Frequently Asked Questions

This section is designed to allow stakeholders easy access to all Frequently Asked Questions about student privacy.  All of the questions contained on this page have been tagged for easy browsing by either topic or audience.  This section is regularly updated as new questions are received.  You may also search the FAQs by using the search box on the top right of the page.

Are educational agencies and institutions required to notify parents and eligible students of their rights under FERPA?

Yes. Educational agencies and institutions must annually notify parents and eligible students of their rights under FERPA. Specifically, schools must notify parents and eligible students of the right:  to inspect and review education records and the procedures to do so; to seek amendment of records the parent or eligible student believes are inaccurate and the procedures to so do; to consent to disclosures of education records, except to the extent that FERPA authorizes disclosure without consent; and to file a complaint with FPCO concerning potential violations. Postsecondary institutions are only required to notify eligible students of their rights under FERPA.34 CFR § 99.7

Are law enforcement records considered education records?

“Law enforcement unit records” (i.e., records created by the law enforcement unit, created for a law enforcement purpose, and maintained by the law enforcement unit) are not “education records” subject to the privacy protections of FERPA. As such, the law enforcement unit may refuse to provide a parent or eligible student with an opportunity to inspect and review law enforcement unit records, and it may disclose law enforcement unit records to third parties without the parent or eligible student’s prior written consent. However, education records, or personally identifiable information from education records, which the school shares with the law enforcement unit, do not lose their protected status as education records just because they are shared with the law enforcement unit.

Are law enforcement records protected under FERPA?

“Law enforcement unit records” (i.e., records created by a law enforcement unit at the educational agency or institution, created for a law enforcement purpose, and maintained by the law enforcement unit) are not “education records” subject to the privacy protections of FERPA. As such, the law enforcement unit may refuse to provide a parent or eligible student with an opportunity to inspect and review law enforcement unit records, and it may disclose law enforcement unit records to third parties without the parent’s or eligible student’s prior written consent.

Resources:

FERPA General Guidance for Parents

Are LEAs or schools required to have written agreements with the Child Welfare Agency (CWA) or tribal organization prior to disclosing personally identifiable information (PII) from education records to the welfare agency or tribal organization?

No. The written agreement requirements in the FERPA regulations do not apply to a disclosure of PII from education records made under this exception by an LEA or school. However, LEAs and schools may want to consider a written agreement, data sharing agreement, or memorandum of understanding (MOU) with a CWA or tribal organization to ensure that the CWA or tribal organization is aware of its responsibility under FERPA to protect PII from education records from unauthorized disclosure. 

Are School Resource Officers (SROs) or other outside local law enforcement officials who serve as a school’s law enforcement unit automatically considered school officials?

No, not automatically. These officials may be considered “school officials” with “legitimate educational interests” and have access to students’ education records, but only if they:

  1. Perform an institutional service or function for which the agency or institution would otherwise use employees;
  2. Are under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Are subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meet the criteria specified in the school or LEA’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

Are schools required to record the disclosure of personally identifiable information (PII) from students’ education records whenever they make disclosures?

Subject to certain exceptions addressed below, schools must maintain a record of each request for access to, and each disclosure of PII from, the education records of each student, as well as the names of state and local educational authorities and federal officials and agencies listed in § 99.31(a)(3) that may make further disclosures of PII from students’ education records without consent. The school must maintain this record with the education records of the student as long as the education records are maintained. 

Schools do not have to record disclosures of PII from education records that were made to: 1) the parent or eligible student; 2) a school official under § 99.31(a)(1); 3) a party with written consent from the parent or eligible student; 4) a party seeking directory information; or 5) a party seeking or receiving records in accordance with the provisions in FERPA related to disclosures pursuant to certain types of subpoenas or court orders as set forth in § 99.31(a)(9)(ii)(A)-(C). See § 99.32(d).

Are SEAs required to have written agreements with the Child Welfare Agency (CWA) or tribal organization prior to redisclosing education records to the CWA or tribal organization?

No. The written agreement requirement of FERPA does not apply to disclosures of education records made under this exception to FERPA’s general consent requirement including the redisclosure of education records by an SEA. The written agreement requirement applies only in the context of other exceptions to FERPA’s general consent requirement (e.g.., the studies exception and the audit/evaluation exception). See §§ 99.31(a)(6) and 99.35(a)(3).