Frequently Asked Questions

This section is designed to allow stakeholders easy access to all Frequently Asked Questions about student privacy.  All of the questions contained on this page have been tagged for easy browsing by either topic or audience.  This section is regularly updated as new questions are received.  You may also search the FAQs by using the search box on the top right of the page.

Are there any limitations as to what education records may be disclosed to a community-based organization to which a school has outsourced an institutional service under the school official exception?

Yes.

FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

It is a best practice to enter into a written agreement with the community-based organization prior to sharing any PII from education records.

Are there any limitations to sharing information based on personal knowledge or observations?

FERPA applies to the disclosure of personally identifiable information (PII) from education records that are maintained by the school.  Therefore, FERPA does not prohibit a school official from releasing information about a student that was obtained through the school official’s personal knowledge or observation unless that knowledge is obtained through his or her official role in making a determination maintained in an education records about the student. For example, under FERPA a principal or other school official who took official action to suspend a student may not disclose that information, absent consent or an exception under § 99.31 that permits the disclosure.

Are there any restrictions on how a community-based organization can use and protect the personally identifiable information (PII) from education records it receives to conduct a study?

Yes. Under the studies exception, the school or LEA may non-consensually disclose PII from education records to the community-based organization only if

  1. The study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of the organization that have legitimate interests in the information;
  2. The information is destroyed when no longer needed for the purposes for which the study was conducted; and
  3. The school or LEA enters into a written agreement with the community-based organization.

Are there limitations as to how the community-based organization may use the personally identifiable information (PII) from education records it receives from a school under the school official exception?

Yes

FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

It is a best practice to enter into a written agreement with the community-based organization prior to sharing any PII from education records.

Are there situations in which school officials may non-consensually disclose personally identifiable information from education records of students who have been disciplined for conduct that posed a significant risk to the safety of the school community?

Yes. Under FERPA, a school may share PII from education records with school officials within the school whom the school has determined to have legitimate educational interests in the behavior of a student who has been disciplined for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community. See § 99.36(b)(2) and Q&A 9 and § 99.36(b)(1) and (2). 

The school may also disclose PII from education records about a student who has been disciplined for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community, to school officials at another school who have been determined to have legitimate educational interests in the behavior of the student, if deemed necessary. 

For instance, if a school official knows that a student, who has been disciplined for bringing a gun or knife to school or threatened to hurt students and/or teachers, is planning to attend a school-sponsored activity at another high school, FERPA would allow that school official to notify school officials at the other high school who have been determined to have legitimate educational interests in the behavior of the student. See § 99.36(b)(3). 

Can a school’s law enforcement unit officials be considered schools officials with legitimate educational interests?

Yes, if certain conditions apply.   These officials may be considered “school officials” with “legitimate educational interests” and have access to students’ education records, but only if they:

  1. Perform an institutional service or function for which the agency or institution would otherwise use employees;
  2. Are under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Are subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meet the criteria specified in the school or LEA’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

Can off-duty police officers or School Resource Officers (SROs) be considered school officials under FERPA and, therefore, have access to students’ education records?

Yes, if certain conditions are met.  FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.