Protecting Student Privacy: FERPA and PPRA Notification Requirements

Student privacy. Protecting educational records. Hot topic these days.

There are only a couple of ways parents can impact who has access to their child’s educational records in a public school. One of those opportunities comes at the beginning of the school year when parents are notified of their rights under the Family Educational Rights and Privacy Act (FERPA). The other opportunity is made available through the Protection of Pupil Rights Amendment (PPRA).

As you head to registration this year, look for these acronyms.

Whenever federal law is discussed, the words tend to big and the length of a document tends to be long. This article is no exception.

Keep reading to gain a better understanding of how these laws govern who has access to a child’s educational records.

[Scroll down to the “Summing It Up” section if you’re short on time. It’s best to read it all, but folks are busy, I know.]

FERPA Rights

Let’s start with this: custodial and noncustodial parents have equal rights under FERPA, unless a school is provided with evidence that there is a court order or State law that specifically provides to the contrary. 

Here’s what FERPA covers.

Parent and family access to educational records – Families must be allowed to review all educational records for their individual child within 45 days of requesting access. School officials should be willing to provide copies of those records. Please note that this only means access to records for your individual child, not school documents such as school calendars, syllabi, general notices or similar items. Those are not considered to be individual to your child because they are relevant for other students as well.

Amendment of inaccuracies – Families have the right to challenge the accuracy and fairness of the educational records kept by the school. This doesn’t give parents a right to challenge a grade, an opinion, or a “substantive decision” made by school officials. While parents have a right to challenge the district, it doesn’t mean the district must actually change the records. Here’s a look at the process you would be expected to undertake to make a formal challenge. A formal hearing can be held when other pathways are exhausted.

Disclosure of student educational records to third parties  – Whether the information is deemed to be Directory Information or Personally Identifiable Information (PII) determines whether parental consent is required prior to disclosure of the information.

Directory Information – Parental consent is not required for the release of Directory Information. School officials should tell parents which information they consider to be directory information.

Even though consent prior to disclosure is not required, district officials must give families the opportunity to declare they do not want directory information released and must give them a reasonable amount of time to do so. This information is often buried deep, so make sure you know how much time you have to opt out.

School districts have the option to designate any and all of the following information to be Directory Information, though they are not required to do so:

• Student’s name
• Address
• Telephone listing
• Electronic mail address
• Photograph
• Date and place of birth
• Dates of attendance
• Grade level
• Participation in officially recognized activities and sports
• Weight and height of members of athletic teams
• Degrees, honors, and awards received
• Student ID number, user ID, or other unique personal identifier used to communicate in electronic systems that cannot be used to access education records without a PIN, password, etc. (A student’s SSN, in whole or in part, cannot be used for this purpose.)

Personally Identifiable Information (PII)  – PII is information that includes

• the student’s name,
• the name of the student’s parent or other family members,
• the address of the student or student’s family; a personal identifier, such as the student’s Social Security Number, student number, or biometric record,
• other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name,
• other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty,
• and information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.

Parental consent is not necessary when PII is disclosed to school officials with legitimate educational interests.

A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility. The definition of “school official” is broad and includes:

• a person employed by the school as an administrator, supervisor, instructor, or support staff member (including health or medical staff and law enforcement unit personnel),
• a person serving on the school board,
• a volunteer or contractor outside of the school who performs an institutional service of function for which the school would otherwise use its own employees and who is under the direct control of the school with respect to the use and maintenance of PII from education records, such as an attorney, auditor, medical consultant, or therapist
• a parent or student volunteering to serve on an official committee, such as a disciplinary or grievance committee, or
• a parent, student, or other volunteer assisting another school official in performing his or her tasks.

These are the other exceptions allowing school officials to disclose PII:

• officials of another school district in which a student seeks or intends to enroll, or is already enrolled if the disclosure is for purposes of the student’s enrollment or transfer,
• to authorized representatives of the Comptroller General of the United States, the Attorney General of the United States, the U.S. Secretary of Education, and State and local educational authorities for audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs,
• to state and local authorities pursuant to a State statute concerning the juvenile justice system and the system’s ability to effectively serve the student whose records are being disclosed,
• to organizations conducting studies for or on behalf of the school making the disclosure for the purposes of administering predictive tests, administering student aid programs, or improving instruction,
• to parents of an eligible student if the student is a dependent for IRS tax purposes,
• to accrediting organizations to carry out their accrediting functions,
• to comply with a judicial order or a lawfully issued subpoena, and
• in connection with a health or safety emergency.

Law enforcement unit records are another group of records that may contain PII but are not protected under FERPA. This includes any individual, office, department, division or other component of a school, such as a unit of commissioned police officers or non-commissioned security guards, that is officially authorized or designated by the school to enforce any local, State, or Federal law, or refer to appropriate authorities a matter for enforcement of any law or to maintain the physical security and safety of the school. However, any educational records associated with that student ARE still protected under FERPA. 

As you can see, the list of exceptions is long.

The Data Quality Campaign has created an excellent document for school officials and policymakers to help them determine which records may be subject to FERPA disclosure requirements.

PPRA Rights

The Protection of Pupil Rights Amendment requires parents to be notified when school districts are going to collect “protected” information and share it with companies who may use it for marketing purposes or for behavioral study and research.

Common Sense Media conducted a nationwide poll in January 2014 and found that 90% of those polled showed concern about how non-educational interests are able to access and use students’ personal information. PPRA governs school collection and provision of personal information to these interests.

Depending upon what type of information is collected and who is funding the collection, parents must either give consent, be given an opportunity to opt out or be allowed to inspect the instrument prior to the collection of the information.

Parental consent must be given if the survey, analysis or evaluation is in one of the following protected eight areas (known as protected information) and is being funded in part or in whole by the federal government:

1. political affiliations or beliefs of the student or the student’s parent,
2. mental or psychological problems of the student or the student’s family,
3. sex behavior or attitudes,
4. illegal, anti-social, self-incriminating, or demeaning behavior,
5. critical appraisals of other individuals with whom respondents have close family relationships,
6. legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers,
7. religious practices, affiliations, or beliefs of the student or student’s parent, or
8. income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).

Parents must be given notice and the opportunity to opt out of

• Any other protected information survey, regardless of funding,
• Any non-emergency, invasive physical exam or screening required as a condition of attendance, administered by the school or its agent, and not necessary to protect the immediate health and safety of a student, except for hearing, vision, or scoliosis screenings, or any physical exam or screening permitted or required under State law, and
• Activities involving collection, disclosure, or use of personal information obtained from students for marketing or to sell or otherwise distribute the information to others.

Parents must be given the opportunity to inspect, upon request and before administration or use

• Protected information surveys of students,
• Instruments used to collect personal information from students for any of the above marketing, sales, or other distribution purposes, and
• Instructional material used as part of the educational curriculum.

Typically, school districts have adopted policies regarding PPRA. Check your school district’s policy manual.

How Parents Should Be Notified of These Rights

Schools are required to notify parents of their FERPA rights every year and to give parents the opportunity to restrict the school’s ability to provide Directory information.

How school officials notify parents is left up to them. The law doesn’t prescribe the required method of notification.

Here’s an example of a model FERPA notification, minus the Directory information notification. Highly technical, but meets the requirement.

Here’s an example of a model FERPA notification about Directory information.

You may be given a form at registration. But if you are not, it’s up to you to dig it out. Look in the Student Handbook and the Code of Conduct. Look in the district’s policy manual. Check out the district and/or school’s web page.

If you can’t find your FERPA notification, ask a school official where it is.

PPRA notification is only required when a student will be asked to participate in one of the activities covered by PPRA.

Here is clear example of a PPRA notification which includes examples of surveys that a district planned to administer through the school year.  This notice also gives parents the opportunity to opt out of specific activities.

What Questions You Should Ask

Finding the appropriate school official to whom you should ask these questions is half the battle. You can start with your child’s teacher, but most likely the person with the answers will be the principal or assistant principal.

What is the school and/or district’s privacy policy with respect to my children’s educational records?

Who has access to my children’s educational records? Ask for details and how schools keep sensitive information locked down.

How will I be notified if the school decides a company has a “legitimate educational interest” in my child’s educational records?

Can I view the list of organizations to whom you have provided Personally Identifiable Information? School districts officials are supposed to keep records of all requests and to whom they have provided the information.

How will I be notified if my child is asked to participate in a survey or other opportunity covered by PPRA?

How much lead time will I have to opt out?

If You Believe Your Child’s Educational Rights Under FERPA or PPRA Have Been Violated 

You must file a complaint with the appropriate authority within 180 days of the alleged violation.

Parents who need assistance or who wish to file a complaint under FERPA or PPRA should do so in writing to the Family Policy Compliance Office, sending pertinent information through the mail, concerning any allegations to the following address:

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, D.C. 20202-5920
Phone: 1-800-USA-LEARN (1-800-872-5327)

Summing It Up – What You Need to Know About FERPA and PPRA

FERPA governs who has access to your child’s educational records.

Parents must be notified at the beginning of every school year of their FERPA rights.

Parents must be given an opportunity to restrict the school’s ability to share Directory information.

School officials and organizations with “legitimate educational interests” have the right to access your child’s Personally Identifiable Information (PII) without your consent.

School officials must keep a record of any organizations with whom they share your child’s PII.

PPRA governs the collection, sharing and use of “protected information”.

Whether parents are given an opportunity to consent or opt out of PPRA-related activities depends on the activity and on who plans to use it.

Parental consent and opt-out notification is non-routine for PPRA-related activities and only required when the activity is planned.

Parents are allowed to inspect, upon request, any PPRA-related instrument of activity.

Parents can file a complaint with the U.S. Department of Education if they believe a child’s FERPA or PPRA rights have been violated.

Resources

FERPA General Guidance for Parents – U.S. Department of Education
Model FERPA Notice to Parents for Directory Information – U.S. Department of Education
Model Notification of FERPA Rights for Elementary and Secondary Schools – U.S. Department of Education
FERPA Exceptions – U.S. Department of Education Privacy Technical Assistance Center
FERPA – Electronic Code of Federal Regulations – The actual regulations along with answers to questions you may have
Complying with FERPA and Other Federal Privacy and Security Laws and Maximizing Appropriate Data Use – Data Quality Campaign (an EXCELLENT resource for all things education data related)

Model Notification of PPRA Rights – U.S. Department of Education
PPRA General Guidance – U.S. Department of Education

Notice to Superintendents regarding FERPA and PPRA – U.S. Department of Education, October 2012

Letter from Education Secretary Arne Duncan to Senator Edward Markey answering questions on FERPA changes – January 2014

Data Quality Campaign – Lots of information about data, including privacy issues

Infographic: Who Uses Student Data? – Data Quality Campaign

Common Sense Media – Advocacy organization working on a School Privacy Zone campaign in an effort to create a set of principles around school technology and sharing of children’s information.