FERPA Workshop

Melissa McGinnisJanuary 2009

Profundities

“If you had to identify, in one word, the reason why the human race has not achieved, and never will achieve, its full potential, that word would be “meetings”.

“Remember that a lone amateur built the Ark. A large group of professionals built the Titanic.”

“The one thing that unites all human beings, regardless of age, gender, religion, economic status, or ethnic background, is that, deep down inside, we ALL believe that we are above average drivers.”

“If you woke up breathing, congratulations! You have another chance!” -Complements of Dave McIntire, Professor, Azusa Pacific University

May 24, 2007

Disclaimer

This information has not been reviewed by, approved by, or endorsed by the Office of General Counsel at Princeton University, or by any other member of the senior administration at Princeton or the Woodrow Wilson School.

Information specific to Princeton comes from Rights, Rules, Responsibilities, and two limited release memos distributed on September 19, 2008 and December 19, 2008, unless otherwise noted.

What is FERPA?

What is FERPA?

The Family Educational Rights and Privacy Act of 1974 (FERPA) was designed to protect the privacy of educational records, affords students certain rights concerning their education records, and to provide guidelines for the correction of inaccurate and misleading data. The law is also known as the Buckley Amendment after its principal senatorial sponsor.

Why does compliance with FERPA matter? It is the law It protects the privacy of our students It protects the University

What about non-compliance? Congress/FERPA has no power to take punitive actions against any individual but it

does have the right to remove federal funds to colleges and universities with proven FERPA violations.

What are Education Records?

Education records include files, documents, and other materials that contain information directly related to a student and are maintained by the University, whether in the Graduate School or in the department.

(records can be in any medium, including handwritten, paper, e-mail, electronic, video, or audio, etc.)

*According to Princeton University policy, these personally identifiable “academic files” must be handled in a secure,

confidential, and consistent manner, one that is governed largely by FERPA. For the purposes of University policy, the academic file

held in the Graduate School’s Academic Affairs Office during a student’s enrollment, and thereafter in Seeley Mudd Library, is

considered to be the student’s official file.*

What are Education Records?

Defined by FERPA, education records do NOT include the following:

1. Records and personal files made by University personnel, including administrators and faculty, which are in the sole possession of the person who made the records

2. Medical and counseling records that are used solely for treatment3. Records maintained by Public Safety for law enforcement purposes4. Employment records that relate exclusively to the individual’s capacity as an

employee (employment records relating to students who are employed as a result of their status, such as graduate assistants or student workers, are considered educational records)

5. Records containing only information concerning a person’s activities after graduation or withdrawal from the University

6. Material relating to the financial status of parents which is contained in any record maintained by the University

7. Confidential letters of recommendation placed in a student’s education record prior to January 1975

8. Confidential letters of recommendation to which a student has waived his or her right of access

Education Records Rights:

A. The right to inspect and review the student’s education records within 45 days of the day the University receives a written request for access.

B. The right to request the amendment of the student’s education records that the student believes are inaccurate or misleading.

C. The right to consent to disclosures of personally identifiable information contained in the student’s education records except to the extent that FERPA authorizes disclosures without consent.

D. The right to file a complaint with the US Department of Education concerning alleged failures of the University to comply with the requirements of FERPA.

A. How does a Princeton student request access to their education records?

According to Princeton’s Rights, Rules, Responsibilities student education records are located primarily in the offices of the Dean of the College, the Dean of Undergraduate Students, the Dean of the Graduate School, the Controller, the Registrar and the various academic departments. A student may request access to his or her education records by filing a written request with the person who is responsible for maintaining the record which the student wants to review. The request must identify the particular record(s) which the student wishes to inspect. The University official will make arrangements for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the University official to whom the request was submitted, that official shall advise the student of the correct official to whom the request should be addressed.

A. How does a Princeton student request access to their education records? Continued…

The Graduate School’s procedure is to have the student request in writing to see his or her file, after which the staff arrange a time and place for the inspection to occur. Prior to a student’s arrival, a member of the Graduate School staff reviews the file to make sure that confidential material is removed from the file (e.g. letters of recommendation to which the student has waived his or her right of inspection).

Students may take notes, request copies of documents in the file (though normally not the entire file), and place an explanatory note, letter or memo into the file. Students may not remove anything from the file.

*Departments are encouraged to create and follow similar procedures*

B. The Right to Request Amendment of Education Records

Students may ask the University to amend a record that they believe is inaccurate or misleading. They should write the University official responsible for the record, clearly identifying the part of the record they want changed and specifying why it is inaccurate or misleading.

If the University decides not to amend the record as requested by the student, the University will notify the student of the decision and advise the student of his or her right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing.

C. The Right to Consent to Disclosures of Personally Identifiable Information

FERPA contains various exceptions to the general rule that the University shall not have a practice of disclosing personally identifiable information contained in a student’s education records without seeking the prior written consent of the student.

Can you guess what some of those exceptions might be?

C. The Right to Consent to Disclosures of Personally Identifiable Information continued…

1. The University may disclose “directory information” without restriction unless the student objects in writing within 30 days after enrollment (the Dean of the Graduate School maintains the official University record of graduate students who have expressly objected to such disclosure).

1. Name2. Local address3. Local telephone number4. E-mail address5. Photo6. Student identification number*7. Dates of attendance8. Major field of study9. Degrees and awards10. Academic institution attended immediately prior to Princeton University11. Participation in officially recognized activities, organizations and athletic teams12. Weight and height of members of athletic teams

Considered available for public disclosure by FERPA, the University has decided to keep the following elements CONFIDENTIAL:

13. Date of birth 14. Place of birth

C. The Right to Consent to Disclosures of Personally Identifiable Information continued…

Under certain conditions it is permissible to release other personally identifiable information, beyond the items mentioned above as “directory information.” That is, information concerning financial aid and other financial matters, evidence of academic or non-academic disciplinary matters, details of academic progress, grades, etc. – normally held in strict confidence – may be revealed to properly qualified third parties (e.g., credentialed government investigators) when those third parties present a formal release signed by the student. When such a release is presented, a copy of it should be placed in the student’s file to indicate that the disclosure of information was properly authorized.

For more information, departments should familiarize themselves with the University Information Security Policy .

C. The Right to Consent to Disclosures of Personally Identifiable Information continued…

2. Faculty members and other officials of the University who have a legitimate educational interest in a student’s education record may be permitted to review it. A University official is a person employed by the University in an administrative, supervisory, academic or research or support staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another University official in performing his or her tasks. A University official has a legitimate educational interest if the official needs to review an educational record in order to fulfill his or her professional responsibility.

C. The Right to Consent to Disclosures of Personally Identifiable Information continued…

3. The University will disclose information to government agencies entitled to it by law (including military recruiters following the Solomon Amendment).

4. The University may disclose information to the parent(s) or guardian(s) of a student unless the student has filed a statement certifying that he or she is not financially dependent as defined by federal income tax laws.

5. After trying to notify the student involved, the University will disclose information in response to a lawfully issued subpoena.

6. The University may disclose information when necessary to determine the student’s eligibility for financial aid or to enforce the terms or conditions of financial aid which a student has received.

C. The Right to Consent to Disclosures of Personally Identifiable Information continued…

7. The University may disclose information to an organization conducting a study if the organization certifies that the study will not be conducted in a way which will permit the personal identification of the students and that personally identifying information will be destroyed when the study is complete.

8. Upon request, the University has the right to disclose education records without a student’s prior consent to officials of another institution in which a student seeks or intends to enroll. However, the University encourages its departments and offices, at the minimum, to make a reasonable attempt to advise the student of the disclosure either before or after in occurs.

C. The Right to Consent to Disclosures of Personally Identifiable Information continued…

9. The University will disclose information to a third party that has been granted permission by the student to request such information. When the student has given written permission for disclosure of information to a third party and subsequent events materially affect the accuracy of the University’s original reporting, permission for the reporting of such additional information is understood in order to make the original reporting accurate.

D. The Right to File a Complaint

Eligible students and parents of dependents who need assistance or who wish to file a complaint under FERPA

should do so to the Family Policy Compliance Office (FPCO)

Family Policy Compliance OfficeUS Department of Education

400 Maryland Ave SWWashington, DC 20202-5920

202-260-3887FERPA.Customer@ed.gov for routine questionsFERPA.Client@ed.gov for compliance training

The Game-Changer – New FERPA Regulations

The Department of Education’s Family Policy Compliance Office (FPCO) issued new regulations on December 9, 2008 (effective January 8, 2009) based on the April 2007 shootings at Virginia Tech, the US Patriot Act, the Campus Sex Crimes Prevention Act, as well as the US Supreme Court decisions in Owasso Independent School District v. Falvo, and Gonzaga University v. Doe.

Summary of Key Changes

The following slides are not part of an exhaustive list, but indicate the new regulations designated by the Office of the General Counsel as most likely to affect Princeton University. For a comprehensive summary of changes visit: http://www.ed.gov/legislation/FedRegister/finrule/2008-4/120908a.pdf.

How does this affect us in admissions?

Institution’s admissions processes are constrained by FERPA regulations on education records but with limited applicability.

Why? “FERPA regulations do not apply to the records of persons who

are not or have not been students at the institution; thus, admissions records are not covered until the applicant has been accepted and is in attendance at the institution (34 C.F.R. §§ 99.1(d), 99.3 (“student”))” (Kaplan & Lee, 2007, p. 317)

What about letters of recommendation? Confidentiality of letters of recommendation can be maintained

by seeking a “right to access” waiver during the application process.

◦Common app example ◦Grad rec example

How does this affect us in admissions?

What if a current student applies to another program within the same institutions? (e.g. MPA students applying to the Ph.D. program).

When a student from one program applies to another program at the same institution, the student is treated as an applicant rather than as a student with respect to the second programs admissions records. Those records are therefore not subject to FERPA until the student is in attendance in the second program.

Summary of Key Changes

Health and Safety Emergencies

Defining an Emergency; Disclosures: An educational agency or institution may disclose personally identifiable information from an education record to appropriate parties, including parents, in connection with an emergency if the knowledge of the information is necessary to protect the health or safety of the student or individuals. The regulations remove the language requiring strict construction of this exception and add a provision that in making a determination as to whether a disclosure is necessary, an educational agency or institution may take into account the totality of the circumstances pertaining to a threat to the safety or health of a student or other individuals. If the educational agency or institution determines that there is an articulable and significant threat to the health or safety of a student or other individuals, it may disclose information from education records to any person whose knowledge of the information is necessary to protect the health and safety of the student or other individuals. The school must record the significant threat that formed the basis for the disclosure and the parties to whom the information was disclosed. If, based on the information available at the time of the determination, there was a rational basis for the determination, the Department will not substitute its judgment for that of the educational agency or institution in evaluating the circumstances and making its determination. (34 C.F.R. § 99.36(a), (c)).

Summary of Key Changes

Directory Information

Student ID Numbers: The regulations provide that an educational agency or institution may not designate as directory information a student’s SSN or other student ID number. However, directory information may include a student’s user ID or other unique identifier used by the student to access or communicate in electronic systems, but only if the electronic identifier cannot be used in conjunction with one or more factors that authenticate the student’s identity, such as a personal identification number (PIN), password, or other factor known or possessed only by the authorized user. The identifier cannot be disclosed as directory information if it can be used by itself to authenticate identity or to gain access to education records. (§ 99.3).

Opt-Out Requests: The regulations clarify that an institution must continue to honor any valid request to opt out of directory information disclosures made while the individual was a student unless the parent or eligible student rescinds the decision to opt out of directory information disclosures. (§ 99.37(b)).

Summary of Key Changes

Directory Information

Identification of students and communications in class: The regulations provide that a student may not use their right to opt out of directory information disclosures to prevent an educational institution from disclosing or requiring a student to disclose the student’s name, identifier, or institutional email address in a class in which the student is enrolled. (§ 99.37(c)).

Prohibition on use of SSNs to identify students when disclosing or confirming directory information: The regulations prohibit an educational agency or institution (or a vendor acting for the school) from using an SSN, either alone or when combined with other data elements, to identify or help identify a student or a student’s records when disclosing or confirming directory information unless the student has provided written consent in accordance with FERPA. A school is not required to deny a request for directory information about a student if the requestor provides an SSN along with the request, but in releasing or confirming directory information, the school cannot use the student’s SSN (or other non-directory information) supplied by the requestor to identify the student or locate the student’s records without the student’s written consent. This prohibition applies even if the requestor also provides the school with other directory information in addition to an SSN, such as the student’s name or email address. While FERPA does not require that a school notify requestors that it is not confirming the student’s SSN (or other non-directory information) when it discloses or confirms directory information, the Department advises that when a party submits a student’s SSN (or other non-directory information) along with a request for directory information, that the school may indicate that it has not used the SSN (or other non-directory information) to locate the student’s records and that its response may not and does not confirm the accuracy of the SSN (or other non-directory information) supplied by the requestor. (§ 99.37(d)).

Summary of Key Changes

Regulatory Definitions

Definition of Disclosure: The regulations exclude from the definition of disclosure the release or return of an education record, or personally identifiable information from an education record, to the party as identified as the party that provided or created the record. (§ 99.3).

Definition of Education Records: The regulations clarify that, with respect to former students, the term education records excludes records that are created or received by an educational agency or institution after an individual is no longer a student in attendance and are not directly related to the individual’s attendance as a student. The regulations also clarify that the term education records excludes grades on peer-graded papers before they are collected and recorded by the instructor. (§ 99.3). (see Owasso for the latter).

Summary of Key Changes

Regulatory Definitions

Personally Identifiable Information: The regulations add biometric record to the list of personal identifiers and add other indirect identifiers, such as date and place of birth and mother's maiden name, to the list of personally identifiable information. Biometric record is defined in the regulations as a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual (e.g. fingerprints, retina and iris patterns, voiceprints, DNA sequences, facial characteristics and handwriting). The regulations remove prior language about personal characteristics and other information that would make the student's identity easily traceable and provide instead that personally identifiable information includes other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. Personally identifiable information also includes information requested by a person who the school reasonably believes knows the identity of the student to whom the record directly relates. This is known as a targeted request. (§ 99.3).

Summary of Key Changes

Regulatory Definitions

De-Identification of Information: The regulations indicate that schools may release, without consent, education records, or information from education records, after the removal of all personally identifiable information provided that the school has made a reasonable determination that a student’s identity is not personally identifiable and taking into account other reasonably available information. Accordingly, there is no “disclosure” under FERPA when education records are released if all identifiers have been removed, along with other personally identifiable information. (§ 99.31(b)).

Summary of Key Changes

Access to Education Records and/or Disclosure

Access by school officials: The regulations clarify the responsibility of an educational agency or institution to use “reasonable” methods” to ensure that access to education records by school officials is limited to circumstances in which the school official possesses a legitimate educational interest. These controls should consist of a combination of appropriate physical (e.g. locking filing cabinets), technological (e.g. role-based access controls for electronic records), and administrative controls (e.g. administrative policies) which restrict access when required. (§ 99.31(a)(1)(ii)).

Identification and authentication of identity: The regulations require an educational agency or institution to use reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom the educational agency or institution discloses personally identifiable information from education records. (§ 99.31(c)).

Summary of Key Changes

Access to Education Records and/or Disclosure

Disclosure to a school where student seeks or intends to enroll: The regulations allow an educational agency or institution to disclose education records, without consent, to another institution even after a student has already enrolled or transferred, and not just if the student seeks or intends to enroll, if the disclosure is for purposes related to the student's enrollment or transfer. An educational agency or institution may update, correct, or explain information it has disclosed to another educational agency or institution as part of the original disclosure under these provisions without consent. In the aftermath of the shooting at Virginia Tech, some questions have arisen about whether FERPA prohibits the disclosure of certain types of information from students' education records to new schools or postsecondary institutions to which they have applied. The regulations clarify that, after a student has already enrolled in a new school, the student’s former school may disclose any records or information that it could have disclosed, including health and disciplinary records, when the student was seeking or intending to enroll in the new school. The requirement that the disclosure must be related to the student’s enrollment or transfer is not intended to limit the kind of records that may be disclosed under this exception. (§ 99.31(a)(2)).

Summary of Key Changes

Access to Education Records and/or Disclosure Disclosures to organizations conducting studies: The regulations clarify

that an educational agency or institution may disclose personally identifiable information from an education record without consent to an organization conducting studies for certain limited purposes, as long as the disclosure is only made to individuals in the organization with a legitimate educational interest in the information, the information is destroyed when no longer needed for the purpose for which the study was conducted and the educational agency or institution enters into a written agreement with the organization. The written agreement must specify the purpose, scope and duration of the study and the information to be disclosed. The written agreement must also require that the organization use personally identifiable information from education records only to meet the study’s stated purpose, that the organization conduct the study in a manner that does not permit personal identification of parents and students by anyone other than representatives of the organization with a legitimate interest, and that the organization destroy or return all personally identifiable information. (§ 99.31(a)(6)).

Summary of Key Changes

Access to Education Records and/or Disclosure

Disclosures required under the Clery Act: The regulations exclude from the statutory prohibition on re-disclosure of education records information that postsecondary institutions are required to disclose under the Clery Act to the accuser and the accused regarding the outcome of any campus disciplinary proceeding brought alleging a sexual offense. (§ 99.33(c)).

Summary of Key Changes

Enforcement

Investigation without a complaint: The regulations clarify that the Department's enforcement responsibilities, as described in Gonzaga University v. Doe, 536 U.S. 273 (2002), include the authority to investigate possible FERPA violations even if no complaint has been filed or a complaint has been withdrawn. The Department may require an educational agency or institution to submit reports, information on policies and procedures, annual notifications, training materials, and other information. (§ 99.62).

Violations not only for pattern or practice: The regulations allow the FPCO to investigate and to issue a notice of findings that an educational agency or institution violated FERPA without also finding that the violation constituted a policy or practice of the agency or institution. The regulations clarify that the FPCO may issue a notice of violation or failure to comply with specific FERPA requirements, such as a single failure to provide a parent with access to education records, and require corrective action. The regulations provide that the Secretary may take any other enforcement action that is legally available, such as entering into a compliance agreement under 20 U.S.C. 1234f or seeking an injunction. (§ 99.64(b); § 99.66(c); §99.67(a)).

Recommended Guidelines

Refer requests to the correct “owner” of the education record in question (i.e. do not release information for which you are not the owner).

Keep a log of FERPA requests (i.e. not student’s own requests, requests made by school officials, or records specified as directory information).

Keep only records that are necessary for your job responsibilities. Properly dispose of education records that do not need to be maintained. Do not display student scores or grades publicly in association with names,

SS#, or any other personal identifier. Do not put papers, graded exams, etc., containing names and grades in

publicly accessible places. Do not access or request information from student education records

without legitimate educational interest and authority. Access does not mean authority!

Parents (unless the student is a legal dependant) and spouses are considered 3rd party and may not obtain non-directory information without written consent from the student.

When in doubt, don’t give it out!

Tutorial

http://www.iue.edu/registrar/FERPA_tutorial.php

References

Kaplin, William A. & Lee, Barbara A. (2007). The Law of Higher Education (4th ed; Student Version). San Francisco: Jossey-Bass.

Washington University Office of General Counsel. (n.d.) Chart on proposed regulations. Retrieved 12/22/2008, from

http://counsel.cua.edu/FERPA/fedlaw//GW.doc