Frequently Asked Questions

This section is designed to allow stakeholders easy access to all Frequently Asked Questions about student privacy.  All of the questions contained on this page have been tagged for easy browsing by either topic or audience.  This section is regularly updated as new questions are received.  You may also search the FAQs by using the search box on the top right of the page.

How does § 544 of the National Defense Authorization Act for Fiscal Year 2002 amend the former Military Recruiter requirements under 10 U.S.C. § 503?

The law’s recruiting provisions apply only to LEAs (including private secondary schools) that receive funds under the ESEA.  These provisions require access by military recruiters to students, under certain conditions, and to secondary school students’ names, addresses, and telephone listings.  They also require LEAs to notify parents of their right to opt out of the disclosure of their children’s names, addresses, and telephone numbers and to comply with any such requests from the parents or the students.

How long does an educational agency or institution have to comply with a request to view records?

FERPA requires that educational agencies and institutions comply with a request by a parent or eligible student for access to education records within a reasonable period of time, but not more than 45 days after receipt of a request.  Some States have laws that may require that parents and eligible students be granted access in a shorter time period.  34 CFR § 99.10(b).

How long must the Child Welfare Agency (CWA) or tribal organization maintain the education records of a child, and what must the CWA or tribal organization do with the education records when no longer needed?

Some of the FERPA exceptions to consent require the recipient of education records to destroy personally identifiable information (PII) from education records when it is no longer needed.  We recommend that the school or LEA and the CWA or tribal organization work together to determine how long the CWA or tribal organization should maintain the education records disclosed under the exception.  For example, the CWA or tribal organization could use its standard records retention and destruction guidelines or return the records to the disclosing school or LEA.  Further, CWA and tribal organizations should be aware of the potential consequences of improperly redisclosing PII from the education records that are received from the school or LEA under the FERPA exception. 

How may a parent or eligible student file a FERPA complaint with the Department of Education?

A parent or eligible student may file a written complaint with the Family Policy Compliance Office regarding an alleged violation under of FERPA.  The complaint must be timely (submitted to the office within 180 days of the date that the complainant knew or reasonably knew of the violation) and state clearly and succinctly specific allegations of fact giving reasonable cause to believe that the school has violated FERPA.

I want to use online tool or application as part of my course. However, I am worried that it is a violation of FERPA. What should I do?

A teacher should first check with their school/district administration to see if that application or service is approved for use in the classroom.  Any applications or services that collect personally identifiable information (PII) from students’ education records under the school officials exception to prior consent in FERPA must:

  • Provides a service or function that the school would otherwise use its own staff
  • Be under the direct control of the school with regard to the use and maintenance of the PII from education records
  • Collection and use of the PII must be consistent with the school or district’s annual notification of rights under FERPA
  • Not re-disclose or use the education data for unauthorized purposes.

Remember that the use of some applications or services may introduce security or privacy vulnerabilities into the school or districts IT systems.  Teachers should always consult their IT representatives to discuss the use of these types of software tools prior to use to ensure compliance with FERPA requirements and promote a safe, secure computing environment. 

If a parent opts out of the public, non-consensual disclosure of directory information (or any subset of such information), must the three data elements be released to military recruiters upon their request?

If a parent opts out of providing directory information to third parties, the opt-out relating to name, address, or telephone number applies to requests from military recruiters as well.  For example, if the opt-out states that telephone numbers will not be disclosed to the public, schools may not disclose telephone numbers to military recruiters.

If a school or LEA discloses personally identifiable information (PII) from education records to a community-based organization under a FERPA exception to consent, what and how much PII from education records can it disclose to the organization?

The school or LEA has discretion under FERPA to decide what and how much PII from education records to disclose to community-based organizations (except in certain cases such as a court order or a subpoena).  The school or LEA should determine which data elements are necessary for the activity in question and provide only those elements.  Often LEAs and schools will discover that the organization can do the work in question without receiving PII from education records.

If a student under 18 is enrolled in both high school and a local college, do parents have the right to inspect and review his or her education records?

If a student is attending a postsecondary institution - at any age - the rights under FERPA have transferred to the student.  However, in a situation where a student is enrolled in both a high school and a postsecondary institution, the two schools may exchange information on that student.  If the student is under 18, the parents still retain the rights under FERPA at the high school and may inspect and review any records sent by the postsecondary institution to the high school.  Additionally, the postsecondary institution may disclose personally identifiable information from the student’s education records to the parents, without the consent of the eligible student, if the student is a dependent for tax purposes under the IRS rules.

If an LEA has not provided notice relating to directory information, may it release a students name, address, and telephone number when requested by a military recruiter?

An LEA may provide a single notice regarding both directory information and information disclosed to military recruiters.  If an LEA does not disclose “directory information” under FERPA, then it must still provide military recruiters access to secondary students’ names, addresses, and telephone listings.  In addition, the LEA must notify parents that they may opt out of this disclosure.  In other words, an LEA that does not disclose “directory information” must nonetheless provide a notice that it discloses information to military recruiters.  The notice must be reasonably calculated to inform parents.

If the school does not list one or more of name, address, and telephone listing among its directory information, may it release that information to military recruiters?

If a school does not designate one or more of the three items as “directory information” under FERPA, it still must provide all three items to military recruiters upon request.  Also, in that case, the school would have to send a separate notice to parents about the missing “directory information” item(s), noting an opportunity to opt out of disclosure of the information to military recruiters.  An easier method, of course, would be for the school to designate all three items – name, address, and telephone listing – as “directory information.”