Frequently Asked Questions

This section is designed to allow stakeholders easy access to all Frequently Asked Questions about student privacy.  All of the questions contained on this page have been tagged for easy browsing by either topic or audience.  This section is regularly updated as new questions are received.  You may also search the FAQs by using the search box on the top right of the page.

May the community-based organization receiving personally identifiable information (PII) from education records redisclose PII from education records without written consent?

No.  Regardless of whether the community-based organization received the PII under the school official, studies, or audit/evaluation exception, the answer is the same – the community-based organization may not redisclose it unless such redisclosure is on behalf of the disclosing entity and is consistent with FERPA.  (34 CFR § 99.33).  If further redisclosure is contemplated, we recommend that provisions addressing authorized redisclosures be included in any agreement with the community-based organization.

May the LEA disclose personally identifiable information (PII) from education records to a community-based organization under the audit or evaluation exception for the purpose of the community-based organization evaluating its own program?

Generally, no.  The audit or evaluation by an community-based organization of its own program (i.e., to determine whether or not the organization’s program is effective) in most cases would not be permitted under the audit or evaluation exception because the audit or evaluation exception only permits the audit or evaluation of federal- or state-supported education programs, which FERPA defines as any program principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, and any program that is administered by an educational agency or institution. 

May the school or LEA non-consensually disclose personally identifiable information (PII) from education records to a community-based organization that is conducting a study for the school or LEA?

Yes.  The studies exception allows for the disclosure of PII from education records without consent to community-based organizations conducting studies for, or on behalf of, the school or LEA.  FERPA limits the purpose of the studies conducted under this exception to: (1) developing, validating, or administering predictive tests; (2) administering student aid programs; or (3) improving instruction.  See 34 CFR § 99.31(a)(6)(i).  

Must a school have a written agreement or contract with a community-based organization to which it non-consensually discloses education records to outsource an institutional service under the school official exception?

No.  While FERPA does not require written agreements or contracts when a school chooses to outsource an institutional service or function to a community-based organization under the “school official” exception, it is a best practice to do so.  Written agreements help ensure that the community-based organization understands its obligations and responsibilities with respect to the use of and privacy protections accorded to the FERPA protected information.  Further, appropriate contractual provisions can establish the direct control required by FERPA under this exception.  Additionally, local or state policies or laws may require the use of written agreements or contracts for procurement. 

Must a school inform parents and eligible students if the school non-consensually discloses personally identifiable information from their education records to a community-based organization to which the school has outsourced an institutional service?

No.  While there is no specific notification requirement regarding disclosures under the exceptions to consent, FERPA does require that each school or LEA annually notify parents and eligible students of their rights under FERPA.  34 CFR § 99.7.  As a part of the annual notice, the school or LEA must include in the notification a specification of the criteria for determining who constitutes a school official and what constitutes a legitimate educational interest.  34 CFR § 99.7(3)(iii).    

Must a school or LEA record the non-consensual disclosure of personally identifiable information (PII) from education records to a community-based organization?

Yes.  Generally, when a school or LEA discloses without consent PII from education records to a community-based organization, with the exception of disclosures made under the “school official” exception, the disclosure must be recorded.  FERPA require schools to record all requests for access to, and all disclosures of, PII from the education records of each student, except for disclosures to school officials, disclosures related to some judicial orders or lawfully issued subpoenas, disclosures of directory information, and disclosures to the parent or eligible student.  See 34 CFR § 99.32(d).  Schools and LEAs must maintain these records with the student’s education records for as long as the student’s records are maintained.  The recorded information must include the parties who have requested or received PII and their legitimate interests in requesting or obtaining the information. Parents and eligible students have a right to inspect and review the record of disclosures.  See 34 CFR § 99.32 for the full list of recordation requirements.

Must an educational agency or institution have a written agreement to disclose personally identifiable information (PII) from education records without consent for the purposes of conducting a study or an audit or evaluation of an education program?

Yes. Both the studies exception and the audit or evaluation exception specifically require that the parties execute a written agreement when disclosing PII from education records without consent.

Must educational agencies and institutions record any disclosure of personally identifiable information (PII) from education records to the Child Welfare Agencies (CWAs) or tribal organization?

Yes.  FERPA requires recordkeeping on requests for access to and disclosures of education records.  See § 99.32.  Thus, if a school discloses education records to the Child Welfare Agency (CWA) or tribal organization under this exception, the school must be compliant with the recordation requirements under FERPA and also must include:  (1) the parties who have requested or received PII from the education records, and (2) the legitimate interests the parties had in requesting or obtaining the information.  If an educational agency or institution discloses PII from education records with the understanding that further disclosures will be made, the educational agency’s or institution’s record of disclosure must include the names and legitimate interests of the additional parties.

Must postsecondary institutions provide a parent with access to an eligible student’s education records?

While the rights under FERPA transfer from the parents to the student when the student turns18 or enrolls in a postsecondary institution at any age, FERPA provides ways in which an institution can share education records on the student with his or her parents.  Schools may disclose any and all information to parents, without the consent of the eligible student, if the student is a dependent for tax purposes under the IRS rules.  FERPA also permits a school to disclose information from an eligible student’s education records to parents if a health or safety emergency involves their son or daughter.  Another provision in FERPA permits a college or university to let parents of students under the age of 21 know when the student has violated any law or policy concerning the use of possession of alcohol or a controlled substance.  School officials may also share information with a parent about an eligible student that is based on that official’s personal knowledge or observation and that is not based on information contained in an education record.