The Family Educational Rights and Privacy Act
May 24, 2021
(FERPA): Legal Issues
Jared P. Cole
Schools generate and maintain numerous student records, including grades, standardized test
Legislative Attorney
scores, disciplinary accounts, contact information, mental health records, and more. The Family

Educational Rights and Privacy Act (FERPA), which applies to educational agencies and
institutions that receive certain types of financial assistance from the Department of Education

(ED), regulates the handling of education records in several ways. The law sets forth two key
requirements for covered entities. First, FERPA requires schools to allow parents to access and review their children’s
education records. Second, it prohibits schools from releasing students’ education records, including personally identifiable
information (PII), without the written consent of their parents, subject to several exceptions. FERPA defines “education
records” as materials that (1) “contain information directly related to a student” and (2) “are maintained by an educational
agency or institution or by a person acting for such agency or institution.”
FERPA does not govern all materials that may contain information about a student . The statute exempts certain categories of
information from its definition of “education records” altogether. For instance, FERPA’s requirements do not apply to
records independently generated by a school’s law enforcement unit for law enforcement purposes.
The statute’s prohibition against disclosing education records also does not apply to so-called “directory information,” as
long as schools follow specific procedures when doing so. And under ED regulations, schools may disclose “de-identified”
records without consent.
FERPA also has various specific exceptions that permit disclosure of student records in different situations. In certain
circumstances, disclosure of education records absent consent is permitted to appropriate “school officials,” which can
include online educational services, law enforcement units, and threat assessment teams. Schools can also disclose a student’s
records to appropriate parties in emergency situations if necessary to protect the health and safety of students. In addition,
schools may disclose education records without consent for the purpose of certain studies, as well as for audits and
evaluations. Disclosure is also sometimes permitted to a state law juvenile justice system in order for that system to serve the
student effectively. In each of these situations, FERPA imposes requirements on the recipients of these student records,
including how materials may be used and when those records may be re-disclosed.
Because FERPA does not create a private right of action to sue schools for noncompliance, enforcement of the statute is
primarily conducted by ED’s Student Privacy Policy Office, which can review and in vestigate violations. When
noncompliance is not resolved through the administrative process, ED can withhold federal funds or terminate eligibility to
receive federal funds.
In addition to complying with FERPA’s requirements concerning disclosure of student records, schools that receive federal
financial assistance must also abide by the requirements of Title IX of the Education Amendments of 1972. In May 2020,
regulations were issued under Title IX that prescribe how schools must respond to allegations of sexual harassment at school.
Those regulations require that during a grievance process in response to a formal complaint of harassment, schools must
make certain information available to relevant parties. Although FERPA does not have an express “exception” for disclosures
in Title IX sexual harassment proceedings, these requirements may nonetheless be reconcilable.

Congressional Research Service

The Family Educational Rights and Privacy Act (FERPA): Legal Issues

chools generate and maintain numerous records that concern their students, including
grades, standardized test scores, disciplinary accounts, contact information, mental health
S records, and more. Concerns about protecting these materials from improper disclosure
have increased with the rise of technology that is used to store and maintain school records.1 And
the major expansion of third-party software to enable school instruction at home during the
Coronavirus Disease 2019 (COVID-19) pandemic has increased some observers’ concern about
the security of students’ information.2
The Family Educational Rights and Privacy Act (FERPA), which applies to educational agencies
and institutions3 that receive certain types of financial assistance from the Department of
Education (ED),4 regulates the handling of student records in several ways.5 The statute has two
key features. First, it requires schools to al ow parents to access and review their children’s
education records.6 Second, it prohibits schools from releasing students’ education records,
including personal y identifiable information (PII), without the written consent of their parents.7
As this report explains, however, this prohibition is not absolute. For instance, FERPA permits the
limited disclosure of otherwise protected student records in certain situations, including to other
school officials for legitimate education interests, or when disclosure is necessary to protect
health and safety in case of an emergency.8 In addition, the statute authorizes disclosure of
students’ so-cal ed “directory information,” subject to several procedural requirements.9

1 See, e.g., Betsy Morris, Schools Wrestle With Privacy of Digital Data Collected on Students, WALL ST. J. (July 10,
2019), https://www.wsj.com/articles/one-parent -is-on-a-mission-to-protect-children-from-digital-mistakes-
11562762000.
2 See, e.g., Shawn Hubler, Keeping Online Testing Honest? Or an Orwellian Overreach? N.Y. T IMES (May 10, 2020),
https://www.nytimes.com/2020/05/10/us/online-testing-cheating-universities-coronavirus.html; Anushka Patil & Jonah
Engel Bromwich, How It Feels When Software Watches You Take Tests, N.Y. T IMES (Sept. 29, 2020),
https://www.nytimes.com/2020/09/29/style/testing-schools-proctorio.html.
3 Educational agencies and institutions includes local educational agencies (LEAs), elementary and secondary schools,
and postsecondary educational institutions. See DEP ’T OF EDUCATION, PRIVACY TECHNICAL ASSISTANCE CENTER,
SCHOOL RESOURCE OFFICERS, SCHOOL LAW ENFORCEMENT UNITS, AND THE FAMILY EDUCATIONAL RIGHTS AND PRIVACY
ACT (FERPA) 6 (2019) [hereinafter LAW ENFORCEMENT UNITS], https://studentprivacy.ed.gov/resources/school-
resource-officers-school-law-enforcement-units-and-ferpa. For ease of reference, this report refers to the recipient
educational agencies and institutions subject to FERPA simply as “schools.”
4 20 U.S.C. § 1232g(a)(1)(A). ED administers a number of programs that distribute financial assistance to schools and
students, including the Elementary and Secondary Education Act, which authorizes aid for elementary and secondary
schools (often through st ate and local educational agencies). See Elementary and Secondary Education Act of 1965,
Pub. L. No. 89-10, 79 Stat. 27 (as amended by Every Student Succeeds Act, Pub. L. No. 114-95, 129 Stat. 1802
(2015)). And ED also provides financial assistance to colleges and universities, including through grants and loans
extended to students, as well as direct financial assistance to certain institutions of higher education, under the Higher
Education Act. See Higher Education Act of 1965, Pub. L. No. 89-329, 79 Stat. 1219 (as amended). For more on the
Elementary and Secondary Education Act, see CRS Report R45977, The Elem entary and Secondary Education Act
(ESEA), as Am ended by the Every Student Succeeds Act (ESSA): A Prim er, by Rebecca R. Skinner. For more on the
Higher Education Act, see CRS Report R43351, The Higher Education Act (HEA): A Prim er, by Alexandra Hegji.
5 20 U.S.C. § 1232g. T he Protection of Pupil Rights Amendment also has implications for student privacy. Id. § 1232h.
Among other things, the law prohibits certain surveys of students absent consent, grants parents of students the right to
inspect potential surveys, and requires schools to allow parents to opt out of certain activities, including physical
examinations. Id. § 1232h(b), (c)(1)(A), and (c)(2).
6 20 U.S.C. § 1232g(a)(1)(A). When a student reaches the age of 18 or attends a postsecondary institution, the rights of
the parent transfer to the student. Id. § 1232g(d); 34 C.F.R. §§ 99.3, 99.5.
7 20 U.S.C. § 1232g(b)(1). FERPA rights transfer to students once they reach the age of 18 or attend a postsecondary
institution. Id. § 1232g(d); 34 C.F.R. §§ 99.3, 99.5.
8 Id. § 1232g(b)(1)(A)-(K).
9 20 U.S.C. § 1232g(b)(1).
Congressional Research Service
1

link to page 16 link to page 17 The Family Educational Rights and Privacy Act (FERPA): Legal Issues

This report discusses FERPA’s provisions and its application to certain areas, including the use of
online software for at-home student learning.10 It also examines how the statute is enforced,11 and
discusses FERPA’s interaction with other legal requirements that apply to schools, such as
regulations under Title IX of the Education Amendments of 1972 (Title IX), which set standards
for adjudicating al egations of sexual harassment at school.12
What Counts as an Education Record?
FERPA defines “education records” as materials that (1) “contain information directly related to a
student” and (2) “are maintained by an educational agency or institution or by a person acting for
such agency or institution.”13 Certain records are expressly exempted from coverage under this
definition, including employment records,14 as wel as records created by educational personnel
that are in the sole possession of the creator (e.g., notes taken by a teacher regarding a
conversation with a student) that are not accessible to anyone except a substitute.15
One of the notable categories of materials excluded from FERPA’s definition of “education
records” is materials created and maintained by a school’s law enforcement unit for law
enforcement purposes.16 Importantly, this category only applies to records that are (1) “created by
a law enforcement unit,” (2) “created for a law enforcement purpose,” and (3) “maintained by”
the law enforcement unit.17 The category does not include records maintained by a component of
the school other than law enforcement. FERPA regulations clarify that the category does not

10 Because FERPA penalizes schools that have a policy or practice of violating its provisions, 20 U.S.C. § 1232g(b)(1),
some disagreement exists with regard to how the statute should int eract with state open records laws. Mathilda McGee-
T ubb, Deciphering the Suprem acy of Federal Funding Conditions: Why State Open Records Laws Must Yield to
FERPA, 53 B.C. L. REV. 1045, 1049 (2012). See United States v. Miami Univ., 294 F.3d 797, 812 (6th Cir. 2002)
(affirming a district court decision that granted an injunction brought by the United States against a university from
releasing records in violation of FERPA). T his report only examines the ways in which FERPA directly regulates the
disclosure of student records. It does not consider the degree to which FERPA, in addition to imposing record-shielding
requirements on covered entities as a condition to receiving federal funds, may also have a p reemptive effect on
inconsistent state or local measures. See generally Caledonian-Record Pub. Co. v. Vermont State Colleges, 175 Vt.
438, 441, 833 A.2d 1273, 1275 –76 (2003) (collecting cases reaching different conclusions on FERPA’s preemptive
effect and observing that “ state and federal courts are sharply divided on this issue.... Some have questioned whether
the federal law, merely by withholding funds from educational institutions that release education records to anyone
other than certain enumerated persons, affirmatively prohibits disclosure of student records.”) (internal citations
omitted).
11 See infra “FERPA Enforcement .”
12 See infra “How Does FERPA Interact With Other Legal Requirements?”
13 22 U.S.C. § 1232g(a)(4)(A).
14 Id. § 1232g(a)(4)(B)(iii); 34 C.F.R. § 99.3. In addition, medical treatment records for students 18 years of age or
older or in college are not considered education records. But to meet this definition, treatment records must be
made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or
paraprofessional acting in his professional or paraprofessional capacity, or assisting in that
capacity, and which are made, maintained, or used only in connection with the provision of
treatment to the student, and are not available to anyone other than persons providing such
treatm ent, except that such records can be personally reviewed by a physician or other appropriate
professional of the student’s choice.
20 U.S.C. § 1232g(a)(4)(B)(iv) (emphasis added).
15 20 U.S.C. § 1232g(a)(4)(B)(i). See DEP’T OF EDUCATION, WHAT RECORDS ARE EXEMPTED FROM FERPA? (accessed
May 11, 2021), https://studentprivacy.ed.gov/faq/what -records-are-exempted-ferpa.
16 20 U.S.C. § 1232g(a)(4)(B)(ii); 34 C.F.R. § 99.8 (a)(1).
17 34 C.F.R. § 99.8 (b)(1). See Bauer v. Kincaid, 759 F. Supp. 575, 590 (W.D. Mo. 1991).
Congressional Research Service
2

link to page 4 The Family Educational Rights and Privacy Act (FERPA): Legal Issues

include records, even if created and maintained by the law enforcement unit, that are used
exclusively for non-law enforcement purposes, such as a disciplinary proceeding.18 But, if a
school’s law enforcement unit independently generates an investigative report on a student for
law enforcement purposes and maintains those records itself, FERPA does not prohibit the local
law enforcement unit from disclosing that information.19 Because of this distinction, ED advises
that local law enforcement units maintain law enforcement records separately from education
records.20
In addition to these exclusions, FERPA and its implementing regulations include a number of
other categories of materials that do not qualify as “education records.”21 Table 1 lists materials
exempted from the definition of “education records.”
Table 1. Materials Excepted by FERPA or its Implementing Regulations from the
Definition of “Education Records”

Instructional Records in Sole Possession of the
“records of instructional, supervisory, and
Maker
administrative personnel and educational personnel
ancil ary thereto which are in the sole possession of the
maker thereof and which are not accessible or revealed
to any other person except a substitute” (20 U.S.C. §
1232g(a)(4)(B)(i))
Law Enforcement Records
“records maintained by a law enforcement unit of
the educational agency or institution that were created
by that law enforcement unit for the purpose of law
enforcement” (20 U.S.C. § 1232g(a)(4)(B)(i ))
Employee Records
“in the case of persons who are employed by
an educational agency or institution but who are not in
attendance at such agency or institution, records made
and maintained in the normal course of business which
relate exclusively to such person in that person’s
capacity as an employee and are not available for use
for any other purpose” (20 U.S.C. § 1232g(a)(4)(B)(i i))

18 34 C.F.R. § 99.8 (b)(2).
19 LAW ENFORCEMENT UNITS, supra note 3, at 15.
20 Id.
21 FERPA regulations contain two such exceptions that are not explicitly mentioned in the statute. The first is for
records of a former student not directly related to the individual’s attendance as a student. 34 C.F.R. § 99.3. ED states
that this provision simply clarifies that such materials do not qualify as “education records” under FERPA. Final
Regulations, Family Educational Rights and Privacy, 73 Fed. Reg. 74806 -01, 74811 (Dec. 9, 2008). The second is for
student grades from peer-graded papers before recording by the teacher. 34 C.F.R. § 99.3. T his regulatory exception
reflects the Supreme Court’s decision in Owasso Indep. Sch. Dist. No. I-011 v. Falvo, 534 U.S. 426, 428 (2002). See
also Final Regulations, Family Educational Rights and Privacy, 73 Fed. Reg. 74806 -01, 74811 (Dec. 9, 2008).
Congressional Research Service
3

The Family Educational Rights and Privacy Act (FERPA): Legal Issues

Health Records of Adult Students
“records on a student who is eighteen years of age or
older, or is attending an institution of postsecondary
education, which are made or maintained by a
physician, psychiatrist, psychologist, or other
recognized professional or paraprofessional acting in his
professional or paraprofessional capacity, or assisting in
that capacity, and which are made, maintained, or used
only in connection with the provision of treatment to
the student, and are not available to anyone other than
persons providing such treatment, except that such
records can be personal y reviewed by a physician or
other appropriate professional of the student’s choice”
(20 U.S.C. § 1232g(a)(4)(B)(iv))
Former Students
“Records created or received by an educational agency
or institution after an individual is no longer a student
in attendance and that are not directly related to the
individual's attendance as a student” (34 C.F.R. § 99.3)
Peer Review Grading
“Grades on peer-graded papers before they are
col ected and recorded by a teacher” (34 C.F.R. § 99.3)
Source: CRS.
A practical example of what counts as an education record under FERPA derives from the
Supreme Court’s 2002 decision in Owasso Independent School District v. Falvo.22 There, the
Court considered whether the process of peer grading in classrooms violated FERPA
requirements.23 The plaintiffs argued that the practice of students grading one another’s papers
and cal ing out those grades to the teacher for recording violated FERPA by disclosing students’
“education records” without parental consent.24 The Court disagreed, ruling that the grades of
students’ papers, at least before being entered into the teacher’s gradebook, are not “education
records” because they are not “maintained” within the meaning of the term’s definition.25 The
term “maintain,” the Court noted, suggested that education records subject to FERPA would be
“kept in a filing cabinet in a records room at the school or on a permanent secure database.”26

22 Owasso Indep. Sch. Dist. No. I-011 v. Falvo, 534 U.S. 426, 428 (2002).
23 Id. at 428. As explained infra, the Court explicitly did not resolve whether FERPA contains a private right of action
to bring suit to enforce its provisions in federal court. Id. at 430-31. T he Court later held that FERPA did not create a
private right of action. Gonzaga Univ. v. Doe, 536 U.S. 273, 276 (2002).
24 Owasso Indep. Sch. Dist., 534 U.S. at 432.
25 Id. at 432-33. T he Court declined to decide whether FERPA protects grades once they are given to a teacher. See id.
at 436 (“For these reasons, even assuming a teacher's grade book is an education record, the Court of Appeals erred, for
in all events the grades on students' papers would not be covered under FERPA at least until the teacher has collected
them and recorded them in his or her grade book. We limit our holding to this narr ow point, and do not decide the
broader question whether the grades on individual student assignments, once they are turned in to teachers, are
protected by the Act.”). It appears that ED and a few lower courts have concluded that FERPA protects grades ent ered
into a gradebook. See DEP ’T OF EDUCATION, WHAT IS AN EDUCATION RECORD?, https://studentprivacy.ed.gov/faq/what -
education-record (“ T hese records include but are not limited to grades, transcripts, class lists, student course schedules,
health records (at the K-12 level), student financial information (at the postsecondary level), and student discipline
files.”); Greenfield v. Newman Univ., Inc., No. 218CV02655DDCT JJ, 2020 WL 2766172, at *2 (D. Kan. May 28,
2020) (“FERPA is intended to protect records” such as “transcripts, test scores, grade information or information
related to student academic performance.”); Ragusa v. Malverne Union Free Sch. Dist., 549 F. Supp. 2d 288, 293
(E.D.N.Y. 2008) (“ [D]ocuments relating to students' grades, evaluations, and academic performance are undoubtedly
‘education records’ within the meaning of FERPA.”).
26 Owasso Indep. Sch. Dist., 534 U.S. at 432-33.
Congressional Research Service
4

link to page 10 The Family Educational Rights and Privacy Act (FERPA): Legal Issues

When students grade one another’s papers, the Court explained, they do not “maintain” records in
the manner that the school registrar does.27
Accessing Education Records
FERPA requires schools that receive financial assistance from ED to al ow parents to access and
review the education records of their children.28 Under the statute, schools must establish
procedures that facilitate this process, and those procedures must ensure that parents can access
their children’s records within 45 days of a request.29 Parents must also have the option to
chal enge the content of those records in order to ensure their accuracy, including through a
hearing if requested.30 According to FERPA regulations, schools must annual y give parents
notice of their rights under the law.31
Although the rights under FERPA transfer from parents to students when they turn 18 or enter
postsecondary education,32 those students’ right of access to records is limited in several ways.
For instance, FERPA does not require colleges to make parents’ financial records available to
students.33
Disclosing Education Records
FERPA prohibits federal funds from going to schools that have a policy permitting disclosure of
students’ education records, including PII, without written parental consent.34 As noted above, the
definition of “education records” under FERPA is broad, perhaps indicating at first glance that
schools might be prohibited from ever releasing a broad range of student information. But the
statute contains numerous qualifications. As explained below, so-cal ed “directory information”
may be disclosed as long as parents are given prior notice of what materials are designated as
directory information and an opportunity to opt out. Further, education records may be released to
specific entities for various purposes outlined in the statute and FERPA regulations. Schools must,
however, keep a record of which individuals or entities (other than a student’s parents) requested

27 Id.
28 20 U.S.C. § 1232g(a)(1)(A). FERPA applies to schools that receive federal financial assistance under an applicable
program of ED.
29 Id. § 1232g(a)(1)(A).
30 Id. § 1232g(a)(2); 34 C.F.R. §§ 99.20-99.21
31 34 C.F.R. § 99.7(a). If a school has a policy of disclosing records under the school official exception, the notice must
also include the criteria used to determine who qualifies as a school official and “what constitutes a legitimate
educational interest.” Id. § 99.7(a)(3)(iii). See infra “School Officials Exception.”
32 20 U.S.C. § 1232g(d); 34 C.F.R. §§ 99.3, 99.5.
33 20 U.S.C. § 1232g(a)(1)(C). T he statute provides that the right of access does not extend t o letters of
recommendation in some situations. T he statute has different provisions for letters of recommendation from before
January 1, 1975, and after. Com pare id. § 1232g(a)(1)(C)(ii), with id. § 1232g(a)(1)(C)(iii) (explaining that the right of
access does not apply to certain confidential recommendations if a student has signed a waiver pursuant to 20 U.S.C. §
1232g(a)(1)(D)).
34 Id. § 1232g(b). FERPA prohibits disclosing “education records” absent consent or a relevant exception. Id. §
1232g(b)(1). But the regulations implementing FERPA permit disclosing records without consent if all PII is removed
“provided that the educational agency or institution or other party has made a reasonable determination that a student's
identity is not personally identifiable, whether through single or multiple releases, and taking into account other
reasonably available information.” 34 C.F.R. § 99.31(b)(1).
Congressional Research Service
5

The Family Educational Rights and Privacy Act (FERPA): Legal Issues

or obtained access to a student’s records, including the legitimate interest such entities had in the
information.35
For many FERPA exceptions,36 the regulations also impose requirements on recipients of student
records regarding the use and re-disclosure of that information.37 When schools disclose PII from
an education record pursuant to an applicable exception, they must do so on the condition that the
recipient wil not re-disclose the information absent consent.38 And when recipients receive
student information, they may only use the information for the purposes for which it was
disclosed.39 That said, the regulations provide that schools may disclose PII to a recipient with the
understanding that the recipient may make further disclosures on behalf of the school if a relevant
exception applies.40
Directory Information and De-identified Data
Although the prohibition on releasing “education records” broadly encompasses information
directly related to a student and maintained by a school,41 FERPA nonetheless provides that basic
student data—so-cal ed “directory information”—may be released without affirmative consent as
long as certain requirements are met.42 Directory information includes material that “would not
general y be considered harmful or an invasion of privacy if disclosed.”43 Schools must give prior
public notice of the types of records designated as directory information and an opportunity for
parents in writing to refuse to al ow specific records to be so designated.44
Under FERPA and its implementing regulations, directory information includes a student’s
identification number,45 as wel as a student’s
name; address; telephone listing; electronic mail address; photograph; date and place of
birth; major field of study; grade level; enrollment status (e.g., undergraduate or graduate,
full-time or part-time); dates of attendance; participation in officially recognized activities
and sports; weight and height of members of athletic teams; degrees, honors and awards
received; and the most recent educational agency or institution attended .46

35 20 U.S.C. § 1232g(b)(4)(A). T his provision appears to exempt disclosures to school officials from this requireme nt.
Id. § 1232g(b)(4)(A); 34 C.F.R. § 99.32(d)(2).
36 T he regulations provide that the use and re-disclosure requirements do “ not apply to disclosures under §§
99.31(a)(8), (9), (11), (12), (14), (15), and (16), and to information that postsecondary institutions are required to
disclose under the Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act, 20 U.S.C.
1092(f) (Clery Act), to the accuser and accused regarding the outcome of any campus disciplinary proceeding brought
alleging a sexual offense.” 34 C.F.R. § 99.33(c).
37 34 C.F.R. § 99.33.
38 Id. § 99.33(a)(1).
39 Id. § 99.33(a)(2).
40 Id. § 99.33(b).
41 20 U.S.C. § 1232g(a)(4)(A).
42 Id. § 1232g(b)(1) and (a)(5)(a).
43 34 C.F.R. § 99.3.
44 20 U.S.C. § 1232g(a)(5)(a); 34 C.F.R. § 99.37(a)(1)-(3).
45 A student’s identification number counts as directory information as long as “ the identifier cannot be used to gain
access to education records except when used in conjunction with one or more factors that authenticate the user's
identity, such as a personal identification number (PIN), password, or other factor known or possessed only by the
authorized user.” 34 C.F.R. § 99.3.
46 Id. § 99.3; 20 U.S.C. § 1232g(a)(5)(A).
Congressional Research Service
6

link to page 4 The Family Educational Rights and Privacy Act (FERPA): Legal Issues

The carve-out of directory information from FERPA’s disclosure prohibition al ows schools to
include certain student information in various publications, such as playbil s for theatre
productions, programs at athletics competitions, student directories, yearbooks, graduation
programs, and honor rolls.47 Directory information also can be distributed to companies that
provide class photos, yearbooks, and class rings.48
FERPA’s regulations also provide that schools, as wel as parties authorized to receive education
records under a relevant exception (e.g., the exception for audits and evaluations),49 may disclose
“de-identified” records absent consent.50 For this exception to apply, the entity must remove al
PII and make “a reasonable determination that a student’s identity is not personal y identifiable,
whether through single or multiple releases, and taking into account other reasonably available
information.”51
School Officials Exception
Schools may disclose education records to appropriate “school officials” without parental
consent.52 School officials include other teachers in the institution if the school has determined
they have “legitimate educational interests.”53 According to FERPA regulations, outside parties,
such as contractors, volunteers, or consultants to whom a school has “outsourced institutional
services or functions,” may also qualify as school officials if (1) the school determines they have
a legitimate educational interest; (2) they conduct “an institutional service or function for which”
the school would otherwise use employees; (3) they are “under the direct control” of the school
regarding the maintenance and use of the records; and (4) they are subject to FERPA’s use and re-
disclosure requirements.54
Final y, schools must “use reasonable methods” to ensure school officials only access those
records in which they have legitimate educational interests.55 According to guidance from ED, a
school official wil typical y have a legitimate educational interest “if he or she needs to review
an education record in order to fulfil his or her professional responsibilities.”56
Online Educational Services
While not explicitly set forth in statute or regulations, ED guidance documents interpret the
school official exception to permit disclosure of education records to third-party providers of
online educational software.57 Schools often use online tools to facilitate instruction provided by

47 DEP’T OF EDUCATION, STUDENT PRIVACY POLICY OFFICE, THE A-B-C’S OF STUDENT DIRECTORY INFORMATION (Aug.
3, 2016), https://studentprivacy.ed.gov/training/b-cs-student-directory-information.
48 Id.
49 20 U.S.C. § 1232g(b)(1)(C), (b)(3), (b)(5); 34 C.F.R. §§ 99.31(a)(3), 99.35.
50 34 C.F.R. § 99.31(b)(1).
51 Id.
52 20 U.S.C. § 1232g(b)(1)(A); 34 C.F.R. § 99.31. Doe v. Woodford Cty. Bd. of Educ., 213 F.3d 921, 927 (6th Cir.
2000) (“For these reasons, we find there was no violation of John Doe's rights under the Act. Any disclosure is
protected by the [school official and health and safety] exceptions under the Act.”).
53 20 U.S.C. § 1232g(b)(1)(A); 34 C.F.R. § 99.31(a)(1)(i)(A).
54 34 C.F.R. § 99.31(a)(1)(i).
55 Id. § 99.33(a)(ii).
56 See LAW ENFORCEMENT UNITS, supra note 3, at 11.
57 DEP’T OF EDUCATION, STUDENT PRIVACY POLICY OFFICE, FERPA & VIRTUAL LEARNING DURING COVID-19 (Mar.
2020) [hereinafter FERPA & VIRTUAL LEARNING],
Congressional Research Service
7

link to page 10 link to page 11 link to page 11 link to page 4 The Family Educational Rights and Privacy Act (FERPA): Legal Issues

third parties. These tools can include programs that students or their parents access through the
internet to participate in a school activity. The use of such tools has expanded with the increase in
at-home learning due to the COVID-19 pandemic.58
Schools may disclose education records to third-party providers under the school official
exception as long as the requirements discussed above are met.59 ED has noted that the “direct
control” requirement above can be met through a contract signed by the school and online
software provider; in some cases, the “Terms of Service” may satisfy this obligation as wel .60 As
mentioned above, providers that receive education records under the school official exception
may only use those records for the specific purpose for which they were disclosed.61 In other
words, providers may only use those education records to perform the outsourced function
assigned by the school. This requirement general y precludes providers from sel ing such
information to another party or reusing it for another purpose.62
Under FERPA’s regulations, however, providers may disclose without consent records that are
properly “de-identified,” or stripped of al PII.63 According to guidance from ED, this includes
metadata that the provider collects through its software.64 For instance, providers might collect
information about how long it takes students to perform a discrete task.65 As long as such
information is stripped of PII, providers may disclose that information without consent.66
Law Enforcement
If a school has outsourced the duties of providing safety and security to law enforcement unit
(LEU) officials, such as school resource officers, it may consider them to be “school officials”
when certain requirements are met.67 As noted above, records created and maintained by an LEU

https://studentprivacy.ed.gov/sites/default/files/resource_document/file/FERPAandVirtualLearning.pdf .
58 Lisa Ward, Data Privacy in the Age of Online Learning, WALL ST. J. (Dec. 8, 2020),
https://www.wsj.com/articles/data-privacy-in-the-age-of-online-learning-11607457738.
59 See FERPA & VIRTUAL LEARNING, supra note 57. Of course, particular states may have their own privacy laws that
restrict when information may be disclosed. See, e.g., Conn. Gen. Stat. Ann. §§ 10-234aa—10-234dd. See Connecticut
Executive Order 2020-7I (authorizing the Commissioner of Education to waive student data privacy requirements “ in
order to provide quality online educational opportunities” during the COVID-19 pandemic), available at
https://portal.ct.gov/-/media/Office-of-the-Governor/Executive-Orders/Lamont -Executive-Orders/Executive-Order-No-
7I.pdf.
60 DEP’T OF EDUCATION, PRIVACY TECHNICAL ASSISTANCE CENTER, PROTECTING STUDENT PRIVACY WHILE USING
ONLINE EDUCATIONAL SERVICES: REQUIREMENTS AND BEST PRACTICES at 4 (Feb. 2014) [hereinafter PROTECTING
STUDENT PRIVACY], https://tech.ed.gov/wp-content/uploads/2014/09/Student -Privacy-and-Online-Educational-
Services-February-2014.pdf.
61 34 C.F.R. § 99.31(a)(1)(i).
62 PROTECTING STUDENT PRIVACY, supra note 60, at 5.
63 34 C.F.R. § 99.31(b)(1). T he regulations provide that such de-identified information may be disclosed “provided that
the educational agency or institution or other party has made a reasonable determination tha t a student’s identity is not
personally identifiable, whether through single or multiple releases, and taking into account other reasonably available
information.” Id.
64 PROTECTING STUDENT PRIVACY, supra note 60, at 2-3.
65 Id. at 5.
66 Id. at 5.
67 See LAW ENFORCEMENT UNITS, supra note 3, at 11. According to ED, an LEU official who is a school or school
district employee “ generally would be considered a school official to whom the school or district may disclose, without
consent, education records (or PII contained in those records), if the law enforcement unit official meets the criteria
specified in the school or district’s annual notification of FERPA rights to parents and eligible students for being a
‘school official’ with a ‘legitimate educational interest’ in the education records.” Id. See 34 C.F.R. § 99.7(a)(3)(iii).
Congressional Research Service
8

link to page 4 link to page 10 link to page 4 The Family Educational Rights and Privacy Act (FERPA): Legal Issues

for law enforcement purposes are not education records under FERPA.68 This means that if a
school’s LEU independently generates records on a student for law enforcement purposes, it wil
not violate FERPA if it discloses that information without consent. However, a school may not
disclose a student’s education records to its LEU without consent unless one of FERPA’s
exceptions is met.69
When schools outsource the function of providing safety and security on campus to LEU
officials, they may sometimes disclose education records without consent to those LEU officials
under the school official exception.70 In order to do so, the school resource officer or LEU official
must meet the four requirements laid out in FERPA’s regulations mentioned above.71 That means
(1) the school must determine that they have a legitimate educational interest in the records; and
the LEU official must (2) perform an institutional service or function for the school; (3) maintain
the records under the direct control of the school; and (4) follow FERPA’s use and re-disclosure
requirements.72
LEU officials to whom a school has outsourced the function of providing safety and security on
campus can satisfy requirement (2) because ensuring school safety constitutes an “institutional
service or function.”73 And as mentioned above, a school can satisfy the “legitimate educational
interest,” requirement (1), if an LEU official needs to review the information to fulfil his job
responsibilities.74 For instance, a school might disclose to its LEU the disciplinary record of a
student who is barred from campus.75
Often, a school wil enter a memorandum of understanding with its LEU that establishes data
protection and use requirements in order to satisfy requirement (3).76 Application of requirement
(4), FERPA’s use and re-disclosure requirements, means that LEUs may only use education
records for the purpose for which the disclosure was made, such as ensuring school safety.77 In
addition, LEUs may not re-disclose covered education records to outside parties, such as a police
department, unless one of FERPA’s exceptions is satisfied.78
Threat Assessment Teams
Schools may also use the school official exception to disclose education records to threat
assessment teams. According to guidance documents issued by ED, a threat assessment team may
“review incidents of threatening behavior by students (current and former), parents, school
employees, or other individuals,” and based on their expertise provide guidance to a school on
how to respond to a potential threat.79 It appears that such teams can assist schools to determine

68 20 U.S.C. § 1232g(a)(4)(B)(ii).
69 Id. § 1232g(b)(1).
70 See LAW ENFORCEMENT UNITS, supra note 3, at 11.
71 See supra note 54.
72 34 C.F.R. § 99.31(a)(1)(i).
73 LAW ENFORCEMENT UNITS, supra note 3, at 12.
74 Id. at 11.
75 Id. at 15.
76 Id. at 12.
77 Id.
78 Id.
79 Id.
Congressional Research Service
9

link to page 13 link to page 4 link to page 4 link to page 4 link to page 13 The Family Educational Rights and Privacy Act (FERPA): Legal Issues

whether student records should be disclosed under the health or safety emergency exception.80
The members of a threat assessment team can include individuals not employed by a school, such
as medical and mental health professionals, as wel as law enforcement officers.81
Members of threat assessment teams are subject to the limitations that apply to al school
officials. Consequently, the members may only use education records for the purposes for which
they were disclosed, and they may not re-disclose the records absent a FERPA exception.82 ED
guidance documents specifical y give an example: if a representative from a police department
serves on a threat assessment team, he or she may not disclose PII from education records
accessed as a member of the team to their police department (absent an applicable FERPA
exception).83
Health and Safety Emergency Exception
FERPA also provides that student records may be released in emergency situations if necessary to
protect the health and safety of students.84 The statute’s regulations spel out in detail how this
exception operates.85 Schools “may take the totality of the circumstances” in determining if an
emergency exists.86 If a school determines that there is an “articulable and significant threat” to
the health or safety of a student or other person, it may disclose an education record to any person
whose knowledge of that information is necessary to protect health and safety.87 As long as a
school has a rational basis for this decision, ED wil not “substitute its judgment” for that of the
school.88
According to ED, examples of a significant and articulable emergency include an impending
natural disaster, terrorist attacks, campus threats, or the outbreak of an epidemic disease.89 For
instance, during the COVID-19 pandemic, ED issued guidance explaining that the health and
safety emergency exception wil sometimes authorize disclosure without consent of PII from
education records to appropriate public health officials to protect public safety.90 State and local
law enforcement officials, public health officials, medical personnel, and parents might need to

80 Id. See supra “Health and Safety Emergency Exception.”
81 LAW ENFORCEMENT UNITS, supra note 3, at 13.
82 34 C.F.R. § 99.33.
83 LAW ENFORCEMENT UNITS, supra note 3, at 14.
84 20 U.S.C. § 1232g(b)(1)(I). Doe v. Woodford Cty. Bd. of Educ., 213 F.3d 921, 927 (6th Cir. 2000) (“For these
reasons, we find there was no violation of John Doe's rights under the Act. Any disclosure is protected by the [school
official and health and safety] exceptions under the Act.”).
85 34 C.F.R. §§ 99.31(a)(10), 99.36.
86 Id. § 99.36(c).
87 Id.
88 Id. See DEP’T OF EDUCATION, ADDRESSING EMERGENCIES ON CAMPUS 4 (June 2011) [hereinafter EMERGENCY
GUIDANCE] (“ This is a flexible standard under which the Department defers to school administrators so that they may
bring appropriate resources to bear on the situation, provided that there is a rational basis for the educational agency’s
or institution’s decisions about the nature of the emergency and the appropriate par ties to whom the information should
be disclosed.”), https://studentprivacy.ed.gov/sites/default/files/resource_document/file/emergency -guidance.pdf.
89 See LAW ENFORCEMENT UNITS, supra note 3, at 17; EMERGENCY GUIDANCE, supra note 88, at 3.
90 DEP’T OF EDUCATION, STUDENT PRIVACY POLICY OFFICE, FERPA & CORONAVIRUS DISEASE 2019 (COVID-19),
FREQUENTLY ASKED QUESTIONS (FAQs) (Mar. 2020),
https://studentprivacy.ed.gov/sites/default/files/resource_document/file/FERPA%20and%20Coronavirus%20Fre quentl
y%20Asked%20Questions_0.pdf. See also CRS Report R46542, Digital Contact Tracing and Data Protection Law, by
Jonathan M. Gaffney, Eric N. Holmes, and Chris D. Linebaugh .
Congressional Research Service
10

link to page 13 link to page 13 The Family Educational Rights and Privacy Act (FERPA): Legal Issues

receive records to protect the health and safety of students and others.91 Any time that a school
discloses a student’s PII from education records under the emergency exception, it must record
the threat and the parties to whom records were disclosed.92
According to guidance from ED, FERPA does not prohibit a school official from disclosing
information obtained not through a record but from personal knowledge or observation.93 For
instance, if a teacher overhears a student make a threat, FERPA does not prohibit that information
from being disclosed.94 Consequently, the teacher could disclose what he or she overheard to
appropriate authorities.95
Studies and Audits Exceptions
FERPA also al ows disclosing education records for the purpose of certain studies,96 as wel as for
audits and evaluations.97 The studies exception al ows schools to disclose records to organizations
conducting studies in order to (1) develop, administer, or validate predictive tests; (2) administer
student aid programs; or (3) improve instruction.98 For instance, a school might disclose
education records to an organization that compares student outcomes across different school
districts.99 Disclosures under the studies exception are permitted only if the study does not
authorize the personal identification of students or parents other than to members of the
organization with legitimate interests in the information.100 In addition, when no longer needed
for the study, the information must be destroyed.101 Final y, in order to disclose education records
to an organization under the studies exception, schools must enter into written agreements with
the organization that specify the scope of the study and limit the use of PII in various ways.102
The audit and evaluation exception permits schools to release education records without consent
to authorized representatives of state and local educational authorities.103 Information under the

91 EMERGENCY GUIDANCE, supra note 88, at 3.
92 34 C.F.R. § 99.32(a)(5).
93 EMERGENCY GUIDANCE, supra note 88, at 4.
94 Id. According to ED, “this general rule does not apply where a school official personally learns of information about
a student through his or her official role in making a determination about the student and the determination is
maintained in an education record.” Id.
95 Id.
96 20 U.S.C. § 1232g(b)(1)(F); 34 C.F.R. § 99.31(a)(6).
97 20 U.S.C. § 1232g(b)(1)(C), (b)(3), (b)(5); 34 C.F.R. §§ 99.31(a)(3), 99.35.
98 20 U.S.C. § 1232g(b)(1)(F); 34 C.F.R. § 99.31(a)(6)(i).
99 DEP’T OF EDUCATION, PRIVACY TECHNICAL ASSISTANCE CENTER, GUIDANCE FOR REASONABLE METHODS AND
WRITTEN AGREEMENTS 1-2 (June 2015),
https://studentprivacy.ed.gov/sites/default/files/resource_document/file/Guidance_for_Reasonable_Methods%20final_0
.pdf.
100 34 C.F.R. § 99.31(a)(6)(iii)(A).
101 Id. § 99.31(a)(6)(iii)(B).
102 Id. § 99.31(a)(6)(iii)(C). In particular, the regulations provide that schools enter into a written agreement that “ (1)
Specifies the purpose, scope, and duration of the study or studies and the information to be disclosed; (2) Requires the
organization to use personally identifiable information from education r ecords only to meet the purpose or purposes of
the study as stated in the written agreement; (3) Requires the organization to conduct the study in a manner that does
not permit personal identification of parents and students, as defined in this part, by an yone other than representatives
of the organization with legitimate interests; and (4) Requires the organization to destroy all personally identifiable
information when the information is no longer needed for the purposes for which the study was conducted and specifies
the time period in which the information must be destroyed.”
103 20 U.S.C. § 1232g(b)(1)(C), (b)(3), (b)(5); 34 C.F.R. §§ 99.31(a)(3), 99.35. Disclosure under this exception may
Congressional Research Service
11

The Family Educational Rights and Privacy Act (FERPA): Legal Issues

exception must be used to audit or evaluate a federal or state-supported education program or to
enforce or ensure compliance with federal legal requirements connected to those programs.104 As
with the studies exception, schools must enter into written agreements with recipients of the
information that specify how the information wil be used and when it wil be destroyed.105
Further, written agreements must establish policies and procedures that protect information from
further disclosure.106
State Law Juvenile Justice System Exception
FERPA also authorizes disclosing education records to a state or local juvenile justice system
without consent in certain situations.107 If a state has adopted a statute after November 19, 1974,
that specifical y al ows disclosure of student education records to state and local officials, then
disclosure without consent is al owed if the disclosure concerns the juvenile justice system’s
“ability to effectively serve, prior to adjudication, the student whose records are released.”108
Officials to whom this information is disclosed must certify in writing that they wil not re-
disclose the information except as provided under state law or with consent.109 Guidance from
ED, in coordination with the Department of Justice (DOJ), indicates that disclosure under this
exception is limited to a local or state juvenile justice system agency.110 For instance, in situations
where the above conditions are met, if a student is arrested for a crime for the first time, a police
department’s juvenile division can receive education records from a school about the student in
order to serve the student effectively prior to adjudication.111
The juvenile justice system exception appears to authorize some disclosures of education records
by a school district to a local juvenile justice agency, although the outer bounds of when a
disclosure concerns the juvenile justice system’s ability to serve a student effectively are
uncertain. Because the statute imposes this requirement for “the student whose records are
released,” disclosure under this exception may require a specific finding of need for a particular
student. This reading of the statute seems consistent with ED and DOJ guidance describing how
the exception operates.112
Victims of Crimes at Postsecondary Institutions
Postsecondary institutions may disclose certain disciplinary records of an al eged perpetrator of a
crime of violence or a nonforcible sex offense.113 First, institutions may disclose to the alleged

also be made to the Comptroller General of the United States, the Attorney General, and the Secretary of Education. 20
U.S.C. § 1232g(b)(1)(C); 34 C.F.R. § 99.31(a)(3).
104 20 U.S.C. § 1232g(b)(3), (b)(5); 34 C.F.R. § 99.35.
105 34 C.F.R. § 99.35(a)(3).
106 Id. § 99.35(a)(3)(v).
107 20 U.S.C. § 1232g(b)(1)(E).
108 Id. § 1232g(b)(1)(E)(ii); 34 C.F.R. § 99.38. T he statute has a similar provision for state laws passed before that date.
20 U.S.C. § 1232g(b)(1)(E)(i).
109 20 U.S.C. § 1232g(b)(1)(E)(ii).
110 See DEP’T OF EDUC., SHARING INFORMATION: A GUIDE TO THE FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT AND
PARTICIP ATION IN JUVENILE JUSTICE PROGRAMS 8 (1997).
111 Id. at 8.
112 Id. at 8-9.
113 20 U.S.C. § 1232g(b)(6). Regulations implementing FERPA provide definitions and examples of these terms. 34
C.F.R. § Appendix A to Part 99.
Congressional Research Service
12

The Family Educational Rights and Privacy Act (FERPA): Legal Issues

victim of such a crime the final results of disciplinary proceedings that are conducted against the
al eged perpetrator of the crime.114 Second, if an institution determines through a disciplinary
proceeding that a student violated its rules or policies with respect to a crime of violence or
nonforcible sex offense, then it may disclose the final results of that proceeding to anyone.115 The
final results are limited to the name of the student, the violation committed, and any sanction the
institution imposes.116 The names of other students, however, such as other victims or witnesses,
may only be disclosed with their consent.117
Importantly, while FERPA authorizes postsecondary institutions to disclose the results of
disciplinary proceedings to the al eged victim of a crime of violence or a nonforcible sex offense,
a statutory provision outside of FERPA, contained in the Higher Education Act (HEA), requires
institutions of higher education to do so in certain circumstances.118 As a condition of receiving
funds under Title IV of the HEA, institutions of higher education must enter a Program
Participation Agreement that requires them to, upon written request, disclose to the al eged victim
of a crime of violence or a nonforcible sex offense the report on the results of a disciplinary
proceeding against the student who is the al eged perpetrator of that offense.119
FERPA Enforcement
As explained above, FERPA prohibits federal funding of schools that have a policy of denying
parents the right to review the education records of their children, as wel as schools that have a
policy or practice of disclosing student education records to unauthorized entities.120 The
enforcement of FERPA’s provisions is statutorily entrusted with the Secretary of Education, who
is responsible for designating an office and review board for investigating and reviewing
complaints of violations.121 The Student Privacy Policy Office in ED reviews and investigates
complaints and violations of FERPA.122 Following an investigation, it wil provide any
complainant as wel as the school written notice of its findings.123 In cases where ED finds that a
school has not complied with FERPA and that failure was based on a school’s policy or practice,
the notice to the school wil include the specific steps needed to comply with FERPA, and provide
a reasonable time to comply.124 If the school does not comply within the time given, the Secretary
can enforce FERPA in a variety of ways, including by withholding further payments under any
educational program, issuing a complaint to compel compliance through a cease and desist order,

114 20 U.S.C. § 1232g(b)(6)(A).
115 Id. § 1232g(b)(6)(B).
116 Id. § 1232g(b)(6)(C).
117 Id. § 1232g(b)(6)(C)(ii).
118 Id. § 1094(a)(26).
119 Id. § 1094(a)(26).
120 20 U.S.C. § 1232g(a)(1); (b)(1).
121 Id. § 1232g(f); (g).
122 FERPA regulations refer to the Office of the Chief Privacy Officer. 34 C.F.R. § 99.60. T he ED website indicates
that the Student Privacy Policy Office is led by the Chief Privacy Officer. DEP ’T OF EDUCATION, STUDENT PRIVACY
POLICY OFFICE, https://www2.ed.gov/about/offices/list/opepd/sppo/index.html.
123 34 C.F.R. § 99.66(b).
124 Id. § 99.66(c).
Congressional Research Service
13

The Family Educational Rights and Privacy Act (FERPA): Legal Issues

or terminating eligibility to receive funding under any educational program.125 Another option is
for the DOJ to bring a lawsuit on behalf of the United States against a noncompliant school.126
Aside from the possibility of a lawsuit brought by the DOJ, the administrative scheme
implemented by ED is the primary enforcement mechanism for FERPA. Whereas some other
federal requirements for schools, such as Title IX of the Education Amendments of 1972,127 are
enforceable through a private right of action brought in federal court directly against a school for
violations, FERPA does not create such a private right of action for students or parents. Courts
have recognized that the statute itself does not explicitly establish a private right of action to sue
for violations.128 And in the 2002 case of Gonzaga University v. Doe, the Supreme Court ruled
that FERPA also does not create any personal rights enforceable under 42 U.S.C. § 1983 (which
provides a remedy for violations of federal y conferred rights against state officials).129 According
to the Court, because Congress did not clearly and unambiguously establish an enforceable right
in the statute, FERPA could not be enforced via a suit under § 1983.130
How Does FERPA Interact With Other Legal
Requirements?
Military Recruiters
While FERPA general y prohibits schools from disclosing student education records without
consent unless an exception applies, two other statutes require schools to disclose certain student
information to military recruiters. The Elementary and Secondary Education Act (ESEA) imposes
certain requirements on local educational agencies that receive federal funds under its
provisions.131 Those schools must disclose the name, address, and telephone listing of secondary
school students upon request to a military recruiter.132 Parents may opt out of this disclosure for
their children, and schools must notify parents of this option.133 Another statute general y directed
at the Department of Defense imposes similar requirements,134 but defines covered schools
somewhat differently.135

125 Id. § 99.67(a). See 34 C.F.R. § 99.60(c) (designating the Office of Administrative Law Judges as the Review Board
authorized to enforce the Act).
126 See e.g., United States v. Miami Univ., 294 F.3d 797, 812 (6th Cir. 2002) (affirming a district court decision that
granted an injunction brought by the United States against a university from releasing records in violation of FERPA).
127 20 U.S.C. § 1681. See Cannon v. Univ. of Chicago, 441 U.S. 677, 717 (1979).
128 Girardier v. Webster Coll., 563 F.2d 1267, 1276 (8th Cir. 1977); Gonzaga Univ. v. Doe, 536 U.S. 273, 276 (2002)
(noting that the lower court “acknowledged that ‘FERPA itself does not give rise to a private cause of action’”).
129 Gonzaga Univ. v. Doe, 536 U.S. 273, 276 (2002).
130 Id. at 290.
131 Elementary and Secondary Education Act of 1965, Pub. L. No. 89-10, 79 Stat. 27, codified as amended at 20 U.S.C.
§ 6301 et seq. T he Every Student Succeeds Act reauthorized the ESEA. See Pub. L. No. 114-95, 129 Stat. 1802 (2015).
132 20 U.S.C. § 7908(a)(1).
133 Id. § 7908(a)(2). When a student turns 18, the consent required of parents transfers to the student. Id. § 7908(a)(5).
134 10 U.S.C. § 503(c)(1).
135 Id. § 503(c)(6). T he DOD-specific statute also applies to local educational agencies that receive assistance under the
ESEA, but defines local educational agencies as (1) local educational agencies within the meaning of the term under
the ESEA and (2) private secondary schools. Id. § 503(c)(6). By contrast, the ESEA defines local educational agencies
as primarily “public” entities. 20 U.S.C. § 7801(30)(A).
Congressional Research Service
14

link to page 18 The Family Educational Rights and Privacy Act (FERPA): Legal Issues

Title IX of the Education Amendments of 1972
In addition to complying with FERPA’s requirements concerning disclosure of student records,
schools that receive federal financial assistance must also abide by the requirements of Title IX of
the Education Amendments of 1972.136 That statute general y prohibits schools from
discriminating on the basis of sex.137 In May 2020, ED issued regulations under Title IX that
prescribe how schools must respond to al egations of sexual harassment at school.138 Those
regulations require that, during a grievance process in response to a formal complaint of
harassment, schools must provide both parties the opportunity to review any evidence obtained
through an investigation related to the al egations.139 They also require schools to al ow parties to
have an advisor present during any proceeding of the grievance process.140 Schools must create an
investigative report that is sent to each party and their advisor,141 and issue written determinations
of responsibility that include various findings that are disclosed to the parties.142
Schools that receive federal financial assistance general y must comply both with FERPA and
these Title IX requirements. Although FERPA does not have an express “exception” for
disclosures in Title IX sexual harassment proceedings, these requirements may nonetheless be
reconcilable. According to ED, the requirements of FERPA and the Title IX regulations do not
contradict each other.143 But in cases in which a direct conflict arises, ED asserts, Title IX’s
requirements override FERPA.144 For support, ED points to the larger General Education
Provisions Act (GEPA)—of which FERPA is a part—which provides that nothing in its

136 20 U.S.C. § 1681.
137 Id. § 1681. While ED’s Student Privacy Office enforces FERPA, T itle IX’s requirements for educational programs
receiving federal financial assistance from ED are enforced by the Office for Civil Rights. See DEP ’T OF EDUCATION,
ABOUT OCR (last accessed Feb. 24, 2021), https://www2.ed.gov/about/offices/list/ocr/aboutocr.html.
138 Nondiscrimination On the Basis of Sex in Education Programs or Activities Receiving Federal Financial Assistance,
85 Fed. Reg. 30026 (May 19, 2020) (codified at 34 C.F.R. Part 106) [hereinafter Nondiscrimination]. T hese provisions
are similar to those included in regulations implementing the Clery Act. 34 C.F.R. § 668.46(k). T he Clery Act
provisions apply to institutions of higher education who participate in T itle IV of the Higher Education Act’s student
financial assistance programs. CRS In Focus IF11277, The Clery Act: Requirem ents and Legal Issues, by Jared P. Cole.
T he procedural requirements for disciplinary actions cover cases of alleged dating violence, domestic violence, sexual
assault, and stalking. 34 C.F.R. § 668.46(k). T he Clery Act regulations also provide that compliance with those
requirements does not violate FERPA. Id. § 668.46(l).
139 34 C.F.R. § 106.45(b)(5)(vi).
140 Id. § 106.45(b)(5)(iv).
141Id. § 106.45(b)(5)(vii).
142 Id. § 106.45(b)(7). T he Biden Administration issued an executive order directing ED to review these regulations for
consistency with T itle IX and the Administration’s position that the statute’s bar against sex discrimination includes
sexual orientation and gender identity. Exec. Order 14021, 86 Fed. Reg. 13,803 (Mar. 11, 2021). ED’s Office of Civil
Rights (OCR) has since announced that it is conducting a review of existing regulations, including amendments to the
regulations made in 2020, in light of the executive order. OCR also indicated that after a period of review and hearing
from the public, it anticipates issuing a notice of proposed rulemaking to amend the T itle IX regulations. Suzanne B.
Goldberg, Acting Assistant Secretary for Civil Rights, Letter to Students, Educators, and other Stakeholders re
Executive Order 14021 (Apr. 6, 2021),
https://www2.ed.gov/about/offices/list/ocr/correspondence/stakeholders/20210406 -titleix-eo-14021.pdf.
143 Nondiscrimination, supra note 138, at 30426, 30428 (“The Department disagrees that § 106.45(b)(5)(v) [of Title IX-
implementing regulations] inherently or directly conflicts with FERPA. A recipient should interpret Title IX and
FERPA in a manner to avoid any conflicts.”).
144 Id.at 30426 (“To the extent that there may be unusual circumstances, where a true conflict between T itle IX and
FERPA may exist (such as a student’s formal complaint against an employee), the Department includes a provision in §
106.6(e) to expressly state that the obligation to comply with these final regulations under T itle IX is not obviated or
alleviated by the FERPA statute or regulations.”).
Congressional Research Service
15

link to page 18 link to page 18 link to page 18 link to page 16 link to page 18 The Family Educational Rights and Privacy Act (FERPA): Legal Issues

provisions “shal be construed to affect the applicability of” Title IX.145 And the Title IX
regulations themselves provide that a recipient’s obligation to comply with Title IX’s
requirements “is not obviated or al eviated by the FERPA.”146
Further, ED asserts that these Title IX regulations help protect a party’s right to procedural due
process under the Constitution.147 In certain student disciplinary cases involving public schools,
the Constitution requires that parties be given adequate notice of the charges against them and a
meaningful opportunity to respond.148 ED is precluded from enforcing Title IX or FERPA in a
manner that deprives students of their constitutional rights.149 According to this line of reasoning,
FERPA cannot prohibit a school from disclosing to an accused student the evidence collected
against him or her in a disciplinary proceeding because that would violate due process.150
In addition, ED points to the FERPA requirement that parents (or eligible students) have access to
their own education records.151 FERPA’s definition of education records includes records that
“contain information directly related to a student.”152 ED notes that the evidence and investigative
report disclosed pursuant to Title IX regulations directly relates to the al egations in a complaint,
and therefore “directly relate” to the students at issue.153
Moreover, as a practical matter, even if compliance with certain Title IX requirements might
appear to conflict with FERPA’s provisions in a particular situation, schools that comply with
Title IX regulations by disclosing evidence to parties in a disciplinary proceeding are unlikely to
face legal repercussions. As noted above, FERPA does not create a private right of action,
meaning that ED conducts most enforcement of the statute.154 But here, ED has explicitly
acknowledged that, as it administers both FERPA and Title IX, it wil “not interpret compliance
with its regulations under Title IX to violate requirements in its regulations under FERPA.”155
Conclusion
Although FERPA’s prohibition on disclosing student records without consent is framed broadly,
the various exceptions to that mandate have provided schools flexibility to respond to situations
in which certain information merits release. As discussed above, schools may disclose materials
in order to ensure school safety, to participate in certain studies aimed at improving education
outcomes, and to adapt to changes in how education is general y offered, including through
developments in technology.

145 20 U.S.C. § 1221(d).
146 34 C.F.R. § 106.6(e).
147 Nondiscrimination, supra note 138, at 30421.
148 See Doe v. Purdue Univ., 928 F.3d 652, 656 (7th Cir. 2019) (Barrett, J.); Doe v. Miami Univ., 882 F.3d 579, 603
(6th Cir. 2018).
149 Nondiscrimination, supra note 138, at 30422.
150 While due process requirements generally apply to public entities, such as a state school, ED h as applied its
reasoning to recipient private schools as well. Id. at 30421-22.
151 Id. at 30433. See 20 U.S.C. § 1232g(a)(1).
152 20 U.S.C. § 1232g(a)(4)(B).
153 Nondiscrimination, supra note 138, at 30433.
154 See supra “FERPA Enforcement .”
155 Nondiscrimination, supra note 138, at 30433.
Congressional Research Service
16

The Family Educational Rights and Privacy Act (FERPA): Legal Issues

Some have expressed larger concerns with the handling of student records.156 The maintenance
and use of student records by third parties authorized to receive them for a particular purpose, for
instance, can generate controversy.157 If lawmakers believe these concerns are warranted, they can
address them through legislation that amends FERPA to define schools’ and other parties’
obligations more specifical y. Further, because the statute lacks a private right of action for
students or parents to bring suit in response to FERPA violations, Congress could consider adding
such a right to the statute. Final y, Congress could also amend the law to clarify the relationship
between FERPA and a school’s obligations under Title IX.

Author Information

Jared P. Cole

Legislative Attorney

Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan
shared staff to congressional committees and Members of Congress. It operates solely at the behest of and
under the direction of Congress. Information in a CRS Report should n ot be relied upon for purposes other
than public understanding of information that has been provided by CRS to Members of Congress in
connection with CRS’s institutional role. CRS Reports, as a work of the United States Government, are not
subject to copyright protection in the United States. Any CRS Report may be reproduced and distributed in
its entirety without permission from CRS. However, as a CRS Report may include copyrighted images or
material from a third party, you may need to obtain the permission of the copyright holder if you wish to
copy or otherwise use copyrighted material.

156 See, e.g., Kathleen McGrory & Natalie Weber, Feds Investigating Pasco Schools Giving Student Data to Sheriff,
T AMP A BAY T IMES (Apr. 19, 2021) (observing that ED “ has opened an investigation into whether the Pasco school
district broke federal law by sharing private student information with the Pasco Sheriff’s office”),
https://www.tampabay.com/investigations/2021/04/19/feds-investigating-pasco-schools-giving-student-data-to-sheriff/.
157 See, e.g., Lisa Ward, Data Privacy in the Age of Online Learning, WALL ST. J. (Dec. 8, 2020) (“ Schools are relying
heavily on technology—from videoconferencing programs to digital-teaching tools and temperature-taking apps—to
educate children safely in the age of Covid. But this rapid deployment of new technology means schools are collecting
a lot more personal data on students. And that is raising some troubling questions about who has access to the data,
how it is being used and whether it is being kept safe.”), https://www.wsj.com/articles/data-privacy-in-the-age-of-
online-learning-11607457738.
Congressional Research Service
R46799 · VERSION 1 · NEW
17