Skip Navigation
Forum Guide to Protecting the Privacy of Student Information: State and Local Education Agencies

Section 2: Commonly Asked Questions

Q. What agencies are subject to federal laws on the privacy of education records?

A. Education agencies and institutions that collect and maintain education records are subject to federal privacy laws if they receive funds from the U.S. Department of Education. If information derives from an education record or is maintained in the record, federal as well as state and local privacy rules apply. See section 2A.

Q. Do privacy assurances differ across federal education programs?

A. Privacy components of laws are administered by federal agencies other than the U.S. Department of Education, and these may be applicable to programs directed in schools. However, the Family Educational Rights and Privacy Act (FERPA) is a comprehensive law that applies broadly to information collected in public agencies or schools that receive federal education funds. Thus, FERPA applies to information collected and maintained by most public elementary, secondary, and postsecondary education institutions and by some private institutions in this country. See section 2A.

Q. Are individuals liable for penalties if they do not adhere to the requirements of FERPA?

A. No, not typically. Institutions receiving funds from the U.S. Department of Education are legally responsible for complying with these laws and could be in jeopardy of losing federal education dollars if they are found to have a policy or practice of violating FERPA. Individual liability would depend on state laws and local policies. See section 2A.

Q. What do state and local education agency personnel need to know about federal privacy laws pertaining to education records?

A. Strong federal laws protect the privacy of education records in schools. Individuals who work with education records in agencies or schools are responsible for knowing the privacy regulations that apply to their work. Agency administrators need to understand federal and state laws, as well as local policies, that govern parental access to records and restrict inappropriate disclosure of information about students and their families. See section 2, A and B.

Q. About which federal student privacy laws do school district or state education agency administrators need to be informed?

A. FERPA and the Protection of Pupil Rights Amendment (PPRA) are the two major laws governing the protection of education records and student and family privacy. The other key laws with specific federal regulatory requirements pertaining to schools are the National School Lunch Act and the Individuals with Disabilities Education Act. See section 2, B–E.

Q. Does FERPA prohibit education agencies and institutions from matching data on students with data from other agencies?

A. FERPA generally prohibits the disclosure of personally identifiable information from students’ education records to other federal and state agencies, without the consent of the parent or eligible student. However, FERPA does not prohibit an education agency or institution from receiving information from outside entities and conducting the data matching internally. While the education agency or institution may conduct internal matches, it may only disclose the results of the match in aggregate form, even to the agency that provided information for the match.

Q. What are the responsibilities of state education agencies for providing parents or eligible students access to education records?

A. A state education agency must provide parents and eligible students with access to education records that the agency maintains. Although these agencies are not required to establish a written policy, they are obligated to honor rights of access and to restrict disclosure of information except to authorized individuals. See section 2B.

Q. How does the No Child Left Behind Act affect FERPA and PPRA?

A. The No Child Left Behind Act impacts FERPA in the following areas: the transfer of school disciplinary records, armed forces recruiter access to students and student recruiting information, student privacy, survey information, parental access to information, and administration of certain physical examinations to minors. For more detailed information, please see the Fact Sheet: Family Educational Rights and Privacy Act of 1974 (exhibit 2–1).

Q. What recent court cases address privacy issues?

A. On February 19, 2002, the U.S. Supreme Court ruled in Owasso ISD v. Falvo that peer grading does not violate FERPA. The Department of Education is currently reviewing the Court’s ruling and may issue additional guidance or regulations to further clarify the scope of the term “education records.”

On June 20, 2002, the U.S. Supreme Court ruled in the case of Gonzaga University v. John Doe. The Court ruled that students and parents may not sue for damages under 42 USC § 1983 to enforce provisions of FERPA.