The Pennsylvania State University FERPA in a Modern World Howard Heevner The Pennsylvania State University What is FERPA? Clarifying FERPA State Protections Data Quality Campaign. (2016, September). Student Data Privacy Legislation: A Summary of 2016 State Legislation. Retrieved March 4, 2017, from dataqualitycampaign.org. Dominguez, D. C., Gonazlez Valles, J. E., & Von Feigenblatt, O. F. (2015). The Family Educational Rights and Privacy Right (FERPA). Journal of Alternative Perspectives in the Social Sciences, 6, 329-335. Electronic Privacy Information Center v. US Department of Education. Civil Action No. 12-0327 (ABJ). (District Court of District of Columbia September 26, 2013). Elliott, T. L. ., Fatemi, D., & Wasan, S. (2014). Student Privacy Rights--History, Owasso, and FERPA. Journal of Higher Education Theory & Practice, 14(4), 34–47. Retrieved from http://content.ebscohost.com/ContentServer.asp?T=P&P=AN&K=100405010&S=R&D=eft&EbscoContent=dGJyMNXb4kSeqLY4yNfsOLCmr02ep7FSs EPIC Advisory Board (2016, June 6). Petition for FERPA Data Security Rule [Letter written June 6, 2016 to John B. King]. Retrieved February 25, 2017, from https://epic.org/privacy/student/ED-Data-Security-Petition.pdf Family Educational Rights and Privacy Act, 20 U.S.C §1232g et seq. (1974). Kevin Kendrick, in his official capacity as Director of Compliance at Alabama State University, v. The Advertiser Company d/b/a The Montgomery Advertiser. No. 1150275. (June 24, 2016). Legislative History of Major FERPA Provisions. (2002). Retrieved January 30, 2017, from http://www2.ed.gov/policy/gen/guid/fpco/ferpa/leg-history.html# Lord, N. (2017, January 27). The History of Data Breaches. Retrieved March 31, 2017, from https://digitalguardian.com/blog/history-data-breaches Marr, B. (2015, September 30). Big Data: 20 Mind-Boggling Facts Everyone Must Read. Forbes. Retrieved March 31, 2017, from http://onforb.es/1KQZqJG Student Privacy Protection Act, H.R. Res. H.R. 3157, 114th Cong. (2016). Vance, A. (2016). EDUCATION LEADERS REPORT Policymaking on Education Data Privacy: Lessons Learned EDUCATION LEADERS REPORT. Data Quality Campaign, 2(1). Retrieved March 5, 2017, from Dataqualitycampaign.org. References FERPA stands for the Family Educational Rights and Privacy Act. It was created in 1974 to ensure students and parents had the ability access student data and others were limited in their ability. Gonzaga University vs. Doe (2002) Individual Rights FERPA does not create a set of individual rights. It is fiduciary intended to set controls to guide the behaviors of institutions. Any benefit to an individual is tangential. Enforcement Court stated FERPA directs the Secretary of Education to terminate funds if there is a failure to comply. There are no financial penalties for individuals under FERPA Owasso Independent School District v. Falvo (2002) Educational Records Court outlined a 2 part test of what constitutes an educational record: 1)“directly relate to the student” 2)maintained by the institution or an individual on behalf of the institution. Kendrick v. The Advertiser Company (2016) Directory Information Clarified the definition of “directory information” by reaffirming the definitions outlined by FERPA and supporting that financial aid information is not included. Department of Education 2011 Final Rule It took three actions in an effort increase clarity: Expanded directory information to include a student’s id number Expanded authorized agents to individuals or entities designated by educational authorities who could access student information without parental consent Expanded educational programs to include any program that is principally involved in the provision of education Since 2013, 410 bills in 49 states have been introduced with regard to student privacy and 36 states have passed 73 laws. Prohibitive Why was FERPA created? Inconsistencies in record management The limitations of parents and students to access educational records The ability for local law enforcement to to access information without parental consent California’s Student Online Personal Information Protection Act (SOPIPA) and AB1584 Both passed in 2014. Only for K-12 students. Focused on regulating the actions of third-party vendors. Prohibits vendors from selling information gathered. Restricts data usage for educational purposes only. 10 have passed bills that mirror SOPIPA. SOPIPA’s companion bill, AB1584 governs the ability of a school to work with outside vendors.  Data remains the property of the school. Contracts must ensure the confidentiality and security of the information Any institution benefiting from federal funds administered by the Department of Education (DOE) must comply. Data Governance Annually student’s parents or the student must be notified of their right to review, amend or appeal their records, grant permission to others, or file a complaint. Only with written consent may information be disclosed. Violation may result in funding being withheld but rarely does. Oklahoma Student DATA Act Passed in 2013. Oklahoma’s law restricts access to student data, defines when data can leave the state, and requires the development of data security plans by educational offices throughout the state. 9 other states have modeled data security laws after Oklahoma.