1. The Pennsylvania State University
FERPA in a Modern World
Howard Heevner
The Pennsylvania State University
What is FERPA?
Clarifying FERPA
State Protections
Data Quality Campaign. (2016, September). Student Data Privacy Legislation: A Summary of 2016 State Legislation. Retrieved March 4, 2017, from dataqualitycampaign.org.
Dominguez, D. C., Gonazlez Valles, J. E., & Von Feigenblatt, O. F. (2015). The Family Educational Rights and Privacy Right (FERPA). Journal of Alternative Perspectives in the Social Sciences, 6,
Electronic Privacy Information Center v. US Department of Education. Civil Action No (ABJ). (District Court of District of Columbia September 26, 2013).
Elliott, T. L. ., Fatemi, D., & Wasan, S. (2014). Student Privacy Rights--History, Owasso, and FERPA. Journal of Higher Education Theory & Practice, 14(4), 34–47. Retrieved from
EPIC Advisory Board (2016, June 6). Petition for FERPA Data Security Rule [Letter written June 6, 2016 to John B. King]. Retrieved February 25, 2017, from
Family Educational Rights and Privacy Act, 20 U.S.C §1232g et seq. (1974).
Kevin Kendrick, in his official capacity as Director of Compliance at Alabama State University, v. The Advertiser Company d/b/a The Montgomery Advertiser. No (June 24, 2016).
Legislative History of Major FERPA Provisions. (2002). Retrieved January 30, 2017, from
Lord, N. (2017, January 27). The History of Data Breaches. Retrieved March 31, 2017, from
Marr, B. (2015, September 30). Big Data: 20 Mind-Boggling Facts Everyone Must Read. Forbes. Retrieved March 31, 2017, from
Student Privacy Protection Act, H.R. Res. H.R. 3157, 114th Cong. (2016).
Vance, A. (2016). EDUCATION LEADERS REPORT Policymaking on Education Data Privacy: Lessons Learned EDUCATION LEADERS REPORT. Data Quality Campaign, 2(1). Retrieved March 5, 2017, from Dataqualitycampaign.org.
References
FERPA stands for the Family Educational Rights and Privacy Act. It was created in 1974 to ensure students and parents had the ability access student data and others were limited in their ability.
Gonzaga University vs. Doe (2002)
Individual Rights
FERPA does not create a set of individual rights. It is fiduciary intended to set controls to guide the behaviors of institutions. Any benefit to an individual is tangential.
Enforcement
Court stated FERPA directs the Secretary of Education to terminate funds if there is a failure to comply. There are no financial penalties for individuals under FERPA
Owasso Independent School District v. Falvo (2002)
Educational Records
Court outlined a 2 part test of what constitutes an educational record: 1)“directly relate to the student” 2)maintained by the institution or an individual on behalf of the institution.
Kendrick v. The Advertiser Company (2016)
Directory Information
Clarified the definition of “directory information” by reaffirming the definitions outlined by FERPA and supporting that financial aid information is not included.
Department of Education 2011 Final Rule
It took three actions in an effort increase clarity:
Expanded directory information to include a student’s id number
Expanded authorized agents to individuals or entities designated by educational authorities who could access student information without parental consent
Expanded educational programs to include any program that is principally involved in the provision of education
Since 2013, 410 bills in 49 states have been introduced with regard to student privacy and 36 states have passed 73 laws.
Prohibitive
Why was FERPA created?
Inconsistencies in record management
The limitations of parents and students to access educational records
The ability for local law enforcement to to access information without parental consent
California’s Student Online Personal Information Protection Act (SOPIPA) and AB1584
Both passed in Only for K-12 students. Focused on regulating the actions of third-party vendors.
Prohibits vendors from selling information gathered. Restricts data usage for educational purposes only. 10 have passed bills that mirror SOPIPA. SOPIPA’s companion bill, AB1584 governs the ability of a school to work with outside vendors.  Data remains the property of the school. Contracts must ensure the confidentiality and security of the information
Any institution benefiting from federal funds administered by the Department of Education (DOE) must comply.
Data Governance
Annually student’s parents or the student must be notified of their right to review, amend or appeal their records, grant permission to others, or file a complaint. Only with written consent may information be disclosed. Violation may result in funding being withheld but rarely does.
Oklahoma Student DATA Act
Passed in 2013.
Oklahoma’s law restricts access to student data, defines when data can leave the state, and requires the development of data security plans by educational offices throughout the state. 9 other states have modeled data security laws after Oklahoma.