We often get calls from people wondering whether their school or their child’s school has violated their privacy rights with respect to education records, and if so, what can be done about it. While federal law provides significant privacy rights for students those rights are not absolute, and there are limited mechanisms to enforce violations.
What is FERPA
The Family Educational Rights and Privacy Act (FERPA) is a federal law that was passed in 1974 to protect the privacy of student education records. The law applies to educational agencies and institutions that receive funds from the U.S. Department of Education. FERPA gives parents or students 18 and older (“eligible students”) the right to inspect and review students’ education records. It also gives parents and eligible students the right to request amendment of the student’s records, and the right to a hearing if the school denies the request to amend.
FERPA defines “education records” as records that are “(1) Directly related to a student; and (2) Maintained by an educational agency or institution or by a party acting for the agency or institution.” There are several exceptions to this definition:
- Notes that are kept only by the person that made them and are not revealed to anyone else are not considered education records.
- As discussed in more detail below, law enforcement unit records at a school are not education records.
- Employment records of people employed by education institutions are not education records.
- Medical, psychiatric, and other treatment records at postsecondary institutions or generated in connection of treatment with students eighteen and older are not education records.
- Records created after an individual is no longer a student and that are not directly related to the person’s attendance as a student.
- Grades on peer-graded papers before they are collected and recorded by a teacher.
FERPA prohibits educational institutions from disclosing personally identifiable information (name, address, personal identifiers, and any information that alone or in combination could allow someone to identify the student) from education records without consent of the student. There are, of course, many exceptions to this rule, including:
- Directory information: Institutions can disclose information like students’ names, addresses, telephone numbers, participation in school sports and activities, and dates of attendance as long as the institution gives public notice of the information it discloses and provides a way for people to opt out of disclosure.
- Within the institution: Institutions can disclose information to officials/teachers within the school if there is a legitimate educational interest for the disclosure.
- To other institutions: Institutions can disclose education records to another school to which the student seeks to enroll or transfer, as long as the information is related to that enrollment or transfer.
- Financial aid: Institutions can disclose education records in connection with student applications for financial aid.
- Studies: Institutions can disclose education records to organizations conducting studies for education institutions, as long as those organizations comply with certain regulations about the handling of that information.
- Judicial orders: Institutions can disclose education records to comply with a judicial order or subpoena, but must notify the students’ affected before the disclosure.
- Litigation between the institution and student: If a school sues a student or the student sues a school the school may disclose that student’s records as needed for the litigation.
- Certain disciplinary outcomes: Education institutions can disclose the final results of certain disciplinary proceedings if students are found responsible for violent crimes or sex offenses, and can disclose the final results of proceedings involving violent crimes or sex offenses to the alleged victim regardless of the outcome of the case.
How is FERPA enforced?
The most frequent question we get about FERPA is how people can sue their schools for violating this law. The answer is simple: they cannot. FERPA does not contain a private right of action, meaning that individuals are not allowed to sue in court under the law. The mechanism to address FERPA violations is a complaint process through the U.S. Department of Education. That complaint must be filed within 180 days of the FERPA violation, or within 180 days of when you knew or should have known about the violation.
Frequent FERPA Questions and Issues
- Who has the right to review records of students eighteen and older?
Once a student turns eighteen, the privacy rights in their records transfer to them, not their parents. The school or district is therefore only required to provide the student access to the education records. If a parent wants access to an eighteen-year-old student’s record, the student must sign a waiver to allow the parent access. Even then, the Department of Education has stated in enforcement documents that it is not required to provide third parties records even with a valid waiver.
- Are discipline records protected by FERPA?
Yes. Disciplinary records are “education records” protected by FERPA. However, FERPA generally only allows parents and eligible students to review and inspect information about that specific student. Where disciplinary records, including witness statements and videos, contain information about more than one student, if the information cannot be segregated or redacted without “destroying its meaning,” the U.S. Department of Education has determined that each student for whom the record is an education record is permitted to review and inspect it. In addition, as noted above, there are some exceptions for disclosures of the final results of certain disciplinary proceedings.
- Are e-mails “education records”?
In our practice we have seen situations in which schools have tried to argue that all emails between students and teachers, or between teachers that mention students, are “education records.” Courts have rejected this broad reading of “education records,” noting that FERPA applies only to those records “maintained” by the education institution, which suggests those records that are kept in a file or database. Following this logic, numerous courts have determined that emails that have not been added to a file or database are not education records protected by FERPA.
- Are school law enforcement unit records “education records”?
Many colleges and universities have their own law enforcement units. While these agencies are part of the educational institution, the records they generate and maintain for law enforcement purposes are not considered “educational records” under FERPA. That means that school law enforcement units are not required to maintain the privacy of those records or share them with students. However, if the schools shares “education records” with its law enforcement unit, those records remain protected.
- What happens to FERPA records in litigation?
In our education practice, we frequently sue schools for violating student rights, and these cases often require the school to produce records not only of our clients, but of other students involved in litigation. As noted above, schools are permitted to disclose education records to comply with a judicial order or subpoena. However, when a school receives such an order or subpoena (unless it is a subpoena that states the contents of the subpoena and the information provided in response should not be disclosed) it is required to make reasonable efforts to notify the parents or eligible student so that the parents or student can intervene in the action if they want to assert their privacy rights.
If you or your child is facing disciplinary action at their school, or is being deprived of their rights, contact our education rights attorneys.