The Family Educational Rights and Privacy Act (FERPA), also known as the Buckley Amendment, was enacted on Aug 21, 1974, and was last amended in 2011. FERPA was established under Section 444 of the General Educational Provisions Act (GEPA). This act is implemented through:
- Title 20 – Educational, Chapter 31, U.S.C. § 1232g having subsections (a-j) and
- Regulations eCFR: Title 34, Subtitle A, Part 99 having subparts (A-E) & sections § 99.1 - § 99.67.
Purpose and Scope of FERPA
FERPA lays down the requirements to ensure the protection of privacy and rights of both students of an educational institution or an agency and their parents.
The Act is applicable to all those public elementary, secondary, and postsecondary educational institutions (colleges and universities) or agencies that receive federal funds from the US Department of Education - ED. Private elementary and private secondary educational institutions or agencies are exempt from FERPA obligations. The Secretary of ED administers the programs under which these funds are made available. The Act does not apply to an educational institution or agency that is a recipient of non-monetary benefits under any program. To learn more, refer to Title 34 > Subtitle A > Part 99 > Subpart A > Section § 99.1.
Section § 99.3 of Subpart A describes contextual meanings of different terms relevant to the FERPA Act and regulations. Some of the significant ones are defined below:
- “Educational agency or institution” is a public or private agency or institution that has received funds; private elementary and secondary educational institutions or agencies are not under the purview of FERPA.
- “Educational records” are files, records, documents, etc.
- Containing student-related information.
- Maintained by an educational institution or agency or a person acting for them.
It does not include educational ancillary records, administrative records, records created for law enforcement purposes, records maintained for normal business operations, or records created by medical professionals such as physicians, psychiatrists, psychologists, or other specialists.
- “Student” is any person whose educational records are maintained by an educational agency or institution in consideration; it excludes a person who hasn't been attending the institution or agency.
- “Eligible student” implies a student aged 18 years old or attending a postsecondary educational institution or agency.
Rights of Parents and Students
Sections § 99.4 and § 99.5 of Subpart A explore the rights that the students and their parents are entitled to. Further, Section § 99.12 also mentions the rights of parents and students w.r.t to review and access student records.
- Unless the educational institution or agency has evidence of a state statute, court order, or legally binding document relating to rights-revoking matters like divorce, custody, or separation, the parents of students are granted all the rights. Students are granted all the rights that their parents could exercise, such as giving consent for information disclosure after they turn 18.
- These rights include the right to access, inspect, and review the educational records belonging to students. Eligible students and parents of minor students also have the right to get their incorrect, inappropriate, misleading, and inaccurate information deleted or corrected.
- If a document or material in the educational record contains information about multiple students, then the parents of one of them have the right to inspect and review the part or get informed of specific information that relates to the student. However, educational institutions or agencies can refuse these rights under certain conditions.
Compliance Requirements as per FERPA
FERPA requires covered educational bodies to implement measures that ensure students' records are kept secure and their confidentiality is maintained. Below are some of the compliance requirements:
- Educational bodies should not conduct a data-gathering activity or survey unless authorized by law.
- Educational institutions or agencies must provide the parents and eligible students the right to inspect and review their children’s or self-educational records, respectively.
- Educational institutions or agencies must prevent the release of the PII or educational records excluding directory information (record details that can be disclosed without causing harm or violating privacy) to any agency, organization, or individual without the written consent of parents, except for some persons and entities; a few are mentioned below:
- Accrediting organizations to perform their operations.
- Organizations that allow personal identification of students and parents to only their representatives while conducting studies to develop, validate, or administer predictive tests, administer student aid programs, etc., and will destroy the information after the purpose has been served.
- Those acting on behalf of the Food and Nutrition Service to evaluate, measure performance, and conduct program monitoring of local and state educational institutes or agencies. The aggregate results without identifying any individual will be reported, provided that the PII is destroyed after the information is not required to evaluate, measure performance, and conduct program monitoring.
- Transfer of records maintained by educational institutions or agencies with third parties should be done only on the condition that the party will neither allow access to this information without the written consent of the student’s parents nor store the information after their purpose has been served. The violation of these conditions can result in prohibition from permitting access to third parties for a maximum of 5 years.
Repercussions of FERPA Non-Compliance
When educational institutions or agencies violate FERPA, they jeopardize student privacy, lose federal funds, get their accreditation revoked, face ED investigation, and incur reputation loss. Teachers or Professors may have to undergo corrective training and, in severe cases, risk losing their licenses.
In one such example from a Texas school, a teacher shared the records of almost 700 students via an email with another employee serving as an instructional coach for special education English language arts, who did not have a legitimate educational need for the information. This coach then forwarded the records to an external labor organization they both belonged to. Upon investigation, it was found that 62 parents of these students had signed FERPA notices not giving consent to the district for information disclosure with third parties. As a result, the teacher’s term contract with the district was terminated.
Section § 99.60 of Subpart - E stipulates that if a complaint is filed against any educational institution or agency for violating FERPA compliance in part or in its entirety, then the Secretary of the Office of the Chief Privacy Officer designates the office to:
- Conduct investigations.
- Review complaints.
- Provide technical support to ensure compliance.
- Designate the Review Board (Office of the Administrative Law Judges) to enforce compliance.
The major setback that educational institutions or agencies face by not adhering to FERPA guidelines is losing funds provided under various programs by the federal government.
Staying FERPA Compliant by Erasing Sensitive Data
Educational institutions or agencies should not have a policy or practice of releasing or sharing educational records or PII of students with third parties without the written consent of parents unless bound by exceptions such as legal obligations. The following must be practiced by the educational institutions to remain compliant with FERPA.
- Inform parents of minor students or eligible students of their rights as listed under Chapter 31 - Section § 1232 g(e).
For Example, the medium of informing could be a notice on the online portal or website, a verbal instruction incorporated in the orientation program, or a group email sent to parents of minor students and eligible students.
- Destroying information after the studies have been completed to develop, validate, or administer predictive tests and improve instruction.
- Erasing student records (PII) after the information is not required to evaluate, measure performance, and conduct program monitoring of state and local educational institutions or agencies.
- Ensuring that the third parties with whom the information was shared by educational institutions or agencies have permanently erased it after the purpose has been fulfilled.
Destroying, erasing, or wiping data permanently requires a certified and safe data erasure tool like BitRaser. This software automatically generates detailed erasure reports and certificates of destruction that can be presented as evidence of irrecoverable data destruction in front of governing authorities and the court of law. Educational institutions or agencies can also satisfy the parents and students covered under FERPA that their records have been erased securely using professional, certified software.
