Frequently Asked Questions

This section is designed to allow stakeholders easy access to all Frequently Asked Questions about student privacy.  All of the questions contained on this page have been tagged for easy browsing by either topic or audience.  This section is regularly updated as new questions are received.  You may also search the FAQs by using the search box on the top right of the page.

Are educational agencies and institutions required to notify parents and eligible students of their rights under FERPA?

Yes. Educational agencies and institutions must annually notify parents and eligible students of their rights under FERPA. Specifically, schools must notify parents and eligible students of the right:  to inspect and review education records and the procedures to do so; to seek amendment of records the parent or eligible student believes are inaccurate and the procedures to so do; to consent to disclosures of education records, except to the extent that FERPA authorizes disclosure without consent; and to file a complaint with SPPO concerning potential violations. Postsecondary institutions are only required to notify eligible students of their rights under FERPA.34 CFR § 99.7

Are law enforcement records considered education records?

“Law enforcement unit records” (i.e., records created by the law enforcement unit, created for a law enforcement purpose, and maintained by the law enforcement unit) are not “education records” subject to the privacy protections of FERPA. As such, the law enforcement unit may refuse to provide a parent or eligible student with an opportunity to inspect and review law enforcement unit records, and it may disclose law enforcement unit records to third parties without the parent or eligible student’s prior written consent. However, education records, or personally identifiable information from education records, which the school shares with the law enforcement unit, do not lose their protected status as education records just because they are shared with the law enforcement unit.

Are law enforcement records protected under FERPA?

“Law enforcement unit records” (i.e., records created by a law enforcement unit at the educational agency or institution, created for a law enforcement purpose, and maintained by the law enforcement unit) are not “education records” subject to the privacy protections of FERPA. As such, the law enforcement unit may refuse to provide a parent or eligible student with an opportunity to inspect and review law enforcement unit records, and it may disclose law enforcement unit records to third parties without the parent’s or eligible student’s prior written consent.

Resources:

FERPA General Guidance for Parents

Are School Resource Officers (SROs) or other outside local law enforcement officials who serve as a school’s law enforcement unit automatically considered school officials?

No, not automatically. These officials may be considered “school officials” with “legitimate educational interests” and have access to students’ education records, but only if they:

  1. Perform an institutional service or function for which the agency or institution would otherwise use employees;
  2. Are under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Are subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meet the criteria specified in the school or LEA’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

Are schools required to record the disclosure of personally identifiable information (PII) from students’ education records whenever they make disclosures?

Subject to certain exceptions addressed below, schools must maintain a record of each request for access to, and each disclosure of PII from, the education records of each student, as well as the names of state and local educational authorities and federal officials and agencies listed in § 99.31(a)(3) that may make further disclosures of PII from students’ education records without consent. The school must maintain this record with the education records of the student as long as the education records are maintained. 

Schools do not have to record disclosures of PII from education records that were made to: 1) the parent or eligible student; 2) a school official under § 99.31(a)(1); 3) a party with written consent from the parent or eligible student; 4) a party seeking directory information; or 5) a party seeking or receiving records in accordance with the provisions in FERPA related to disclosures pursuant to certain types of subpoenas or court orders as set forth in § 99.31(a)(9)(ii)(A)-(C). See § 99.32(d).

Are there any limitations to sharing information based on personal knowledge or observations?

FERPA applies to the disclosure of personally identifiable information (PII) from education records that are maintained by the school.  Therefore, FERPA does not prohibit a school official from releasing information about a student that was obtained through the school official’s personal knowledge or observation unless that knowledge is obtained through his or her official role in making a determination maintained in an education records about the student. For example, under FERPA a principal or other school official who took official action to suspend a student may not disclose that information, absent consent or an exception under § 99.31 that permits the disclosure.

Are there situations in which school officials may non-consensually disclose personally identifiable information from education records of students who have been disciplined for conduct that posed a significant risk to the safety of the school community?

Yes. Under FERPA, a school may share PII from education records with school officials within the school whom the school has determined to have legitimate educational interests in the behavior of a student who has been disciplined for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community. See § 99.36(b)(2) and Q&A 9 and § 99.36(b)(1) and (2). 

The school may also disclose PII from education records about a student who has been disciplined for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community, to school officials at another school who have been determined to have legitimate educational interests in the behavior of the student, if deemed necessary. 

For instance, if a school official knows that a student, who has been disciplined for bringing a gun or knife to school or threatened to hurt students and/or teachers, is planning to attend a school-sponsored activity at another high school, FERPA would allow that school official to notify school officials at the other high school who have been determined to have legitimate educational interests in the behavior of the student. See § 99.36(b)(3).