Federal Laws

The Family Educational Rights and Privacy Act (FERPA) also requires that schools give parents and students the opportunity to access information in their education records. Students and parents are allowed to review and potentially amend incorrect information within their education record. Procedures should be put in place to simplify this process.

A school may not generally disclose personally identifiable information from an eligible student’s education records to a third party without written consent. There are a number of exceptions to this rule, which are laid out in the Department of Education’s FERPA Exceptions — Summary CHART.

FERPA Directory Information
Student’s Name
Address
Telephone listing
Email Address
Photograph
Date & Place of Birth
Major/Field of Study
Dates of Attendance
Grade Level
Participation in officially recognized activities & sports
Weight & Height of Athletes
Degrees, Honors, & Awards Received
Most recent educational institution attended
Student ID, User ID, or other unique identifier (that cannot be used to access education records withought a pin or password)
  • FERPA gives parents and students the right to opt out of having their “directory information” shared.
  • FERPA allows schools to share student information among designated “school officials” with “legitimate educational interests.” Schools must define these terms, and inform parents who they consider a “school official” and what is deemed a “legitimate educational interest.” This process allows schools to partner with outside persons or entities to provide educational tools and services.

Aside from the two most common FERPA exceptions listed above, there are a number of other circumstances when prior consent is not required to disclose information about a student. The following are categories of people/organizations that may not need express student consent to gain access to certain information about students.

Individual/Entity seeking information Type of information available without consent…
Parents Of Dependent Post-Secondary Students Generally – any student information
Of Non-Dependent Post-Secondary Students (1) Information in connection with the student’s health or safety
(2) Information related to the student’s violation of the law or the academic institution’s policy governing use or possession of alcohol or controlled substances
Schools In which the student intends to enroll
Financial Aid Offices Facts relevant to determining a students eligibility, amount, or conditions surrounding receiving financial aid
Authorized Representative of Federal, State, and local Governments and Educational Authorities Auditing, evaluating, or enforcing education programs
Organizations Data used to conduct studies, predictive tests, administering student aid program, or improving instruction
Judicial or law enforcement authority In compliance with an order or subpoena
Victims Results of a disciplinary hearing of a crime of violence
Third Parties Final results of a disciplinary hearing concerning a student who is an alleged perpetrator of a crime of violence and who was found to have committed a violation of the institution’s rules or policies
Community Notification Program Information concerning a student required to register as a sex offender in the State

Children’s Online Privacy Protection Act (COPPA)

The Children’s Online Privacy Protection Act (COPPA) guides the protection of data, when companies collect “personally identifiable information” directly from students under the age of 13. The FTC updated its COPPA guidance in April 2014 to clarify that “the school’s ability to consent on behalf of the parent is limited to the educational context – where an operator collects personal information from students for the use and benefit of the school, and for no other commercial purpose…. because the scope of the school’s authority to act on behalf of the parent is limited to the school context.” School consent cannot substitute a parent’s approval “in connection with online behavioral advertising, or building user profiles for commercial purposes not related to the provision of the online service.”

PROTECTION OF PUPIL RIGHTS AMENDMENT (PPRA)

PPRA Sensitive Information
Political Affiliations
Address
Mental & Psychoogical Problems
Email Address
Sex behavior & Attitudes
Date & Place of Birth
Illegal, anti-social, self-incriminating & demeaning behavior
Critical Appraisals of other individuals
Legally recognized privileged or analogous relationships
Participation in officially recognized activities & sports
Income