The school shutdowns prompted by the COVID-19 pandemic have led to significant concerns about students’ loss of both academic and social-emotional learning. A survey by Horace Mann Educators Corporation revealed that 97 percent of teachers reported seeing higher levels of learning loss in their students during the pandemic than they had seen before. According to a report conducted by McKinsey & Company, this learning loss is disproportionately impacting Black and Hispanic students. Districts, such as in Tennessee and Connecticut, have used afterschool programs as a way to recover students’ lost learning. Afterschool programs, formally referred to as Out-of-School Time programs (OSTs), service 7.7 million students each year. After more than a year of remote and modified in-person learning and with increased education funding in 2021, schools and districts are looking to afterschool programs more than ever to make up for lost learning time.
Because school and afterschool services overlap, many of these organizations want to exchange data to provide continuity throughout the day and evaluate program effectiveness. Since the relationship between afterschool programs and schools is increasingly likely to involve data disclosures, schools need to understand the requirements of the Family Educational Rights and Privacy Act (FERPA) to ensure that these data disclosures comply with the law. FERPA does not contain a provision that directly covers data exchanges with afterschool programs; rather, schools can take several routes, depending on the circumstances. To help schools and districts share data safely with afterschool programs, the Future of Privacy Forum (FPF) has created this guide to clarify FERPA’s data sharing requirements and to offer additional best practices.
Why Does Data Sharing with Afterschool Programs Matter and How Can Schools and Districts Benefit from It?
Data sharing with afterschool programs can help community partners provide services tailored to students’ needs. This, in turn, can lead to the following positive results:
- Improved academic and life outcomes for students.
- Greater understanding of students’ needs, specifically additional resources and support services.
- Increased insight into how community partners operate, helping schools and districts better align community partners to achieve schools’ overall goals.
When schools engage in permissible data sharing, they can better understand which resources and support students need and open the door for more positive learning experiences and outcomes.
What Are FERPA’s Requirements for Sharing Personally Identifiable Information from Education Records?
While not directly addressing data exchanges with afterschool programs, FERPA outlines several ways that a school can share data, depending on the circumstances. By far, the most common ways that schools share students’ personally identifiable information (PII) with afterschool programs are through written parental consent and the school official exception.
Individual Student Data Shared with Written Parental Consent
Schools and districts may feel that the most transparent way to share data is through written consent from a parent or eligible student. The written consent must
- Specify the education records that may be disclosed;
- State the purpose(s) of the disclosure; and
- Identify the party(ies) to whom the disclosure may be made.
Organizations may call this consent by different names, such as a waiver or consent form. Schools can administer these consents, or the consents can be built into the afterschool program registration process so that the school receives consent to disclose the necessary education records when parents/caretakers register students for the afterschool program. When schools use written parental consent for the disclosures, a best practice is to coordinate with the afterschool program to work out details regarding the consent form. For example, who will distribute the form to parents? Who will collect it? What exact language will appear on the form? Schools could also adapt an existing consent form, such as this one from Seattle Public Schools.
Note that if the school does not coordinate with the afterschool program, then it will likely be necessary to confirm parents’ identities before disclosing records. The US Department of Education’s Privacy Technical Assistance Center has provided guidance on identity authentication best practices.
Written parental consent is not always optimal because some parents/caretakers may find it challenging to provide written consent, which would delay or prevent students from accessing services.
Organizations may call this consent by different names, such as a waiver or consent form. Schools can administer these consents, or the consents can be built into the afterschool program registration process so that the school receives consent to disclose the necessary education records when parents/caretakers register students for the afterschool program. When schools use written parental consent for the disclosures, a best practice is to coordinate with the afterschool program to work out details regarding the consent form. For example, who will distribute the form to parents? Who will collect it? What exact language will appear on the form? Schools could also adapt an existing consent form, such as this one from Seattle Public Schools.
Note that if the school does not coordinate with the afterschool program, then it will likely be necessary to confirm parents’ identities before disclosing records. The US Department of Education’s Privacy Technical Assistance Center has provided guidance on identity authentication best practices.
Written parental consent is not always optimal because some parents/caretakers may find it challenging to provide written consent, which would delay or prevent students from accessing services.
Individual Student Data Shared Through the FERPA School Official Exception
Schools can also use a FERPA exception to share data with afterschool programs. While there are many exceptions, the school official exception is particularly relevant to schools. The school official exception permits schools to outsource institutional services or functions that involve disclosure of education records under certain circumstances. An afterschool program may be considered a school official if it
- Performs an institutional service or function for which the school or LEA would otherwise use employees;
- Is under the direct control of the school or LEA with respect to the use and maintenance of education records;
- Agrees not to disclose the information to any other party;
- Agrees to only use the information for the purposes for which the disclosure was made;
- Meets the criteria specified in the school’s or LEA’s annual notification of FERPA rights for being a school official with a legitimate educational interest.
The first criteria, that the afterschool program perform a service for which the school would otherwise use its own employees, is arguably the most crucial to review. According to youth.gov, afterschool programs provide various services, including “academic support, mentoring, positive youth development, arts, sports and recreation, apprenticeships, workforce development programs, and programs for opportunity youth (i.e., youth not in schools or the workforce) and homeless youth.” Afterschool services that the school already provides would reasonably meet this criteria, while afterschool services the school does not provide most likely would not. If the afterschool program does not meet the first criteria, then it may not be possible for schools to disclose education records to the afterschool program under the school official exception. To determine whether the afterschool program meets the criteria, schools should have a process in place (see Seattle Public Schools for an example of a review process).
If the afterschool program performs a service for which a school would otherwise use its own employees, schools can handle the remaining requirements most easily via a written agreement or contract with the afterschool program (FERPA does not require a contract, however, so schools may choose to meet the requirements in other ways). Ideally, this contract specifies the service or function the afterschool program will provide and restricts other uses and disclosures of students’ information.
Schools must ensure that under the school official exception, they give afterschool programs access only to the education records in which the programs have a legitimate educational interest, and that those education records have been specified by the school.
Other Routes for Sharing Individual Student Data
FERPA allows other routes for sharing students’ PII, including the studies exception, the audit/evaluation exception, and sharing properly de-identified data. As these exceptions are less common, we describe them briefly here and include a list of additional resources at the end of this article.
Under the studies exception, schools may share education records with organizations conducting studies for or on behalf of schools or local education agencies for the purposes of (1) developing, validating, or administering predictive tests, (2) administering student aid programs; or (3) improving instruction. To meet this exception, schools or LEAs must enter into a written agreement with the organization, and this written agreement must contain mandatory elements.
The audit/evaluation exception permits schools to designate a third party as an authorized representative for an audit or evaluation of a federal- or state-funded education program. In practice, this limitation is similar to the studies exception in that both must include a written agreement that greatly limits what the afterschool program can do with the data. This written agreement also has mandatory elements.
Schools may also release properly de-identified information to an afterschool program. FERPA does not consider the sharing of de-identified education records to be a disclosure because by definition, de-identified data does not contain PII. To learn more, see this US Dept of Ed resource.
Best Practices for Schools and Districts
Regardless of which of FERPA’s methods schools use to disclose student data to an afterschool program, schools should consider the following best practices:
- Establish clear policy and process for requesting and approving afterschool programs and for identifying the appropriate FERPA exception.
- Although not required under the school official exception, written agreements are strongly encouraged to help afterschool programs understand their obligations and responsibilities. A written agreement establishes how the afterschool program may use the data and helps establish that the school or LEA directly controls the afterschool program with respect to the use and maintenance of education records.
- Be transparent with families and students. Consider providing a public list of afterschool programs and the data that the school shares. Schools can publish information on their website about the information they collect, use, and share with afterschool programs.
Additional Resources
- Data Sharing Tool Kit for Communities (Department of Education)
- FERPA Guidance on Sharing Information with Community-Based Organizations (Department of Education)
- FERPA Exceptions – Summary (Department of Education)
- Data Governance and Stewardship (Department of Education)
- Data + Out-of-School Time Partnerships = Student Success (Data Quality Campaign)
- Student Data Privacy Best Practices: Five Ways Community Organizations Can Ensure Effective and Responsible Data Use (Strive Together)
Written by Juliana Cotto and Jim Siegl, with thanks to Elijah Armstrong and Demi Busby at the Future of Privacy Forum and David Sallay at the Utah State Board of Education and the Future of Privacy Forum.
