Skip Navigation
Forum Guide to the Privacy of Student Information
NCES 2006-805
July 2006

Data Requests and FERPA

Information requests from the press, researchers, and the general public are fairly common in most school systems and state education agencies. In this regard, the FERPA statute provides that an education agency or institution may not have a policy of disclosing education records or personally identifiable information from education records, without prior consent from the parent or eligible student, unless it is considered directory information or falls under one of the other consent exceptions contained in the law [20 U.S.C. §1232(g)(b)(1)]. (For exceptions to consent guidelines, see Disclosure of Student Information.) Agencies should determine whether requests for data meet these exceptions on a case-by-case basis.

Nothing in FERPA prohibits a school from disclosing information in aggregate, or in another form that is not personally identifiable. Personally identifiable information includes:

  • the student's name;
  • the name of the student's parent or other family member;
  • the address of the student or student's family;
  • a personal identifier, such as the student's social security number or student number;
  • a list of personal characteristics that would make the student's identity easily traceable; or
  • other information that would make the student's identity easily traceable.

In circumstances that may lead to the identification of an individual, the disclosing education agency or institution must ensure that student-level information is not personally identifiable by removing the student's name and ID number, as well as any "personal characteristics" and "other information that would make the student's identity easily traceable." This includes, but is not limited to, such factors as physical description (race, sex, appearance, etc.); date and place of birth; religion and national origin; participation in sports, clubs, and other activities; academic performance; employment; and disciplinary actions or criminal proceedings. "Other information that would make the student's identity easily traceable" may also exist in the small cell sizes in aggregated or statistical information from education records.

In cases where personal information cannot be removed, school officials must secure written parental consent before disclosing the data to outside organizations. The required consent form should specify:

  • the records that may be disclosed;
  • the purpose of the disclosure; and
  • the identity of the party or class of parties to whom the disclosure may be made.

(34 CFR § 99.30(b)