Ask Matt – March 2012 – Family Educational Rights Privacy Act (FERPA) Matt Carver, J.D., Director of Legal Services tel - 515.267.1115 fax - 515.267.1066 11/5/2017

Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. 11/5/2017

FERPA - Sec. 99.31 Under what conditions is prior consent not required to disclose information? (a) An educational agency or institution may disclose personally identifiable information from an education record of a student without the consent required by §99.30 if the disclosure meets one or more of the following conditions: (1)(i)(A) The disclosure is to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests. 11/5/2017

FERPA - Sec. 99.31 Under what conditions is prior consent not required to disclose information? (cont.) (B) A contractor, consultant, volunteer, or other party to whom an agency or institution has outsourced institutional services or functions may be considered a school official under this paragraph provided that the outside party— ( 1 ) Performs an institutional service or function for which the agency or institution would otherwise use employees; ( 2 ) Is under the direct control of the agency or institution with respect to the use and maintenance of education records; and ( 3 ) Is subject to the requirements of §99.33(a) governing the use and redisclosure of personally identifiable information from education records. 11/5/2017

FERPA - Sec. 99.31 Under what conditions is prior consent not required to disclose information? (cont.) (ii) An educational agency or institution must use reasonable methods to ensure that school officials obtain access to only those education records in which they have legitimate educational interests. An educational agency or institution that does not use physical or technological access controls must ensure that its administrative policy for controlling access to education records is effective and that it remains in compliance with the legitimate educational interest requirement in paragraph (a)(1)(i)(A) of this section. (2) The disclosure is, subject to the requirements of §99.34, to officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student's enrollment or transfer. 11/5/2017

FERPA - Sec. 99.34 What conditions apply to disclosure of information to other educational agencies or institutions? (a) An educational agency or institution that discloses an education record under §99.31(a)(2) shall: (1) Make a reasonable attempt to notify the parent or eligible student at the last known address of the parent or eligible student, unless: (i) The disclosure is initiated by the parent or eligible student; or (ii) The annual notification of the agency or institution under §99.7 includes a notice that the agency or institution forwards education records to other agencies or institutions that have requested the records and in which the student seeks or intends to enroll or is already enrolled so long as the disclosure is for purposes related to the student's enrollment or transfer; . . . 11/5/2017

FERPA - Transfer of Student Records - Schools are permitted to disclose a student's education records to officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll. The regulations permit SEAs and other State educational authorities to facilitate this transfer of students' education records by allowing them to re-disclose information on behalf of school districts and institutions in the State as part of their consolidated education data system. These changes were made to help school districts and institutions obtain access to a new student's education records, including the student's scores on State assessments, in a more timely manner. 11/5/2017

FERPA - Sec. 99.36 What conditions apply to disclosure of information in health and safety emergencies? (a) An educational agency or institution may disclose personally identifiable information from an education record to appropriate parties, including parents of an eligible student, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.

 11/5/2017

FERPA - Sec. 99.36 What conditions apply to disclosure of information in health and safety emergencies? (cont.) (b) Nothing in this Act or this part shall prevent an educational agency or institution from--
 (1) Including in the education records of a student appropriate information concerning disciplinary action taken against the student for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community;
 (2) Disclosing [disciplinary action against a student and the related risky conduct of the student] to teachers and school officials within the agency or institution who the agency or institution has determined have legitimate educational interests in the behavior of the student; or
. . . 11/5/2017

FERPA - Sec. 99.36 What conditions apply to disclosure of information in health and safety emergencies? (cont.) (c) In making a determination under paragraph (a) of this section, an educational agency or institution may take into account the totality of the circumstances pertaining to a threat to the health or safety of a student or other individuals. If the educational agency or institution determines that there is an articulable and significant threat to the health or safety of a student or other individuals, it may disclose information from education records to any person whose knowledge of the information is necessary to protect the health or safety of the student or other individuals. If, based on the information available at the time of the determination, there is a rational basis for the determination, the Department will not substitute its judgment for that of the educational agency or institution in evaluating the circumstances and making its determination. 11/5/2017

FERPA - Disclosures to parents - Even after the rights under FERPA have transferred from parents to an eligible student, an educational agency or institution may generally disclose education records to the student's parents without consent under several existing provisions of FERPA. For example, the final regulations clarify that under 99.5 and 99.36 an educational agency or institution may disclose information to an eligible student's parents in a health or safety emergency, regardless of whether the student is a dependent for Federal income tax purposes. A school may disclose information to parents under any circumstances if the eligible student is a dependent for Federal income tax purposes. 11/5/2017

FERPA - Release of Data - Educational agencies and institutions are permitted to release, without consent, education records, or information from education records that have been de-identified through the removal of all personally identifiable information. The final regulations amend the definition of "personally identifiable information" and offer guidance to educational agencies and institutions and State educational authorities on determining how to de-identify information. The regulations also identify factors that should be considered before releasing this information. For instance, the regulations require educational agencies and institutions and other parties that release de-identified education records to take into account information that is linked or linkable to a specific student as well as other reasonably available information about a student, so that the cumulative effect of multiple disclosures of student data does not allow a reasonable person in the school community to identify the student with reasonable certainty. 11/5/2017

FERPA – Recent Changes* The U.S. Department of Education recently published new final amendments to regulations implementing FERPA. The amended regulations took effect January 3, 2012. *Some bullets adapted from article titled: U.S. Department of Education Final FERPA Regulations: Advisory and Overview, Prepared by Education Counsel, LLC for the Data Quality Campaign on December 2, 2011 11/5/2017

FERPA – Recent Changes Directory Information Changes Limited recipients/purposes for directory information disclosures. The regulations clarify that an educational agency or institution may adopt a directory information policy limited to disclosure to specific parties, for specific purposes, or both – and not just a directory information policy for disclosure of directory information to the public – if it specifies those limits in the annual public notice it provides to parents and eligible students. (Parent consent is not required for the release of directory information.)   "Directory information" is personally identifiable information in a student's education record – such as a student's name, address, dates of attendance, etc. – that would not generally be considered harmful or an invasion of privacy if disclosed. A parent or eligible student still has an opt out right to require that directory information relating to the student not be disclosed without prior written consent. 11/5/2017

FERPA – Recent Changes State and local data systems - The regulations broaden access to data by: Broadening the categories of individuals/entities that may receive data for evaluation/audit purposes. Subject to privacy safeguards discussed below, the regulations permit disclosure of data to any entity or person designated by the state or local educational authority for the purpose of evaluating or auditing federal or state- supported education programs, or enforcing compliance with federal legal requirements relating to those programs. Thus, a state or local education official may disclose data to a workforce agency or other non-education agency for these purposes. 11/5/2017

FERPA – Recent Changes Authorizing state or local agency disclosures for research studies. The regulations provide that nothing in FERPA prevents a state or local education authority from [1] entering into agreements with organizations conducting research studies (for example, to improve instruction) and [2] re-disclosing data to such organizations for such studies on behalf of schools, postsecondary institutions, or school districts (subject to the same kind of agreement to protect privacy that already applies to schools, postsecondary institutions, and school districts making such disclosures). This provision, for the first time, makes the research studies provision in FERPA applicable to state-level data. The preamble to the regulations recognizes that state educational agencies and state higher education agencies typically have either express or implied authority to perform and support research to improve instruction in publicly funded education programs for the benefit of multiple educational agencies and institutions in their state. 11/5/2017

FERPA – Recent Changes New Privacy Safeguards - The regulations balance the provisions for expanded access, described above, with new provisions to protect the privacy of student records, including: Written agreements with authorized representatives. The regulations require written agreements that address privacy safeguards between the state or local education authority and its authorized representative to which it provides data to carry out evaluations, audits or compliance activities. The agreements, among other things, must designate the authorized representative as such; specify the information to be disclosed; describe the activity with sufficient specificity to make clear that it comes within an authorized purpose; provide for the destruction of the data when no longer needed for the authorized purpose (and the time period for such destruction); and establish policies and procedures to protect the student data from further disclosure and unauthorized use, including limiting use of the data to authorized representatives with legitimate interests in the purposes of the disclosure.   11/5/2017

FERPA – Recent Changes Authorizing disclosures from postsecondary institutions/data systems to K-12 officials/data systems and from K-12 agencies/data systems to publicly funded early childhood learning programs/data systems. The regulations reverse ED's prior interpretation that data could be disclosed only to evaluate or audit programs of the disclosing agency. That previous interpretation barred postsecondary institutions from disclosing data to local school districts if the purpose was to evaluate how well the K-12 system or secondary schools had prepared students for college. It had a parallel effect on the disclosure of data by elementary schools to publicly funded early childhood learning programs, an effect also reversed by the new regulations. An SEA or LEA can now evaluate the preparedness of its high school graduates for postsecondary education by designating the postsecondary institution as its authorized representative through a written agreement. The SEA/LEA could then obtain information such as remedial courses their graduates had to take in college, or how long their graduates persisted in college. State or Federally-funded early childhood education programs can now obtain information on how well their students performed in kindergarten by designating an SEA or LEA as their authorized representative through a written agreement. 11/5/2017

FERPA – Recent Changes Strengthened Enforcement. The regulations also provide for strengthened enforcement of FERPA: Debarring access for violations. The regulations provide that if an authorized representative that receives data to perform evaluations, audits, or compliance activities or any other recipient of disclosures under FERPA (including a state or local educational agency) improperly re-discloses the data in violation of FERPA, the educational institution or authority that provided the data would be required to deny that recipient further access to personally identifiable data for at least five years.   No opt out for student IDs/badges. Based on school security and safety concerns, the regulations provide that parents (or eligible students) may not use their right to opt out of directory information disclosures to prevent an educational agency or institution from requiring students to disclose the student's name, identifier, or email address in a class in which the student is enrolled or prevent the agency or institution from requiring the student to wear or otherwise publicly disclose student ID badges or cards designated as directory information. 11/5/2017

FERPA Do you have to provide a class list of juniors to a company selling class rings? NO. If the parents or eligible student do not opt out of providing directory information, then the school district MAY provide such a list to Jostens, but you are not required to do so. 11/5/2017

FERPA Do you have to provide a class list of juniors to the Army? Probably. As long as the parents/guardians or eligible student have not opted out of providing information to military recruiters, and your school receives federal dollars, then you are required to provide the contact information to the military. You are additionally required to provide military recruiters with the same access at school as you provide to employers or colleges (job or college fairs, tables in the lunchroom, visiting students at school, etc.). 11/5/2017

Questions? 11/5/2017