Frequently Asked Questions

This section is designed to allow stakeholders easy access to all Frequently Asked Questions about student privacy.  All of the questions contained on this page have been tagged for easy browsing by either topic or audience.  This section is regularly updated as new questions are received.  You may also search the FAQs by using the search box on the top right of the page.

What types of notification do local educational agencies (LEAs), i.e., school districts, have to make to parents about the Protection of Pupil Rights Amendment (PPRA)?

There are three types of notification an LEA must provide parents and students.  The first one is a general notification of their rights under PPRA. 

The second notice is a notification of specific events.  The following activities require notification:

  • Activities involving the collection, disclosure, or use of personal information collected from students for marketing purposes or for selling that information, or otherwise providing it to others for that purpose;
  • The administration of any survey containing one or more of the eight protected areas listed above: and
  • Any nonemergency, invasive physical examination or screening that is: (1) required as a condition of attendance; (2) administered by the school and scheduled by the school in advance; and (3) not necessary to protect the immediate health and safety of the student, or of other students.

The third notice is a notification of the policies LEAs are required to develop, in consultation with parents, under PPRA.  The LEA shall provide the notice at least annually, at the beginning of the school year, and within a reasonable period of time after any substantive change in the policies.

When a state educational agency (SEA) or local educational agency (LEA) discloses PII from education records to a CWA or tribal organization under the exception in FERPA, may the recipient of the data use it to evaluate their own programs?

No. The PII from education records disclosed to the CWA or tribal organization under the exception in FERPA must only be used for the purpose of addressing the education needs of children in foster care placement.  Thus, the PII from education records disclosed under the exception to FERPA may not be used for any other purpose, including to audit or evaluate a federal- or state-supported education program. 

When can law enforcement unit officials serve as “school officials”?

In order for law enforcement unit officials to be considered school officials, they must meet the criteria for who constitutes a school official that are set forth in the school’s or LEA’s annual notification to parents and eligible students of their rights under FERPA.  See § 99.7(a)(3)(iii).  This notification must be distributed by a school or LEA every year through a forum that is likely to be viewed by parents and eligible students, such as a student handbook, school website, a direct letter to parents, or a combination of methods, and must inform parents and eligible students of their rights under FERPA.  These officials may be considered “school officials” with “legitimate educational interests” and have access to students’ education records, but only if they:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

When does a parent or eligible student have a right to a hearing?

An educational agency or institution must hold a hearing within a reasonable time after it has received a request from the parent or eligible student challenging the content of the student’s education records on the grounds that the information contained in the education records is inaccurate, misleading, or in violation of the privacy rights of the student.

When does the school official exception allow a school or LEA to non-consensually disclose education records to a community-based organization?

A community-based organization may be considered a “school official” only if it:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records; 
  3. Is subject to the requirements of § 99.33(a) governing the use and redisclosure of personally identifiable information (PII) from education records. and
  4. Meets the criteria specified in the school’s or LEA’s Annual Notification of FERPA rights for being a school official with a legitimate educational interest in the education records. 

Once a school determines that a community-based organization meets the above criteria, the organization may have access to PII from education records, without consent, under the school official exception, in order to perform the required institutional services and functions for the school. (See § 99.31(a)(1)(i)(B))

When is a photo or video of a student an education record under FERPA?

As with any other “education record,” a photo or video of a student is an education record, subject to specific exclusions, when the photo or video is:  (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. (20 U.S.C. 1232g(a)(4)(A); 34 CFR § 99.3 “Education Record”)[1]

 

Directly Related to a Student:

FERPA regulations do not define what it means for a record to be “directly related” to a student. In the context of photos and videos, determining if a visual representation of a student is directly related to a student (rather than just incidentally related to him or her) is often context-specific, and educational agencies and institutions should examine certain types of photos and videos on a case by case basis to determine if they directly relate to any of the students depicted therein. Among the factors that may help determine if a photo or video should be considered “directly related” to a student are the following:

  • The educational agency or institution uses the photo or video for disciplinary action (or other official purposes) involving the student (including the victim of any such disciplinary incident);
  • The photo or video contains a depiction of an activity:
    • that resulted in an educational agency or institution’s use of the photo or video for disciplinary action (or other official purposes) involving a student (or, if disciplinary action is pending or has not yet been taken, that would reasonably result in use of the photo or video for disciplinary action involving a student);
    • that shows a student in violation of local, state, or federal law;  
    • that shows a student getting injured, attacked, victimized, ill, or having a health emergency;
  • The person or entity taking the photo or video intends to make a specific student the focus of the photo or video (e.g., ID photos, or a recording of a student presentation); or
  • The audio or visual content of the photo or video otherwise contains personally identifiable information contained in a student’s education record.

A photo or video should not be considered directly related to a student in the absence of these factors and if the student’s image is incidental or captured only as part of the background, or if a student is shown participating in school activities that are open to the public and without a specific focus on any individual.

Examples of situations that may cause a video to be an education record:

  • A school surveillance video showing two students fighting in a hallway, used as part of a disciplinary action, is directly related to the students fighting.   
  • A classroom video that shows a student having a seizure is directly related to that student because the depicted health emergency becomes the focus of the video. 
  • If a school maintains a close-up photo of two or three students playing basketball with a general view of student spectators in the background, the photo is directly related to the basketball players because they are the focus of the photo, but it is not directly related to the students pictured in the background. Schools often designate photos or videos of students participating in public events (e.g., sporting events, concerts, theater performances, etc.) as directory information and/or obtain consent from the parents or eligible students to publicly disclose photos or videos from these events.
  • A video recording of a faculty meeting during which a specific student’s grades are being discussed is directly related to that student because the discussion contains PII from the student’s education record.

 

Maintained by an educational agency or institution:

To be considered an education record under FERPA, an educational agency or institution, or a party acting for the agency or institution, also must maintain the record. Thus, a photo taken by a parent at a school football game would not be considered an education record, even if it is directly related to a particular student, because it is not being maintained by the school or on the school’s behalf. If, however, the parent’s photo shows two students fighting at the game, and the parent provides a copy of the photo to the school, which then maintains the photo in the students’ disciplinary records, then the copy of the photo being maintained by the school is an education record.

 

Exclusion for Law Enforcement Unit Records

The FERPA statute and regulations (20 U.S.C. 1232g(a)(4)(B)(ii) and 34 CFR §§ 99.3 and 99.8) exclude from the definition of education records those records created and maintained by a law enforcement unit of an educational agency or institution for a law enforcement purpose. Thus, if a law enforcement unit of an educational agency or institution creates and maintains the school’s surveillance videos for a law enforcement purpose, then any such videos would not be considered to be education records. If the law enforcement unit provides a copy of the video to another component within the educational agency or institution (for example, to maintain the record in connection with a disciplinary action), then the copy of the video may become an education record of the student(s) involved if the video is not subject to any other exclusion from the definition of “education records” and the video is:  (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. 

 

[1] The Individuals with Disabilities Education Act (IDEA) also contains privacy protections that apply to children with disabilities. 20 U.S.C. 1417(c) and 34 CFR §§ 300.610-300.626 and 34 CFR §§ 303.401-303.416. Under the IDEA, participating agencies must protect the personally identifiable information (PII), data, or records that are collected, maintained, or used by the participating agency. While the definition of “education record” under Part B of the IDEA cross-references the FERPA definition in 34 CFR § 99.3, the application of IDEA requirements may raise different questions.

When is it permissible to utilize FERPA’s health or safety emergency exception for disclosures?

In some situations, school administrators may determine that it is necessary to disclose personally identifiable information (PII) from a student’s education records to appropriate parties in order to address a health or safety emergency.  FERPA’s health or safety emergency provision permits such disclosures when the disclosure is necessary to protect the health or safety of the student or other individuals.  See 34 CFR §§ 99.31(a)(10) and 99.36.  This exception to FERPA’s general consent requirement is limited to the period of the emergency and generally does not allow for a blanket release of PII from a student’s education records.  Rather, these disclosures must be related to an actual, impending, or imminent emergency, such as a natural disaster, a terrorist attack, a campus shooting, or the outbreak of an epidemic disease. 

When the organization publishes the results of the study can it publish results in a way that allows individual students to be identified?

No.  Absent the prior, written consent from the parent or eligible student, FERPA prohibits personally identifiable information (PII) from education records from being published in a way that would allow individual students and their parents to be identified.  The organization conducting the study can use PII from education records to conduct the study for the school, but results must be published in a way that protects the privacy and confidentiality of the individuals involved. For example, when publishing data tables, the organization may need to use cell suppression or other methods of disclosure avoidance so that students cannot be identified through small numbers displayed in table cells. 

Who are considered “appropriate parties” that may receive information under the health or safety emergency exception?

Typically, local or state law enforcement officials, public health officials, trained medical personnel, and parents (including parents of an eligible student) are the types of appropriate parties to whom schools may disclose information under this FERPA exception.  An appropriate party under the health or safety emergency exception to FERPA’s general consent requirement is a party whose knowledge of such information is necessary to protect the health or safety of the student or other persons.