The Family Educational Rights and
Privacy Act (FERPA): A Legal Overview
Jody Feder
Legislative Attorney
May 1, 2013
Congressional Research Service
7-5700
www.crs.gov
RS22341
CRS Report for Congress
Pr
epared for Members and Committees of Congress
The Family Educational Rights and Privacy Act (FERPA): A Legal Overview
Summary
The Family Educational Rights and Privacy Act (FERPA) of 1974 guarantees parental access to
student education records, while limiting the disclosure of those records to third parties. The act,
sometimes referred to as the Buckley Amendment, was designed to address parents’ growing
concerns over privacy and the belief that parents should have the right to learn about the
information schools were using to make decisions concerning their children. No substantial
legislative changes have been made to FERPA since 2001, but in 2011, the Department of
Education (ED) issued controversial new regulations that, among other things, permit educational
agencies and institutions to disclose personally identifiable information to third parties for
purposes of conducting audits or evaluations of federal- or state-supported education programs or
enforcing compliance with federal requirements related to such programs.
Congressional Research Service
The Family Educational Rights and Privacy Act (FERPA): A Legal Overview
Contents
Access to Education Records ........................................................................................................... 1
Release of Education Records ......................................................................................................... 1
General Exceptions .................................................................................................................... 2
Directory Information ................................................................................................................ 3
Health and Safety Exception ..................................................................................................... 4
Disclosure of Misconduct and Drug and Alcohol Violations .................................................... 4
Disclosures Related to the Investigation and Prosecution of Terrorism .................................... 5
The 2011 Regulations ................................................................................................................ 5
Enforcement of FERPA Violations .................................................................................................. 6
Contacts
Author Contact Information............................................................................................................. 7
Congressional Research Service
The Family Educational Rights and Privacy Act (FERPA): A Legal Overview
his report provides an overview of the Family Educational Rights and Privacy Act
(FERPA),1 as well as a discussion of several court cases that have clarified the statute’s
Trequirements.
Access to Education Records
Under FERPA, educational agencies and institutions that receive federal funds must provide
parents with access to the educational records of their children. Access must be provided within a
reasonable time, but no later than forty-five days after a request to access education records has
been made. In addition, the statute provides parents with an opportunity to challenge the content
of their children’s education records in order to ensure that the records are not inaccurate,
misleading, or otherwise in violation of a student’s privacy rights.2
Under the statute, education records are defined to include those records, files, documents, and
other materials that contain information directly related to a student and that are maintained by an
educational agency or institution or by a person acting for such agency or institution.3 Education
records may also include videotape and products of other media.4 However, education records do
not include any of the following: (1) records of educational personnel that are in the sole
possession of the maker and not accessible to anyone other than a substitute; (2) records
maintained by a law enforcement unit of an educational agency or institution for purposes of law
enforcement; (3) employment records; or (4) medical records for students who are age eighteen or
older.5
The parents of a student may exercise rights granted by FERPA until the student reaches the age
of eighteen or attends an institution of postsecondary education. At that point, the rights defined
by FERPA are transferred from the parents to the student.6 However, FERPA provides that certain
types of information shall not be available to students in institutions of postsecondary education.
Such students shall not have access to their parents’ financial records. Letters and statements of
recommendation submitted prior to the enactment of FERPA must also remain confidential if the
letters are not used for other purposes. Finally, recommendations regarding admission to any
educational agency or institution, employment application, and the receipt of an honor must
remain confidential if the student has signed a waiver of his right of access.7
Release of Education Records
In addition to requirements regarding access to educational records, FERPA prohibits educational
agencies or institutions that receive federal funds from having a policy or practice of releasing the
1 20 U.S.C. §1232g.
2 Id. at §1232g(a)(2). See also 34 C.F.R. §99.21(a)-(b).
3 20 U.S.C. §1232g(a)(4)(A).
4 34 C.F.R. §99.3.
5 20 U.S.C. §1232g(a)(4)(B); 34 C.F.R. §99.3.
6 20 U.S.C. §1232g(d).
7 Id. at §1232g(a)(1)(C).
Congressional Research Service
1
The Family Educational Rights and Privacy Act (FERPA): A Legal Overview
education records of a student without the written consent of his parents.8 In addition, each
educational agency or institution must maintain a record that identifies those individuals,
agencies, or organizations that have requested or obtained access to a student’s education
records.9
It is important to note that consent is not required for the release of education records to certain
individuals and organizations. These exceptions to FERPA’s general prohibition against
nonconsensual disclosure of educational records are described in detail below, as are
controversial 2011 regulations that, among other things, permit educational agencies and
institutions to disclose personally identifiable information to third parties under limited
circumstances.
General Exceptions
Under FERPA, education records may be released without consent to certain school or
government officials, including the following: school officials with a legitimate educational
interest in the records; school officials at a school to which a student intends to transfer, as long as
the parents are notified of the transfer; authorized representatives of the Comptroller General of
the United States, the Secretary of Education, or state educational authorities in connection with
an audit and evaluation of federally supported education programs or in connection with the
enforcement of federal requirements that relate to such programs; authorized representatives of
the Attorney General for law enforcement purposes; in connection with a student’s application
for, or receipt of, financial aid; state and local officials pursuant to a state statute that requires
disclosure concerning the juvenile justice system and the system’s ability to effectively serve the
student whose records are released; and persons designated in a federal grand jury subpoena or
any other subpoena issued for a law enforcement purpose.10 In addition, a new exception was
added in 2013 to allow nonconsensual disclosure to a caseworker or other state, local, or tribal
child welfare agency official with legal responsibility for the care or protection of the student.11
Education records may also be released without consent to certain third parties other than school
or government officials. For example, education records may also be released to accrediting
organizations to carry out their accrediting functions, and to the parents of a dependent student.
Organizations conducting studies for the purpose of developing, validating, or administering
predictive tests, administering student aid programs, and improving instruction may also access
education records. However, such studies must be conducted in a manner that does not reveal the
personal identification of students and their parents, and the education records must be destroyed
when they are no longer needed.12
In 2001, the definition of “education records” and the requirements related to the release of such
records was the subject of review in a Supreme Court case, Owasso Independent School District
v. Falvo, that considered whether peer grading and the practice of calling out grades in class
8 Id. at §1232(b)(1).
9 Id. at §1232(b)(4)(A).
10 Id. at §1232(b)(1).
11 Id.
12 Id.
Congressional Research Service
2
The Family Educational Rights and Privacy Act (FERPA): A Legal Overview
resulted in an impermissible release of education records.13 The plaintiff argued that the grades on
student-graded assignments were education records maintained by students acting for an
educational institution and that students should not be allowed to call out the grades they recorded
in class because education records may not be released without consent. The school district, on
the other hand, maintained that FERPA’s definition of “education records” covered only
institutional records or materials maintained in a permanent file, such as final course grades,
standardized test scores, attendance records, and similar information, but not student homework
or classroom work.14
Ultimately, the Court concluded that the grades on peer-graded student assignments were not
education records, identifying two statutory explanations for its decision. First, the Court
determined that student assignments are not “maintained” within the meaning of FERPA’s
definition of “education records” because neither the teacher nor the students maintain the grades
of a recently corrected assignment in a manner that reflected a common understanding of when
something is “maintained.” As the Court observed, the word “maintain” suggests records that
“will be kept in a filing cabinet in a records room at the school or on a permanent secure
database.... ”15 Second, the Court concluded that student graders are not “person[s] acting for” an
educational institution for purposes of FERPA’s definition of “education records.” The Court
found that the phrase “acting for” does not suggest students, but rather connotes agents of the
school, such as teachers, administrators, and other school employees. Moreover, the Court
maintained that correcting a classmate’s work could be viewed as being part of an assignment: “It
is a way to teach material again in a new context, and it helps show students how to assist and
respect fellow pupils.”16 The Court did not interpret FERPA to prohibit such educational
techniques, and noted that the logical consequences of finding peer-graded assignments to be
education records would seem unbounded.
Directory Information
Absent prior notice from a parent, an educational agency or institution may release directory
information without consent. FERPA defines directory information to include the following: “the
student’s name, address, telephone listing, date and place of birth, major field of study,
participation in officially recognized activities and sports, weight and height of members of
athletic teams, dates of attendance, degrees and awards received, and the most recent previous
educational agency or institution attended by the student.”17
An agency or institution compiling directory information must give public notice of the
categories of information it has designated as “directory information,” and must allow a
reasonable period of time after the issuance of such notice to permit a parent to inform the agency
or institution that parental consent must be given before the release of any or all of the directory
information.18
13 534 U.S. 426 (2002).
14 Id. at 431-32.
15 Id. at 432-433.
16 Id. at 433.
17 20 U.S.C. §1232g(a)(5).
18 Id.
Congressional Research Service
3
The Family Educational Rights and Privacy Act (FERPA): A Legal Overview
In 2011, the Department of Education (ED) issued new regulations that expanded the definition of
directory information to include a student identification number displayed on a student
identification card or badge. Under the new regulations, parents may not opt out or otherwise
prevent an educational agency or institution from requiring students to wear badges or cards that
are designated as directory information.19
Health and Safety Exception
Under another important exception to the general prohibition against nonconsensual release of
educational records, such records may be released in connection with an emergency if the records
are necessary to protect the health or safety of the student or other persons.20 In the wake of the
shootings at Virginia Tech, there have been several attempts to clarify FERPA’s health or safety
exception. For example, under amendments to the Higher Education Act made in 2008, ED is
required to provide guidance clarifying rules regarding disclosure when a “student poses a
significant risk of harm to himself or herself or to others, including a significant risk of suicide,
homicide, or assault.” Such guidance must clarify that institutions that disclose such information
in good faith are not liable for the disclosure.21 In addition, ED issued regulations that contain
similar clarifications regarding disclosure requirements in the event of a threat to health or
safety.22
Disclosure of Misconduct and Drug and Alcohol Violations
FERPA does not restrict postsecondary institutions from disclosing certain information about
student misconduct and from identifying student drug and alcohol violations. For example, a
postsecondary institution may disclose to an alleged victim of any crime of violence or
nonforcible sex offense the final results of any disciplinary proceeding conducted by the
institution against the alleged perpetrator. Likewise, an institution may disclose to anyone the
final results of any disciplinary proceeding conducted against a student who is an alleged
perpetrator of any crime of violence or nonforcible sex offense if the institution determines as a
result of the proceeding that the student committed a violation of the institution’s rules or policies
with respect to such crime or offense.23
It is important to note that amendments made to the Higher Education Act in 2008 essentially
override FERPA’s optional disclosure rule by requiring institutions of higher education to disclose
to the alleged victim of any crime of violence or a nonforcible sex offense the results of any
disciplinary proceeding conducted by the institution against a student who is the alleged
perpetrator of such a crime or offense. If the alleged victim is deceased as a result of such crime
or offense, the next of kin of such victim shall be treated as the alleged victim for purposes of
disclosure.24
19 Department of Education, Family Educational Rights and Privacy, 76 FR 75604 (December 2, 2011).
20 Id. at §1232(b)(1).
21 P.L. 110-315, §801.
22 Department of Education, Family Educational Rights and Privacy, 73 FR 74806 (December 9, 2008).
23 20 U.S.C. §1232g(b)(6).
24 P.L. 110-315, §493.
Congressional Research Service
4
The Family Educational Rights and Privacy Act (FERPA): A Legal Overview
In addition, FERPA permits a postsecondary institution to disclose to a parent or legal guardian of
a student information regarding any violation of any federal, state, or local law, or any rule or
policy of the institution, governing the use or possession of alcohol or a controlled substance.
However, disclosure is permitted only when the student is under the age of twenty-one and the
institution determines that the student committed a disciplinary violation with respect to the use
or possession of alcohol or a controlled substance.25
Disclosures Related to the Investigation and Prosecution of
Terrorism
In 2001, FERPA was amended to allow the Attorney General (AG) or certain employees
designated by the AG to seek access to education records that are relevant to an authorized
investigation or prosecution of a terrorism-related offense or an act of domestic or international
terrorism. These records may be disseminated and used as evidence in an administrative or
judicial proceeding.26
To obtain access to the records, the AG or his designee must submit a written application to a
court for an order requiring an educational agency or institution to release the records. The
application must certify that there are specific facts that give reason to believe that the education
records are likely to contain relevant information, and the court shall issue the order if it finds that
the application includes this certification.27 Education records disclosed pursuant to a court order
are not subject to FERPA’s requirement that educational agencies and institutions maintain
records identifying entities that have requested or obtained access to a student’s education
records.28
The 2011 Regulations
In 2011, ED issued a final rule amending the FERPA regulations.29 Designed to allow increased
data sharing, the rule was intended, in part, to facilitate the development of statewide longitudinal
data systems (SLDS). According to ED, “Improved access to data will facilitate States’ ability to
evaluate education programs, to ensure limited resources are invested effectively, to build upon
what works and discard what does not, to increase accountability and transparency, and to
contribute to a culture of innovation and continuous improvement in education.”30
The new regulations make a number of changes, including, but not limited to
• permitting educational agencies and institutions to disclose personally
identifiable information to authorized third parties for purposes of conducting
audits or evaluations of federal- or state-supported education programs or
enforcing compliance with federal requirements related to such programs;
25 20 U.S.C. §1232g(i).
26 Id. at §1232g(j)(1).
27 Id. at §1232g(j)(2).
28 Id. at §1232g(b)(4).
29 Department of Education, Family Educational Rights and Privacy, 76 FR 75604 (December 2, 2011).
30 Id.
Congressional Research Service
5
The Family Educational Rights and Privacy Act (FERPA): A Legal Overview
• allowing student identification numbers to be designated as directory information
for purposes of display on a student identification card or badge; and
• adding new enforcement mechanisms for violations of the act.
The changes regarding release of personally identifiable information and directory information
have proved to be somewhat controversial. Indeed, privacy advocates have raised concerns,
noting that the changes may pose increased risks to student privacy, and one organization—the
Electronic Privacy Information Center (EPIC)—has filed a lawsuit alleging that the regulations
exceed the agency’s statutory authority and are contrary to existing law.31
Enforcement of FERPA Violations
Under FERPA, educational agencies and institutions found to have a policy of denying parental
access to a student’s education records or releasing a student’s education records without written
consent may be denied federal funds. The Secretary of Education is authorized to deal with
violations of the act and to establish or designate a review board for investigating and
adjudicating FERPA violations.32 The Family Policy Compliance Office (FPCO), which acts as a
review board, permits students and parents who suspect a violation to file individual written
complaints.33 If a violation is found after investigation, the FPCO will notify the complainant and
the educational agency or institution of its findings and identify the specific steps that the agency
or institution must take to comply with FERPA.34 If the agency or institution fails to comply
within a reasonable period of time, the Secretary may either withhold further payments under any
applicable program, issue a complaint to compel compliance through a cease-and-desist order, or
terminate eligibility to receive funding.35
In Gonzaga University v. Doe,36 the Court considered whether a student could enforce the
provisions of FERPA by suing an institution for damages under 42 U.S.C. Section 1983, which
provides a remedy for violations of federally conferred rights. The respondent, a former student at
Gonzaga, planned to teach in the Washington state public school system after graduation.
Washington required new teachers to obtain an affidavit of good moral character from a dean of
their graduating college or university, but the respondent was denied such an affidavit after
Gonzaga’s teacher certification specialist informed the state agency responsible for teacher
certification of allegations involving sexual misconduct by the respondent. The respondent sued
Gonzaga, alleging a violation of section 1983 for the impermissible release of personal
information to an unauthorized person under FERPA.37
The Court found that FERPA creates no personal rights that may be enforced under section 1983.
The Court noted that unless Congress expresses an unambiguous intent to confer individual
31 Electronic Privacy Information Center v. U.S. Department of Education, No: 1:12-cv-00327 (D.D.C. filed February
29, 2012).
32 20 U.S.C. §1232g(f), (g).
33 34 C.F.R. §99.63.
34 Id. at §99.66.
35 Id. at §99.67(a).
36 536 U.S. 273 (2002).
37 Id. at 277.
Congressional Research Service
6
The Family Educational Rights and Privacy Act (FERPA): A Legal Overview
rights, federal funding provisions, like those included in FERPA, provide no basis for private
enforcement under section 1983. The respondent had argued that as long as Congress intended for
a statute to “benefit” putative plaintiffs, the statute could be found to confer rights enforceable
under section 1983.38 The Court disagreed: “it is the rights, not the broader or vaguer ‘benefits’ or
‘interests,’ that may be enforced under the authority of that section.”39 The Court also observed
that FERPA’s nondisclosure provisions had an aggregate focus and were not concerned with the
needs of any particular person.40 By having such a focus, the provisions could not be understood
to give rise to individual rights.
Author Contact Information
Jody Feder
Legislative Attorney
jfeder@crs.loc.gov, 7-8088
38 Id. at 282.
39 Id. at 283.
40 Id. at 288.
Congressional Research Service
7