1.B. Key Concepts of Privacy Laws and Confidentiality Policies

Privacy laws lead to establishing regulations that education agencies and schools must follow so that information about children is available only to officials who are authorized to know such information. The laws were passed by the U.S. Congress to ensure parents the right of access to information about their children, while allowing education officials the flexibility they need to use the information in making decisions that serve children well.

Federal and state privacy statutes pertaining to students in elementary and secondary schools build on concepts of common law and privacy guarantees found in the U.S. Constitution. Fundamental to the government’s rulemaking about data collection, privacy, and appropriate use are three concepts—notification, disclosure, and informed consent.

Notification, according to FERPA, refers to an agency’s responsibility to annually notify parents and eligible students of their rights under FERPA. Though not specified in FERPA, when school officials collect information about families or students, they should explain the legal basis for compiling data, or “give public notice,” of the reasons the data are being collected.

Disclosure refers to access, release, or transfer of personally identifiable information about individuals. Privacy laws define appropriate or inappropriate information disclosures or releases. According to FERPA, data about students may be disclosed without parental consent only under certain conditions specified in the law and regulations. For example, FERPA permits schools to disclose information from students’ education records to school officials who have a legitimate educational interest in the information. Any instance in which unauthorized individuals see or use private information about students is an inappropriate and often illegal disclosure, unless the parent or student gives consent or a law makes such access legal. FERPA regulations require that prior written consent be given by parents for the disclosure of information to persons not authorized by FERPA to have access to the records without consent.

Informed consent, though not specifically a FERPA requirement, involves an individual’s agreement in the context of a written account of why personal information is requested and how it will be used. In general, parents should have the option, without penalty, of agreeing or declining to provide the information that an education agency or school requests. Certain information, however, is required by schools, and parents must provide the information in order for their children to be enrolled. The parents’ agreement should be an informed decision, based on an understandable explanation of how the information will be used. Once a parent’s consent is given for a particular purpose or set of purposes, the information cannot be “redisclosed” (used by a third party) except as originally indicated.

Top