Overview of FERPA for Student Data Privacy

Educational institutions need to comply with the Family Education Rights and Privacy Act (FERPA) of 1974, also called as the Buckley Amendment. FERPA is a United States federal law that protects privacy of students’ educational information and records. FERPA applies to all agencies and institutions that receive federal funds, under any program administered by the Department of Education, including elementary and secondary schools, colleges, and universities.

FERPA gives parents certain rights with respect to their children's education records at elementary and secondary schools that are subject to FERPA’s requirements.  These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are called "eligible students." The purposes of FERPA are twofold: to ensure that parents have access to their children's educational records and to protect the privacy rights of parents and children by limiting access to these records without parental consent.

FERPA deals with:

• access to educational records
• parental right to inspect and review records
• amendment of records

Rights of Parents:

Once the rights transfer to the “eligible student”, the school is not required to share the information with parents unless with following exceptions:

• Student’s signed written consent;
• Student is claimed as dependent for tax purposes;
• Health or Safety emergency of student is involved;
• Student is under 21, and has violated any law or policy concerning the use or possession of alcohol or a controlled substance;
• Upon request, parents have an opportunity to inspect and review education records, but not to receive copies, except in limited circumstances.

Disclosure to Third Party:

Schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions:

• School officials with legitimate educational interest;
• Other schools to which a student is transferring;
• Specified officials for audit or evaluation purposes;
• Appropriate parties in connection with financial aid to a student;
• Organizations conducting certain studies for or on behalf of the school;
• Accrediting organizations;
• To comply with a judicial order or lawfully issued subpoena;
• Appropriate officials in cases of health and safety emergencies;
• State and local authorities, within a juvenile justice system, pursuant to specific State law.
• "Directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance, if the parents are given general notice of the information they have designated as “directory” information, along with the right to opt, and period of time they have to opt out.

Educational institutions should conduct an annual security assessment to validate their compliance with FERPA.

By Rupal Talati.