Running head: FINAL POLICY RESEARCH PAPER - FERPA
EDLP 704: Decision-Making: Legal Perspectives – Final Policy Research Paper on FERPA
Philip W. Holmes
Virginia Commonwealth University Ed.D. (Leadership) – Cohort 4 (2016)
1
FINAL POLICY RESEARCH PAPER - FERPA
2
EDLP 704: Decision-Making: Legal Perspectives – Final Policy Research Paper on FERPA
The author will describe the Family Education Rights and Privacy Act (FERPA) of 1974,
and review the legal and research issues relevant to FERPA. He will then discuss the interview
that the author and his colleagues completed with a key subject matter expert on the FERPA
policy, and the extent to which that interview supports or challenges the legal and research issues
previously explored. Finally, the author will analyze the FERPA policy from two political
perspectives, will review the success of its implementation, and will suggest methods or
processes by which the success of FERPA might be evaluated.
Summary of Policy
FERPA is the Family Educational Rights and Privacy Act of 1974. President Gerald R.
Ford signed the act on August 21, 1974 and it became effective as of November 19, 1974. It was
actually an amendment of the General Education Provisions Act, offered on the floor of the
Senate by Senator James Buckley of New York (“Legislative History,” 2004). As an amendment
that was quickly signed into law, it bypassed the usual process of committee deliberations and
hearings that legislation usually goes through, and thus it lacks the expected legislative record for
legislation of its type (Cyphert & Garbutt, 2010; Graham et al., 2008; Weeks, 2001).
Because the act bypassed the usual legislative process, and because constituent groups
quickly clamored for more clarity, the Senate was obliged soon afterward to enact several major
amendments to explain further its intention and scope. Senator Buckley also partnered with
Senator Claiborne Pell to issue a statement that explained the intention behind the act; their
statement essentially took the place of the historical record that committee hearings and
deliberations usually create (“Legislative History,” 2004).
FINAL POLICY RESEARCH PAPER - FERPA
3
The basic goal of FERPA was to regulate access to educational records, to ensure that
parents had the right and ability to access the educational records of their children (to verify their
accuracy and relevancy, and to make corrections if needed) and that students had a similar right,
once they reached the age of eighteen (Weeks, 2001). This last point is key. In its first iteration,
FERPA transferred rights of access to educational records from the parent or parents to the child
once the child reached the age of eighteen, and mandated that the child at that point had to
provide written consent before his or her educational records could be disclosed; however, the
first amendments to FERPA noted numerous exceptions to this rule, and specified that if a child
was financially dependent on his or her parents (per the Internal Revenue Code), then the parent
or parents had access to the child’s educational records regardless of the child’s written consent
(“Legislative History,” 2004).
FERPA originally applied essentially to every educational institution, from pre-school to
graduate school; however, it was quickly amended to apply only to those institutions that receive
federal education funding (“Legislative History,” 2004). This paper focuses particularly on the
impact of FERPA on post-secondary schools; however, since nearly all post-secondary schools
receive federal funding of some sort, FERPA’s reach is actually quite extensive (Graham, Hall,
and Gilmer, 2008; Weeks, 2001).
In its first iteration, FERPA attempted to spell out which items were actually covered by
the policy; however, the attempt proved unwieldy, and the catch-all term “education records”
was coined in the first wave of amendments. This first wave of amendments also noted that socalled “directory information” was exempt from FERPA, and included such information as
FINAL POLICY RESEARCH PAPER - FERPA
4
student address, field of study, date of birth, place of birth, and participation in athletic activities
(“Legislative History,” 2004).
Policy Type
Fowler (2013) explored Theodore Lowi’s three types of policies or techniques of control
(distributive, regulatory, and redistributive), and before suggesting the type of policy to which
FERPA belongs, it will be helpful to review the three policy types that Lowi posited.
Fowler (2013) noted that distributive policies “bestow gifts on citizens” in multiple
forms, and have the effect of reinforcing or discouraging certain behaviors (p. 214). She further
noted that regulatory policies, as the name itself suggests, are “formalized rules” that “either
reduce or expand the alternatives available to those regulated,” and include “penalties for those
who break them” (p. 216). Fowler stated that redistributive policies “shift resources or power
from one social group to another,” (p. 218). Finally, she noted that determining a policy’s type
will also to some extent help predict the success of that policy, and may illuminate the groups
that will be in favor of a policy and the groups that will be opposed to it.
What can Fowler’s work say about FERPA? Certainly FERPA seems regulatory in
nature, as it details what educational institutions at the primary, secondary, and post-secondary
level can and cannot do regarding defined educational records. It further defines the rights that
students and parents have regarding the content of educational records and the access to those
records (and the penalties that can be assessed to educational institutions if they do not operate in
congruence with those rights).
FERPA also appears to be redistributive. Many post-secondary schools (as noted above)
tend to operate under the perception that regardless of the amendments to FERPA that would
FINAL POLICY RESEARCH PAPER - FERPA
5
enable them to provide education records to parents as long as their student children are
financially dependent upon them, all rights to a student’s information transfer to the student at
the age of eighteen (per FERPA’s original intent). Thus, for these post-secondary institutions at
least, FERPA redistributes the power over a student’s records from the parents to the student
upon the age of eighteen.
Legal Issues Relevant to Policy
Constitutional Law
There are no constitutional law issues related to the Family Educational Rights and
Privacy Act of 1974. The Congress of the United States passed this legislation in accordance
with the first article of the United States Constitution, which provides Congress with the ability
to expend funds as necessary for the well-being of the citizens of this country (“Legislative
History,” 2004; Furthey, 2008).
Federal and State Statutory Law
The Family Educational Rights and Privacy Act of 1974 has been amended eleven times
since it was first enacted in 1974 (Graham et al., 2008). As previously noted, these amendments
have been primarily intended to clarify the original intent of Senator Buckley. No particular
research issues have been identified with these amendments, per se.
As noted in the introduction to this paper, a subject matter expert was interviewed by the
author and his colleagues to provide more immediate, tangible, and practical information
regarding the experience of implementing FERPA in a major educational institution. Later
segments of this paper will make use of the transcript of this interview and will note the gap
between the intention of the first amendments to FERPA to allow parents who have
FINAL POLICY RESEARCH PAPER - FERPA
6
demonstrated the financial dependency of their children to obtain the educational records of their
children, and the reality of educational institutions that do not allow such access without the
expressed permission of those children (when they are at least eighteen years old).
Educational Regulations
FERPA is a federal law, and so federal and state regulations are in place simply to direct
and facilitate its implementation (Cyphert & Garbutt, 2010). As noted above, FERPA has been
amended eleven times by Congress, and each of these amendments could have triggered
concomitant regulatory changes at the state or federal level.
Sometimes, incidents outside of the legislative arena also trigger regulatory changes. A
starkly illustrative example of a regulatory change prompted by a non-legislative event is
provided by the unfortunate school shooting at Virginia Tech in 2007. Federal and state
investigations into the causes that led to this tragedy indicated that essential information about
the mental health of the shooter was not shared between agencies at Virginia Tech, or between
the university and the shooter’s parents, because of misguided apprehensions about the
stringency and rigidity of FERPA. Regulations at the Department of Education level now
specify that parents “may be notified when there is a health or safety emergency involving their
son or daughter, notwithstanding any FERPA provision that might otherwise prevent such a
disclosure” (Cyphert & Garbutt, 2010, p. 48).
Case Law
Two cases related to FERPA have reached the level of the United States Supreme Court.
Owasso Independent School District v. Falvo pertained to the definition of an educational record.
In this case, the mother of children attending school in Owasso, Kansas, took issue with the
FINAL POLICY RESEARCH PAPER - FERPA
7
practice at that school system of having children peers grade each other’s assignments and then
call out the grades; the mother considered the practice to be degrading and demeaning to her
children, and contended that it violated FERPA because it entailed the public sharing of grades,
or educational records (Futhey, 2008). The Supreme Court decided in 2002 that “grades on
student assignments [that were called out by students’ peers] did not constitute education
records” because they had not yet been recorded in the teacher’s formal grade book (Futhey,
2008, p. 290).
The second FERPA case to reach the Supreme Court was Gonzaga v. Doe, which was
also decided in 2002. This case revolved around the question of whether an individual had the
right to sue because of FERPA violations; specifically, because a university disclosed “a
student’s personal information in connection with state law teacher certification requirements”
(Graham et al., 2008, p. 307). The Supreme Court essentially ruled that an individual cannot sue
an educational institution for damages related to the unauthorized release of educational records
(Futhey, 2008).
Research Issues Relevant to Policy
Most of the research issues related to FERPA emanate from the lack of clarity as to what
FERPA intends and how it should be applied. First, there is a lack of clarity as to why FERPA
was created in the first place, and why it was created in the manner that it was. Second, there is a
lack of clarity as to how it should be applied (especially by post-secondary schools). Many postsecondary schools in particular cling to an outdated and frankly untenable position regarding
what FERPA actually entails. Far too many of these schools continue to operate under the
assumption that they can release no education records without signed release forms from
FINAL POLICY RESEARCH PAPER - FERPA
8
students aged eighteen or older, despite numerous amendments and regulations that point to the
contrary.
Weeks (2001) noted that FERPA was designed to “ensure the rights of students and
parents to the access and confidentiality of student records” (p.39). It is difficult to find a more
accurate and succinct definition of FERPA’s intent. While FERPA regulates the confidentiality
and access of all student records (from kindergarten through post-secondary-school), the focus of
this paper is on the impact of FERPA on post-secondary-school institutions. By statute, FERPA
regulates only those post-secondary schools that receive financial support from the Department
of Education; however, since nearly all post-secondary-schools receive federal funding of some
sort, FERPA’s reach is actually quite extensive (Graham, Hall, and Gilmer, 2008; Weeks, 2001).
Given FERPA’s broad impact on educational institutions, on their students, and on their
students’ parents, its genesis seems unusual and almost haphazard: it was offered as an
amendment on the floor of the Senate by Senator James Buckley of New York, and therefore
bypassed the typical committee and hearings process that nearly all pieces of legislature of its
scope undergo (Cyphert & Garbutt, 2010; Graham et al., 2008; Weeks, 2001). This lack of
“legislative history” makes it difficult for us to, in Cyphert and Garbutt’s (2010) excellent
phrase, “divine Congressional intent” behind the legislation (p. 47).
There was confusion about FERPA almost immediately after its birth, which led Senator
Buckley and Senator Claiborne Pell (his co-sponsor for several FERPA amendments) to
formulate and issue a joint statement that same year, which purported to present the sort of
granularity regarding the legislation’s intent that committee hearings generally provide (Graham
et al., 2008). FERPA has been amended by Congress nearly a dozen times since then, generally
FINAL POLICY RESEARCH PAPER - FERPA
9
in response to concerns from students, parents, and educational institutions about its unclear
language (Graham et al., 2008). Despite this record of multiple amendments, the intention and
scope of FERPA remain unclear; post-secondary schools in particular exhibit wide variation in
their interpretation and application of the policy (Graham et al., 2008; Weeks, 2001).
For example, soon after FERPA was signed into law, it was amended to enable postsecondary schools to disclose student education records to parents when those students are
financially dependent on those parents; however, many universities still operate as if that
amendment does not exist, and refuse to disclose student data to parents unless the student has
signed a disclosure form, regardless of that student’s financial dependency on his or her parents
(Weeks, 2001). Indeed, as Weeks (2001) stated, “Once a student is eighteen or enters a
postsecondary institution, the rights of parents transfer to the student unless the college decides
to permit parents of dependent students access to student records,” and many colleges and
universities decide not to permit that access (p 41).
Despite the extent to which FERPA has roiled the waters in post-secondary education,
Weeks (2001) noted that it was primarily designed to address “the misuse and abuse of student
records by elementary and secondary schools” [emphasis added] (p 40). Senator Buckley was
concerned about situations in which irrelevant or inaccurate information was placed in the files
of secondary school students, and the growing number of cases of confidential student
information being released to individuals or organizations that had no valid or justifiable reason
to possess that information (Weeks, 2010). Futhey (2008) also reported that many allegations of
abuses related to education records were current in the early 1970’s, and prompted Congress to
act.
FINAL POLICY RESEARCH PAPER - FERPA
10
FERPA applies only to education records, and not every piece of information that a
school possesses about a student can be defined as an education record. Generally speaking,
information that is considered “directory information” does not fit the statutory definition of an
education record, and can therefore be disclosed without the student’s consent. While directory
information pertains to the student, it has no negative impact if it is released, and it includes such
strictly biographical data as the student’s name, his or her address and place of birth, college
major or area of study, participation in formal or informal sports, and degree obtained (Furthey,
2008). Non-directory data are, de facto, education records, and cannot be disclosed without
expressed permission; such data include (among other items) the parents’ financial information
(generally submitted as a part of the student’s financial aid application), the student’s grades, and
information pertaining to the student’s medical and mental health (Furthey, 2008).
To ensure compliance, FERPA regulations mandate that any school that reveals education
records without the consent of the student may lose all of its federal education funding
(Pasternak, 1993; Furthey, 2008). However, such a penalty has never been assessed since
FERPA was established forty years ago (Graham, et al., 2008).
Interviews
The author and two colleagues completed an interview with a subject matter expert on
FERPA; specifically, the interviewee is an expert on the implementation of FERPA in a
university setting. The subject will be referred to as the interviewee throughout.
Purpose
On February 26, 2014, the author and two colleagues completed an interview with an
expert on implementing FERPA at the post-secondary level. The purpose of this interview was
FINAL POLICY RESEARCH PAPER - FERPA
11
to obtain practical insights about the implementation of FERPA from someone well-placed to
have observed and worked through any challenges or issues with how the policy works and how
it is perceived by administrators, faculty, and students at the university level (and also the parents
of those students).
Description of Procedure
The interviewee is the direct manager of a colleague who is not on the author’s team; the
interviewee was actually recommended to us by this colleague. We emailed the interviewee and
included the name of his direct report, thanking her for helping us connect with the interviewee.
This email included the key details about the interview (expected length of one hour, and our
need to take notes during the interview). We subsequently reached out to the interviewee’s
assistant, who enabled us to set up an hour-long interview with the interviewee. We sent our
questions to the interviewee beforehand.
The interview occurred on the afternoon of February 26, 2014, and it took place at the
interviewee’s office at the university. We spent the first part of the interview reviewing the
purpose of the interview – to review the implementation of FERPA in the interviewee’s
university environment – and noted that it was not our intention to evaluate the appropriateness
of the policy or of its implementation. We thanked the interviewee for giving us an hour of his
time, explained the research on FERPA that we had conducted in preparation for the interview,
and reviewed how the interviewee had been chosen to be the subject of our interview. We noted
that we would be going through the same list of questions that we had sent to the interviewee
ahead of time, and that some follow-up questions might be necessary; however, the interviewee
was free not to answer any questions that we might pose.
FINAL POLICY RESEARCH PAPER - FERPA
12
We thanked the interviewee for giving us permission to record the interview, and
reiterated that the recording was intended to insure that we captured his comments exactly. We
informed the interviewee that he would have the opportunity to review the transcript for
accuracy, and noted that we would not use the interviewee’s name in any place in the transcript
or the resulting paper. We then proceeded to the first question on our list. The full list of
questions posed to the interviewee is in Appendix B.
A transcript was prepared based on the audio recording. Every word of the interview was
captured on the transcript.
Profile of Interviewee
The interviewee is a senior administrator of a major university, and he holds a Ph.D.
degree. His particular responsibility is to lead the office that provides end-to-end support of
students in the areas of financial aid, records and registration, and student accounting; it also
includes the entire admissions department.
Data, by Question
Twelve questions were posed to our interviewee. Each of the questions is listed below,
along with a summary of the interviewee’s responses.
How did this policy come about? The interviewee noted that the policy was started in
1974, and distributed to the team members a hardcopy of a document entitled, “Legislative
History of Major FERPA Provisions.” The interviewee noted the prominence of an organization
to which the interviewee belongs, the American Association of Collegiate Registrars and
Admissions Officers (AACRAO) and noted that this organization performs FERPA training for
its members every year. The interviewee gave no further information at this point regarding how
FINAL POLICY RESEARCH PAPER - FERPA
13
the policy came about. (See question four, "Who were some other people or other groups
interested in this policy?” for additional insights from the interviewee in this regard.)
What is the purpose of the policy? The interviewee noted that FERPA was designed
initially to protect student information, and as it has evolved it has clarified who besides the
student has access to student information. The interviewee noted that the most recent
amendment of FERPA was prompted by the Patriot Act and it greatly expands the amount of
information that the government can obtain from schools without student consent or knowledge.
The interviewee clarified the distinction between directory information (benign, not
impactful if released, data that the university must release if asked) and non-directory
information (this is a smaller subset of information, has a potentially dangerous impact to the
student if released without the student’s consent, and includes items like the student’s Social
Security Number). The interviewee noted that requests for student information (the interviewee
did not use the term “education records,” though that is often the term one finds in the literature)
are reviewed in his university by the Institutional Research Department.
What is your role with respect to this policy’s implementation? The interviewee
noted that the various external groups that might seek student information, and clarified that his
area’s role is protecting students’ data from those who do not have a right to see it. After a
student reaches the age of 18, it is up to the student to decide how or whether that information
will be shared (including with his or her parents). That decision is noted in the FERPA release,
which details who besides the student can have access to which pieces of the student’s
information. The interviewee noted that his area’s involvement starts when students go through
orientation, when individuals from the Office of Strategic Enrollment Management review
FINAL POLICY RESEARCH PAPER - FERPA
14
FERPA with both the students and the parents, note the ramifications of the policy (for example,
if the student does not authorize the parents to review his or her educational information, the
parents cannot call the university to discuss how to pay for the student’s tuition), and provide
blank FERPA release forms for the students to complete.
One of the author’s colleagues asked the interviewee whether the student’s status as a
financial dependent of the parents (in the eyes of the I.R.S.) would enable the parents to view the
student’s records. The interview noted that they do not capture financial dependency statuses.
(Note in the segment on research issues above that FERPA has been amended to allow
universities to reveal student information to parents when a financial dependency on the parents
exists; however, it is up to the university to decide whether to do so, and many decide not to.)
Who were some other people or other groups interested in this policy? The
interviewee was asked specifically if FERPA was designed in response to a particular problem
that was pressing in 1974. The interview stated that he was not aware of any problem that
FERPA might have been designed expressly to address; however, he wondered if perhaps it had
been created in response to issues related to the draft and the Vietnam War. The interviewee
then noted that from his point of view, groups interested in this policy in general (and student
information in particular) are primarily on campus, such as faculty members. The interviewee
noted the key phrase, “educational interest,” and stated that it is the registrar’s role to determine
who in the campus environment truly has an educational interest in a particular student’s
information. Thus, someone in the registrar’s office can relatively easily look at a student’s
information, because of their legitimate educational interest, but someone from the building
maintenance staff could not.
FINAL POLICY RESEARCH PAPER - FERPA
15
What kinds of things were considered as the policy was implemented? The
interviewee noted that security, training, and self-audits were all considered as key portions of
FERPA implementation. The interviewee noted that the student information system has different
levels of access, so that while two employees could have access to it, each might be relegated to
very different areas of that system.
The interviewee was asked whether a visitor who reviewed FERPA procedures at the
interviewee’s university, and then compared them with FERPA procedures at a university in
Tennessee, might see essentially the same procedures. The interview agreed, and suggested that
most universities likely operate with FERPA in very similar ways. (Note in the segment on
research issues above that variation in FERPA procedures and internal policies is actually
considered to be widespread.)
What are some strengths of the policy? The interviewee noted that one strength of the
policy is the general agreement among universities as to how to implement it. He further noted
that because faculty members cannot view most student information, it precludes the possibility
of instructor bias (based on previous grades in other classes or perhaps on the student’s financial
situation). Finally, the interviewee noted that for many students, deciding who gets access to
their information is one of the first adult decisions that they have to make, and so making that
decision is formative in itself.
How did you get “buy-in” for the policy? The interviewee noted that since FERPA is
the law, “buy-in” is not really an issue. He further noted that the perceived punishment for not
following FERPA is very strong, and that apprehension is by itself enough to drive compliance.
(Note in the segment on research issues above that the penalty for non-compliance – essentially,
FINAL POLICY RESEARCH PAPER - FERPA
16
losing any federal education funding that the institution is receiving – is likely a reason why so
many universities protect student information in excess of what FERPA amendments require,
even though no university has ever lost federal education funding as a result of non-compliance
with FERPA.)
What did you imagine the process would look like for implementing the policy? The
interviewee noted the difficulty of detailing FERPA to the various involved groups, both on
campus and off campus. The interviewee also noted his expectation that FERPA might be
reviewed to students at the high school level, perhaps by guidance counselors (this apparently is
never the case). The interviewee noted the expense and complexity of retaining FERPA forms
on behalf of students, and the obligation to provide training for various employees on campus –
training that must be updated after new amendments or related regulations. Finally, the
interviewee noted, with some regret, the inevitable conflicts with those who strongly believe that
they are or should be able to view student data (but have not been authorized by the student to
view it), and the onerous process that the school’s customer service staff must go through.
Is there any language in the policy that is bothersome to you? The interviewee could
not think of any language in the policy that is bothersome. He did note that the law is long,
complicated, and detailed, and yet it does not cover every case or situation.
What is your perception of the success of implementation of this policy? The
interviewee believed that the policy is successful, and acknowledged that it was the lack of
evidence of failure (low number of complaints, low number of situations where data should have
been protected but was not) that was leading him to conclude that it has been implemented
successfully. He noted that keeping up with training was probably an issue in most schools.
FINAL POLICY RESEARCH PAPER - FERPA
17
How will you know the policy is doing what it is intended to do? The interviewee
believed his answer would be the same here as for the previous question.
Do you have anything else you’d like to add that hasn’t been talked about? The
interviewee stated that the most recent amendment (stemming from the Patriot Act) was
potentially problematic, and seemed to be the latest in a string of amendments that has had the
result of increased access to student data. He suggested that it would be beneficial if a simplified
and condensed version of FERPA could be created and disseminated to students and parents
before their chaotic and emotional first week on campus.
Themes and Topics Emerging
The compilation of themes and topics – with relevant interviewee responses – is attached
as Appendix C.
Topics emerging. Ten topics emerged from the interview. These topics are:

Policy Origination and History

Policy Purpose

Roles

Interested Persons and Groups

Policy Strengths

Policy Concerns

Implementation Procedures

Implementation Challenges and Considerations

Buy-In

Evidence of Success
FINAL POLICY RESEARCH PAPER - FERPA
18
Themes emerging. Three themes emerged from the interview. These themes are:

Importance of Training

Compliance Issues

Frustrations and Confusions.
Summary and reflection. Several key themes can be gleaned from the interview
transcript. The first key theme is the extent to which the interviewee was convinced that the
stance taken by his university – that is, that they cannot release students’ records to parents
without a signed FERPA release from the student – reflected the intention of FERPA. As noted
above in the research section, this is not actually true. FERPA was amended shortly after it was
enacted specifically to enable universities like the interviewee’s to send education records to
parents when a financial dependency can be established. However, the interviewee’s strong
focus on the relevancy and importance of FERPA as a matter of settled law reflects his
determination to ensure the safety of student records, and that is in itself laudable.
Another key theme is actually the reverse of the coin: namely, the extent to which
conflicts arise in the university setting as a result of FERPA and of the university’s rigid stance.
Usually these conflicts arise because of students’ inability or unwillingness to sign a FERPA
release for their parents; however, it was also a surprise to learn how often internecine conflicts
regarding FERPA arise within the university (when faculty members attempt to obtain student
information and find out that they cannot).
The final theme is the need for consistent and stringent training across the university,
including in the areas that interact with students and their families. This theme was also a
surprise. The American Association of Collegiate Registrars and Admissions Officers,
FINAL POLICY RESEARCH PAPER - FERPA
19
AACRAO, apparently devotes much of its annual conference to the topic of FERPA, and offers
regular training to school staff on the policy. Our interviewee noted that a corollary need was to
be vigilant around compliance after the training has been completed, and to ensure that processes
and procedures are created, maintained, and followed regarding information security (because of
the amount of educational records located in university systems).
Conclusions
In this section, the author will analyze FERPA from two political perspectives (drawn
from the Fowler text previously cited), will analyze the success of the implementation of FERPA
(making use of that same text and also drawing from the author’s interview with a key subject
matter expert), and will make suggestions regarding how FERPA could be evaluated.
Analysis from Two Political Perspectives
Fowler (2013) reviewed various political perspectives that have an impact on policies,
their genesis, and their success. For this paper, the author will explore two of those political
perspectives: Conservatism (specifically business conservatism) and Liberalism (specifically
New Democrats).
Business conservatism. Fowler (2013) noted that American business conservatism
experienced a resurgence in the last two decades of the twentieth century, highlighted by the rise
to the presidency of Ronald Reagan (serving from 1980 to 1988), and mirrored overseas by the
concomitant rise to power of Margaret Thatcher (in many ways Reagan’s ideological twin) in the
United Kingdom. While Fowler did not state it, we can assume that the presidential leadership
of both George H. W. Bush and his son, George W. Bush, were likewise a reflection of the
FINAL POLICY RESEARCH PAPER - FERPA
20
power of business conservatism during this period, as was the term as prime minister of John
Major immediately following Thatcher’s years in office.
Fowler (2013) stated that the hallmark of business conservatism is the notion that human
behavior is invariably the result of the pursuit of economic well-being. She added that to the
business conservative, this pursuit is neither greedy nor problematic, but is rather wholly positive
and inevitable, and generally results in the overall betterment of the larger economy and the
health of the overall culture. Implicit in this notion from Fowler is the idea of wealth “trickling
down” from the most successful members of society – not necessarily because the most
successful are donating portions of their wealth or sharing that wealth intentionally with those
who are less successful (in fact, one could assume from Fowler’s work that such actions would
generally be frowned upon by business conservatives), but rather because wealth inevitably
spreads out (or, as another cliché would put it, “a rising tide lifts all boats”).
While a case could be made that government actions can improve the health or
functioning of an economy, such a case would not be made by business conservatives. Instead,
as Fowler (2013) noted, those who pursue success in the economy (that is, in the market) find
that success best and most easily when government does not intervene. These “laissez-faire” or
“leave it alone” business conservatives have faith that the forces within the market will moderate
the market on their own, and that any intervention (however well-intentioned) will only impede
those inherent and regulating forces. As Fowler (2013) noted, business conservatives do not see
“global economic problems” as the result of the actions of unguided economies; rather, they see
those problems as “the natural result of the misguided policies of the welfare state” (p. 108).
FINAL POLICY RESEARCH PAPER - FERPA
21
“In their discourse and policy proposals,” Fowler (2013) noted, “business conservatives
emphasize two values: efficiency and freedom,” and in their educational policies, they tend to
suggest measures that would introduce into schools the same competitive and meritocratic forces
that they laud in private industry, such as “higher standards, more accountability in schools,
merit pay, and proficiency testing – all policies designed to improve the economy” (p. 108).
Unfortunately for our purposes here, Fowler did not mention FERPA; however, we can
infer from her review of business conservatives that they would have an ambivalent reaction to
this policy. Its primary author, Senator James Buckley of New York, was himself a Republican;
however, his purpose in sponsoring the amendment that bears his name seems not to have been
in any way economic; rather, his purpose was to protect the accuracy and relevancy of student
records, and to ensure that both students and parents had access to them (Weeks, 2001).
Possibly, we could imagine a business conservative supporting FERPA because incorrect
education records (which students and their parents did not have the right to obtain, inspect, and
correct) might to some small extent impede students from being successful in school (and thus,
by extension, in the later work environment); however, that is far away from a primary goal.
Given the extent to which business conservatives shy away from extensive government
intervention in general, it is more likely that most would conclude that FERPA has become
unwieldy and ungainly (despite its original intent), and would be dismayed by the extensive
private and governmental resources devoted to defining it, interpreting it, and applying it.
New Democrats. Fowler (2013) noted that New Democrats rose to prominence in
American politics at approximately the same time that business conservatives reasserted
themselves, and thus it makes sense also to review the likely reaction of New Democrats to
FINAL POLICY RESEARCH PAPER - FERPA
22
FERPA. Fowler did not state this, but the author is old enough to recall the rise of New
Democrats in the 1980’s, and would suggest that not only were they the corollary to business
conservatives, they were in many ways a reaction to business conservatism. Fowler (2013)
suggested that New Democrats arose “in reaction against the New Left,” and noted that they
moved away from “race-and-gender identity politics” because of the negative connotation of
those politics with the important voting block of “working class citizens” (p. 111). Fowler could
have added that Reagan’s business conservative allies at that point were having great success
pulling those working class citizens (once stalwart supporters of the Democratic Party) to the
Republican Party.
Like business conservatives, the New Democrats tended to support the capitalistic
economic system and were generally opposed to entitlement programs; however, unlike business
conservatives, New Democrats believed that government is not inherently bad, nor is it
necessarily too large or in need of curtailment (Fowler, 2013). While they agreed with business
conservatives that a growing economy is a boon to all classes in society, they tended to believe
that without some sort of intervention in the free market, economic equality is difficult if not
impossible to achieve, and that the free market too often worked to pull classes apart. Thus, New
Democratic policies promoted “economic growth and fraternity” in their policies (Fowler, 2013,
p. 111).
Fowler (2013) posited Bill Clinton’s presidency in the 1990’s as the zenith of New
Democratic power in American politics, and noted that he and his staff promoted educational
policies fully in line with New Democratic tenets regarding fraternity – “programs of national
and community service for young people… to strengthen their sense of brotherhood” – and
FINAL POLICY RESEARCH PAPER - FERPA
23
economic growth – “improved vocational and technical education as a way to stimulate
economic growth” (p. 111). While New Democrats would likely support business conservative
efforts to raise standards in American schools, they would go beyond the new conservative
desire to ensure that schools are creating ready workers, and add to their goals the desire to
“build a sense of national unity” (Fowler, 2013, p. 111).
Given that New Democrats are not inherently or necessarily opposed to a powerful
federal government, there is no reason to suspect that they would have immediate animosity
toward FERPA merely because the maintenance and promulgation of the policy has necessitated
a spurt of growth in the Department of Education at least (and causing an increase in the size of
the government is in itself a reason for most business conservatives to dislike the policy). As
FERPA is not likely to impact the economy, and has no discernible impact on any sense of social
cohesion in the nation’s communities, it seems likely that most New Democrats would be neutral
or ambivalent toward FERPA.
Success of Implementation
Fowler (2013) believed that the job of leaders in education “can be summarized in two
words: policy implementation” (p. 241), and stated that while some policies can be implemented
without a great deal of difficulty, other policies (especially those that are redistributive) can be
quite vexing and challenging. As discussed above, the author believes that FERPA has been
interpreted by most colleges and universities in a redistributive fashion (that is, it has been
interpreted as redistributing authority – as necessitating the movement of the authority over a
student’s information from the parents to the student), and thus it is not surprising that research
suggests its implementation has been difficult.
FINAL POLICY RESEARCH PAPER - FERPA
24
Drawing from the history of educational policy implementation since the 1960’s, Fowler
(2013) concluded that researchers themselves have changed how they view the success or failure
of policy implementation – in effect, their understanding of how to measure the success or failure
of a policy has matured as they have worked through the actual process of measuring it. Before
the 1960’s, there were very few broad-scale educational policies to measure, and thus
educational researchers in the 1960’s were not only measuring the success of new broad-scale
educational policies, they were measuring the success of new broad-scale educational policies
for the first time.
Fowler (2013) separated this new research into implementation success into three phases:
first generation research (which viewed the success of policy implementation in a generally
pessimistic light, and was mainly published in the late 1960’s and early 1970’s), second
generation research (which began to note the gradual success of those initiatives that researchers
had previously despaired of, and which extended into the early 1980’s), and third generation
research, which moderated the more optimistic evaluations of the second generation, and
incorporated into its evaluation process a more nuanced understanding of the more complex and
far-reaching goals of educational initiatives around the turn of the last century.
Fowler (2013) noted that a powerful lesson learned by researchers from all three
generations of evaluation research is that those who implement policies should be seen also as
learners, and not simply as implementers, because they must learn and master the details and
ramifications of the new policy before they can implement it in the manner that the policy
demands. Fowler (2013) further noted that when implementers approach a new policy, they
naturally tend to try to understand it and make sense of it using existing frames of reference,
FINAL POLICY RESEARCH PAPER - FERPA
25
what she calls “already formed schemas,” which may end up causing the implementer to
misjudge or underestimate the subtleties of the policy or the difficulty of implementing it
properly (p. 250).
Our interviewee seems to concur with Fowler here. One of the key themes that emerged
from the interview (noted above) was the tremendous importance of stringent and ongoing
training regarding FERPA throughout the university. The interviewee further noted that this
training is absolutely essential when amendments are enacted or new regulations pertaining to
FERPA come into play. “Because [FERPA] is paramount in the industry and it’s highly
confusing, it’s changing,” the interviewee stated (Interviewee, p. 68, INTER.-1-Intro, in
Appendix C).
While our interviewee did not refer to Fowler’s model, we can infer that one of the
reasons why training on FERPA is so essential is that when implementers are faced with
amendments or new regulations, they exhibit the tendency that Fowler (2013) described; i.e.,
implementers attempt to understand amendment or new regulations through older lenses, and
must take time to learn and master all of the new complexities.
Fowler (2013) posited several key high-level steps that successful leaders should take
when implementing a policy. First, one must mobilize or prepare for implementation. This step
generally takes longer to complete than most leaders anticipate. Mobilization includes
discerning the reasons why a policy is being adopted, ensuring that the reasons make sense for
the institution or organization, and ensuring that sufficient support is available from all of those
who will be impacted by the policy.
FINAL POLICY RESEARCH PAPER - FERPA
26
Second, the successful leader must “plan the implementation” (Fowler, 2013, p. 260).
This entails determining who should be ruled in and ruled out of the planning process and also
devoting time and energy to predicting at the beginning of the process “the exact nature of what
is essential to the project” (Fowler, 2013, p. 260).
Third, the successful leader must gather the resources that the implementation will
require (Fowler, 2013). Fowler further noted that many implementation difficulties can be
attributed to the extent to which implementers were not able to gather the resources that the
implementation actually required. Fowler (2013) added that these resources can typically be
categorized as money, time, personnel, space, and equipment and materials, and she concluded
with the warning that “genuine policy changes” often rest on the ability of leaders to “analyze
carefully what resources are necessary and obtain them both before and during implementation”
(p. 263). Given that FERPA is not a newly implemented policy, our interviewee did not offer any
concurring or diverging commentary on these initial steps specifically.
Finally, we should not forget the importance of “providing a strong social infrastructure
for implementation,” which Fowler (2013) declared may go against the common culture of
teaching as an “individualistic profession” where teachers must “sink or swim” (p. 255). The
third generation researchers mentioned above often found that “mentors, coaches, and support
networks” were key ingredients in successful policy implementations, because they gave
implementers a chance to share concerns and suggestions, see how others were coping with the
struggles related with implementation, and obtain essential feedback about their own
performance (p 255).
FINAL POLICY RESEARCH PAPER - FERPA
27
Our interviewee noted the importance of the professional organization to which he
belongs, the American Association of Collegiate Registrars and Admissions Officers
(AACRAO), specifically because of that organization’s annual conference; where “there’s
something called the FERPA Update, which is the most highly attended session at the entire
thing” (Interviewee, p. 68, INTER.-1-Intro, in Appendix C). This conference clearly provides a
small version of the sort of social support and opportunities for discussion and idea-sharing that
Fowler (2013) considered to be crucial to successful policy implementations.
Suggestions for Evaluating Effectiveness of Policy
While many of the research articles that the author encountered can be said to constitute
evaluations, to some degree, of the FERPA policy, he found no evidence of the sort of formal
evaluation of FERPA that Fowler (2013) described. Her words above may explain why no
formal evaluations of FERPA seem to have been completed. The actual process of evaluating a
policy is simple, though likely never easy. The seven straight-forward steps for evaluating a
policy that Fowler (2013) described are listed below.
1. Determine the goals of the policy
2. Select indicators
3. Select or develop data-collection instruments
4. Collect data
5. Analyze and summarize data
6. Write evaluation report
7. Respond to evaluators’ recommendations
(Fowler, 2013, page 282).
FINAL POLICY RESEARCH PAPER - FERPA
28
It is tempting to suggest that these steps ought simply to be followed – perhaps by the
Department of Education, perhaps by a committee or group set up by Congress – to evaluate the
success of FERPA; however, after considering the matter, the author believes that a formal
evaluation of FERPA’s success would be terribly difficult and likely ineffective. As noted above,
there is wide variation among post-secondary-schools as to the implementation of FERPA, and
this variation would make comparisons impossible.
Fowler (2013) noted that the first step in evaluating a policy is to determine its goals.
Weeks (2001) noted that FERPA was designed to “ensure the rights of students and parents to the
access and confidentiality of student records” (p. 39). Yet, when asked to describe the purpose of
FERPA, our interviewee stated that the purpose of the policy is “to protect individual’s
identities” (Interviewee, p. 69, INTER.-4-2, in Appendix C). He later stated that the “real
fundamental [goal], especially for our division, is protecting the student’s data from – and the
froms could be the parents” (Interviewee, p. 70, INTER-5-3, in Appendix C). With this kind of
variation in the understanding of simply the goals of the policy (our interviewee seemingly
embraced the goal of confidentiality, but not necessarily of access), evaluation will be very
difficult.
If the author were charged with evaluating the success of FERPA, he would first
categorize the ways in which post-secondary school systems have chosen to define and
implement it. For example, some universities draw rigid lines in the sand and will release no
information to parents without a signed FERPA form. Some universities will release student
records to parents when a financial dependency has been verified. Our interviewee also noted
variations in FERPA communications, with some universities focusing strongly on informing
FINAL POLICY RESEARCH PAPER - FERPA
29
students and parents about FERPA rights during orientation, and others informing students and
parents of FERPA only after the issue actually arises. “I worked at a place before here, and we
changed it where [FERPA] was never talked about until the parents called up the financial aid
office or the student accounts office” (Interviewee, p. 72, INTER-21-12, in Appendix C).
Then the author would determine how to measure the success of each FERPA model. It
has already been noted above that no university has ever lost federal funding because of a
FERPA failure. But, one should be able to arrive at other indicators of success, perhaps simply
by surveying students and parents to determine “the level of pain” related to FERPA issues. One
would also survey administrators at various levels in the schools themselves.
The relative success or failure of the different models of application could then be
compared, and a formal proposal made regarding the optimal application model.
Fowler (2013) noted that after writing the evaluation report, the final step is simply to
respond to the recommendations from those evaluators that the report contains. The author
imagines this evaluation report stating that a certain FERPA model is optimum (communicate
FERPA to these stakeholders at this point in time using this simplified communication; follow
these rules regarding what is or is not an education record; make education records available to
parents when they meet these criteria or are authorized to receive such records via this process or
this FERPA form); however, the author also imagines that writing this report would be the last
simple step in the process. There would remain the very difficult steps of communicating the
recommendations, tracking the institutions already in compliance versus those not already in
compliance (and doubtless there would be multiple levels of compliance), deciding on the length
of time institutions would have to come into compliance, coming up with the resources to track,
FINAL POLICY RESEARCH PAPER - FERPA
30
measure, define, and enforce compliance, and finally agreeing on the inevitable appellate process
for those institutions that had numerous reasons why they might not be able to conform to certain
criteria.
As noted above, FERPA persists in its current form both because of and despite its many
amendments. The author is forced to conclude that the best way to evaluate it may be the
method that the interviewee created.
Perception of the success of the implementation? I’d say in general it probably works out
pretty well. You know, as you mentioned earlier, we don’t hear the horror stories so
maybe we’re not getting complaints. It’s working out alright… We don’t see that there
are large numbers of people saying my identity’s been stolen or personal information’s
been compromised and all this type of a thing. So that’s pretty good. Um, and we also,
while we do have discussions with our colleagues about who’s allowed and who’s not,
they eventually go away. (Interviewee, p. 81, INTER.-19-10, in Appendix C)
FINAL POLICY RESEARCH PAPER - FERPA
31
References
Cyphert, A.B., & Garbutt, K. (2010). The balkanization of university support systems: FERPA's
chilling effect on campuses and how honors administrators can break the ice. Journal of
the National Collegiate Honors Council, 11, 47-53.
Futhey, R.W. (2008). The Family Educational Rights & Privacy Act of 1974: Recommendations
for realigning educational privacy with Congress’ original intent. Creighton Law Review,
41, 277-314.
Graham, R., Hall, R., & Gilmer, W. G. (2008). Connecting the dots…: Information sharing by
post-secondary educational institutions under the Family Education Rights and Privacy
Act (FERPA). Education and the Law, 20, 301-316.
Pasternak, S. (1993). Unsealing campus law enforcement records. Newspaper Research Journal,
13-14, 17-27.
Weeks, K.M. (2001). Family-friendly FERPA policies: Affirming Parental Partnerships. New
Directions for Student Services, 2, 39-50.
U. S. Department of Education. (2004). Legislative History of Major FERPA Provisions.
Retrieved from http://www2.ed.gov/policy/gen/guid/fpco/ferpa/leg-history.html
FINAL POLICY RESEARCH PAPER - FERPA
32
Appendix A (FERPA Policy)
Subpart A—General
§99.1 To which educational agencies or institutions do these regulations apply?
(a) Except as otherwise noted in §99.10, this part applies to an educational agency or
institution to which funds have been made available under any program administered by the
Secretary, if—
(1) The educational institution provides educational services or instruction, or both, to
students; or
(2) The educational agency is authorized to direct and control public elementary or
secondary, or postsecondary educational institutions.
(b) This part does not apply to an educational agency or institution solely because
students attending that agency or institution receive non-monetary benefits under a program
referenced in paragraph (a) of this section, if no funds under that program are made available to
the agency or institution.
(c) The Secretary considers funds to be made available to an educational agency or
institution of funds under one or more of the programs referenced in paragraph (a) of this
section—
(1) Are provided to the agency or institution by grant, cooperative agreement, contract,
subgrant, or subcontract; or
(2) Are provided to students attending the agency or institution and the funds may be paid
to the agency or institution by those students for educational purposes, such as under the Pell
Grant Program and the Guaranteed Student Loan Program (titles IV-A-1 and IV-B, respectively,
of the Higher Education Act of 1965, as amended).
(d) If an educational agency or institution receives funds under one or more of the
programs covered by this section, the regulations in this part apply to the recipient as a whole,
including each of its components (such as a department within a university).
(Authority: 20 U.S.C. 1232g)
[53 FR 11943, Apr. 11, 1988, as amended at 61 FR 59295, Nov. 21, 1996; 65 FR 41852,
July 6, 2000]
§99.2 What is the purpose of these regulations?
FINAL POLICY RESEARCH PAPER - FERPA
33
The purpose of this part is to set out requirements for the protection of privacy of parents
and students under section 444 of the General Education Provisions Act, as amended.
(Authority: 20 U.S.C. 1232g)
NOTE TO §99.2: 34 CFR 300.610 through 300.626 contain requirements regarding the
confidentiality of information relating to children with disabilities who receive evaluations,
services or other benefits under Part B of the Individuals with Disabilities Education Act (IDEA).
34 CFR 303.402 and 303.460 identify the confidentiality of information requirements regarding
children and infants and toddlers with disabilities and their families who receive evaluations,
services, or other benefits under Part C of IDEA. 34 CFR 300.610 through 300.627 contain the
confidentiality of information requirements that apply to personally identifiable data,
information, and records collected or maintained pursuant to Part B of the IDEA.
[53 FR 11943, Apr. 11, 1988, as amended at 61 FR 59295, Nov. 21, 1996; 73 FR 74851,
Dec. 9, 2008]
§99.3 What definitions apply to these regulations?
The following definitions apply to this part:
Act means the Family Educational Rights and Privacy Act of 1974, as amended, enacted
as section 444 of the General Education Provisions Act.
(Authority: 20 U.S.C. 1232g)
Attendance includes, but is not limited to—
(a) Attendance in person or by paper correspondence, videoconference, satellite, Internet,
or other electronic information and telecommunications technologies for students who are not
physically present in the classroom; and
(b) The period during which a person is working under a work-study program.
(Authority: 20 U.S.C. 1232g)
Authorized representative means any entity or individual designated by a State or local
educational authority or an agency headed by an official listed in §99.31(a)(3) to conduct—with
respect to Federal- or State-supported education programs—any audit or evaluation, or any
compliance or enforcement activity in connection with Federal legal requirements that relate to
these programs.
(Authority: 20 U.S.C. 1232g(b)(1)(C), (b)(3), and (b)(5))
FINAL POLICY RESEARCH PAPER - FERPA
34
Biometric record, as used in the definition of personally identifiable information, means a
record of one or more measurable biological or behavioral characteristics that can be used for
automated recognition of an individual. Examples include fingerprints; retina and iris patterns;
voiceprints; DNA sequence; facial characteristics; and handwriting.
(Authority: 20 U.S.C. 1232g)
Dates of attendance. (a) The term means the period of time during which a student
attends or attended an educational agency or institution. Examples of dates of attendance include
an academic year, a spring semester, or a first quarter.
(b) The term does not include specific daily records of a student's attendance at an
educational agency or institution.
(Authority: 20 U.S.C. 1232g(a)(5)(A))
Directory information means information contained in an education record of a student
that would not generally be considered harmful or an invasion of privacy if disclosed.
(a) Directory information includes, but is not limited to, the student's name; address;
telephone listing; electronic mail address; photograph; date and place of birth; major field of
study; grade level; enrollment status (e.g., undergraduate or graduate, full-time or part-time);
dates of attendance; participation in officially recognized activities and sports; weight and height
of members of athletic teams; degrees, honors, and awards received; and the most recent
educational agency or institution attended.
(b) Directory information does not include a student's—
(1) Social security number; or
(2) Student identification (ID) number, except as provided in paragraph (c) of this
definition.
(c) In accordance with paragraphs (a) and (b) of this definition, directory information
includes—
(1) A student ID number, user ID, or other unique personal identifier used by a student for
purposes of accessing or communicating in electronic systems, but only if the identifier cannot
be used to gain access to education records except when used in conjunction with one or more
factors that authenticate the user's identity, such as a personal identification number (PIN),
password or other factor known or possessed only by the authorized user; and
(2) A student ID number or other unique personal identifier that is displayed on a student
ID badge, but only if the identifier cannot be used to gain access to education records except
FINAL POLICY RESEARCH PAPER - FERPA
35
when used in conjunction with one or more factors that authenticate the user's identity, such as a
PIN, password, or other factor known or possessed only by the authorized user.
(Authority: 20 U.S.C. 1232g(a)(5)(A))
Disciplinary action or proceeding means the investigation, adjudication, or imposition of
sanctions by an educational agency or institution with respect to an infraction or violation of the
internal rules of conduct applicable to students of the agency or institution.
Disclosure means to permit access to or the release, transfer, or other communication of
personally identifiable information contained in education records by any means, including oral,
written, or electronic means, to any party except the party identified as the party that provided or
created the record.
(Authority: 20 U.S.C. 1232g(b)(1) and (b)(2))
Early childhood education program means—
(a) A Head Start program or an Early Head Start program carried out under the Head Start
Act (42 U.S.C. 9831 et seq.), including a migrant or seasonal Head Start program, an Indian
Head Start program, or a Head Start program or an Early Head Start program that also receives
State funding;
(b) A State licensed or regulated child care program; or
(c) A program that—
(1) Serves children from birth through age six that addresses the children's cognitive
(including language, early literacy, and early mathematics), social, emotional, and physical
development; and
(2) Is—
(i) A State prekindergarten program;
(ii) A program authorized under section 619 or part C of the Individuals with Disabilities
Education Act; or
(iii) A program operated by a local educational agency.
Educational agency or institution means any public or private agency or institution to
which this part applies under §99.1(a).
(Authority: 20 U.S.C. 1232g(a)(3))
FINAL POLICY RESEARCH PAPER - FERPA
36
Education program means any program that is principally engaged in the provision of
education, including, but not limited to, early childhood education, elementary and secondary
education, postsecondary education, special education, job training, career and technical
education, and adult education, and any program that is administered by an educational agency
or institution.
(Authority: 20 U.S.C. 1232g(b)(3), (b)(5))
Education records. (a) The term means those records that are:
(1) Directly related to a student; and
(2) Maintained by an educational agency or institution or by a party acting for the agency
or institution.
(b) The term does not include:
(1) Records that are kept in the sole possession of the maker, are used only as a personal
memory aid, and are not accessible or revealed to any other person except a temporary substitute
for the maker of the record.
(2) Records of the law enforcement unit of an educational agency or institution, subject to
the provisions of §99.8.
(3)(i) Records relating to an individual who is employed by an educational agency or
institution, that:
(A) Are made and maintained in the normal course of business;
(B) Relate exclusively to the individual in that individual's capacity as an employee; and
(C) Are not available for use for any other purpose.
(ii) Records relating to an individual in attendance at the agency or institution who is
employed as a result of his or her status as a student are education records and not excepted
under paragraph (b)(3)(i) of this definition.
(4) Records on a student who is 18 years of age or older, or is attending an institution of
postsecondary education, that are:
(i) Made or maintained by a physician, psychiatrist, psychologist, or other recognized
professional or paraprofessional acting in his or her professional capacity or assisting in a
paraprofessional capacity;
FINAL POLICY RESEARCH PAPER - FERPA
37
(ii) Made, maintained, or used only in connection with treatment of the student; and
(iii) Disclosed only to individuals providing the treatment. For the purpose of this
definition, “treatment” does not include remedial educational activities or activities that are part
of the program of instruction at the agency or institution; and
(5) Records created or received by an educational agency or institution after an individual
is no longer a student in attendance and that are not directly related to the individual's attendance
as a student.
(6) Grades on peer-graded papers before they are collected and recorded by a teacher.
(Authority: 20 U.S.C. 1232g(a)(4))
Eligible student means a student who has reached 18 years of age or is attending an
institution of postsecondary education.
(Authority: 20 U.S.C. 1232g(d))
Institution of postsecondary education means an institution that provides education to
students beyond the secondary school level; “secondary school level” means the educational
level (not beyond grade 12) at which secondary education is provided as determined under State
law.
(Authority: 20 U.S.C. 1232g(d))
Parent means a parent of a student and includes a natural parent, a guardian, or an
individual acting as a parent in the absence of a parent or a guardian.
(Authority: 20 U.S.C. 1232g)
Party means an individual, agency, institution, or organization.
(Authority: 20 U.S.C. 1232g(b)(4)(A))
Personally Identifiable Information
The term includes, but is not limited to—
(a) The student's name;
(b) The name of the student's parent or other family members;
(c) The address of the student or student's family;
FINAL POLICY RESEARCH PAPER - FERPA
38
(d) A personal identifier, such as the student's social security number, student number, or
biometric record;
(e) Other indirect identifiers, such as the student's date of birth, place of birth, and
mother's maiden name;
(f) Other information that, alone or in combination, is linked or linkable to a specific
student that would allow a reasonable person in the school community, who does not have
personal knowledge of the relevant circumstances, to identify the student with reasonable
certainty; or
(g) Information requested by a person who the educational agency or institution
reasonably believes knows the identity of the student to whom the education record relates.
(Authority: 20 U.S.C. 1232g)
Record means any information recorded in any way, including, but not limited to,
handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche.
(Authority: 20 U.S.C. 1232g)
Secretary means the Secretary of the U.S. Department of Education or an official or
employee of the Department of Education acting for the Secretary under a delegation of
authority.
(Authority: 20 U.S.C. 1232g)
Student, except as otherwise specifically provided in this part, means any individual who
is or has been in attendance at an educational agency or institution and regarding whom the
agency or institution maintains education records.
(Authority: 20 U.S.C. 1232g(a)(6))
[53 FR 11943, Apr. 11, 1988, as amended at 60 FR 3468, Jan. 17, 1995; 61 FR 59295,
Nov. 21, 1996; 65 FR 41852, July 6, 2000; 73 FR 74851, Dec. 9, 2008; 76 FR 75641, Dec. 2,
2011]
§99.4 What are the rights of parents?
An educational agency or institution shall give full rights under the Act to either parent,
unless the agency or institution has been provided with evidence that there is a court order, State
statute, or legally binding document relating to such matters as divorce, separation, or custody
that specifically revokes these rights.
FINAL POLICY RESEARCH PAPER - FERPA
39
(Authority: 20 U.S.C. 1232g)
§99.5 What are the rights of students?
(a)(1) When a student becomes an eligible student, the rights accorded to, and consent
required of, parents under this part transfer from the parents to the student.
(2) Nothing in this section prevents an educational agency or institution from disclosing
education records, or personally identifiable information from education records, to a parent
without the prior written consent of an eligible student if the disclosure meets the conditions in
§99.31(a)(8), §99.31(a)(10), §99.31(a)(15), or any other provision in §99.31(a).
(b) The Act and this part do not prevent educational agencies or institutions from giving
students rights in addition to those given to parents.
(c) An individual who is or has been a student at an educational institution and who
applies for admission at another component of that institution does not have rights under this part
with respect to records maintained by that other component, including records maintained in
connection with the student's application for admission, unless the student is accepted and
attends that other component of the institution.
(Authority: 20 U.S.C. 1232g(d))
[53 FR 11943, Apr. 11, 1988, as amended at 58 FR 3188, Jan. 7, 1993; 65 FR 41853, July
6, 2000; 73 FR 74852, Dec. 9, 2008]
§99.6 [Reserved]
§99.7 What must an educational agency or institution include in its annual
notification?
(a)(1) Each educational agency or institution shall annually notify parents of students
currently in attendance, or eligible students currently in attendance, of their rights under the Act
and this part.
(2) The notice must inform parents or eligible students that they have the right to—
(i) Inspect and review the student's education records;
(ii) Seek amendment of the student's education records that the parent or eligible student
believes to be inaccurate, misleading, or otherwise in violation of the student's privacy rights;
FINAL POLICY RESEARCH PAPER - FERPA
40
(iii) Consent to disclosures of personally identifiable information contained in the
student's education records, except to the extent that the Act and §99.31 authorize disclosure
without consent; and
(iv) File with the Department a complaint under §§99.63 and 99.64 concerning alleged
failures by the educational agency or institution to comply with the requirements of the Act and
this part.
(3) The notice must include all of the following:
(i) The procedure for exercising the right to inspect and review education records.
(ii) The procedure for requesting amendment of records under §99.20.
(iii) If the educational agency or institution has a policy of disclosing education records
under §99.31(a)(1), a specification of criteria for determining who constitutes a school official
and what constitutes a legitimate educational interest.
(b) An educational agency or institution may provide this notice by any means that are
reasonably likely to inform the parents or eligible students of their rights.
(1) An educational agency or institution shall effectively notify parents or eligible
students who are disabled.
(2) An agency or institution of elementary or secondary education shall effectively notify
parents who have a primary or home language other than English.
(Approved by the Office of Management and Budget under control number 1880-0508)
(Authority: 20 U.S.C. 1232g (e) and (f))
[61 FR 59295, Nov. 21, 1996]
§99.8 What provisions apply to records of a law enforcement unit?
(a)(1) Law enforcement unit means any individual, office, department, division, or other
component of an educational agency or institution, such as a unit of commissioned police
officers or non-commissioned security guards, that is officially authorized or designated by that
agency or institution to—
(i) Enforce any local, State, or Federal law, or refer to appropriate authorities a matter for
enforcement of any local, State, or Federal law against any individual or organization other than
the agency or institution itself; or
FINAL POLICY RESEARCH PAPER - FERPA
41
(ii) Maintain the physical security and safety of the agency or institution.
(2) A component of an educational agency or institution does not lose its status as a law
enforcement unit if it also performs other, non-law enforcement functions for the agency or
institution, including investigation of incidents or conduct that constitutes or leads to a
disciplinary action or proceedings against the student.
(b)(1) Records of a law enforcement unit means those records, files, documents, and
other materials that are—
(i) Created by a law enforcement unit;
(ii) Created for a law enforcement purpose; and
(iii) Maintained by the law enforcement unit.
(2) Records of a law enforcement unit does not mean—
(i) Records created by a law enforcement unit for a law enforcement purpose that are
maintained by a component of the educational agency or institution other than the law
enforcement unit; or
(ii) Records created and maintained by a law enforcement unit exclusively for a non-law
enforcement purpose, such as a disciplinary action or proceeding conducted by the educational
agency or institution.
(c)(1) Nothing in the Act prohibits an educational agency or institution from contacting
its law enforcement unit, orally or in writing, for the purpose of asking that unit to investigate a
possible violation of, or to enforce, any local, State, or Federal law.
(2) Education records, and personally identifiable information contained in education
records, do not lose their status as education records and remain subject to the Act, including the
disclosure provisions of §99.30, while in the possession of the law enforcement unit.
(d) The Act neither requires nor prohibits the disclosure by an educational agency or
institution of its law enforcement unit records.
(Authority: 20 U.S.C. 1232g(a)(4)(B)(ii))
[60 FR 3469, Jan. 17, 1995]
Subpart B—What Are the Rights of Inspection and Review of Education Records?
FINAL POLICY RESEARCH PAPER - FERPA
42
§99.10 What rights exist for a parent or eligible student to inspect and review
education records?
(a) Except as limited under §99.12, a parent or eligible student must be given the
opportunity to inspect and review the student's education records. This provision applies to—
(1) Any educational agency or institution; and
(2) Any State educational agency (SEA) and its components.
(i) For the purposes of subpart B of this part, an SEA and its components constitute an
educational agency or institution.
(ii) An SEA and its components are subject to subpart B of this part if the SEA maintains
education records on students who are or have been in attendance at any school of an educational
agency or institution subject to the Act and this part.
(b) The educational agency or institution, or SEA or its component, shall comply with a
request for access to records within a reasonable period of time, but not more than 45 days after
it has received the request.
(c) The educational agency or institution, or SEA or its component shall respond to
reasonable requests for explanations and interpretations of the records.
(d) If circumstances effectively prevent the parent or eligible student from exercising the
right to inspect and review the student's education records, the educational agency or institution,
or SEA or its component, shall—
(1) Provide the parent or eligible student with a copy of the records requested; or
(2) Make other arrangements for the parent or eligible student to inspect and review the
requested records.
(e) The educational agency or institution, or SEA or its component shall not destroy any
education records if there is an outstanding request to inspect and review the records under this
section.
(f) While an education agency or institution is not required to give an eligible student
access to treatment records under paragraph (b)(4) of the definition of Education records in
§99.3, the student may have those records reviewed by a physician or other appropriate
professional of the student's choice.
(Authority: 20 U.S.C. 1232g(a)(1) (A) and (B))
FINAL POLICY RESEARCH PAPER - FERPA
43
[53 FR 11943, Apr. 11, 1988, as amended at 61 FR 59296, Nov. 21, 1996]
§99.11 May an educational agency or institution charge a fee for copies of
education records?
(a) Unless the imposition of a fee effectively prevents a parent or eligible student from
exercising the right to inspect and review the student's education records, an educational agency
or institution may charge a fee for a copy of an education record which is made for the parent or
eligible student.
(b) An educational agency or institution may not charge a fee to search for or to retrieve
the education records of a student.
(Authority: 20 U.S.C. 1232g(a)(1))
§99.12 What limitations exist on the right to inspect and review records?
(a) If the education records of a student contain information on more than one student, the
parent or eligible student may inspect and review or be informed of only the specific information
about that student.
(b) A postsecondary institution does not have to permit a student to inspect and review
education records that are:
(1) Financial records, including any information those records contain, of his or her
parents;
(2) Confidential letters and confidential statements of recommendation placed in the
education records of the student before January 1, 1975, as long as the statements are used only
for the purposes for which they were specifically intended; and
(3) Confidential letters and confidential statements of recommendation placed in the
student's education records after January 1, 1975, if:
(i) The student has waived his or her right to inspect and review those letters and
statements; and
(ii) Those letters and statements are related to the student's:
(A) Admission to an educational institution;
(B) Application for employment; or
(C) Receipt of an honor or honorary recognition.
FINAL POLICY RESEARCH PAPER - FERPA
44
(c)(1) A waiver under paragraph (b)(3)(i) of this section is valid only if:
(i) The educational agency or institution does not require the waiver as a condition for
admission to or receipt of a service or benefit from the agency or institution; and
(ii) The waiver is made in writing and signed by the student, regardless of age.
(2) If a student has waived his or her rights under paragraph (b)(3)(i) of this section, the
educational institution shall:
(i) Give the student, on request, the names of the individuals who provided the letters and
statements of recommendation; and
(ii) Use the letters and statements of recommendation only for the purpose for which they
were intended.
(3)(i) A waiver under paragraph (b)(3)(i) of this section may be revoked with respect to
any actions occurring after the revocation.
(ii) A revocation under paragraph (c)(3)(i) of this section must be in writing.
(Authority: 20 U.S.C. 1232g(a)(1) (A), (B), (C), and (D))
[53 FR 11943, Apr. 11, 1988, as amended at 61 FR 59296, Nov. 21, 1996]
Subpart C—What Are the Procedures for Amending Education Records?
§99.20 How can a parent or eligible student request amendment of the student's
education records?
(a) If a parent or eligible student believes the education records relating to the student
contain information that is inaccurate, misleading, or in violation of the student's rights of
privacy, he or she may ask the educational agency or institution to amend the record.
(b) The educational agency or institution shall decide whether to amend the record as
requested within a reasonable time after the agency or institution receives the request.
(c) If the educational agency or institution decides not to amend the record as requested,
it shall inform the parent or eligible student of its decision and of his or her right to a hearing
under §99.21.
(Authority: 20 U.S.C. 1232g(a)(2))
FINAL POLICY RESEARCH PAPER - FERPA
45
[53 FR 11943, Apr. 11, 1988; 53 FR 19368, May 27, 1988, as amended at 61 FR 59296,
Nov. 21, 1996]
§99.21 Under what conditions does a parent or eligible student have the right to a
hearing?
(a) An educational agency or institution shall give a parent or eligible student, on request,
an opportunity for a hearing to challenge the content of the student's education records on the
grounds that the information contained in the education records is inaccurate, misleading, or in
violation of the privacy rights of the student.
(b)(1) If, as a result of the hearing, the educational agency or institution decides that the
information is inaccurate, misleading, or otherwise in violation of the privacy rights of the
student, it shall:
(i) Amend the record accordingly; and
(ii) Inform the parent or eligible student of the amendment in writing.
(2) If, as a result of the hearing, the educational agency or institution decides that the
information in the education record is not inaccurate, misleading, or otherwise in violation of the
privacy rights of the student, it shall inform the parent or eligible student of the right to place a
statement in the record commenting on the contested information in the record or stating why he
or she disagrees with the decision of the agency or institution, or both.
(c) If an educational agency or institution places a statement in the education records of a
student under paragraph (b)(2) of this section, the agency or institution shall:
(1) Maintain the statement with the contested part of the record for as long as the record
is maintained; and
(2) Disclose the statement whenever it discloses the portion of the record to which the
statement relates.
(Authority: 20 U.S.C. 1232g(a)(2))
[53 FR 11943, Apr. 11, 1988, as amended at 61 FR 59296, Nov. 21, 1996]
§99.22 What minimum requirements exist for the conduct of a hearing?
The hearing required by §99.21 must meet, at a minimum, the following requirements:
(a) The educational agency or institution shall hold the hearing within a reasonable time
after it has received the request for the hearing from the parent or eligible student.
FINAL POLICY RESEARCH PAPER - FERPA
46
(b) The educational agency or institution shall give the parent or eligible student notice of
the date, time, and place, reasonably in advance of the hearing.
(c) The hearing may be conducted by any individual, including an official of the
educational agency or institution, who does not have a direct interest in the outcome of the
hearing.
(d) The educational agency or institution shall give the parent or eligible student a full
and fair opportunity to present evidence relevant to the issues raised under §99.21. The parent or
eligible student may, at their own expense, be assisted or represented by one or more individuals
of his or her own choice, including an attorney.
(e) The educational agency or institution shall make its decision in writing within a
reasonable period of time after the hearing.
(f) The decision must be based solely on the evidence presented at the hearing, and must
include a summary of the evidence and the reasons for the decision.
(Authority: 20 U.S.C. 1232g(a)(2))
Subpart D—May an Educational Agency or Institution Disclose Personally
Identifiable Information From Education Records?
§99.30 Under what conditions is prior consent required to disclose information?
(a) The parent or eligible student shall provide a signed and dated written consent before
an educational agency or institution discloses personally identifiable information from the
student's education records, except as provided in §99.31.
(b) The written consent must:
(1) Specify the records that may be disclosed;
(2) State the purpose of the disclosure; and
(3) Identify the party or class of parties to whom the disclosure may be made.
(c) When a disclosure is made under paragraph (a) of this section:
(1) If a parent or eligible student so requests, the educational agency or institution shall
provide him or her with a copy of the records disclosed; and
(2) If the parent of a student who is not an eligible student so requests, the agency or
institution shall provide the student with a copy of the records disclosed.
FINAL POLICY RESEARCH PAPER - FERPA
47
(d) “Signed and dated written consent” under this part may include a record and signature
in electronic form that—
(1) Identifies and authenticates a particular person as the source of the electronic consent;
and
(2) Indicates such person's approval of the information contained in the electronic
consent.
(Authority: 20 U.S.C. 1232g (b)(1) and (b)(2)(A))
[53 FR 11943, Apr. 11, 1988, as amended at 58 FR 3189, Jan. 7, 1993; 69 FR 21671, Apr.
21, 2004]
§99.31 Under what conditions is prior consent not required to disclose
information?
(a) An educational agency or institution may disclose personally identifiable information
from an education record of a student without the consent required by §99.30 if the disclosure
meets one or more of the following conditions:
(1)(i)(A) The disclosure is to other school officials, including teachers, within the agency
or institution whom the agency or institution has determined to have legitimate educational
interests.
(B) A contractor, consultant, volunteer, or other party to whom an agency or institution
has outsourced institutional services or functions may be considered a school official under this
paragraph provided that the outside party—
(1) Performs an institutional service or function for which the agency or institution would
otherwise use employees;
(2) Is under the direct control of the agency or institution with respect to the use and
maintenance of education records; and
(3) Is subject to the requirements of §99.33(a) governing the use and redisclosure of
personally identifiable information from education records.
(ii) An educational agency or institution must use reasonable methods to ensure that
school officials obtain access to only those education records in which they have legitimate
educational interests. An educational agency or institution that does not use physical or
technological access controls must ensure that its administrative policy for controlling access to
education records is effective and that it remains in compliance with the legitimate educational
interest requirement in paragraph (a)(1)(i)(A) of this section.
FINAL POLICY RESEARCH PAPER - FERPA
48
(2) The disclosure is, subject to the requirements of §99.34, to officials of another school,
school system, or institution of postsecondary education where the student seeks or intends to
enroll, or where the student is already enrolled so long as the disclosure is for purposes related to
the student's enrollment or transfer.
NOTE: Section 4155(b) of the No Child Left Behind Act of 2001, 20 U.S.C. 7165(b),
requires each State to assure the Secretary of Education that it has a procedure in place to
facilitate the transfer of disciplinary records with respect to a suspension or expulsion of a
student by a local educational agency to any private or public elementary or secondary school in
which the student is subsequently enrolled or seeks, intends, or is instructed to enroll.
(3) The disclosure is, subject to the requirements of §99.35, to authorized representatives
of—
(i) The Comptroller General of the United States;
(ii) The Attorney General of the United States;
(iii) The Secretary; or
(iv) State and local educational authorities.
(4)(i) The disclosure is in connection with financial aid for which the student has applied
or which the student has received, if the information is necessary for such purposes as to:
(A) Determine eligibility for the aid;
(B) Determine the amount of the aid;
(C) Determine the conditions for the aid; or
(D) Enforce the terms and conditions of the aid.
(ii) As used in paragraph (a)(4)(i) of this section, financial aid means a payment of funds
provided to an individual (or a payment in kind of tangible or intangible property to the
individual) that is conditioned on the individual's attendance at an educational agency or
institution.
(Authority: 20 U.S.C. 1232g(b)(1)(D))
(5)(i) The disclosure is to State and local officials or authorities to whom this information
is specifically—
FINAL POLICY RESEARCH PAPER - FERPA
49
(A) Allowed to be reported or disclosed pursuant to State statute adopted before
November 19, 1974, if the allowed reporting or disclosure concerns the juvenile justice system
and the system's ability to effectively serve the student whose records are released; or
(B) Allowed to be reported or disclosed pursuant to State statute adopted after November
19, 1974, subject to the requirements of §99.38.
(ii) Paragraph (a)(5)(i) of this section does not prevent a State from further limiting the
number or type of State or local officials to whom disclosures may be made under that
paragraph.
(6)(i) The disclosure is to organizations conducting studies for, or on behalf of,
educational agencies or institutions to:
(A) Develop, validate, or administer predictive tests;
(B) Administer student aid programs; or
(C) Improve instruction.
(ii) Nothing in the Act or this part prevents a State or local educational authority or
agency headed by an official listed in paragraph (a)(3) of this section from entering into
agreements with organizations conducting studies under paragraph (a)(6)(i) of this section and
redisclosing personally identifiable information from education records on behalf of educational
agencies and institutions that disclosed the information to the State or local educational authority
or agency headed by an official listed in paragraph (a)(3) of this section in accordance with the
requirements of §99.33(b).
(iii) An educational agency or institution may disclose personally identifiable information
under paragraph (a)(6)(i) of this section, and a State or local educational authority or agency
headed by an official listed in paragraph (a)(3) of this section may redisclose personally
identifiable information under paragraph (a)(6)(i) and (a)(6)(ii) of this section, only if—
(A) The study is conducted in a manner that does not permit personal identification of
parents and students by individuals other than representatives of the organization that have
legitimate interests in the information;
(B) The information is destroyed when no longer needed for the purposes for which the
study was conducted; and
(C) The educational agency or institution or the State or local educational authority or
agency headed by an official listed in paragraph (a)(3) of this section enters into a written
agreement with the organization that—
FINAL POLICY RESEARCH PAPER - FERPA
50
(1) Specifies the purpose, scope, and duration of the study or studies and the information
to be disclosed;
(2) Requires the organization to use personally identifiable information from education
records only to meet the purpose or purposes of the study as stated in the written agreement;
(3) Requires the organization to conduct the study in a manner that does not permit
personal identification of parents and students, as defined in this part, by anyone other than
representatives of the organization with legitimate interests;
and
(4) Requires the organization to destroy all personally identifiable information when the
information is no longer needed for the purposes for which the study was conducted and
specifies the time period in which the information must be destroyed.
(iv) An educational agency or institution or State or local educational authority or Federal
agency headed by an official listed in paragraph (a)(3) of this section is not required to initiate a
study or agree with or endorse the conclusions or results of the study.
(v) For the purposes of paragraph (a)(6) of this section, the term organization includes,
but is not limited to, Federal, State, and local agencies, and independent organizations.
(7) The disclosure is to accrediting organizations to carry out their accrediting functions.
(8) The disclosure is to parents, as defined in §99.3, of a dependent student, as defined in
section 152 of the Internal Revenue Code of 1986.
(9)(i) The disclosure is to comply with a judicial order or lawfully issued subpoena.
(ii) The educational agency or institution may disclose information under paragraph
(a)(9)(i) of this section only if the agency or institution makes a reasonable effort to notify the
parent or eligible student of the order or subpoena in advance of compliance, so that the parent or
eligible student may seek protective action, unless the disclosure is in compliance with—
(A) A Federal grand jury subpoena and the court has ordered that the existence or the
contents of the subpoena or the information furnished in response to the subpoena not be
disclosed;
(B) Any other subpoena issued for a law enforcement purpose and the court or other
issuing agency has ordered that the existence or the contents of the subpoena or the information
furnished in response to the subpoena not be disclosed; or
FINAL POLICY RESEARCH PAPER - FERPA
51
(C) An ex parte court order obtained by the United States Attorney General (or designee
not lower than an Assistant Attorney General) concerning investigations or prosecutions of an
offense listed in 18 U.S.C. 2332b(g)(5)(B) or an act of domestic or international terrorism as
defined in 18 U.S.C. 2331.
(iii)(A) If an educational agency or institution initiates legal action against a parent or
student, the educational agency or institution may disclose to the court, without a court order or
subpoena, the education records of the student that are relevant for the educational agency or
institution to proceed with the legal action as plaintiff.
(B) If a parent or eligible student initiates legal action against an educational agency or
institution, the educational agency or institution may disclose to the court, without a court order
or subpoena, the student's education records that are relevant for the educational agency or
institution to defend itself.
(10) The disclosure is in connection with a health or safety emergency, under the
conditions described in §99.36.
(11) The disclosure is information the educational agency or institution has designated as
“directory information”, under the conditions described in §99.37.
(12) The disclosure is to the parent of a student who is not an eligible student or to the
student.
(13) The disclosure, subject to the requirements in §99.39, is to a victim of an alleged
perpetrator of a crime of violence or a non-forcible sex offense. The disclosure may only include
the final results of the disciplinary proceeding conducted by the institution of postsecondary
education with respect to that alleged crime or offense. The institution may disclose the final
results of the disciplinary proceeding, regardless of whether the institution concluded a violation
was committed.
(14)(i) The disclosure, subject to the requirements in §99.39, is in connection with a
disciplinary proceeding at an institution of postsecondary education. The institution must not
disclose the final results of the disciplinary proceeding unless it determines that—
(A) The student is an alleged perpetrator of a crime of violence or non-forcible sex
offense; and
(B) With respect to the allegation made against him or her, the student has committed a
violation of the institution's rules or policies.
(ii) The institution may not disclose the name of any other student, including a victim or
witness, without the prior written consent of the other student.
FINAL POLICY RESEARCH PAPER - FERPA
52
(iii) This section applies only to disciplinary proceedings in which the final results were
reached on or after October 7, 1998.
(15)(i) The disclosure is to a parent of a student at an institution of postsecondary
education regarding the student's violation of any Federal, State, or local law, or of any rule or
policy of the institution, governing the use or possession of alcohol or a controlled substance if—
(A) The institution determines that the student has committed a disciplinary violation
with respect to that use or possession; and
(B) The student is under the age of 21 at the time of the disclosure to the parent.
(ii) Paragraph (a)(15) of this section does not supersede any provision of State law that
prohibits an institution of postsecondary education from disclosing information.
(16) The disclosure concerns sex offenders and other individuals required to register
under section 170101 of the Violent Crime Control and Law Enforcement Act of 1994, 42 U.S.C.
14071, and the information was provided to the educational agency or institution under 42
U.S.C. 14071 and applicable Federal guidelines.
(b)(1) De-identified records and information. An educational agency or institution, or a
party that has received education records or information from education records under this part,
may release the records or information without the consent required by §99.30 after the removal
of all personally identifiable information provided that the educational agency or institution or
other party has made a reasonable determination that a student's identity is not personally
identifiable, whether through single or multiple releases, and taking into account other
reasonably available information.
(2) An educational agency or institution, or a party that has received education records or
information from education records under this part, may release de-identified student level data
from education records for the purpose of education research by attaching a code to each record
that may allow the recipient to match information received from the same source, provided
that—
(i) An educational agency or institution or other party that releases de-identified data
under paragraph (b)(2) of this section does not disclose any information about how it generates
and assigns a record code, or that would allow a recipient to identify a student based on a record
code;
(ii) The record code is used for no purpose other than identifying a de-identified record
for purposes of education research and cannot be used to ascertain personally identifiable
information about a student; and
FINAL POLICY RESEARCH PAPER - FERPA
53
(iii) The record code is not based on a student's social security number or other personal
information.
(c) An educational agency or institution must use reasonable methods to identify and
authenticate the identity of parents, students, school officials, and any other parties to whom the
agency or institution discloses personally identifiable information from education records.
(d) Paragraphs (a) and (b) of this section do not require an educational agency or
institution or any other party to disclose education records or information from education records
to any party except for parties under paragraph (a)(12) of this section.
(Authority: 20 U.S.C. 1232g(a)(5)(A), (b), (h), (i), and (j)).
[53 FR 11943, Apr. 11, 1988; 53 FR 19368, May 27, 1988, as amended at 58 FR 3189,
Jan. 7, 1993; 61 FR 59296, Nov. 21, 1996; 65 FR 41853, July 6, 2000; 73 FR 74852, Dec, 9,
2008; 74 FR 401, Jan. 6, 2009; 76 FR 75641, Dec. 2, 2011]
§99.32 What recordkeeping requirements exist concerning requests and
disclosures?
(a)(1) An educational agency or institution must maintain a record of each request for
access to and each disclosure of personally identifiable information from the education records
of each student, as well as the names of State and local educational authorities and Federal
officials and agencies listed in §99.31(a)(3) that may make further disclosures of personally
identifiable information from the student's education records without consent under §99.33(b).
(2) The agency or institution shall maintain the record with the education records of the
student as long as the records are maintained.
(3) For each request or disclosure the record must include:
(i) The parties who have requested or received personally identifiable information from
the education records; and
(ii) The legitimate interests the parties had in requesting or obtaining the information.
(4) An educational agency or institution must obtain a copy of the record of further
disclosures maintained under paragraph (b)(2) of this section and make it available in response to
a parent's or eligible student's request to review the record required under paragraph (a)(1) of this
section.
(5) An educational agency or institution must record the following information when it
discloses personally identifiable information from education records under the health or safety
emergency exception in §99.31(a)(10) and §99.36:
FINAL POLICY RESEARCH PAPER - FERPA
54
(i) The articulable and significant threat to the health or safety of a student or other
individuals that formed the basis for the disclosure; and
(ii) The parties to whom the agency or institution disclosed the information.
(b)(1) Except as provided in paragraph (b)(2) of this section, if an educational agency or
institution discloses personally identifiable information from education records with the
understanding authorized under §99.33(b), the record of the disclosure required under this
section must include:
(i) The names of the additional parties to which the receiving party may disclose the
information on behalf of the educational agency or institution; and
(ii) The legitimate interests under §99.31 which each of the additional parties has in
requesting or obtaining the information.
(2)(i) A State or local educational authority or Federal official or agency listed in
§99.31(a)(3) that makes further disclosures of information from education records under
§99.33(b) must record the names of the additional parties to which it discloses information on
behalf of an educational agency or institution and their legitimate interests in the information
under §99.31 if the information was received from:
(A) An educational agency or institution that has not recorded the further disclosures
under paragraph (b)(1) of this section; or
(B) Another State or local educational authority or Federal official or agency listed in
§99.31(a)(3).
(ii) A State or local educational authority or Federal official or agency that records further
disclosures of information under paragraph (b)(2)(i) of this section may maintain the record by
the student's class, school, district, or other appropriate grouping rather than by the name of the
student.
(iii) Upon request of an educational agency or institution, a State or local educational
authority or Federal official or agency listed in §99.31(a)(3) that maintains a record of further
disclosures under paragraph (b)(2)(i) of this section must provide a copy of the record of further
disclosures to the educational agency or institution within a reasonable period of time not to
exceed 30 days.
(c) The following parties may inspect the record relating to each student:
(1) The parent or eligible student.
FINAL POLICY RESEARCH PAPER - FERPA
55
(2) The school official or his or her assistants who are responsible for the custody of the
records.
(3) Those parties authorized in §99.31(a) (1) and (3) for the purposes of auditing the
recordkeeping procedures of the educational agency or institution.
(d) Paragraph (a) of this section does not apply if the request was from, or the disclosure
was to:
(1) The parent or eligible student;
(2) A school official under §99.31(a)(1);
(3) A party with written consent from the parent or eligible student;
(4) A party seeking directory information; or
(5) A party seeking or receiving records in accordance with §99.31(a)(9)(ii)(A) through
(C).
(Approved by the Office of Management and Budget under control number 1880-0508)
(Authority: 20 U.S.C. 1232g(b)(1) and (b)(4)(A))
[53 FR 11943, Apr. 11, 1988, as amended at 61 FR 59297, Nov. 21, 1996; 73 FR 74853,
Dec. 9, 2008]
§99.33 What limitations apply to the redisclosure of information?
(a)(1) An educational agency or institution may disclose personally identifiable
information from an education record only on the condition that the party to whom the
information is disclosed will not disclose the information to any other party without the prior
consent of the parent or eligible student.
(2) The officers, employees, and agents of a party that receives information under
paragraph (a)(1) of this section may use the information, but only for the purposes for which the
disclosure was made.
(b)(1) Paragraph (a) of this section does not prevent an educational agency or institution
from disclosing personally identifiable information with the understanding that the party
receiving the information may make further disclosures of the information on behalf of the
educational agency or institution if—
(i) The disclosures meet the requirements of §99.31; and
FINAL POLICY RESEARCH PAPER - FERPA
56
(ii)(A) The educational agency or institution has complied with the requirements of
§99.32(b); or
(B) A State or local educational authority or Federal official or agency listed in
§99.31(a)(3) has complied with the requirements of §99.32(b)(2).
(2) A party that receives a court order or lawfully issued subpoena and rediscloses
personally identifiable information from education records on behalf of an educational agency or
institution in response to that order or subpoena under §99.31(a)(9) must provide the notification
required under §99.31(a)(9)(ii).
(c) Paragraph (a) of this section does not apply to disclosures under §§99.31(a)(8), (9),
(11), (12), (14), (15), and (16), and to information that postsecondary institutions are required to
disclose under the Jeanne Clery Disclosure of Campus Security Policy and Campus Crime
Statistics Act, 20 U.S.C. 1092(f) (Clery Act), to the accuser and accused regarding the outcome
of any campus disciplinary proceeding brought alleging a sexual offense.
(d) An educational agency or institution must inform a party to whom disclosure is made
of the requirements of paragraph (a) of this section except for disclosures made under
§§99.31(a)(8), (9), (11), (12), (14), (15), and (16), and to information that postsecondary
institutions are required to disclose under the Clery Act to the accuser and accused regarding the
outcome of any campus disciplinary proceeding brought alleging a sexual offense.
(Authority: 20 U.S.C. 1232g(b)(4)(B))
[53 FR 11943, Apr. 11, 1988, as amended at 61 FR 59297, Nov. 21, 1996; 65 FR 41853,
July 6, 2000; 73 FR 74853, Dec. 9, 2008; 76 FR 75642, Dec. 2, 2011]
§99.34 What conditions apply to disclosure of information to other educational
agencies or institutions?
(a) An educational agency or institution that discloses an education record under
§99.31(a)(2) shall:
(1) Make a reasonable attempt to notify the parent or eligible student at the last known
address of the parent or eligible student, unless:
(i) The disclosure is initiated by the parent or eligible student; or
(ii) The annual notification of the agency or institution under §99.7 includes a notice that
the agency or institution forwards education records to other agencies or institutions that have
requested the records and in which the student seeks or intends to enroll or is already enrolled so
long as the disclosure is for purposes related to the student's enrollment or transfer;
FINAL POLICY RESEARCH PAPER - FERPA
57
(2) Give the parent or eligible student, upon request, a copy of the record that was
disclosed; and
(3) Give the parent or eligible student, upon request, an opportunity for a hearing under
subpart C.
(b) An educational agency or institution may disclose an education record of a student in
attendance to another educational agency or institution if:
(1) The student is enrolled in or receives services from the other agency or institution;
and
(2) The disclosure meets the requirements of paragraph (a) of this section.
(Authority: 20 U.S.C. 1232g(b)(1)(B))
[53 FR 11943, Apr. 11, 1988, as amended at 61 FR 59297, Nov. 21, 1996; 73 FR 74854,
Dec. 9, 2008]
§99.35 What conditions apply to disclosure of information for Federal or State
program purposes?
(a)(1) Authorized representatives of the officials or agencies headed by officials listed in
§99.31(a)(3) may have access to education records in connection with an audit or evaluation of
Federal or State supported education programs, or for the enforcement of or compliance with
Federal legal requirements that relate to those programs.
(2) The State or local educational authority or agency headed by an official listed in
§99.31(a)(3) is responsible for using reasonable methods to ensure to the greatest extent
practicable that any entity or individual designated as its authorized representative—
(i) Uses personally identifiable information only to carry out an audit or evaluation of
Federal- or State-supported education programs, or for the enforcement of or compliance with
Federal legal requirements related to these programs;
(ii) Protects the personally identifiable information from further disclosures or other uses,
except as authorized in paragraph (b)(1) of this section; and
(iii) Destroys the personally identifiable information in accordance with the requirements
of paragraphs (b) and (c) of this section.
(3) The State or local educational authority or agency headed by an official listed in
§99.31(a)(3) must use a written agreement to designate any authorized representative, other than
an employee. The written agreement must—
FINAL POLICY RESEARCH PAPER - FERPA
58
(i) Designate the individual or entity as an authorized representative;
(ii) Specify—
(A) The personally identifiable information from education records to be disclosed;
(B) That the purpose for which the personally identifiable information from education
records is disclosed to the authorized representative is to carry out an audit or evaluation of
Federal- or State-supported education programs, or to enforce or to comply with Federal legal
requirements that relate to those programs; and
(C) A description of the activity with sufficient specificity to make clear that the work
falls within the exception of §99.31(a)(3), including a description of how the personally
identifiable information from education records will be used;
(iii) Require the authorized representative to destroy personally identifiable information
from education records when the information is no longer needed for the purpose specified;
(iv) Specify the time period in which the information must be destroyed; and
(v) Establish policies and procedures, consistent with the Act and other Federal and State
confidentiality and privacy provisions, to protect personally identifiable information from
education records from further disclosure (except back to the disclosing entity) and unauthorized
use, including limiting use of personally identifiable information from education records to only
authorized representatives with legitimate interests in the audit or evaluation of a Federal- or
State-supported education program or for compliance or enforcement of Federal legal
requirements related to these programs.
(b) Information that is collected under paragraph (a) of this section must—
(1) Be protected in a manner that does not permit personal identification of individuals by
anyone other than the State or local educational authority or agency headed by an official listed
in §99.31(a)(3) and their authorized representatives, except that the State or local educational
authority or agency headed by an official listed in §99.31(a)(3) may make further disclosures of
personally identifiable information from education records on behalf of the educational agency
or institution in accordance with the requirements of §99.33(b); and
(2) Be destroyed when no longer needed for the purposes listed in paragraph (a) of this
section.
(c) Paragraph (b) of this section does not apply if:
(1) The parent or eligible student has given written consent for the disclosure under
§99.30; or
FINAL POLICY RESEARCH PAPER - FERPA
59
(2) The collection of personally identifiable information is specifically authorized by
Federal law.
(Authority: 20 U.S.C. 1232g(b)(1)(C), (b)(3), and (b)(5))
[53 FR 11943, Apr. 11, 1988, as amended at 73 FR 74854, Dec. 9, 2008; 76 FR 75642,
Dec. 2, 2011]
§99.36 What conditions apply to disclosure of information in health and safety
emergencies?
(a) An educational agency or institution may disclose personally identifiable information
from an education record to appropriate parties, including parents of an eligible student, in
connection with an emergency if knowledge of the information is necessary to protect the health
or safety of the student or other individuals.
(b) Nothing in this Act or this part shall prevent an educational agency or institution
from—
(1) Including in the education records of a student appropriate information concerning
disciplinary action taken against the student for conduct that posed a significant risk to the safety
or well-being of that student, other students, or other members of the school community;
(2) Disclosing appropriate information maintained under paragraph (b)(1) of this section
to teachers and school officials within the agency or institution who the agency or institution has
determined have legitimate educational interests in the behavior of the student; or
(3) Disclosing appropriate information maintained under paragraph (b)(1) of this section
to teachers and school officials in other schools who have been determined to have legitimate
educational interests in the behavior of the student.
(c) In making a determination under paragraph (a) of this section, an educational agency
or institution may take into account the totality of the circumstances pertaining to a threat to the
health or safety of a student or other individuals. If the educational agency or institution
determines that there is an articulable and significant threat to the health or safety of a student or
other individuals, it may disclose information from education records to any person whose
knowledge of the information is necessary to protect the health or safety of the student or other
individuals. If, based on the information available at the time of the determination, there is a
rational basis for the determination, the Department will not substitute its judgment for that of
the educational agency or institution in evaluating the circumstances and making its
determination.
(Authority: 20 U.S.C. 1232g (b)(1)(I) and (h))
FINAL POLICY RESEARCH PAPER - FERPA
60
[53 FR 11943, Apr. 11, 1988; 53 FR 19368, May 27, 1988, as amended at 61 FR 59297,
Nov. 21, 1996; 73 FR 74854, Dec. 9, 2008]
§99.37 What conditions apply to disclosing directory information?
(a) An educational agency or institution may disclose directory information if it has given
public notice to parents of students in attendance and eligible students in attendance at the
agency or institution of:
(1) The types of personally identifiable information that the agency or institution has
designated as directory information;
(2) A parent's or eligible student's right to refuse to let the agency or institution designate
any or all of those types of information about the student as directory information; and
(3) The period of time within which a parent or eligible student has to notify the agency
or institution in writing that he or she does not want any or all of those types of information
about the student designated as directory information.
(b) An educational agency or institution may disclose directory information about former
students without complying with the notice and opt out conditions in paragraph (a) of this
section. However, the agency or institution must continue to honor any valid request to opt out of
the disclosure of directory information made while a student was in attendance unless the student
rescinds the opt out request.
(c) A parent or eligible student may not use the right under paragraph (a)(2) of this
section to opt out of directory information disclosures to—
(1) Prevent an educational agency or institution from disclosing or requiring a student to
disclose the student's name, identifier, or institutional email address in a class in which the
student is enrolled; or
(2) Prevent an educational agency or institution from requiring a student to wear, to
display publicly, or to disclose a student ID card or badge that exhibits information that may be
designated as directory information under §99.3 and that has been properly designated by the
educational agency or institution as directory information in the public notice provided under
paragraph (a)(1) of this section.
(d) In its public notice to parents and eligible students in attendance at the agency or
institution that is described in paragraph (a) of this section, an educational agency or institution
may specify that disclosure of directory information will be limited to specific parties, for
specific purposes, or both. When an educational agency or institution specifies that disclosure of
directory information will be limited to specific parties, for specific purposes, or both, the
FINAL POLICY RESEARCH PAPER - FERPA
61
educational agency or institution must limit its directory information disclosures to those
specified in its public notice that is described in paragraph (a) of this section.
(e) An educational agency or institution may not disclose or confirm directory
information without meeting the written consent requirements in §99.30 if a student's social
security number or other non-directory information is used alone or combined with other data
elements to identify or help identify the student or the student's records.
(Authority: 20 U.S.C. 1232g(a)(5) (A) and (B))
[53 FR 11943, Apr. 11, 1988, as amended at 73 FR 74854, Dec. 9, 2008; 76 FR 75642,
Dec. 2, 2011]
§99.38 What conditions apply to disclosure of information as permitted by State
statute adopted after November 19, 1974, concerning the juvenile justice system?
(a) If reporting or disclosure allowed by State statute concerns the juvenile justice system
and the system's ability to effectively serve, prior to adjudication, the student whose records are
released, an educational agency or institution may disclose education records under
§99.31(a)(5)(i)(B).
(b) The officials and authorities to whom the records are disclosed shall certify in writing
to the educational agency or institution that the information will not be disclosed to any other
party, except as provided under State law, without the prior written consent of the parent of the
student.
(Authority: 20 U.S.C. 1232g(b)(1)(J))
[61 FR 59297, Nov. 21, 1996]
§99.39 What definitions apply to the nonconsensual disclosure of records by
postsecondary educational institutions in connection with disciplinary proceedings
concerning crimes of violence or non-forcible sex offenses?
As used in this part:
Alleged perpetrator of a crime of violence is a student who is alleged to have committed
acts that would, if proven, constitute any of the following offenses or attempts to commit the
following offenses that are defined in appendix A to this part:
Arson
Assault offenses
FINAL POLICY RESEARCH PAPER - FERPA
62
Burglary
Criminal homicide—manslaughter by negligence
Criminal homicide—murder and nonnegligent manslaughter
Destruction/damage/vandalism of property
Kidnapping/abduction
Robbery
Forcible sex offenses.
Alleged perpetrator of a nonforcible sex offense means a student who is alleged to have
committed acts that, if proven, would constitute statutory rape or incest. These offenses are
defined in appendix A to this part.
Final results means a decision or determination, made by an honor court or council,
committee, commission, or other entity authorized to resolve disciplinary matters within the
institution. The disclosure of final results must include only the name of the student, the violation
committed, and any sanction imposed by the institution against the student.
Sanction imposed means a description of the disciplinary action taken by the institution,
the date of its imposition, and its duration.
Violation committed means the institutional rules or code sections that were violated and
any essential findings supporting the institution's conclusion that the violation was committed.
(Authority: 20 U.S.C. 1232g(b)(6))
[65 FR 41853, July 6, 2000]
Subpart E—What Are the Enforcement Procedures?
§99.60 What functions has the Secretary delegated to the Office and to the Office
of Administrative Law Judges?
(a) For the purposes of this subpart, Office means the Family Policy Compliance Office,
U.S. Department of Education.
(b) The Secretary designates the Office to:
FINAL POLICY RESEARCH PAPER - FERPA
63
(1) Investigate, process, and review complaints and violations under the Act and this part;
and
(2) Provide technical assistance to ensure compliance with the Act and this part.
(c) The Secretary designates the Office of Administrative Law Judges to act as the
Review Board required under the Act to enforce the Act with respect to all applicable programs.
The term applicable program is defined in section 400 of the General Education Provisions Act.
(Authority: 20 U.S.C. 1232g (f) and (g), 1234)
[53 FR 11943, Apr. 11, 1988, as amended at 58 FR 3189, Jan. 7, 1993]
§99.61 What responsibility does an educational agency or institution, a recipient of
Department funds, or a third party outside of an educational agency or institution have
concerning conflict with State or local laws?
If an educational agency or institution determines that it cannot comply with the Act or
this part due to a conflict with State or local law, it must notify the Office within 45 days, giving
the text and citation of the conflicting law. If another recipient of Department funds under any
program administered by the Secretary or a third party to which personally identifiable
information from education records has been non-consensually disclosed determines that it
cannot comply with the Act or this part due to a conflict with State or local law, it also must
notify the Office within 45 days, giving the text and citation of the conflicting law.
(Authority: 20 U.S.C. 1232g(f))
[76 FR 75642, Dec. 2, 2011]
§99.62 What information must an educational agency or institution or other
recipient of Department funds submit to the Office?
The Office may require an educational agency or institution, other recipient of
Department funds under any program administered by the Secretary to which personally
identifiable information from education records is non-consensually disclosed, or any third party
outside of an educational agency or institution to which personally identifiable information from
education records is non-consensually disclosed to submit reports, information on policies and
procedures, annual notifications, training materials, or other information necessary to carry out
the Office's enforcement responsibilities under the Act or this part.
(Authority: 20 U.S.C. 1232g(b)(4)(B), (f), and (g))
[76 FR 75643, Dec. 2, 2011]
FINAL POLICY RESEARCH PAPER - FERPA
64
§99.63 Where are complaints filed?
A parent or eligible student may file a written complaint with the Office regarding an
alleged violation under the Act and this part. The Office's address is: Family Policy Compliance
Office, U.S. Department of Education, 400 Maryland Avenue, SW., Washington, DC 20202.
(Authority: 20 U.S.C. 1232g(g))
[65 FR 41854, July 6, 2000, as amended at 73 FR 74854, Dec. 9, 2008]
§99.64 What is the investigation procedure?
(a) A complaint must contain specific allegations of fact giving reasonable cause to
believe that a violation of the Act or this part has occurred. A complaint does not have to allege
that a violation is based on a policy or practice of the educational agency or institution, other
recipient of Department funds under any program administered by the Secretary, or any third
party outside of an educational agency or institution.
(b) The Office investigates a timely complaint filed by a parent or eligible student, or
conducts its own investigation when no complaint has been filed or a complaint has been
withdrawn, to determine whether an educational agency or institution or other recipient of
Department funds under any program administered by the Secretary has failed to comply with a
provision of the Act or this part. If the Office determines that an educational agency or institution
or other recipient of Department funds under any program administered by the Secretary has
failed to comply with a provision of the Act or this part, it may also determine whether the
failure to comply is based on a policy or practice of the agency or institution or other recipient.
The Office also investigates a timely complaint filed by a parent or eligible student, or conducts
its own investigation when no complaint has been filed or a complaint has been withdrawn, to
determine whether a third party outside of the educational agency or institution has failed to
comply with the provisions of §99.31(a)(6)(iii)(B) or has improperly redisclosed personally
identifiable information from education records in violation of §99.33.
(Authority: 20 U.S.C. 1232g(b)(4)(B), (f) and (g))
(c) A timely complaint is defined as an allegation of a violation of the Act that is
submitted to the Office within 180 days of the date of the alleged violation or of the date that the
complainant knew or reasonably should have known of the alleged violation.
(d) The Office may extend the time limit in this section for good cause shown.
(Authority: 20 U.S.C. 1232g(b)(4)(B), (f) and (g))
[53 FR 11943, Apr. 11, 1988, as amended at 58 FR 3189, Jan. 7, 1993; 65 FR 41854, July
6, 2000; 73 FR 74854, Dec. 9, 2008; 76 FR 75643, Dec. 2, 2011]
FINAL POLICY RESEARCH PAPER - FERPA
65
§99.65 What is the content of the notice of investigation issued by the Office?
(a) The Office notifies in writing the complainant, if any, and the educational agency or
institution, the recipient of Department funds under any program administered by the Secretary,
or the third party outside of an educational agency or institution if it initiates an investigation
under §99.64(b). The written notice—
(1) Includes the substance of the allegations against the educational agency or institution,
other recipient, or third party; and
(2) Directs the agency or institution, other recipient, or third party to submit a written
response and other relevant information, as set forth in §99.62, within a specified period of time,
including information about its policies and practices regarding education records.
(b) The Office notifies the complainant if it does not initiate an investigation because the
complaint fails to meet the requirements of §99.64.
(Authority: 20 U.S.C. 1232g(g))
[73 FR 74855, Dec. 9, 2008, as amended at 76 FR 75643, Dec. 2, 2011]
§99.66 What are the responsibilities of the Office in the enforcement process?
(a) The Office reviews a complaint, if any, information submitted by the educational
agency or institution, other recipient of Department funds under any program administered by
the Secretary, or third party outside of an educational agency or institution, and any other
relevant information. The Office may permit the parties to submit further written or oral
arguments or information.
(b) Following its investigation, the Office provides to the complainant, if any, and the
educational agency or institution, other recipient, or third party a written notice of its findings
and the basis for its findings.
(c) If the Office finds that an educational agency or institution or other recipient has not
complied with a provision of the Act or this part, it may also find that the failure to comply was
based on a policy or practice of the agency or institution or other recipient. A notice of findings
issued under paragraph (b) of this section to an educational agency or institution, or other
recipient that has not complied with a provision of the Act or this part—
(1) Includes a statement of the specific steps that the agency or institution or other
recipient must take to comply; and
(2) Provides a reasonable period of time, given all of the circumstances of the case,
during which the educational agency or institution or other recipient may comply voluntarily.
FINAL POLICY RESEARCH PAPER - FERPA
66
(d) If the Office finds that a third party outside of an educational agency or institution has
not complied with the provisions of §99.31(a)(6)(iii)(B) or has improperly redisclosed personally
identifiable information from education records in violation of §99.33, the Office's notice of
findings issued under paragraph (b) of this section—
(1) Includes a statement of the specific steps that the third party outside of the educational
agency or institution must take to comply; and
(2) Provides a reasonable period of time, given all of the circumstances of the case,
during which the third party may comply voluntarily.
(Authority: 20 U.S.C. 1232g(b)(4)(B), (f), and (g))
[76 FR 75643, Dec. 2, 2011]
§99.67 How does the Secretary enforce decisions?
(a) If an educational agency or institution or other recipient of Department funds under
any program administered by the Secretary does not comply during the period of time set under
§99.66(c), the Secretary may take any legally available enforcement action in accordance with
the Act, including, but not limited to, the following enforcement actions available in accordance
with part D of the General Education Provisions Act—
(1) Withhold further payments under any applicable program;
(2) Issue a complaint to compel compliance through a cease and desist order; or
(3) Terminate eligibility to receive funding under any applicable program.
(b) If, after an investigation under §99.66, the Secretary finds that an educational agency
or institution, other recipient, or third party has complied voluntarily with the Act or this part, the
Secretary provides the complainant and the agency or institution, other recipient, or third party
with written notice of the decision and the basis for the decision.
(c) If the Office finds that a third party, outside the educational agency or institution,
violates §99.31(a)(6)(iii)(B), then the educational agency or institution from which the
personally identifiable information originated may not allow the third party found to be
responsible for the violation of §99.31(a)(6)(iii)(B) access to personally identifiable information
from education records for at least five years.
(d) If the Office finds that a State or local educational authority, a Federal agency headed
by an official listed in §99.31(a)(3), or an authorized representative of a State or local
educational authority or a Federal agency headed by an official listed in §99.31(a)(3), improperly
rediscloses personally identifiable information from education records, then the educational
FINAL POLICY RESEARCH PAPER - FERPA
67
agency or institution from which the personally identifiable information originated may not
allow the third party found to be responsible for the improper redisclosure access to personally
identifiable information from education records for at least five years.
(e) If the Office finds that a third party, outside the educational agency or institution,
improperly rediscloses personally identifiable information from education records in violation of
§99.33 or fails to provide the notification required under §99.33(b)(2), then the educational
agency or institution from which the personally identifiable information originated may not
allow the third party found to be responsible for the violation access to personally identifiable
information from education records for at least five years.
(Authority: 20 U.S.C. 1232g(b)(4)(B) and (f); 20 U.S.C. 1234c)
[76 FR 75643, Dec. 2, 2011]
Appendix A to Part 99—Crimes of Violence Definitions
Arson
Any willful or malicious burning or attempt to burn, with or without intent to defraud, a
dwelling house, public building, motor vehicle or aircraft, personal property of another, etc.
Assault Offenses
An unlawful attack by one person upon another.
NOTE: By definition there can be no “attempted” assaults, only “completed” assaults.
(a) Aggravated Assault. An unlawful attack by one person upon another for the purpose
of inflicting severe or aggravated bodily injury. This type of assault usually is accompanied by
the use of a weapon or by means likely to produce death or great bodily harm. (It is not necessary
that injury result from an aggravated assault when a gun, knife, or other weapon is used which
could and probably would result in serious injury if the crime were successfully completed.)
(b) Simple Assault. An unlawful physical attack by one person upon another where
neither the offender displays a weapon, nor the victim suffers obvious severe or aggravated
bodily injury involving apparent broken bones, loss of teeth, possible internal injury, severe
laceration, or loss of consciousness.
(c) Intimidation. To unlawfully place another person in reasonable fear of bodily harm
through the use of threatening words or other conduct, or both, but without displaying a weapon
or subjecting the victim to actual physical attack.
NOTE: This offense includes stalking.
FINAL POLICY RESEARCH PAPER - FERPA
68
Burglary
The unlawful entry into a building or other structure with the intent to commit a felony or
a theft.
Criminal Homicide—Manslaughter by Negligence
The killing of another person through gross negligence.
Criminal Homicide—Murder and Nonnegligent Manslaughter
The willful (nonnegligent) killing of one human being by another.
Destruction/Damage/Vandalism of Property
To willfully or maliciously destroy, damage, deface, or otherwise injure real or personal
property without the consent of the owner or the person having custody or control of it.
Kidnapping/Abduction
The unlawful seizure, transportation, or detention of a person, or any combination of
these actions, against his or her will, or of a minor without the consent of his or her custodial
parent(s) or legal guardian.
NOTE: Kidnapping/Abduction includes hostage taking.
Robbery
The taking of, or attempting to take, anything of value under confrontational
circumstances from the control, custody, or care of a person or persons by force or threat of force
or violence or by putting the victim in fear.
NOTE: Carjackings are robbery offenses where a motor vehicle is taken through force or
threat of force.
Sex Offenses, Forcible
Any sexual act directed against another person, forcibly or against that person's will, or
both; or not forcibly or against the person's will where the victim is incapable of giving consent.
(a) Forcible Rape (Except “Statutory Rape”). The carnal knowledge of a person, forcibly
or against that person's will, or both; or not forcibly or against the person's will where the victim
is incapable of giving consent because of his or her temporary or permanent mental or physical
incapacity (or because of his or her youth).
FINAL POLICY RESEARCH PAPER - FERPA
69
(b) Forcible Sodomy. Oral or anal sexual intercourse with another person, forcibly or
against that person's will, or both; or not forcibly or against the person's will where the victim is
incapable of giving consent because of his or her youth or because of his or her temporary or
permanent mental or physical incapacity.
(c) Sexual Assault With An Object. To use an object or instrument to unlawfully penetrate,
however slightly, the genital or anal opening of the body of another person, forcibly or against
that person's will, or both; or not forcibly or against the person's will where the victim is
incapable of giving consent because of his or her youth or because of his or her temporary or
permanent mental or physical incapacity.
NOTE: An “object” or “instrument” is anything used by the offender other than the
offender's genitalia. Examples are a finger, bottle, handgun, stick, etc.
(d) Forcible Fondling. The touching of the private body parts of another person for the
purpose of sexual gratification, forcibly or against that person's will, or both; or not forcibly or
against the person's will where the victim is incapable of giving consent because of his or her
youth or because of his or her temporary or permanent mental or physical incapacity.
NOTE: Forcible Fondling includes “Indecent Liberties” and “Child Molesting.”
Nonforcible Sex Offenses (Except “Prostitution Offenses”)
Unlawful, nonforcible sexual intercourse.
(a) Incest. Nonforcible sexual intercourse between persons who are related to each other
within the degrees wherein marriage is prohibited by law.
(b) Statutory Rape. Nonforcible sexual intercourse with a person who is under the
statutory age of consent.
(Authority: 20 U.S.C. 1232g(b)(6) and 18 U.S.C. 16)
[65 FR 41854, July 6, 2000]
FINAL POLICY RESEARCH PAPER - FERPA
70
Appendix B (Interview Procedure)
Preparation
 Create script of what you will say to introduce yourself and your request for an interview
(see below)
 Make initial contact with interviewee to set up appointment (phone/Skype or in person –
latter preferred). Interviewee MAY want questions in advance, and that is fine. Let them
know you will be taking notes; ask permission to audiotape, if you intend to, let him/her
know approximately how long the interview might last
 Prepare questions and note-taking materials; check that any recording equipment is
working properly
Statement of Purpose
 Describe the policy issue
 Describe the development and implementation of the policy
 NOT to make evaluation of appropriateness of policy or its implementation
Procedure
 Thank the person for agreeing to be interviewed
 Let the person know you have done some research on the policy topic, and why you are
interested in exploring the policy further. Stay positive in your remarks!!
 Let the person know why s/he was selected for the interview.
 Let the person know that you will be asking a series of questions, and that you may ask
some follow-up questions for clarification. Let the person know that if s/he prefers NOT
to answer any of the questions that is fine.
 Let the person know approximately how long the interview will take.
 Let the person know that s/he will be given an opportunity to review the transcript for
accuracy
Confidentiality
 Let the person know you will need to take notes; ASK permission to record, if you intend
to do so (if you are teaming on this project, that is fine-shift around recording/questioning
responsibilities)
 It’s important to let folks know that you will use NO NAMES and NO IDENTIFIABLE
INFORMATION in the transcription, analysis documents or report. Let them know that
the data will be destroyed after the report has been turned in.
Recording Responses to Questions (verbal AND non-verbal)
FINAL POLICY RESEARCH PAPER - FERPA




71
As you ask questions [see last page of this attachment), record EVERY WORD from the
interviewee, whether you think it answers the specific question or not. *
Record exact language and do not paraphrase or substitute your own words.
Make note of tone of voice, body language, emotion.
Ask follow-up questions as needed AND STAY FOCUSED ON THE PURPOSE! Don’t
get sidetracked
Transcribing and Reviewing*
 Again, it is critical to transcribe everything the interviewee said in his/her own words. If
you are interested in recording the interview and transcribing from that, there are several
recording devices that can be purchased that come with software that allows you to
transcribe more easily. In our last LC, folks used a SONY device.
 For every one (1) hour of interview data, it will take 3-4 hours to transcribe and analyze
 After the transcription, send the script back to the interviewee and ask that it be checked
for accuracy. Also, let the person know if there is something they do NOT want reported,
s/he should let you know that.
Analyzing the Data**
 NOT quantitative; so, no frequencies, percentages, etc.
 Thematic approach – (put your Confluence to work!!)
 Use a “cut and paste” method put language into topical/thematic categories; code what
you are using so that you can find it in the original transcript **
INTERVIEW QUESTIONS
NOTE: Tense changes may be needed, depending upon whether or not the policy is currently in
place or being considered/developed. Provide any background regarding the [proposed] policy,
such as the legislation if necessary.
1. How did this policy [policy itself or the idea for the policy, if not yet developed] come about?
2. What is the purpose of the policy?
3. What is your role with respect to this policy’s [development, implementation]?
4. Who were some other people [their roles, not names] or other groups interested in this
policy?
5. What kinds of things were considered as the policy was developed/implemented?
6. What are some strengths of the policy?
7. How did you get “buy-in” for the policy?
8. What did (you imagine) the process (would) look like for implementing the policy?
9. Is there any language in the policy that is bothersome to you?
10. What is your perception of the success of implementation of this policy?
FINAL POLICY RESEARCH PAPER - FERPA
11. How will you know the policy is doing what it is intended to do?
12. Do you have anything else you’d like to add that hasn’t been talked about?
THANK HIM/HER FOR PARTICIPATING, AND REMIND OF TRANSCRIPT REVIEW.
72
FINAL POLICY RESEARCH PAPER - FERPA
73
Appendix C (Interview Theme and Topic Analysis)
Topic
Policy
Origination
&
History
Interviewee Responses
INTER.-1-Intro: The history of it? So, you know, it started
in ’74. This outlines (passed document to team) when, what was
done, what amendments were made, and all that kind of jazz, and
then the law itself are these thirty-some pages.
INTER.-4-1: All right, so… your first question is, “How did
this policy come about?”… um… and you know… there’s the
history of the legislation here, it was started in ’74, and maybe I’ll
couple that with the purpose of the policy, which is the second
question.
INTER.-5-3: Um, so, and the policy, you know, we see, I
think it’s had ten amendments, or something like that, so it’s not
changing significantly, but it has changed, and again the most recent
one was the Patriot Act in 2001 or 2002, whenever that was, so
nothing since then. There are, as I mentioned earlier, I think,
additional interpretations of things, and small iterative changes to the
law that are reviewed in, through various organizations, ours is
AACRAO,
Policy
Purpose
INTER.-20-12: anything we’d like to add that hasn’t been
talked about. Um, I think the most recent amendment to it is curious,
and is, I don’t know if worrisome is the word, but the last several of
them I think were about increasing access by different parties for
different reasons. So it kind of seems like it’s going in the opposite
direction um from restricting to now restricting but and these other
parties have access to things. Um, and I think everyone whose
responsible for guarding data gets concerned when other people get
to be grabbing in you know like what’s the purpose.
INTER.-4-2: I think more than anything else it’s to protect –
it’s to protect individuals’ identities. And you know, it’s not just at
the collegiate level, but that’s what I can speak to. Um, there are, uh,
different components of it, so I think it’s to protect, it’s to protect
that people aren’t stealing our information, um, but it has also clearly
articulated, through its evolution, who’s entitled to that, and the most
recent iteration, which was, it might have been 2002, with Homeland
Security, the Patriot Act and all, that’s where it kind of opened it up
and said, more or less, the government can take what it wants and not
even tell the individual about it.
FINAL POLICY RESEARCH PAPER - FERPA
Role(s)
74
INTER.-1-Intro: every year at the annual conference there’s
something called the FERPA Update, which is the most highly
attended session at the entire thing, and Leroy Rooker, who’s
probably, you’d call him like the godfather of FERPA, he makes the
presentation, he’s on the staff now at AACRAO,
INTER.-2-Intro: All right, OK, implement fits.
INTER.-2-Intro: LS: Or compliance, maybe.
INTER.-4-2: … I’ve certainly had to provide information
when legal entities have come in because you know they needed to
verify even if someone was on campus or whatever…
INTER.-4-2: – we don’t get an awful lot of requests through
our office, in general, the policy… the policy police or kind of the
gate keeper of this information will be your IR department, here it’s
called the office of planning and decision support, so if we do get a
request we’ll channel it to them, um, there are times when we’ll also
channel it through university counsel to make sure that it’s legit and
that the request is written properly and that it’s – there’s a record of
it.
INTER.-5-2: Institutional Research. … Well, they’re –
they’re – they’re really the entity that reports outward –
INTER.-5-3: So the registrar’s office primarily will provide
information to the inner constituencies about operational data and
data in production, we’d call it, but when it’s uh, when we’re looking
at something like this, it generally will go through an IR office. Each
institution can decide, but in general, that’s how it is.
INTER.-5-3: There are, as I mentioned earlier, I think,
additional interpretations of things, and small iterative changes to the
law that are reviewed in, through various organizations, ours is
AACRAO, because at the end of the day, the registrar or the IR
office, whoever it is, wants to definitively be able to know, am I
allowed to release this or am I not allowed to release this.
INTER.-5-3: Someone could, if they were doing a study,
request a whole bunch of directory information – it doesn’t happen
that often, but it happens, maybe a couple times a year. And then,
um, the real fundamental one, especially for our division, is
protecting the student’s data from – and the “froms” could be the
parents, it’s really from anybody –
FINAL POLICY RESEARCH PAPER - FERPA
75
INTER.-6-3: So, right away, what we do is, if someone is
asking, if anyone is calling us up or writing or visiting and saying I
want information on your academics, or your financial records, or
whatever it is, we say no, unless we’ve got what’s called the FERPA
release. The FERPA release is essentially a form, and we need to
keep a record that the student has approved, signed off, where the
student will list who can have access to what, and it could be just
academic records, it could be just financial, it could be both.
INTER.-6-3: so, the role, our role with the implementation of
it, I guess, which is question three, is… it begins at orientation, new
student orientation. While we provide all this information in the
university catalog – its law, we outline what the law is in general
terms, where they can reference it for further detail, and our policy in
regard to how that information will be safeguarded or released. Then
at new student orientation, our registrar’s office will explain this to
both the students as well as to the parents. And we don’t endorse one
practice over the other. We’re simply providing information, because
there’s a point of a lot of confusion. And what we tell them is, hey
student, if you’re 18 or over, this information is yours. You have the
right not to share it with anybody. Um, if you want to share it with
somebody, we need to know their name. You need to sign the paper.
And we do the same thing to parents. And then we lay out a few
scenarios so they can contextualize it a little bit.
INTER.-7-3: But we implement that, we inform them about it
through the catalog and in new student orientation, and then we give
out the forms at orientation, and we take them back to our office
right away.
INTER.-7-3: Nonetheless, um, throughout students’ careers
here we inevitably get calls throughout the week from – and it’s
generally parents or guardians – who want to discuss something
about the student’s academics or finances. We don’t have the release
on file. We’ll inform them, nicely, “we can’t discuss it unless, and
this is due to, you know, this is a law,” because people get very
emotional at that point, and then let them know that student needs to
come in and we’ll give them a form to sign if they want to do that,
but we can’t force them to do that.
INTER.-7-3: We, um, to my knowledge we don’t have a lot
of those requests. Um… And as long as – and that’s why we pass
those requests for directory information through university counsel.
FINAL POLICY RESEARCH PAPER - FERPA
76
I’m not sure what the rules associated with that are, technically….
But that’s why we pass it through them, just to make sure… We may
be obligated to provide it to a commercial, to a vendor.
INTER.-11-4: our registrar’s office is the guardian of the
data, um, and we find ourselves often saying, you know, while
you’re a faculty member and you want, you know, to know certain
information about a student, we can’t give that to you.
INTER.-13-4: Part of our job is to help educate the campus
about the need to maintain, to retain confidentiality of student
information so the registrar’s office provides FERPA training. We
have an online FERPA training we require of all of our staff and we
recommend for really anyone who works on campus. Um because it
would be a really bad thing, if and I’m just saying if a faculty
member, you know, goes out and starts sharing information whatever
about kind of private things it wouldn’t be good at all.
INTER.-14-4: The University of Maryland maybe about a
week or two ago had a big theft of data which included SSN#s on
hundreds of thousands of students. Hmm, now that wasn’t like a
FERPA thing per say although we are, we are charged with having
safeguards set up to protect that data. So in addition to just releasing
it we have to safeguard it and that gets down to even you know
locking file drawers, locking, and you know preventing physical
access to things and making sure night stuff is you know and there is
information security requirements that are built up. So we have to
have the highest standard.
INTER.-15-5: Anjour is like the data police here. And the
registrar’s office is often always looked to as you know, kind of seen
as that wall. And it’s not because we want to be a wall, we’re just
trying to protect what we’ve been given the responsibility to protect.
INTER.-21-12: It’s an institution by institution decision as to
if they are going to inform. I worked at a place before here, and we
changed it where that was never talked about until the parents called
up the financial aid office or the student accounts office. And they
go, “We don’t have the FERPA release.” And they go, “What’s that
and why wasn’t I told about that?” So you be, I mean there’s no –
there’s a best practice for sure and we’re delivering that here. But
there’s no rule that says that you need to present this ever you know.
… As far as the law is concerned, it’s the law and if a student wants
to get it released…
FINAL POLICY RESEARCH PAPER - FERPA
Interested
Persons
&
Groups
77
INTER.-1-Intro: The organization that people in my business
belong to would be AACRAO, American Association of Collegiate
Registrars and Admissions Officers, and this is for you. They’ve got
an annual – well, they’ve got on their website, and I’ve listed the
exact site here, FERPA training.
INTER.-4-2: … I’ve certainly had to provide information
when legal entities have come in because you know they needed to
verify even if someone was on campus or whatever…
INTER.-1-Intro: every year at the annual conference there’s
something called the FERPA Update, which is the most highly
attended session at the entire thing, and Leroy Rooker, who’s
probably, you’d call him like the godfather of FERPA, he makes the
presentation, he’s on the staff now at AACRAO,
INTER.-4-2: – we don’t get an awful lot of requests through
our office, in general, the policy… the policy police or kind of the
gate keeper of this information will be your IR department, here it’s
called the office of planning and decision support, so if we do get a
request we’ll channel it to them, um, there are times when we’ll also
channel it through university counsel to make sure that it’s legit and
that the request is written properly and that it’s – there’s a record of
it.
INTER.-5-3: Into some of the nuances of it, uh, and how it
applies to university life, I’ve mentioned the external constituencies
seeking the information, so again, in general, you know, could be,
uh, a legal group that needs to look into a student, um, could be the
government, the armed forces, I think there have been cases during
times when more soldiers were needed and they want the list of all
the students you’ve got, you know, that kind of a thing, and they are
entitled to that. Someone could, if they were doing a study, request a
whole bunch of directory information – it doesn’t happen that often,
but it happens, maybe a couple times a year.
INTER.-7-3: Nonetheless, um, throughout students’ careers
here we inevitably get calls throughout the week from – and it’s
generally parents or guardians – who want to discuss something
about the student’s academics or finances. We don’t have the release
on file. We’ll inform them, nicely, “we can’t discuss it unless, and
this is due to, you know, this is a law,” because people get very
FINAL POLICY RESEARCH PAPER - FERPA
78
emotional at that point, and then let them know that student needs to
come in and we’ll give them a form to sign if they want to do that,
but we can’t force them to do that.
INTER.-10/11-4: I’m… I’m going to make something up –
… But I… this is going to be a path to send you on, maybe, but…
My bet is… that because this was instituted in ’74, it had something
to do with draft, army draft…. Um, I know… and I’m not an expert
on FERPA in like elementary and secondary school and all that kind
of stuff, but, um, students, when they’re young, are given forms to
take home, and they are, uh, armed forces FERPA forms, and – And I
think it’s only an opt out. If you don’t sign it, army gets your
information, all the armed forces. And I think, if I’ve got it right,
and I’m not an expert and it’s been a long time, um, if at any point, if
you like, if you miss it, then that’s life, you can’t, it’s too bad, you
can’t opt out all of a sudden.
INTER.-11-4: As far as… um… groups interested in this
policy, I think from my perspective it would be, um, people on
campus. So, you know, obviously we’ve got groups interested in
getting some information from students, and that directory
information they’re entitled to. But outside of that, are, um, various
offices that serve students or come into contact with students, and
frankly, um, our registrar’s office is the guardian of the data, um, and
we find ourselves often saying, you know, while you’re a faculty
member and you want, you know, to know certain information about
a student, we can’t give that to you.
INTER.-12/13-4: Part of FERPA enables people who have an
educational interest, with and in the student, to that private
information. And we determine that, the registrar really determines
that. … So, um, FERPA doesn’t apply to everybody, I guess is the
way I can say that. So, um, my educational interest in students could
be… uh, I don’t know, let me try to think of an example of what it
could be for someone, you know, we’re, … we’re the maintainer of
records, so we’re entitled to be looking at certain things, right? …
But if, if the grounds office, the grounds and maintenance, wanted
information, we’d say, “You don’t have a legitimate educational
interest and the need to have that information. And actually that
would be most offices on campus. Um, so, you know, again, like
with faculty. It’s not the faculty’s business what your grades are.
Right? … Because, why would it be? How does that play into your
educational interest with them? It shouldn’t. So we’re not going to
provide you with that information. While another office, it may.
FINAL POLICY RESEARCH PAPER - FERPA
79
… Maybe you know an office such as student conduct - that
I can see. Um, they’ve you know, they are reviewing a student for
whatever issue there is and they need to look at the history. Athletics
- they need to see grades and things.
INTER.-13-4: There are also a couple, again, they are not
loopholes, but they’re kind of stipulations in FERPA where some
information is made public; and they have to do with criminal
activity. And I think there is specific reference to sexual behavior,
campus sex crimes, and things like that. And so the specifics in here,
but I’m pretty sure it’s you know, that if we know there is a sexual
predator on campus the state guidelines are you release that then you
know that kind of thing gets out there. So yea those would be the
groups interested in it.
Policy
Strengths
INTER.-16-5: There’s wide spread, I think, agreement on the
interpretations. Um that’s a strength of it. There is so, there are best
practices out there because it is so widespread- that’s a strength.
There’s a lot of new training on it because it’s important.
INTER.-16-6: There are also issues of uh you know - another
strength is that it reduces the amount of bias that can be introduced,
and I’m specifically thinking of like a faculty member. If I know by
looking at your grades your kind of history of success in certain
types of classes I’m going to judge you. Or if I see that you’re
making so much money, I’m going to judge/apply some kind of
thought about people like you. So, it helps to reduce bias by, you
know, preventing access to information people don’t need for their
work.
INTER.-16/17-6: Um and I guess another strength of it would
be that a um, and I’m thinking about the student, and they get the
opportunity to make a responsible decision um to engage whoever is
their parent, guardian, or whatever the situation is in this discussion,
um, and they get the right to choose. I think that is an important thing
that you know uh is given to you when you’re that age – that’s
important.
Policy
Concerns
INTER.-18/19-9: It’s kind of - the law is the law. And as is
with most laws, it’s confusing. Uh, it’s 30 pages worth. It is so not
easy to understand that major associations such as ACRBA provide
annual updates on it and some annual books on it. There is a product
FINAL POLICY RESEARCH PAPER - FERPA
80
they have called ask the FERPA professor it’s just a really complex
thing. And you know it doesn’t take into consideration every single
situation and what would?
INTER.-19-10: Or even you know honestly anybody because
you get used to it, then it changes a little bit. You didn’t know, maybe
we’re not current and so it’s yea a tough thing. And again it’s not like
it’s exciting and everyone is always picking up a book to read about
it.
INTER.-20-12: anything we’d like to add that hasn’t been
talked about. Um, I think the most recent amendment to it is curious,
and is, I don’t know if worrisome is the word, but the last several of
them I think were about increasing access by different parties for
different reasons. So it kind of seems like it’s going in the opposite
direction um from restricting to now restricting but and these other
parties have access to things. Um, and I think everyone who’s
responsible for guarding data gets concerned when other people get
to be grabbing in you know like what’s the purpose.
Implementation
INTER.-1-Intro: The organization that people in my business
Procedures
belong to would be AACRAO, American Association of Collegiate
Registrars and Admissions Officers, and this is for you. They’ve got
an annual – well, they’ve got on their website, and I’ve listed the
exact site here, FERPA training. Because this is paramount in the
industry and it’s highly confusing, it’s changing, and they sell every
year – and I guess this was just so you’d know how often this thing,
how dynamic it is, every year there’s a new FERPA guide. Uh, and
they’ve got – I’m not saying buy it, you don’t need to buy it, but just
to show you, and every year at the annual conference there’s
something called the FERPA Update, which is the most highly
attended session at the entire thing, and Leroy Rooker, who’s
probably, you’d call him like the godfather
of FERPA, he makes the presentation, he’s on the staff now
at AACRAO, so… it confuses people in the business.
INTER.-4-2: The… one big distinction I think is what is
called directory information and what is not directory information.
So, directory information refers to, uh, data that can be requested that
we must provide. And it’s kind of more private than you’d expect.
And so, you know, name, address, all sorts of personal information,
that’s outlined in here as well. And they’re very few things that are
non-directory information, those would include Social Security
Number, and, uh, you know, student ID number, those types of
things, but honestly, with all of the other information, you could, I’m
FINAL POLICY RESEARCH PAPER - FERPA
81
certain, if someone had bad intent that would be more than enough
information to do whatever they needed to do.
INTER.-5-3: So the registrar’s office primarily will provide
information to the inner constituencies about operational data and
data in production, we’d call it, but when it’s uh, when we’re looking
at something like this, it generally will go through an IR office. Each
institution can decide, but in general, that’s how it is.
INTER.-6-3: So, students who are under 18, their parents
have the right to their information, but once they turn 18 it’s the
student’s decision if they want to share that information with
anybody.
INTER.-6-3: While we provide all this information in the
university catalog – its law, we outline what the law is in general
terms, where they can reference it for further detail, and our policy in
regard to how that information will be safeguarded or released. Then
at new student orientation, our registrar’s office will explain this to
both the students as well as to the parents. And we don’t endorse one
practice over the other. We’re simply providing information, because
there’s a point of a lot of confusion. And what we tell them is, hey
student, if you’re 18 or over, this information is yours. You have the
right not to share it with anybody. Um, if you want to share it with
somebody, we need to know their name. You need to sign the paper.
And we do the same thing to parents. And then we lay out a few
scenarios so they can contextualize it a little bit. Um, and what we
do is generally, you know, we say “in many instances a student’s bill
will be sent home, because that’s the permanent address on file. If
your parents are helping you finance your education and they call us
up and what to discuss how to pay for the bill, we can’t discuss that
with them unless you’ve authorized us to.
INTER.-7-3: And in general that’s when they all go, oh yeah,
I’ll sign.
And it’s also the point when the parents, you know, typically
what parents will say is, if I’m paying for my child’s education, you
better believe I want to see their grades and all this. And we say,
that’s a discussion for you guys. But we implement that, we inform
them about it through the catalog and in new student orientation, and
then we give out the forms at orientation, and we take them back to
our office right away. Because we’d like to get that all out of the
way, because the bills are going to start hitting even before school
FINAL POLICY RESEARCH PAPER - FERPA
82
starts, their schedules are going to hit before school starts, and all
that type of a thing.
L.S,-14-5: Definitely, yep, yep. Security is a big one, training,
self-audit is a big one.
Um, those, those would probably be some of the biggest ones
(considerations).
INTER.-15-5: Anjour is like the data police here. And the
registrar’s office is often always looked to as you know, kind of seen
as that wall. And it’s not because we want to be a wall, we’re just
trying to protect what we’ve been given the responsibility to protect.
Implementation
INTER.-4-2: The… one big distinction I think is what is
Challenges
called directory information and what is not directory information.
&
So, directory information refers to, uh, data that can be requested that
Considerations we must provide. And it’s kind of more private than you’d expect.
And so, you know, name, address, all sorts of personal information,
that’s outlined in here as well. And they’re very few things that are
non-directory information, those would include Social Security
Number, and, uh, you know, student ID number, those types of
things, but honestly, with all of the other information, you could, I’m
certain, if someone had bad intent that would be more than enough
information to do whatever they needed to do.
INTER.-17-8: I’ll say from our perspective it’s laborious and
it’s challenging as far as communicating it to different
constituencies. So, families, student, and parent are – we’re trying to
explain a thirty page law to them to distill it in five minutes and ask
of them to even make a decision in five minutes. I think that’s a
challenge that we didn’t expect it would be like. We expected some
of this would be covered by high school guidance counselors,
maybe, as well as some other things – that would be really nice. I
don’t think we expected we’d need to keep records on hand forever –
well it’s not forever- there is a statute on how long to keep it. But it’s
not so easy right now. It truly is a paper that gets signed and then
walked over somewhere else. We’re looking to see if we can base
this in the cloud and use electronic signatures and things. Those cost
money, though, believe it or not. So, it costs me like $1:65 per each
per parental signature I’m going to get. So if we’re bringing in 3600
freshman. So it makes me think we’ll just keep the piece of paper.
Um, yea. Then you know where are you going to store it? Safeguard
FINAL POLICY RESEARCH PAPER - FERPA
83
it? When you clean it out and all that kind of stuff? So it’s kind of a
challenge there.
INTER.-18-8: And for maintaining the training, it’s not an
exciting topic to you know talk about. It’s confusing. Anjour
developed for us this online FERBA training tool at my request last
year. I would bet you that most people didn’t ace it the first time they
took it including our long-timers because there are just so many little
intricate situations. And we need to keep people up-to-date on this to
be able to show that we’ve been doing the training if we ever do have
an incidence and that type of practice. So there is a lot of work into
just making sure people are sharp with this.
INTER.-18-8: And then there’s we didn’t imagine probably
that we would ever get into arguments with colleagues about whose
entitled to see what and why and why it’s not fair and all this, and
that happens.
INTER.-18-8: And we’ve had new significant customer
service training with our staff dealing with people on the phone so
we have to set up a verification process. How do I know that the
person on the other line really is somebody’s mother or father or
whatever? You know, so we have to set up certain protocols for that.
And um and in instances when we don’t have, and that’s for
someone with the release, and in instances where there is no
permission, how do we talk that other person off the fighting line. So
we’ve had to have extensive training on that and that takes an awful
lot of time. If you get someone on the phone next thing you know it’s
5-10 minutes on the phone just talking about this stuff. It’s not time
well used.
INTER.-19-10: So I think in general it’s pretty good.
Absolutely, I think every institution has staff, every institution that
just don’t know it well enough and probably don’t always go through
the protocols as they should.
Buy-In
INTER.-17-7: “How did you get ‘buy-in’ for the policy?” So
again you know since it’s a law it’s tied to all kinds of things. We
have to do it. Everyone on campus knows the word FERPA. Most
people don’t know what it means, and most people think it covers
much more than it really does which I mean we’ll use to our
advantage if they think they can’t say anything - it’s better for us.
But it’s almost like one of those scary things where people do it
because they know they need to do it because the damage could be
FINAL POLICY RESEARCH PAPER - FERPA
84
so great or the punishment could be so great. So buy-in is somewhat
driven by fear I think there. For people in our offices it’s just
maintaining the letter of the law and you know real strong
compliance.
Evidence
Of
Success
INTER.-19-10: Perception of the success of the
implementation. I’d say in general it probably works out pretty well.
You know, as you mentioned earlier, we don’t hear the horror stories
so maybe because we’re not getting complaints. It’s working out
alright. … We don’t see that there are large numbers of people saying
my identity’s been stolen or personal information’s been
compromised and all this type of a thing. So that’s pretty good. Um,
and we also, while we do have discussions with our colleagues about
who’s allowed or whose not, they eventually go away. So if we’re
fighting about you want access and I say no. Eventually I’m going to
win you know because you know we own the data.
INTER.-19-10: So I think in general it’s pretty good.
Absolutely, I think every institution has staff, every institution that
just don’t know it well enough and probably don’t always go through
the protocols as they should.
INTER.-20-11: How do you know it is doing what it is
intended to do – maybe that’s similar to 10 in that we’re not seeing
big negative facts.
Themes
Importance
Of
Training
Interviewee Responses
INTER.-1-Intro: The organization that people in my business
belong to would be AACRAO, American Association of Collegiate
Registrars and Admissions Officers, and this is for you. They’ve got an
annual – well, they’ve got on their website, and I’ve listed the exact site
here, FERPA training. Because this is paramount in the industry and it’s
highly confusing, it’s changing, and they sell every year – and I guess
this was just so you’d know how often this thing, how dynamic it is,
every year there’s a new FERPA guide. Uh, and they’ve got – I’m not
saying buy it, you don’t need to buy it, but just to show you, and every
year at the annual conference there’s something called the FERPA
Update, which is the most highly attended session at the entire thing, and
FINAL POLICY RESEARCH PAPER - FERPA
85
Leroy Rooker, who’s probably, you’d call him like the godfather of
FERPA, he makes the presentation, he’s on the staff now at AACRAO,
so… it confuses people in the business.
INTER.-16-5: There’s wide spread, I think, agreement on the
interpretations. Um that’s a strength of it. There is so, there are best
practices out there because it is so widespread- that’s a strength. There’s
a lot of new training on it because it’s important.
INTER.-18-8: And we’ve had new significant customer service
training with our staff dealing with people on the phone so we have to
set up a verification process. How do I know that the person on the other
line really is somebody’s mother or father or whatever? You know, so we
have to set up certain protocols for that. And um and in instances when
we don’t have, and that’s for someone with the release, and in instances
where there is no permission, how do we talk that other person off the
fighting line. So we’ve had to have extensive training on that and that
takes an awful lot of time. If you get someone on the phone next thing
you know it’s 5-10 minutes on the phone just talking about this stuff. It’s
not time well used.
Compliance
INTER.-7-3: And it’s also the point when the parents, you know,
Issues
typically what parents will say is, if I’m paying for my child’s education,
you better believe I want to see their grades and all this. And we say,
that’s a discussion for you guys.
INTER.-7-3: Nonetheless, um, throughout students’ careers here
we inevitably get calls throughout the week from – and it’s generally
parents or guardians – who want to discuss something about the
student’s academics or finances. We don’t have the release on file.
We’ll inform them, nicely, “we can’t discuss it unless, and this is due to,
you know, this is a law,” because people get very emotional at that
point, and then let them know that student needs to come in and we’ll
give them a form to sign if they want to do that, but we can’t force them
to do that.
INTER.-13-4: Part of our job is to help educate the campus about
the need to maintain, to retain confidentiality of student information so
the registrar’s office provides FERPA training. We have an online
FERPA training we require of all of our staff and we recommend for
really anyone who works on campus. Um because it would be a really
bad thing, if and I’m just saying if a faculty member, you know, goes out
and starts sharing information whatever about kind of private things it
wouldn’t be good at all.
FINAL POLICY RESEARCH PAPER - FERPA
86
INTER.-14-4: I mean, so these are laws and they are tied to uh
the funding that we receive so I could see you know, sanctions, really
egregious problems I’m sure could lead to you know you are cut off.
…That would be a bad consequence
INTER.-14-4: The University of Maryland maybe about a week
or two ago had a big theft of data which included SSN#s on hundreds of
thousands of students. Hmm, now that wasn’t like a FERPA thing per
say although we are, we are charged with having safeguards set up to
protect that data. So in addition to just releasing it we have to safeguard
it and that gets down to even you know locking file drawers, locking,
and you know preventing physical access to things and making sure
night stuff is you know and there is information security requirements
that are built up. So we have to have the highest standard.
L.S,-14-5: Definitely, yep, yep. Security is a big one, training,
self-audit is a big one.
Um, those, those would probably be some of the biggest ones
(considerations).
INTER.-15-5: Yea, so I mean we even got requirements that you
have to time off and have passwords set up. You know we have to be
able to demonstrate it’s it’s really really extensive how you’re going to
maintain the confidentiality of that data. Um that includes restricting
access to certain data fields on the student information system and other
softwares. So if there are four of us who work at the university, and we
all play around in the student information system, we will all probably, if
we have different positions, have different security levels of access. So
again, like a faculty member can’t look up your social security number
or your grades, or these other things because it just - there’s no
educational interest in them having access to it. And uh that sometimes
gets under people’s skins – a little bit, because, you know, why can’t I
have access to that, and sorry.
INTER.-17-7: “How did you get ‘buy-in’ for the policy?” So
again you know since it’s a law it’s tied to all kinds of things. We have to
do it. Everyone on campus knows the word FERPA. Most people don’t
know what it means, and most people think it covers much more than it
really does which I mean we’ll use to our advantage if they think they
can’t say anything - it’s better for us. But it’s almost like one of those
scary things where people do it because they know they need to do it
because the damage could be so great or the punishment could be so
great. So buy-in is somewhat driven by fear I think there. For people in
FINAL POLICY RESEARCH PAPER - FERPA
87
our offices it’s just maintaining the letter of the law and you know real
strong compliance.
Frustrations
INTER.-1-Intro: They’ve got an annual – well, they’ve got on
&
their website, and I’ve listed the exact site here, FERPA training.
Confusions Because this is paramount in the industry and it’s highly confusing, it’s
changing, and they sell every year – and I guess this was just so you’d
know how often this thing, how dynamic it is, every year there’s a new
FERPA guide. Uh, and they’ve got – I’m not saying buy it, you don’t
need to buy it, but just to show you, and every year at the annual
conference there’s something called the FERPA Update, which is the
most highly attended session at the entire thing, and Leroy Rooker,
who’s probably, you’d call him like the godfather of FERPA, he makes
the presentation, he’s on the staff now at AACRAO, so… it confuses
people in the business.
LS: No, I appreciate that, I get enough of that from my
colleagues. (general laughter) [In response to: RT: …we didn’t want to
blindside you.]
INTER.-11-4: Sometimes that’s a point of frustration. But, other
people aren’t entitled to it.
INTER.-15-5: like a faculty member can’t look up your social
security number or your grades, or these other things because it just there’s no educational interest in them having access to it. And uh that
sometimes gets under people’s skins – a little bit, because, you know,
why can’t I have access to that, and sorry.
INTER.-18-8: And for maintaining the training, it’s not an
exciting topic to you know talk about. It’s confusing.
INTER.-18/19-9: It’s kind of - the law is the law. And as is with
most laws, it’s confusing. Uh, it’s 30 pages worth. It is so not easy to
understand that major associations such as ACRBA provide annual
updates on it and some annual books on it. There is a product they have
called ask the FERPA professor it’s just a really complex thing. And you
know it doesn’t take into consideration every single situation and what
would?
INTER.-20-12: It would be awesome and probably work even
better if there were some easy to read material presented to young people
and their families. And I don’t know what the vehicle is um, but I got to
FINAL POLICY RESEARCH PAPER - FERPA
88
tell you that when they get here, they don’t know what it means and if
they’ve heard of it they are confused about it. And it just - we don’t help
by running through it in a quick fashion and saying here is the web site if
you want to read up on it.
Key information – All Topics
Key information-Theme - Importance of Training
Key information-Theme – Compliance Issues
Key information-Theme – Frustrations &
Confusions