D.

Compliance:
- Control Disclosure: Student has the right to control disclosure of information from their
education records. Except in specific exceptions, a student must provide a signed and
dated written consent before a school may disclose any information from their
education records. The student’s authorization can be obtained via technology if the
student has been appropriately authenticated. This consent must:
1- Specify which records may be disclosed;
2- State the purpose of the disclosure; and
3- Identify the party or class of parties to whom disclosure may be made.

o Consent forms: Generally, institutions have consent forms available for common
requests such as:
1- Parental access
2- Employment inquiries
3- Spousal Access

If no such form exists, the student or the institution should provide some sort of
document that contains the requirements for signed consent to disclose, and ensure
that the student signs and dates that document. These forms should be maintained
along with the student’s education record.

o Directory Information OPT-OUT: Directory Information is information not generally

considered to be harmful or an invasion of privacy if disclosed. It is up to the
institution to designate which items are included in the directory information policy
and to notify students that they have the right to opt-out of such disclosures. The
process by which they do so should be outlined in the directory information notice
to students. If a student has opted out from these disclosures, then there must be a
signed and dated consent from the student in order to disclose the information,
unless the disclosure meets a specific FERPA exception to signed consent.

- File a complaint: If a student believes they have been denied any of their rights under
FERPA, FERPA grants that student the right to file a complaint to the Department of
Education. Under FERPA, the student should not go to the civil or criminal court system,
but they could do so under another common law right, e.g. slander or libel.
o Student Privacy Policy Office: The SPPO is responsible for the administration and
enforcement of federal laws relating to the privacy of students’ education records,
and for the provision of technical assistance on student privacy issues for the
broader education community. SPPO’s student privacy functions are divided across
two focus areas, providing guidance and best practices, and administering federal
education privacy laws.
o Investigation: The SPPO will investigate and enforce complaints from parents and
eligible students relating to their rights under the Family Educational Rights and
Privacy Act (FERPA). The SPPO also provides technical assistance to parents and
students who feel their rights under FERPA may have been violated. If a
determination is made that a school violated FERPA, the school and the complainant
 are so advised, and the school is informed of the steps it must take to come into
compliance.
o Penalty for non-compliance: Generally, the SPPO will advise institutions of what
steps need to be taken in order to bring their practices and policies into compliance.
However, if a school remains non-compliant with FERPA, the penalty can be the
withdrawal of U.S. Department of Education funds from the institution. These funds
include Title IV Funds, from which federal financial aid originates.

- Institutional Obligations: Institutions must perform certain actions both in response to

FERPA requests and to inform students of their rights. Aside from the steps that must be
completed to satisfy the immediate requirements associated with student FERPA rights,
there are other requirements your institution must complete:
1- The Annual Notification of Student Rights under FERPA, which must be produced
annually regardless of the volume of FERPA, requests at your campus.
2- Record-keeping requirements, which are related to disclosure and access to records.

o Annual Notification of Student Rights under FERPA: Institutions must notify

students in attendance at least annually of their rights under FERPA, which include
their primary rights:
1- Right to inspect and review their education records.
2- Right to request an amendment of education records.
3- Right to consent to disclosures, with certain exceptions.
4- Right to file a complaint with the U.S. Department of Education.

The notification must also include:

1- The procedure to inspect and review records.

2- What data items the institution considers to be directory information.
3- A statement that education records may be disclosed to school officials with
legitimate educational interest without prior written consent, including:
Specification of criteria for determining who are school officials; and What
constitutes a legitimate educational interest.

o Record Keeping: With several exceptions, noted below, the institution must
maintain a record of each request for access to an education record for as long as
the record itself is maintained. This record must include the parties who have
requested or received the information legitimately, as well as any unauthorized
access such as a data breach, file theft, etc. The record must include the legitimate
interest parties had in receiving information, and proof that the student is aware of
disclosures made under one of the exceptions to signed consent. However, the
requirement to maintain a record of access does not apply if the request was from,
or the disclosure was made to:
1- The student.
2- A properly designated school official for a legitimate educational purpose (such
as the student’s instructor or advisor).
 3- A party with written consent from the student.
4- A party seeking directory information.
5- A party with a law enforcement subpoena or court order which specifies that
the existence or contents of the subpoena or court order not be disclosed.

o Third-Party Disclosure: As an aside, when disclosing information from education

records to any party that does NOT require signed consent to access that
information, the institution generally must inform the party that no further
disclosures can be made (with very few exceptions that most staff won’t have to
worry about).

- Exceptions: One of the keystones of FERPA is the student’s right to control who can
have access to their records. However, like most things in higher education, there are
exceptions. There are two kinds of rules under FERPA. The ‘Must’ rules mean that the
institution MUST comply with the letter of the law. 'May' rules allow institutions
flexibility in how they share or restrict access to information from student education
records. Many of the exceptions to signed consent fall into this ‘May’ category. Some of
these exceptions for disclosure are not required by FERPA, but ARE required either for
funding purposes or because of other laws, including state laws. These exceptions will
be discussed further in subsequent sections.

o May and Must Rules:

Must Rules: The 'Must' rules in FERPA were covered in the previous section and have to
do with the student's primary rights. As it pertains to disclosure, the 'must' rules are:

1-The student's right to inspect and review their record;

2-The student's right to seek to amend their record;
3-The student's right to limit disclosure from their record;

May Rules: There are 16 exceptions to signed consent, all listed in §99.31 of the FERPA
regulations. Exceptions are reserved for specific parties who can access specific records
for narrowly defined reasons. We will cover the key exceptions. Parties must meet all
criteria for an exception for disclosure to be proper. Each of the exceptions fall into the
May category, meaning that they permit institutions to disclose information if all of the
criteria for an exception are met, but FERPA does not require it. Note that some state or
federal laws may require or prevent the disclosure even if FERPA does not.

o Record of Access: If access is granted to education records based on certain

exceptions, such access should be noted in the student’s education record. Each rule
will clarify whether or not this record of access is required.

o Note on School Officials: Disclosures to school officials with a legitimate educational

interest do not require that a notation of the access request or disclosure be
maintained in the education record, nor do school officials need a signed consent
 form so long as the school official has a legitimate educational interest in the record.
Legitimate educational interest exists when a school official needs access to a
student’s education record to perform designated job functions.

- Important Exceptions: Each exception listed below is an exception under §99.31 of the
FERPA regulations. As such before disclosure without signed consent can be permitted
all criteria under each exception must be met.
o Accrediting Organizations: For the purposes of maintaining institutional
accreditation, agencies may require education records containing Personally
Identifiable Information (PII), and institutions are permitted to disclose them.
Any disclosure under this exception requires recordation in the student’s
education record.
o Federal, State, and local educational authorities conducting an audit,
evaluation, or enforcement of education programs: Personal Identifiable
Information (PII) from education records may be disclosed if they are used to
audit or evaluate Federal- or State-supported education programs, or to
enforce/comply with Federal legal requirements related to those education
programs. Examples include:
1- Comptroller General of the U.S.,
2- Attorney General
3- Secretary of Education.
4- State or local education authorities.
Any disclosure under this exception requires recordation in the student’s
education record.
o Alleged Victims of a Crime of Violence: During a disciplinary hearing process
concerning a violent or sex crime, the alleged victim of the crime is permitted
to receive the results of the hearing, including any personally identifiable
information (PII) that might be included. This is still a 'May' rule under FERPA
but the institution must still disclose, per the Clery Act.
o To comply with a judicial order or subpoena: If the institution receives a court
order or subpoena requiring access to education records, the institution may
disclose that information so long as the subpoena is lawfully issued. The
institution must make a reasonable effort to notify the student prior to this
disclosure, unless the subpoena or court order is for a law enforcement
purpose and specifically requires that the student not be notified.
o Disclosing information to an outside party: If a student is found in violation of
an institution’s code of conduct that relates to a crime of violence, the
institution may disclose the results of that investigation to any party, including
other students and school officials.
o Parents of a dependent student: If a student is listed as a dependent on the
parent’s or legal custodian’s most recent IRS tax return, FERPA allows for the
disclosure of their education records to the parents or guardian.
 o In connection with financial aid or scholarship fund disbursement: For the
purposes of paying for school, FERPA allows for institutions to disclose
information about the student in connection with financial aid and scholarship
fund disbursement. If the scholarship or financial aid is from an outside third-
party, it may be good practice to ask the student to provide a signed consent
for release.
o Schools to which the student seeks or intends to enroll: If a student has
applied for admission to another institution, FERPA allows for the sharing of
that student’s education records with the other institution. Most institutions
require such a student to submit a transcript request before releasing records
information to another institution. Another business reason why an institution
might not automatically share information is if there is a hold on the student’s
record. Note that California now requires release of a transcript, even if there
is a financial hold on the student’s record.
o Health and Safety Emergency: The final exception we will talk about that is
best practice to disclose for is the health and safety emergency exception. If
the institution has identified a clear and articulable threat to the student or to
others, on- or off-campus, the institution may provide that information to
appropriate parties. Appropriate parties can include anyone who may or can
help address the situation. Quickly - law enforcement, health professionals,
teacher, professors, roommates, etc.

- Other Exceptions: All of the exceptions fall into the 'May' category. The exceptions
covered previously are either generally best practice to disclose. The following
exceptions, however, provide institutions with more flexibility.
o Organizations conducting studies on behalf of educational institutions: The
institution may choose to use an outside organization to conduct a study that
will inform the development, validation, or administration of tests, instruction,
or student aid. These organizations can use personally identifiable information
(PII) as necessary in their study, but any published results or usage must have
that PII removed, and the study provider cannot keep any education records
used in the study.
o Appropriate Law Enforcement Officials: If a disciplinary hearing finds a student
in violation of the student code of conduct, the institution is permitted to
disclose the results, not the details, of the hearing to outside law enforcement
officials.
o To parents if under the age of 21 and found in violation of the institution’s
drug and alcohol policy. If the underage student violates the drug and alcohol
policy, the institution may disclose this information to the parents or legal
guardians even if the student is not listed as a dependent on the parent’s tax
returns.
o If a student is required to register as a sex offender in the state: If a student is
a registered sex offender, the institution can disclose that they are a sex
offender and may disclose information to any party that it deems appropriate.