Student Privacy: Can Universities Ask For Student Data?

The Family Educational Rights and Privacy Act (FERPA) is a federal law that governs the privacy of student education records. FERPA applies to all colleges and universities that receive federal funding. It gives parents the right to inspect, review, and challenge the content of their child's education records until their child turns 18 or attends college, at which point these rights are transferred to the student. FERPA prohibits schools from disclosing personally identifiable information from student education records to third parties without the consent of the parent or eligible student, except in certain situations. These include disclosure to school officials, parents of a student under 21 concerning the student's violation of any law or school policy governing alcohol or drug use, in connection with a health or safety emergency, to comply with a judicial order or lawfully issued subpoena, or to other parties as permitted by the student or their parents.

FERPA nondisclosure rules apply to any electronic records, including emails and library records, as long as the records are maintained by the institution and pertain to an individual student. However, swipe card logs or electronic records of a student's entry into campus buildings that require a swipe card or personal access code may be excluded if they are maintained by a college or university campus police or security office, in which case they would be considered law enforcement records and would not be subject to FERPA nondisclosure rules.

While there is no state law equivalent to FERPA, state Freedom of Information Acts generally exempt education and law enforcement records maintained by public colleges and universities from disclosure. Students whose privacy rights have been violated may not have an explicit cause of action under state law, but they could seek a tort law remedy in civil court for an invasion of privacy.

The Family Educational Rights and Privacy Act (FERPA) is a federal law that governs the disclosure of student education records

FERPA applies to any educational institution that receives federal funding, including all public schools and the majority of private institutions. FERPA defines an "eligible student" as a student who has reached 18 years of age or is attending an institution of postsecondary education. When a student becomes an eligible student, the rights previously afforded to their parents under FERPA are transferred to the student.

FERPA defines "education records" as information that is directly related to a student and maintained by an educational agency or institution, or a party acting for such an agency or institution. This includes grades, transcripts, class lists, student course schedules, health records, student financial information, and student discipline files. Notably, FERPA does not protect the confidentiality of information in general and therefore does not apply to information derived from a source other than education records.

FERPA requires educational institutions to annually notify parents and eligible students of their rights under the Act. This includes the right to inspect and review the student's education records, seek amendment of the records, consent to disclosures of personally identifiable information, and file a complaint concerning potential violations.

FERPA also outlines the conditions under which prior consent is required to disclose information, as well as the conditions under which prior consent is not required. For example, prior consent is not required when disclosing information to other school officials, to officials of another school where the student seeks or intends to enroll, or in cases of health and safety emergencies.

FERPA imposes strict penalties for non-compliance, including the potential loss of all federal funding. However, the Department of Education has never imposed such a penalty, and it is difficult to demonstrate that a school has a "policy or practice" of violating FERPA as opposed to the occasional violation.

FERPA prohibits schools from disclosing to third parties personally identifiable information from student education records without the consent of the parent or eligible student

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student educational records. It applies to any public or private elementary, secondary, or post-secondary school, and any state or local education agency that receives federal funds under a program administered by the Secretary of Education.

FERPA has two parts. Firstly, it gives students the right to inspect and review their own education records, request corrections, halt the release of personally identifiable information, and obtain a copy of their institution's policy concerning access to educational records. Secondly, it prohibits educational institutions from disclosing "personally identifiable information in education records" without the written consent of the student, or, if the student is a minor, the student's parents.

However, there are several exceptions that allow the release of student records to certain parties or under certain conditions. Records may be released without the student's consent:

• To school officials with a legitimate educational interest
• To other schools to which a student seeks or intends to enroll
• To education officials for audit and evaluation purposes
• To accrediting organizations
• To parties in connection with financial aid to a student
• To organizations conducting certain studies for or on behalf of a school
• To comply with a judicial order or lawfully issued subpoena
• In the case of health and safety emergencies
• To state and local authorities within a juvenile justice system

In addition, some records maintained by schools are exempt from FERPA, including:

• Records in the sole possession of school officials
• Records maintained by a law enforcement unit of the educational institution
• Records of an educational institution's non-student employees
• Records on a student who is 18 years of age or older or who attends a post-secondary institution that are maintained by a health professional

FERPA also allows, but does not require, schools to release "directory information," including students' names and addresses, to the public. However, this exception was modified in 2002, and high schools are now required to provide students' names, addresses, and telephone numbers to military recruiters, unless a student or parent opts out of such disclosure.

FERPA permits disclosure without consent in certain situations, such as to other school officials, in connection with a health or safety emergency, or to comply with a judicial order

The Family Educational Rights and Privacy Act (FERPA) is a federal law that affords parents the right to have access to their children's education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records. When a student turns 18 years old, or enters a postsecondary institution at any age, the rights under FERPA transfer from the parents to the student (“eligible student”).

FERPA permits disclosure without consent in certain situations, such as:

• To other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests.
• In connection with a health or safety emergency, or to appropriate parties if the student's or other individuals' health or safety is at serious and imminent risk.
• To comply with a judicial order or lawfully issued subpoena.

FERPA defines a "legitimate educational interest" as when a school official needs to review an education record in order to fulfill his or her professional responsibility.

FERPA also permits disclosure without consent to:

• Officials of another school in which the student seeks or intends to enroll.
• Representatives of agencies or organizations from which the student has received financial aid or to whom the student has applied to receive financial aid.
• State and local officials or other authorities if the disclosure is allowed by a state law adopted after November 19, 1974, and if the disclosure concerns the juvenile justice system and its ability to serve the student.
• Organizations conducting studies for, or on behalf of, educational agencies or institutions.
• Accrediting organizations to carry out their accrediting functions.
• Parents of a dependent student as defined by the IRS.
• Appropriate parties in connection with a health or safety emergency if the official deems the disclosure to be warranted by the seriousness of the threat to the health and safety of the student or other persons, and the information is necessary to meet the emergency.

Schools must notify parents and eligible students annually of their rights under FERPA

The Family Educational Rights and Privacy Act (FERPA) is a federal law that affords parents the right to have access to their children's education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records.

FERPA requires educational agencies and institutions to notify parents and eligible students annually of their rights under FERPA. This includes the right to:

• Inspect and review education records and the procedures to do so.
• Seek amendment of records the parent or eligible student believes are inaccurate, and the procedures to do so.
• Consent to disclosures of education records, except to the extent that FERPA authorizes disclosure without consent.
• File a complaint with the Student Privacy Policy Office (SPPO) concerning potential violations.

Postsecondary institutions are only required to notify eligible students of their rights under FERPA. In this context, an "eligible student" refers to a student who has reached the age of 18 or who is attending a postsecondary institution at any age. Once a student becomes an eligible student, the rights afforded to their parents under FERPA transfer to the student.

While FERPA requires educational agencies and institutions to notify parents and eligible students of their rights, it does not require them to do so individually. Instead, agencies must provide notification where parents and eligible students are likely to see it. Additionally, provisions must be made to effectively inform individuals with a disability or whose primary language is not English.

When parents (or eligible students) request to review their records, the educational institution must respond within 45 days, and they cannot destroy any of the requested records during this time. Either parent has the right to review an education record unless there is evidence of a court order or state law revoking or restricting these rights. Parents may also access the education records of eligible students if they claim the student as a dependent for income tax purposes, although verification of the requester's relationship with the child may be required.

It is important to note that the right of parents to access information is limited to their own child or children's records. If the education record includes information about other students, that information must be removed before disclosure to ensure that parents do not have access to any other child's records.

FERPA does not apply to law enforcement unit records, which are maintained for law enforcement purposes

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. However, it does not apply to law enforcement unit records, which are defined as records that are:

• Created by a law enforcement unit
• Created for a law enforcement purpose
• Maintained by the law enforcement unit

Law enforcement unit records are not considered "education records" and are therefore not subject to FERPA's privacy protections. This means that law enforcement units can refuse to let parents or eligible students inspect and review these records. They can also disclose these records to third parties without the prior written consent of the parent or eligible student.

It is important to note that education records or personally identifiable information from education records that are shared with the law enforcement unit do not lose their protected status as education records just because they have been shared.

Frequently asked questions