Individual Student Data Shared Through the FERPA School Official Exception
Schools can also use a FERPA exception to share data with afterschool programs. While there are many exceptions, the school official exception is particularly relevant to schools. The school official exception permits schools to outsource institutional services or functions that involve disclosure of education records under certain circumstances. An afterschool program may be considered a school official if it
- Performs an institutional service or function for which the school or LEA would otherwise use employees;
- Is under the direct control of the school or LEA with respect to the use and maintenance of education records;
- Agrees not to disclose the information to any other party;
- Agrees to only use the information for the purposes for which the disclosure was made;
- Meets the criteria specified in the school’s or LEA’s annual notification of FERPA rights for being a school official with a legitimate educational interest.
The first criteria, that the afterschool program perform a service for which the school would otherwise use its own employees, is arguably the most crucial to review. According to youth.gov, afterschool programs provide various services, including “academic support, mentoring, positive youth development, arts, sports and recreation, apprenticeships, workforce development programs, and programs for opportunity youth (i.e., youth not in schools or the workforce) and homeless youth.” Afterschool services that the school already provides would reasonably meet this criteria, while afterschool services the school does not provide most likely would not. If the afterschool program does not meet the first criteria, then it may not be possible for schools to disclose education records to the afterschool program under the school official exception. To determine whether the afterschool program meets the criteria, schools should have a process in place (see Seattle Public Schools for an example of a review process).
If the afterschool program performs a service for which a school would otherwise use its own employees, schools can handle the remaining requirements most easily via a written agreement or contract with the afterschool program (FERPA does not require a contract, however, so schools may choose to meet the requirements in other ways). Ideally, this contract specifies the service or function the afterschool program will provide and restricts other uses and disclosures of students’ information.
Schools must ensure that under the school official exception, they give afterschool programs access only to the education records in which the programs have a legitimate educational interest, and that those education records have been specified by the school.