The Family Educational Rights and Privacy Act of 1974 (FERPA) is the preeminent federal law governing privacy rights regarding the collection, storage, and dissemination of the personal information of students in the educational environment. FERPA is complex, particularly the regulatory framework supporting the law, which can lead to confusion among parents and educational staff regarding what are and are not FERPA violations and the consequences of any such violations. Let’s shed some light on the subject.
Department of Education Funding
The statutory FERPA text begins with the following statement:
(a) Conditions for availability of funds to educational agencies or institutions; inspection and review of education records; specific information to be made available; procedure for access to education records; reasonableness of time for such access; hearings; written explanations by parents; definitions.
[20 U.S. Code Section 1232g (emphasis added)]
The initial language of the code is critical to understanding FERPA violations because of the particular language used, notwithstanding it isn’t exactly a page-turner.
FERPA is what is known as “carrot and stick” legislation. Educational institutions can receive funding from the Department of Education [the carrot] so long as each complies with the law and accompanying regulations. And conversely, institutions that fail to comply with FERPA cannot receive funding from the Department of Education [the stick].
Most institutions in the modern education system in the United States are reliant on federal funding, so FERPA compliance is standard. However, a niche of private institutions forge financing from the government and can ignore FERPA compliance. These schools are small in number, and we will ignore them for the purposes of this article.
FERPA Violation Examples
For educational institutions that do receive federal funding, FERPA violations are a legitimate concern. FERPA classifies the personal information of students as either “education records” or “directory information.” As a very general notion, a school needs written consent from a student or parent before the institution can release information in education records to third parties. The schools need no such permission before releasing directory information. Examples of FERPA violations would include the disclosure of the following educational records to third parties:
- A student’s social security number,
- A student’s grades,
- An academic evaluation of a student,
- Medical records of a student such as vaccination records, and
- Attendance records.
Let’s assume your 9-year-old son attends Carver Elementary School. The New York Times is doing a story correlating student grades to whether students have had specific vaccinations. The administration for Carver provides the Times with access to student records. Such access would constitute a FERPA violation.
In a modern context, we are also seeing FERPA violations occurring in the online environment. Problems arise when teachers and students communicate via online platforms or social media. The flow of information can result in teachers mentioning information that should remain private. For example, the attendance record, academic evaluation of a student, or their grades. Public schools are being alerted to the problem and are starting to provide training to teachers and other staff, but the problem still occurs frequently.
FERPA Violation Cases
Can a parent or student sue an educational institution that receives funding from the Department of Education for FERPA violations? Federal courts traditionally were divided on the issue. A few district courts took the view that FERPA provided students with a right to claim a violation of their civil rights. Other district courts found no such right existed. The split in the districts caused no small amount of headaches as schools in one district faced legal threats while those in another had no such concerns.
The Supreme Court finally stepped in to settle the matter in 2002 in a 7-2 decision. In Gonzaga University v. Doe, 536 U.S. 273, the majority justices found that FERPA prohibits only “the federal funding of educational institutions that have a policy or practice of releasing education records to unauthorized persons.” Since the law only addressed funding, the Court ruled students and parents do not have the right to bring FERPA legal actions.
Can parents or students sue an educational institution for a FERPA violation? The answer is no.
FERPA Violation Penalty and Consequences
FERPA violations in public schools do have consequences. Take FERPA violations in elementary schools, for example. If the Department of Education investigates and finds a violation, the FERPA penalty can be the loss of all or part of the funding provided by the Department of Education. In theory, a school, district, or university could be shutdown given the withdraw of funding.
How likely is such a result?
Instead, the Department of Educational will typically notify the school of the violations and then demand specific changes to bring the school into compliance. If a school refuses to comply, only then will the Department of Education consider removing all or part of the funding provided to the school. In nearly every case, the school will comply with the demanded changes to keep its financing in place.
FERPA violations occur continuously. The positive news is most educational institutions will take remedial steps when presented with the infractions. The more difficult step is motivating the Department of Education to take action on this privacy law. As a parent, you just need to stick with it and don’t give up.