Schools generate and maintain numerous records that concern their students, including grades, standardized test scores, disciplinary accounts, contact information, mental health records, and more. Concerns about protecting these materials from improper disclosure have increased with the rise of technology that is used to store and maintain school records.¹ And the major expansion of third-party software to enable school instruction at home during the Coronavirus Disease 2019 (COVID-19) pandemic has increased some observers' concern about the security of students' information.²

The Family Educational Rights and Privacy Act (FERPA), which applies to educational agencies and institutions³ that receive certain types of financial assistance from the Department of Education (ED),⁴ regulates the handling of student records in several ways.⁵ The statute has two key features. First, it requires schools to allow parents to access and review their children's education records.⁶ Second, it prohibits schools from releasing students' education records, including personally identifiable information (PII), without the written consent of their parents.⁷ As this report explains, however, this prohibition is not absolute. For instance, FERPA permits the limited disclosure of otherwise protected student records in certain situations, including to other school officials for legitimate education interests, or when disclosure is necessary to protect health and safety in case of an emergency.⁸ In addition, the statute authorizes disclosure of students' so-called "directory information," subject to several procedural requirements.⁹

This report discusses FERPA's provisions and its application to certain areas, including the use of online software for at-home student learning.¹⁰ It also examines how the statute is enforced,¹¹ and discusses FERPA's interaction with other legal requirements that apply to schools, such as regulations under Title IX of the Education Amendments of 1972 (Title IX), which set standards for adjudicating allegations of sexual harassment at school.¹²

What Counts as an Education Record?

FERPA defines "education records" as materials that (1) "contain information directly related to a student" and (2) "are maintained by an educational agency or institution or by a person acting for such agency or institution."¹³ Certain records are expressly exempted from coverage under this definition, including employment records,¹⁴ as well as records created by educational personnel that are in the sole possession of the creator (e.g., notes taken by a teacher regarding a conversation with a student) that are not accessible to anyone except a substitute.¹⁵

One of the notable categories of materials excluded from FERPA's definition of "education records" is materials created and maintained by a school's law enforcement unit for law enforcement purposes.¹⁶ Importantly, this category only applies to records that are (1) "created by a law enforcement unit," (2) "created for a law enforcement purpose," and (3) "maintained by" the law enforcement unit.¹⁷ The category does not include records maintained by a component of the school other than law enforcement. FERPA regulations clarify that the category does not include records, even if created and maintained by the law enforcement unit, that are used exclusively for non-law enforcement purposes, such as a disciplinary proceeding.¹⁸ But, if a school's law enforcement unit independently generates an investigative report on a student for law enforcement purposes and maintains those records itself, FERPA does not prohibit the local law enforcement unit from disclosing that information.¹⁹ Because of this distinction, ED advises that local law enforcement units maintain law enforcement records separately from education records.²⁰

In addition to these exclusions, FERPA and its implementing regulations include a number of other categories of materials that do not qualify as "education records."²¹ Table 1 lists materials exempted from the definition of "education records."

A practical example of what counts as an education record under FERPA derives from the Supreme Court's 2002 decision in Owasso Independent School District v. Falvo.²² There, the Court considered whether the process of peer grading in classrooms violated FERPA requirements.²³ The plaintiffs argued that the practice of students grading one another's papers and calling out those grades to the teacher for recording violated FERPA by disclosing students' "education records" without parental consent.²⁴ The Court disagreed, ruling that the grades of students' papers, at least before being entered into the teacher's gradebook, are not "education records" because they are not "maintained" within the meaning of the term's definition.²⁵ The term "maintain," the Court noted, suggested that education records subject to FERPA would be "kept in a filing cabinet in a records room at the school or on a permanent secure database."²⁶ When students grade one another's papers, the Court explained, they do not "maintain" records in the manner that the school registrar does.²⁷

Accessing Education Records

FERPA requires schools that receive financial assistance from ED to allow parents to access and review the education records of their children.²⁸ Under the statute, schools must establish procedures that facilitate this process, and those procedures must ensure that parents can access their children's records within 45 days of a request.²⁹ Parents must also have the option to challenge the content of those records in order to ensure their accuracy, including through a hearing if requested.³⁰ According to FERPA regulations, schools must annually give parents notice of their rights under the law.³¹

Although the rights under FERPA transfer from parents to students when they turn 18 or enter postsecondary education,³² those students' right of access to records is limited in several ways. For instance, FERPA does not require colleges to make parents' financial records available to students.³³

Disclosing Education Records

FERPA prohibits federal funds from going to schools that have a policy permitting disclosure of students' education records, including PII, without written parental consent.³⁴ As noted above, the definition of "education records" under FERPA is broad, perhaps indicating at first glance that schools might be prohibited from ever releasing a broad range of student information. But the statute contains numerous qualifications. As explained below, so-called "directory information" may be disclosed as long as parents are given prior notice of what materials are designated as directory information and an opportunity to opt out. Further, education records may be released to specific entities for various purposes outlined in the statute and FERPA regulations. Schools must, however, keep a record of which individuals or entities (other than a student's parents) requested or obtained access to a student's records, including the legitimate interest such entities had in the information.³⁵

For many FERPA exceptions,³⁶ the regulations also impose requirements on recipients of student records regarding the use and re-disclosure of that information.³⁷ When schools disclose PII from an education record pursuant to an applicable exception, they must do so on the condition that the recipient will not re-disclose the information absent consent.³⁸ And when recipients receive student information, they may only use the information for the purposes for which it was disclosed.³⁹ That said, the regulations provide that schools may disclose PII to a recipient with the understanding that the recipient may make further disclosures on behalf of the school if a relevant exception applies.⁴⁰

Directory Information and De-identified Data

Although the prohibition on releasing "education records" broadly encompasses information directly related to a student and maintained by a school,⁴¹ FERPA nonetheless provides that basic student data—so-called "directory information"—may be released without affirmative consent as long as certain requirements are met.⁴² Directory information includes material that "would not generally be considered harmful or an invasion of privacy if disclosed."⁴³ Schools must give prior public notice of the types of records designated as directory information and an opportunity for parents in writing to refuse to allow specific records to be so designated.⁴⁴

Under FERPA and its implementing regulations, directory information includes a student's identification number,⁴⁵ as well as a student's

name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; enrollment status (e.g., undergraduate or graduate, full-time or part-time); dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors and awards received; and the most recent educational agency or institution attended.⁴⁶

The carve-out of directory information from FERPA's disclosure prohibition allows schools to include certain student information in various publications, such as playbills for theatre productions, programs at athletics competitions, student directories, yearbooks, graduation programs, and honor rolls.⁴⁷ Directory information also can be distributed to companies that provide class photos, yearbooks, and class rings.⁴⁸

FERPA's regulations also provide that schools, as well as parties authorized to receive education records under a relevant exception (e.g., the exception for audits and evaluations),⁴⁹ may disclose "de-identified" records absent consent.⁵⁰ For this exception to apply, the entity must remove all PII and make "a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information."⁵¹

School Officials Exception

Schools may disclose education records to appropriate "school officials" without parental consent.⁵² School officials include other teachers in the institution if the school has determined they have "legitimate educational interests."⁵³ According to FERPA regulations, outside parties, such as contractors, volunteers, or consultants to whom a school has "outsourced institutional services or functions," may also qualify as school officials if (1) the school determines they have a legitimate educational interest; (2) they conduct "an institutional service or function for which" the school would otherwise use employees; (3) they are "under the direct control" of the school regarding the maintenance and use of the records; and (4) they are subject to FERPA's use and re-disclosure requirements.⁵⁴

Finally, schools must "use reasonable methods" to ensure school officials only access those records in which they have legitimate educational interests.⁵⁵ According to guidance from ED, a school official will typically have a legitimate educational interest "if he or she needs to review an education record in order to fulfill his or her professional responsibilities."⁵⁶

Online Educational Services

While not explicitly set forth in statute or regulations, ED guidance documents interpret the school official exception to permit disclosure of education records to third-party providers of online educational software.⁵⁷ Schools often use online tools to facilitate instruction provided by third parties. These tools can include programs that students or their parents access through the internet to participate in a school activity. The use of such tools has expanded with the increase in at-home learning due to the COVID-19 pandemic.⁵⁸

Schools may disclose education records to third-party providers under the school official exception as long as the requirements discussed above are met.⁵⁹ ED has noted that the "direct control" requirement above can be met through a contract signed by the school and online software provider; in some cases, the "Terms of Service" may satisfy this obligation as well.⁶⁰ As mentioned above, providers that receive education records under the school official exception may only use those records for the specific purpose for which they were disclosed.⁶¹ In other words, providers may only use those education records to perform the outsourced function assigned by the school. This requirement generally precludes providers from selling such information to another party or reusing it for another purpose.⁶²

Under FERPA's regulations, however, providers may disclose without consent records that are properly "de-identified," or stripped of all PII.⁶³ According to guidance from ED, this includes metadata that the provider collects through its software.⁶⁴ For instance, providers might collect information about how long it takes students to perform a discrete task.⁶⁵ As long as such information is stripped of PII, providers may disclose that information without consent.⁶⁶

Law Enforcement

If a school has outsourced the duties of providing safety and security to law enforcement unit (LEU) officials, such as school resource officers, it may consider them to be "school officials" when certain requirements are met.⁶⁷ As noted above, records created and maintained by an LEU for law enforcement purposes are not education records under FERPA.⁶⁸ This means that if a school's LEU independently generates records on a student for law enforcement purposes, it will not violate FERPA if it discloses that information without consent. However, a school may not disclose a student's education records to its LEU without consent unless one of FERPA's exceptions is met.⁶⁹

When schools outsource the function of providing safety and security on campus to LEU officials, they may sometimes disclose education records without consent to those LEU officials under the school official exception.⁷⁰ In order to do so, the school resource officer or LEU official must meet the four requirements laid out in FERPA's regulations mentioned above.⁷¹ That means (1) the school must determine that they have a legitimate educational interest in the records; and the LEU official must (2) perform an institutional service or function for the school; (3) maintain the records under the direct control of the school; and (4) follow FERPA's use and re-disclosure requirements.⁷²

LEU officials to whom a school has outsourced the function of providing safety and security on campus can satisfy requirement (2) because ensuring school safety constitutes an "institutional service or function."⁷³ And as mentioned above, a school can satisfy the "legitimate educational interest," requirement (1), if an LEU official needs to review the information to fulfill his job responsibilities.⁷⁴ For instance, a school might disclose to its LEU the disciplinary record of a student who is barred from campus.⁷⁵

Often, a school will enter a memorandum of understanding with its LEU that establishes data protection and use requirements in order to satisfy requirement (3).⁷⁶ Application of requirement (4), FERPA's use and re-disclosure requirements, means that LEUs may only use education records for the purpose for which the disclosure was made, such as ensuring school safety.⁷⁷ In addition, LEUs may not re-disclose covered education records to outside parties, such as a police department, unless one of FERPA's exceptions is satisfied.⁷⁸

Threat Assessment Teams

Schools may also use the school official exception to disclose education records to threat assessment teams. According to guidance documents issued by ED, a threat assessment team may "review incidents of threatening behavior by students (current and former), parents, school employees, or other individuals," and based on their expertise provide guidance to a school on how to respond to a potential threat.⁷⁹ It appears that such teams can assist schools to determine whether student records should be disclosed under the health or safety emergency exception.⁸⁰ The members of a threat assessment team can include individuals not employed by a school, such as medical and mental health professionals, as well as law enforcement officers.⁸¹

Members of threat assessment teams are subject to the limitations that apply to all school officials. Consequently, the members may only use education records for the purposes for which they were disclosed, and they may not re-disclose the records absent a FERPA exception.⁸² ED guidance documents specifically give an example: if a representative from a police department serves on a threat assessment team, he or she may not disclose PII from education records accessed as a member of the team to their police department (absent an applicable FERPA exception).⁸³

Health and Safety Emergency Exception

FERPA also provides that student records may be released in emergency situations if necessary to protect the health and safety of students.⁸⁴ The statute's regulations spell out in detail how this exception operates.⁸⁵ Schools "may take the totality of the circumstances" in determining if an emergency exists.⁸⁶ If a school determines that there is an "articulable and significant threat" to the health or safety of a student or other person, it may disclose an education record to any person whose knowledge of that information is necessary to protect health and safety.⁸⁷ As long as a school has a rational basis for this decision, ED will not "substitute its judgment" for that of the school.⁸⁸

According to ED, examples of a significant and articulable emergency include an impending natural disaster, terrorist attacks, campus threats, or the outbreak of an epidemic disease.⁸⁹ For instance, during the COVID-19 pandemic, ED issued guidance explaining that the health and safety emergency exception will sometimes authorize disclosure without consent of PII from education records to appropriate public health officials to protect public safety.⁹⁰ State and local law enforcement officials, public health officials, medical personnel, and parents might need to receive records to protect the health and safety of students and others.⁹¹ Any time that a school discloses a student's PII from education records under the emergency exception, it must record the threat and the parties to whom records were disclosed.⁹²

According to guidance from ED, FERPA does not prohibit a school official from disclosing information obtained not through a record but from personal knowledge or observation.⁹³ For instance, if a teacher overhears a student make a threat, FERPA does not prohibit that information from being disclosed.⁹⁴ Consequently, the teacher could disclose what he or she overheard to appropriate authorities.⁹⁵

Studies and Audits Exceptions

FERPA also allows disclosing education records for the purpose of certain studies,⁹⁶ as well as for audits and evaluations.⁹⁷ The studies exception allows schools to disclose records to organizations conducting studies in order to (1) develop, administer, or validate predictive tests; (2) administer student aid programs; or (3) improve instruction.⁹⁸ For instance, a school might disclose education records to an organization that compares student outcomes across different school districts.⁹⁹ Disclosures under the studies exception are permitted only if the study does not authorize the personal identification of students or parents other than to members of the organization with legitimate interests in the information.¹⁰⁰ In addition, when no longer needed for the study, the information must be destroyed.¹⁰¹ Finally, in order to disclose education records to an organization under the studies exception, schools must enter into written agreements with the organization that specify the scope of the study and limit the use of PII in various ways.¹⁰²

The audit and evaluation exception permits schools to release education records without consent to authorized representatives of state and local educational authorities.¹⁰³ Information under the exception must be used to audit or evaluate a federal or state-supported education program or to enforce or ensure compliance with federal legal requirements connected to those programs.¹⁰⁴ As with the studies exception, schools must enter into written agreements with recipients of the information that specify how the information will be used and when it will be destroyed.¹⁰⁵ Further, written agreements must establish policies and procedures that protect information from further disclosure.¹⁰⁶

State Law Juvenile Justice System Exception

FERPA also authorizes disclosing education records to a state or local juvenile justice system without consent in certain situations.¹⁰⁷ If a state has adopted a statute after November 19, 1974, that specifically allows disclosure of student education records to state and local officials, then disclosure without consent is allowed if the disclosure concerns the juvenile justice system's "ability to effectively serve, prior to adjudication, the student whose records are released."¹⁰⁸ Officials to whom this information is disclosed must certify in writing that they will not re-disclose the information except as provided under state law or with consent.¹⁰⁹ Guidance from ED, in coordination with the Department of Justice (DOJ), indicates that disclosure under this exception is limited to a local or state juvenile justice system agency.¹¹⁰ For instance, in situations where the above conditions are met, if a student is arrested for a crime for the first time, a police department's juvenile division can receive education records from a school about the student in order to serve the student effectively prior to adjudication.¹¹¹

The juvenile justice system exception appears to authorize some disclosures of education records by a school district to a local juvenile justice agency, although the outer bounds of when a disclosure concerns the juvenile justice system's ability to serve a student effectively are uncertain. Because the statute imposes this requirement for "the student whose records are released," disclosure under this exception may require a specific finding of need for a particular student. This reading of the statute seems consistent with ED and DOJ guidance describing how the exception operates.¹¹²

Victims of Crimes at Postsecondary Institutions

Postsecondary institutions may disclose certain disciplinary records of an alleged perpetrator of a crime of violence or a nonforcible sex offense.¹¹³ First, institutions may disclose to the alleged victim of such a crime the final results of disciplinary proceedings that are conducted against the alleged perpetrator of the crime.¹¹⁴ Second, if an institution determines through a disciplinary proceeding that a student violated its rules or policies with respect to a crime of violence or nonforcible sex offense, then it may disclose the final results of that proceeding to anyone.¹¹⁵ The final results are limited to the name of the student, the violation committed, and any sanction the institution imposes.¹¹⁶ The names of other students, however, such as other victims or witnesses, may only be disclosed with their consent.¹¹⁷

Importantly, while FERPA authorizes postsecondary institutions to disclose the results of disciplinary proceedings to the alleged victim of a crime of violence or a nonforcible sex offense, a statutory provision outside of FERPA, contained in the Higher Education Act (HEA), requires institutions of higher education to do so in certain circumstances.¹¹⁸ As a condition of receiving funds under Title IV of the HEA, institutions of higher education must enter a Program Participation Agreement that requires them to, upon written request, disclose to the alleged victim of a crime of violence or a nonforcible sex offense the report on the results of a disciplinary proceeding against the student who is the alleged perpetrator of that offense.¹¹⁹

FERPA Enforcement

As explained above, FERPA prohibits federal funding of schools that have a policy of denying parents the right to review the education records of their children, as well as schools that have a policy or practice of disclosing student education records to unauthorized entities.¹²⁰ The enforcement of FERPA's provisions is statutorily entrusted with the Secretary of Education, who is responsible for designating an office and review board for investigating and reviewing complaints of violations.¹²¹ The Student Privacy Policy Office in ED reviews and investigates complaints and violations of FERPA.¹²² Following an investigation, it will provide any complainant as well as the school written notice of its findings.¹²³ In cases where ED finds that a school has not complied with FERPA and that failure was based on a school's policy or practice, the notice to the school will include the specific steps needed to comply with FERPA, and provide a reasonable time to comply.¹²⁴ If the school does not comply within the time given, the Secretary can enforce FERPA in a variety of ways, including by withholding further payments under any educational program, issuing a complaint to compel compliance through a cease and desist order, or terminating eligibility to receive funding under any educational program.¹²⁵ Another option is for the DOJ to bring a lawsuit on behalf of the United States against a noncompliant school.¹²⁶

Aside from the possibility of a lawsuit brought by the DOJ, the administrative scheme implemented by ED is the primary enforcement mechanism for FERPA. Whereas some other federal requirements for schools, such as Title IX of the Education Amendments of 1972,¹²⁷ are enforceable through a private right of action brought in federal court directly against a school for violations, FERPA does not create such a private right of action for students or parents. Courts have recognized that the statute itself does not explicitly establish a private right of action to sue for violations.¹²⁸ And in the 2002 case of Gonzaga University v. Doe, the Supreme Court ruled that FERPA also does not create any personal rights enforceable under 42 U.S.C. § 1983 (which provides a remedy for violations of federally conferred rights against state officials).¹²⁹ According to the Court, because Congress did not clearly and unambiguously establish an enforceable right in the statute, FERPA could not be enforced via a suit under § 1983.¹³⁰

How Does FERPA Interact With Other Legal Requirements?

Military Recruiters

While FERPA generally prohibits schools from disclosing student education records without consent unless an exception applies, two other statutes require schools to disclose certain student information to military recruiters. The Elementary and Secondary Education Act (ESEA) imposes certain requirements on local educational agencies that receive federal funds under its provisions.¹³¹ Those schools must disclose the name, address, and telephone listing of secondary school students upon request to a military recruiter.¹³² Parents may opt out of this disclosure for their children, and schools must notify parents of this option.¹³³ Another statute generally directed at the Department of Defense imposes similar requirements,¹³⁴ but defines covered schools somewhat differently.¹³⁵

Title IX of the Education Amendments of 1972

In addition to complying with FERPA's requirements concerning disclosure of student records, schools that receive federal financial assistance must also abide by the requirements of Title IX of the Education Amendments of 1972.¹³⁶ That statute generally prohibits schools from discriminating on the basis of sex.¹³⁷ In May 2020, ED issued regulations under Title IX that prescribe how schools must respond to allegations of sexual harassment at school.¹³⁸ Those regulations require that, during a grievance process in response to a formal complaint of harassment, schools must provide both parties the opportunity to review any evidence obtained through an investigation related to the allegations.¹³⁹ They also require schools to allow parties to have an advisor present during any proceeding of the grievance process.¹⁴⁰ Schools must create an investigative report that is sent to each party and their advisor,¹⁴¹ and issue written determinations of responsibility that include various findings that are disclosed to the parties.¹⁴²

Schools that receive federal financial assistance generally must comply both with FERPA and these Title IX requirements. Although FERPA does not have an express "exception" for disclosures in Title IX sexual harassment proceedings, these requirements may nonetheless be reconcilable. According to ED, the requirements of FERPA and the Title IX regulations do not contradict each other.¹⁴³ But in cases in which a direct conflict arises, ED asserts, Title IX's requirements override FERPA.¹⁴⁴ For support, ED points to the larger General Education Provisions Act (GEPA)—of which FERPA is a part—which provides that nothing in its provisions "shall be construed to affect the applicability of" Title IX.¹⁴⁵ And the Title IX regulations themselves provide that a recipient's obligation to comply with Title IX's requirements "is not obviated or alleviated by the FERPA."¹⁴⁶

Further, ED asserts that these Title IX regulations help protect a party's right to procedural due process under the Constitution.¹⁴⁷ In certain student disciplinary cases involving public schools, the Constitution requires that parties be given adequate notice of the charges against them and a meaningful opportunity to respond.¹⁴⁸ ED is precluded from enforcing Title IX or FERPA in a manner that deprives students of their constitutional rights.¹⁴⁹ According to this line of reasoning, FERPA cannot prohibit a school from disclosing to an accused student the evidence collected against him or her in a disciplinary proceeding because that would violate due process.¹⁵⁰

In addition, ED points to the FERPA requirement that parents (or eligible students) have access to their own education records.¹⁵¹ FERPA's definition of education records includes records that "contain information directly related to a student."¹⁵² ED notes that the evidence and investigative report disclosed pursuant to Title IX regulations directly relates to the allegations in a complaint, and therefore "directly relate" to the students at issue.¹⁵³

Moreover, as a practical matter, even if compliance with certain Title IX requirements might appear to conflict with FERPA's provisions in a particular situation, schools that comply with Title IX regulations by disclosing evidence to parties in a disciplinary proceeding are unlikely to face legal repercussions. As noted above, FERPA does not create a private right of action, meaning that ED conducts most enforcement of the statute.¹⁵⁴ But here, ED has explicitly acknowledged that, as it administers both FERPA and Title IX, it will "not interpret compliance with its regulations under Title IX to violate requirements in its regulations under FERPA."¹⁵⁵

Conclusion

Although FERPA's prohibition on disclosing student records without consent is framed broadly, the various exceptions to that mandate have provided schools flexibility to respond to situations in which certain information merits release. As discussed above, schools may disclose materials in order to ensure school safety, to participate in certain studies aimed at improving education outcomes, and to adapt to changes in how education is generally offered, including through developments in technology.

Some have expressed larger concerns with the handling of student records.¹⁵⁶ The maintenance and use of student records by third parties authorized to receive them for a particular purpose, for instance, can generate controversy.¹⁵⁷ If lawmakers believe these concerns are warranted, they can address them through legislation that amends FERPA to define schools' and other parties' obligations more specifically. Further, because the statute lacks a private right of action for students or parents to bring suit in response to FERPA violations, Congress could consider adding such a right to the statute. Finally, Congress could also amend the law to clarify the relationship between FERPA and a school's obligations under Title IX.