Section 6: Commonly Asked Questions

Q. Who (other than parents) must a school official allow to see an education record of a student?

A. School officials are not required to allow anyone other than the parents to see the education records of a student; the exceptions allowing the release are circumstances stipulated by federal or state laws, such as government-required audits, evaluations, or court orders. See section 6D; also see a detailed discussion of the federal statutes in section 2B.

Q. Which public officials have access to education records without consent of a parent?

A. School officials with a “legitimate educational interest” in the information have access to education records without specific consent of parents or eligible students. Policies defining officials who may receive information without prior consent must be accessible to parents for review. FERPA also permits other disclosures of information from education records without consent, usually for educational purposes. For examples, schools may disclose information on students to state or local educational authorities for audit or evaluation of federal or state supported education programs, or for the enforcement of federal legal requirements relating to those programs (such as IDEA). This condition for disclosure without consent does not generally extend to other state agencies.

Q. If a parent makes information about a student public, must school officials keep that piece of information confidential?

A. Yes, school officials should not respond to information made public by a parent, such as to the media, without consent from the parent. See section 6C.

Q. Must a school official release a student’s record to a family lawyer?

A. A school official does not have to release a record of a student to his or her family lawyer, but may do so upon receipt of a prior written consent from the parent, unless the school is assured that the attorney is asking on behalf of the parent. See section 6D.

Q. What penalties apply to the misuse or improper disclosure of confidential information?

A. The penalty for noncompliance with the Family Educational Rights and Privacy Act (FERPA) and Protection of Pupil Rights Amendment (PPRA) can be withdrawal of U.S. Department of Education funds from the institution or agency that has violated the law. This applies to schools, school districts, and state education agencies. The Family Policy Compliance Office of the U.S. Department of Education, charged with reviewing and investigating complaints, seeks to promote voluntary compliance with the law. A third party who improperly discloses personally identifiable information from student records can be prohibited from receiving access to records at the education agency or institution for at least 5 years. State laws on privacy may also apply penalties.

Q. What are the liabilities or penalties if an education agency or institution violates FERPA?

A. An education agency or institution subject to FERPA may not have a policy or practice of disclosing education records, or nondirectory, personally identifiable information from education records, without the written consent of the parent or eligible student, except as allowed by law. If a complaint is received by the Department of Education alleging a violation of FERPA, the FPCO investigates the complaint to determine if a violation of FERPA occurred. If a school is found to be out of compliance with FERPA, the FPCO works to bring the school into voluntary compliance with the law. If voluntary compliance is not achieved, then a school would be in jeopardy of losing federal education dollars. There is no private cause of action (right to sue) under FERPA and, in 2002, the U.S. Supreme Court ruled in Gonzaga University v. John Doe that students and parents may not sue for damages under 42 USC § 1983 to enforce provisions of FERPA.

Q. What are the consequences of a third party’s misuse of education records?

A. School officials must inform third parties receiving information, as allowed under FERPA, of the requirements concerning redisclosure of information. If a third party is found to have improperly redisclosed personally identifiable information from education records, the school may not allow that third party access to information for at least 5 years.

Q. Can student records be transmitted electronically, via the Internet or facsimile?

A. The law requires agencies to prevent the unauthorized release of personally identifiable information from education records. Thus, when student records are transmitted electronically, confidentiality must be protected both by the sender and receiver of information. Agencies must establish procedures for releasing information, and they must continually train officials and clerical staff about their obligation to treat personally identifiable information confidentially.

Various experts in the application of FERPA and the uses of electronic data exchange consider facsimile machines to be less secure than the electronic transmission of records. If facsimile machines are to be used, the institutions involved with the exchange of student information must establish security procedures that meet the privacy obligations set out in FERPA. See section 6I.

Top