Confidentiality Laws

Four separate laws cover the protection of the confidentiality of individually identifiable information collected by the National Center for Education Statistics (NCES)-the Privacy Act of 1974, the Education Sciences Reform Act of 2002, the USA Patriot Act of 2001, and the E-Government Act of 2002.

The Privacy Act of 1974 applies to all Federal agencies and their employees. In particular, the law states that:

• The purpose of this Act is to provide certain safeguards for an individual against invasion of personal privacy by requiring Federal agencies…to collect, maintain, use or disseminate any record of identifiable personal information in a manner that assures that such action is for necessary and lawful purpose, that the information is current and accurate for its intended use, and that adequate safeguards are provided to prevent misuse of such information.

Under the Privacy Act, a willful disclosure of individually identifiable data is a misdemeanor, subject to a fine up to $5,000. However, the Privacy Act contains a number of conditions for disclosure that serve as exceptions to the requirement to protect the confidentiality of the data. In particular, disclosures may be made:

• (7) to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought; or
• (11) pursuant to the order of a court of competent jurisdiction.

As a result of these exceptions, the Education Sciences Reform Act of 2002 (ESRA 2002), and its predecessor, the National Education Statistics Act of 1994 (NESA 1994), both strengthened the confidentiality provisions of The Privacy Act of 1974 as they apply to data collected by the National Center for Education Statistics, by specifying that individually identifiable information collected under ESRA 2002 and its predecesor, the National Education Statistics Act of 1994 (NESA 1994), is immune from legal process. Furthermore, these data shall not, without the consent of the individual concerned, be admitted as evidence or used for any purpose in any action, suit, or other judicial or administrative proceeding.

Under ESRA 2002 all individually identifiable information about students, their families, and their schools, shall remain confidential. To this end, ESRA 2002 requires that no person may:

• Use any individually identifiable information furnished under the provisions of this section for any purpose other than statistical purposes for which it is supplied;
• Make any publication whereby the data furnished by any particular person under this section can be identified; or
• Permit anyone other than the individuals authorized by the Commissioner to examine the individual reports.

Employees, including temporary employees, or other persons who have sworn to observe the limitations imposed by this law, who knowingly publish or communicate any individually identifiable information will be subject to fines of up to $250,000, or up to 5 years in prison, or both (Class E felony).

Following the events of September 11, 2001 the USA Patriot Act of 2001 was signed into law on October 26, 2001. This law amended the confidentiality provisions of NESA 1994 by permitting the Attorney General to petition a Judge for an ex parte order requiring the Secretary of the Department of Education to provide NCES data that is identified as relevant to an authorized investigation or prosecution of an offense concerning national or international terrorism to the Attorney General. Any data obtained by the Attorney General for these purposes must be treated as confidential information, "consistent with such guidelines as the Attorney General, after consultation with the Secretary, shall issue to protect confidentiality."

As a result of the Patriot Act, the intended use clause of the NESA of 1994 was amended. That is, the portion of the NESA of 1994 that specified that data collected by NCES may only be used for statistical purposes was amended by the fact that the data may now be used with a judge's order for matters relevant to an offense concerning national or international terrorism. This amendment was incorporated into ESRA 2002.

It is important to note that the confidentiality of data collected by NCES is protected in all instances, since even in the case of a judge's order for matters relevant to an offense concerning national or international terrorism, the Attorney General must protect the confidentiality of the data.

Following the enactment of the Patriot Act, the 107th Congress enacted the E-Government Act of 2002, Title V, Subtitle A, Confidential Information Protection (CIP 2002) which requires that all individually identifiable information supplied by individuals or institutions to a federal agency for statistical purposes under the pledge of confidentiality must be kept confidential and may only be used for statistical purposes. Any willful disclosure of such information for nonstatistical purposes, without the informed consent of the respondent, is a class E felony.