From EPIC:
EPIC has obtained documents from the Department of Education detailing parent and student complaints about the misuse of educational records. The Department released the documents in response to an EPIC Freedom of Information Act request. The documents reveal that schools and districts have disclosed students’ personal records without consent, possibly in violation of the Family Educational Rights and Privacy Act. The documents also reveal that the Department failed to investigate many FERPA complaints. EPIC is expecting to receive more documents about the agency’s enforcement of the federal student privacy law. For more information, see EPIC: Student Privacy and EPIC: Open Government.
Having read through all the files EPIC shared, I think it would be more accurate to say that the Family Policy Compliance Office (FPCO) decided that no investigation was warranted in the vast majority of the complaints due to some common misunderstandings about what rights FERPA provides. Here are some of the recurring themes I saw in their correspondence.
1. Many complaints about improper disclosure of education records did not lead to an investigation because the party to whom the records had been disclosed was a “school official” under FERPA. The FPCO’s boilerplate response to such complaints explained:
FERPA generally prohibits the nonconsensual disclosure of infonnation derived from education records. One of the exceptions to the prior written consent requirement in FERP A allows “school officials, including teachers, within the agency or institution” to obtain access to education records provided the educational agency or institution has determined that they have “legitimate educational interests” in the information. 34 CFR § 99.31(a)(l). Although “school official” is not defined in the statute or regulations, this office has interpreted the term broadly to include a teacher; school principal; president; chancellor; board member; trustee; registrar; counselor; admissions officer; attorney; accountant; human resources professional; information systems specialist; and support or clerical personneL A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.
2. Many complaints about a school’s refusal to provide copies of a student’s education records were rejected because FERPA does not require a school to provide copies of records, but only access to the records to inspect them – unless failure to provide copies would essentially prevent access (as would be the case if the parent did not live within commuting distance of the school). In other cases, complaints about refusal to provide copies of records did not lead to any enforcement action because FERPA does not require schools to create education records or to preserve or maintain them (unless a request for them has already been made).
3. Many complaints did not lead to any investigation or action because the issues raised by the complainants fell under the federal special education law, I.D.E.A., which also includes provisions about the confidentiality and privacy of education records. In those cases, complainants were advised that I.D.E.A. is enforced by state education agencies, and they were provided the contact information for their state.
4. Significantly, a number of complaints about improper or unauthorized disclosure of personal information were not covered by FERPA at all. As FPCO explained in another boilerplate response:
Additionally, FERPA does not protect the confidentiality of information in general, and, therefore, does not apply to the disclosure of information derived from a source other than education records, even if education records exist which contain that information. As a general rule, information that is obtained through personal knowledge or observation, and not from an education record, is not protected from disclosure under FERPA.
The implications of the above strike me as a significant, as if a teacher were to disclose to another student’s parents that “John Doe is a disciplinary problem,” that might not violate FERPA if the statement was based on her observations in class – even if there were education records concerning disciplinary problems. Similarly, a school administrator might reveal information about a child to the police based on the administrator’s experience with the child and it would not be a violation of FERPA unless the administrator shared actual education records with the police (and even then, there might be a health or safety emergency exemption that would make that permissible).
5. Some complaints resulted in no investigation because they were not filed within the regulatory timeframe of 180 days.
6. Some complaints resulted in no action because the complainants did not provide a concise and clear statement of the alleged infraction accompanied by supporting documentation.
7. Some complaints resulted in no action because the schools involved were not public schools or schools covered by FERPA.
8. A number of complaints about schools’ refusal to amend records did not result in any investigation because although FERPA grants parents (or students over age 18) the right to request records be amended to correct inaccurate information, FERPA does not require schools to amend the records or change grades or opinions just because it is requested. If the school declines to amend the records, they must provide the opportunity for a hearing and if they still decline after the hearing, the parent or student has the right to have a statement inserted in the record about the dispute that will remain in the records as long as the disputed information is in the records.
In only a few cases did I see any evidence that FPCO reached out to school, district, or post-secondary institution to offer “technical assistance” to help them comply with FERPA.
For parents who want to understand more about the FERPA complaint process, I’d recommend you start by understanding what FERPA actually covers and what it doesn’t. I’ve compiled some resources to help:
- FERPA General Guidance for Parents
- FERPA (Regulations)
- How to File a FERPA Complaint
- IDEA and FERPA Confidentiality Provisions (Comparison Chart)
- Family Policy Compliance Office (General Information)