Define:
What schools does FERPA apply to?
applies to all educational institutions that receive federal funding (both K-12 and universities)
Define:
student
under FERPA
any individual who is or has been in attendance at an educational agency or institution where:
- attendance includes individuals who are present on campus as well as those who participate via the internet
- does NOT include individuals who only applied to an educational institution or were accepted but didn’t enroll
Define:
educational record
under FERPA
all records directly related to the student and maintained by or on behalf of the K-12 school or university where:
- record: any information recorded in a way, including handwriting, print, computer media (emails), video or audio tape, film, etc.
Define:
personally identifiable information
under FERPA
- personal identifiers like student number, DOB, POB
- information that alone or in combo can be linked to a student and would allow the student to be identified with reasonable certainty
- info requested by a person whom the school reasonably believes knows the identity of the student to which the education record is linked
Define:
directory information
under FERPA
information that would not generally be considered harmful or an invasion of privacy if disclosed
How do schools determine what “directory information” is?
under FERPA
- allows individual educational institutions to create their own definition for this based on lists of examples provided in statutes and rules laid down by DoE
- before an educational institution can declare information to be directory information, must provide students with opportunity to opt out of release of their directory information (unless it falls under a FERPA exception)
- student ID # can only be used as directory information if the number can’t be used to access education records without another factor known only by the authorized user
Who is the rights holder under FERPA?
- when student enrolled in high school → parent holds rights under FERPA if student under 18, even if student also attending classes at college or university
- student only attending college or university → student is holder regardless of age
When the student is the rights holder, when can a school disclose educational records to a parent?
under FERPA
- school may disclose to parents educational records of student without their consent if student is a dependent for tax purposes
- with student consent
When is disclosure of education records permitted?
under FERPA
if one of following conditions is met:
- info isn’t “personally identifiable”
- info is “directory information” that student hasn’t blocked release of
- consent provided by rights holder
- disclosure is made to the rights holder
- statutory exception applies as long as school uses “reasonable methods” to identify the party to whom they disclose the information
What constitutes valid student consent to disclosure?
under FERPA
must be signed, dated and written and must (1) identify the records to be disclosed, (2) purpose of disclosure and (3) to whom the disclosure is being made
What are the statutory exceptions under which a school can disclose PII from an education record without student consent?
- disclosure to school officials who have determined a legitimate educational interest: if record is relevant and necessary to their responsibilities
- disclosure to educational institution in which a students seeks/intends to/currently is enrolled, when disclosure for purpose related to student’s enrollment or transfer
- disclosure in connection with financial aid that the student has received or for which the student will apply, when the purpose of the disclosure is to determine the student’s eligibility for aid, conditions to obtain aid, or amount of financial aid
- disclosure to organizations doing research studies for, or on behalf of, educational institutions for the purpose of developing predictive tests, administering student aid programs, or improving school instruction
- disclosure to accrediting organizations to fulfill accrediting duties
- disclosure to the alleged victim of a forcible or nonforcible sex offense
- disclosure of information related to sex offenders and others when the information is provided to the school under federal registration and disclosure requirements
- disclosure to a person or entity that is verified as the party that provided or created that record
- disclosure to law enforcement or otherwise to comply with a judicial order or subpoena (but school must make reasonable efforts to notify the student prior to the disclosure, unless it is a legal matter that orders nondisclosure)
- disclosure to appropriate parties in connection with a health or safety emergency, if knowledge of this info necessary to protect health or safety of student or others where the harm is articulable and significant (rational basis standard)
What rights do students/parents have under FERPA?
- right to access and review most education records
- right to request corrections to education records
- receive annual notice of their rights under FERPA
- file complaints with the DoE
Define:
When does an educational institution have to respond to a request to access and review education records by the rights holder?
under FERPA
educational institution must provide access to record within 45 days of request and respond to reasonable request for explanations of records
Define:
right to request corrections to education records
if student believes record is inaccurate, misleading or in violation of their privacy
- if request granted, record must be corrected within a reasonable time
- if request denied, student can request a hearing
- if hearing affirms, student’s request, record must be amended and student notified; if request denied, institution must notify student of their right to place a written statement in the file about the contested record
What are the requirements for a hearing in which a student’s request to amend their education record was denied?
- student must receive prior and reasonable notice of the time, place and date
- hearing is held within reasonable time after request
- hearing conducted by party without direct interest in outcome
- student given “full and fair” opportunity to present their case, with or without assistance or representation
- decision must be based on evidence presented at hearing, delivered in writing, within a reasonable amount of time after hearing, and must contain a summary and explanation for the decision
What action can a student/parent take under FERPA?
- no private right of action
- can file formal complaints with Department of Education
Does FERPA preempt state law?
no
What does the Protection of Pupil Rights Amendment of 1978 provide?
provides certain rights to parents of minors with regard to the collection of sensitive information from students through surveys, including:
- political affiliations
- mental and psychological problems potentially embarrassing to the student and their family
- sex behavior and attitudes
- illegal, antisocial, self-incriminating, and demeaning behavior
- critical appraisals of other individuals with whom respondents have close family relationships
- legally recognized privileged or analogous relationships (lawyer, physician, etc.)
- religious practices, affiliations or beliefs of student/student’s parent
- income (other than required by law for determining eligibility for program)
Who does the Protection of Pupil Rights Amendment apply to?
all K-12 schools that receive federal funding (not colleges or universities)
What does the No Child Left Behind Act of 2001 require?
broadened PPRA to limit the collection and disclosure of student survey information by requiring schools to:
- enact policies regarding the collection, disclosure or use of personal information about students for commercial purposes
- allow parents to access and inspect surveys and other commercial instruments before they are administered to students
- provide advance notice to parents about the approximate date when these activities are scheduled
- provide parents the right to opt out of surveys or other sharing of student information for commercial purposes
Define:
What does the Individuals with Disabilities Education Act (IDEA) require?
federal law that ensures eligible students (ages 3-12) receive a free appropriate public education (FAPE)
- requires schools to provide special education services that are tailored to each eligible student through the student’s individualized education program (IEP)
- provides parent or adult students with the right to inspect educational records, to request explanation of educational records and ask that educational records be amended
How does the HIPAA Privacy Rule interact with FERPA?
health records are subject to FERPA where a public elementary or secondary school provides a nurse for student health issues
Define:
education technology
computer software, mobile applications and web-based tools to educators, students and parents
FERPA and EdTech: Google
- in 2014, students in CA who used Google’s Apps for Education sued Google, accusing the company of scanning millions of emails sent to and received by students → Google agreed to change business practices after assertion that Google violated FERPA
- also led U.S. DoE to issue guidelines in 2014: instructs schools and universities to determine on a case-by-case basis whether the edtech companies they partner with utilize FERPA-protected data, and if so, they must ensure FERPA requirements are met
-
Structure of U.S. Law17
-
Technological Aspects of Privacy2
-
Enforcement of U.S. Privacy and Security Laws16
-
Information Management from a U.S. Perspective110
-
Cross-sector FTC Privacy Protection31
-
Healthcare / Medical63
-
Financial67
-
Education26
-
Telecommunications and Marketing54
-
Law Enforcement and Privacy30
-
National Security and Privacy10
-
Civil Litigation and Privacy11
-
Intro to Workplace Privacy7
-
Privacy Before, During and After Employment25
-
Federal vs. State Authority6
-
Data Privacy and Security Laws44
-
Data Breach Notification Laws14
