a party acting for the school (34 CFR 99.3). The definition is broad. It is not limited to transcripts and report cards. Attendance logs, discipline files, counseling notes kept in the official file, special education plans, emails about a specific student and data held in a vendor's platform on the school's behalf can all be education records.

Some records are carved out of the definition. The main exclusions are sole possession notes that a staff member keeps as a personal memory aid and shares with no one, records of a school's law enforcement unit created for law enforcement purposes, ordinary employment records, certain treatment records of students 18 and older at the postsecondary level, and alumni records created after the student has left.

The privacy protection attaches to personally identifiable information (PII) from education records. PII includes the obvious direct identifiers such as name, address and student ID, but also indirect identifiers such as date of birth or mother's maiden name, and any information that, alone or combined, would let a reasonable person in the school community identify the student with reasonable certainty. That last clause is the one that catches de-identification attempts: removing names from a small class report does not make it anonymous if the remaining columns still point to one child.

FERPA gives parents a short list of rights. They can inspect and review the student's education records, and the school must respond within 45 days of a request (34 CFR 99.10). They can ask the school to amend records they believe are inaccurate or misleading, and they are entitled to a hearing if the school refuses (99.20 to 99.22). They must give written consent before the school discloses PII from education records, unless an exception applies (99.30). And they can file a complaint with the Department of Education.

These rights transfer from the parent to the student when the student turns 18 or enters a postsecondary institution at any age. At that point the student is an eligible student and the rights are theirs (99.5). A college therefore deals with students directly, while a K-12 district usually deals with parents.

Schools must notify parents and eligible students of these rights every year (99.7). That annual notice is easy to overlook, but it is one of the most important documents in this course, because it is where the school defines who counts as a school official and what counts as a legitimate educational interest. Vendors depend on those definitions, as Module 2 explains.

A school may designate certain low-sensitivity items as directory information, such as name, grade level, participation in activities, honors and dates of attendance, and disclose them without consent (34 CFR 99.37). To do that it must tell families which items it treats as directory information and give them a reasonable period to opt out.

Directory information is narrower than it sounds. A Social Security number can never be directory information, and a student ID can only be used as directory information in limited circumstances, such as when it is displayed on a badge and cannot be used to access records without a password. Schools can also adopt a limited directory information policy that restricts disclosure to specific parties or purposes.

For a vendor the practical point is this: directory information is a policy choice each school makes, and a family's opt-out has to be honored. A product that publishes student names, for example on a public leaderboard, needs to know which students have opted out before it shows anything.

Written consent is the default, but 34 CFR 99.31 lists exceptions that let a school disclose PII without it. The ones you will meet most often are disclosures to school officials with a legitimate educational interest, to another school where the student seeks to enroll, to authorized representatives for audits or evaluations of education programs, to organizations conducting studies for the school, in connection with financial aid, to comply with a judicial order or lawfully issued subpoena, and to appropriate parties in a health or safety emergency.

Each exception has its own conditions. The studies exception and the audit or evaluation exception both require a written agreement with specific terms. The emergency exception applies only to a specific, articulable and significant threat, and the school must record what the threat was. Most disclosures also have to be recorded in the student's record of disclosures, which families can inspect (99.32).

Information that is properly de-identified is not PII, so a school can release it without consent (99.31(b)). The hard part is the word properly. The school has to make a reasonable determination that no student is identifiable, taking into account other information that is reasonably available. Small cell sizes, rare categories and combinations of attributes are the usual ways de-identification fails.

FERPA's ultimate penalty is the withdrawal of federal education funds from the school. In practice the Department of Education resolves complaints by working with the school to come into compliance. The Supreme Court held in Gonzaga University v. Doe (2002) that FERPA does not give individuals a private right to sue for damages.

That can make FERPA sound toothless, but it is not how districts experience it. Districts treat FERPA, state student privacy laws and their own board policies as hard requirements in procurement. A vendor that cannot explain how it fits the school official exception, or that has vague terms about data use, simply does not get through the contract review.