Frequently Asked Questions

This section is designed to allow stakeholders easy access to all Frequently Asked Questions about student privacy.  All of the questions contained on this page have been tagged for easy browsing by either topic or audience.  This section is regularly updated as new questions are received.  You may also search the FAQs by using the search box on the top right of the page.

Is prior written consent of the parent or eligible student required to disclose information to community-based organizations?

In most cases, yes.  Written consent is generally required before personally identifiable information (PII) from students’ education records may be disclosed to community-based organizations.  Except as set forth in § 99.31 of the regulations and in the statutory exceptions to consent at 20 U.S.C. 1232g, FERPA requires written consent from parents or eligible students before PII from education records are disclosed (34 CFR § 99.30).  For activities that do not fit within the statutory exceptions to consent, we recommend that schools, local educational agencies (LEAs), and/or community-based organizations build written consent into the registration process so that when parents sign students up for services offered by a community-based organization, the organization obtains the consent needed to access those education records of the student that will be needed to provide its services to that student.  

May a Child Welfare Agency (CWA) or tribal organization redisclose personally identifiable information (PII) from education records to other individuals or entities?

In some cases, FERPA does permit a CWA or tribal organization to redisclose PII from education records for a limited purpose.  Specifically, it provides that redisclosures may only be made to an individual or entity “engaged in addressing the student’s education needs” and authorized by such agency or organization to receive such disclosure and such disclosure must be consistent with the state or tribal laws applicable to protecting the confidentiality of a student’s education records.  20 U.S.C. § 1232g(b)(1)(L).

May a Child Welfare Agency (CWA) or tribal organization that receives personally identifiable information (PII) from education records through the exception in FERPA use the PII for purposes other than addressing the education needs of the child?

No.  FERPA is clear that the PII from education records disclosed to the CWA or tribal organization under the 2013 exception to FERPA must only be used to address the educational needs of children in foster care placement. 

May a postsecondary institution disclose financial aid records without written consent?

FERPA permits institutions to disclose, without consent, personally identifiable information from students’ education records when the disclosure is in connection with a student's application for, or receipt of, financial aid. Disclosures under this exception to consent may be made if the information is necessary for such purposes as to:  (a) determine eligibility for the aid; (b) determine the amount of the aid; (c) determine the conditions for the aid; or (d) enforce the terms and conditions of the aid.

May a postsecondary institution disclose information about a disciplinary proceeding to the victim of a crime of violence or a non-forcible sex offense?

Yes, a postsecondary institution may disclose only the final results of the disciplinary proceeding to a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense. The institution may disclose to the victim the final results of the disciplinary proceeding regardless of whether the institution concluded a violation was committed.

May a school disclose directory information to a community-based organization without written consent?

Generally, yes.  FERPA allows schools that have adopted directory information policies to disclose properly designated directory information without consent on students whose parents (or eligible students) have not opted out of the disclosure of directory information.  See § 99.37(a).  However, if a school adopts a directory information policy specifying that disclosure of directory information will be limited to specific parties, for specific purposes, or both, then the school is required to limit its directory information disclosures to those specified in its public notice.  See § 99.37(d).

May a social security number or other student identification number be listed as directory information?

A school may not designate a student’s social security number as directory information.  However, directory information may include a student’s user ID or other unique identifier used by the student to access or communicate in electronic systems, but only if the electronic identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the student’s identity, such as a personal identification number (PIN), password, or other factor known or possessed only by the student or authorized user. 34 CFR § 99.3