Law Enforcement Access to Student Records

What are my school’s obligations under FERPA?

FERPA broadly prohibits schools from disclosing student records without the written consent of the parent or student. There are a few limited exceptions, including an exception that permits disclosure in response to various legal processes such as lawful subpoenas and court order.

What information can my school disclose while still complying with FERPA?

Schools may typically disclose information from student records without consent only under a FERPA exception or in response to a valid court order or subpoena. Before turning over records in response to a request, schools should consult with legal counsel to determine whether the request is valid and appropriately tailored, as well as how the school should respond.

In many cases, schools may disclose student directory information – like name, address, phone number, or email – if students or parents do not opt-out of these disclosures at the beginning of the year. However, schools should be careful to not reveal other information about students in the process. For example, a school must usually obtain parental consent before disclosing a list of names and phone numbers of all students who are English Language Learners. While this list contains only directory information, disclosing the list would implicitly reveal confidential student information because it is linked to protected non-directory information. Similarly, schools would typically need consent to disclose the names and addresses of undocumented students because that list implicitly reveals immigration status.

How should the school keep parents or students informed of record requests?

FERPA requires schools to notify the student or parent before disclosing records unless a court has ruled otherwise. This allows the student or parent to act to protect their rights before records are passed on to law enforcement. However, law enforcement or government officials may ask a school for confidentiality or serve process that requires a school to keep the request confidential. In this case, confidentiality is only allowed if the issuing court or agency has ordered the school not to disclose to anyone the existence or contents of the subpoena or the institution’s response. If this occurs, schools should remind law enforcement officials of FERPA’s notification requirements, and determine whether the confidentiality request is supported by proper legal process. Schools should also consult legal counsel about their obligations to provide or withhold notice to students of parents.

What about School Resource Officers (SROs)?

SROs may access student record data only under an exception to FERPA such as the school official exception (meaning the SRO has a legitimate educational interest in that information and is not allowed to redisclose it without consent) or the health and safety exception. Otherwise, SROs must be treated the same as any other law enforcement official. If in doubt whether an SRO is acting as a school official in certain situations, consult with legal counsel.

What if law enforcement asks my service providers for my students’ records?

Service providers are typically considered agents of the school through their contracts. This means that student records held by service providers are covered by FERPA. Service providers should also be aware of additional privacy safeguards they must abide by when it comes to student records, such as the Fourth Amendment and the Electronic Communications Privacy Act (ECPA). Therefore, service providers should, whenever possible, insist on a warrant before disclosing the content of student records to law enforcement. Service providers should then consult with their legal counsel to make sure warrants are valid and determine the appropriate scope of their response.

Will my service provider notify me about a government data request and their response?

Many service providers will – as a standard policy – notify school districts when they receive a government request for student records. Schools should ask their service providers about notification policies and make sure contracts include a right to be notified about a record request. Schools should also ask service providers about their data retention policies to ensure they are not storing data longer than necessary. In rare circumstances, law enforcement officials might request or require a service provider to keep a request confidential – even from the school. In that case, the provider should remind the government official that FERPA requires that any redisclosure of student data by the provider must be on behalf of the school, and consult with legal counsel about their obligations.

What if a school or service provider discloses too much information to law enforcement.

FERPA prohibits schools or service providers from disclosing more information than legally requested by law enforcement officials. As mentioned above, FERPA also requires that service providers only redisclose student data on behalf of the school. FERPA violations could result in investigations by the U.S. Department of Education. Service providers may also be liable under ECPA if they unlawfully disclose more information than required by legal process; ECPA provides a private right of action in many cases, allowing individuals harmed by improper disclosures to sue.

Is the data on student immigration status treated differently?

Some schools collect student immigration status or other data that can be used to imply immigration status in order to better serve those students. Before collecting this information, schools should review their responsibilities under the Supreme Court case Plyler v. Doe. If schools do collect student immigration status, it is considered part of the student record and is protected by FERPA. Therefore, schools may only disclose this information with consent or in response toa valid court order or subpoena.