Should the school or LEA contact SPPO if the community-based organization has violated FERPA?

While FERPA does not require that you notify us, we recommend that you contact SPPO if a community-based organization violates FERPA and provide us with information concerning the violation and any actions that you have taken.  SPPO has the authority to impose what is informally known as “the five-year rule ban” against the community-based organization if SPPO determines that it has violated certain provisions under FERPA.  The five-year rule means that SPPO can instruct the originating LEA or school to not provide the community-based organization with further access to PII from students’ education records for a minimum period of five years.  SPPO may impose a longer period of time in which the community-based organization may not have access to PII.  The five-year rule ban applies regardless of whether the community-based organization is a recipient of Department funds.  For more information on penalties for FERPA violations, see 34 CFR § 99.67.