Understanding Family Educational Rights and Privacy Act (FERPA)

FERPA is a federal law that protects the privacy of students’ education records. The term “education records” means those records that are (1) directly related to a student and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education (ED).

At the postsecondary level, FERPA affords “eligible students” the right to have access to their education records, the right to seek to have the records amended, and the right to have some control over the disclosure of information from the records.

Under FERPA, an educational institution is prohibited from disclosing personally identifiable information from students’ education records without consent unless the disclosure meets an exception to FERPA’s general consent requirement. Examples include school officials with legitimate educational interest, such as institutional research staff conducting analyses of prison education program effectiveness; other schools to which a student is transferring; staff conducting audit or evaluation activities; appropriate parties in connection with financial aid to a student; organizations conducting studies for or on behalf of the school; accrediting organizations; judicial or legal staff to comply with a judicial order or lawfully issued subpoena; appropriate officials in cases of health and safety emergencies; and state and local authorities, within a juvenile justice system, pursuant to specific state law.

Schools may disclose, without consent, “directory” information such as a student’s name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell eligible students about directory information and allow parents and eligible students a reasonable amount of time to opt out of disclosure. It is important to note that opting out of directory information disclosure does not preclude institutions from using student education records for audit, evaluation, and program improvement purposes.

FERPA and Prison Education Programs

Postsecondary institutions enrolling incarcerated students must navigate the challenges of providing higher education in prison while also complying with FERPA guidelines. For example, students in prison education programs face restrictions on the use of technology that make it difficult for them to access the information needed to complete their Free Application for Federal Student Aid (FAFSA). Prison education programs may need to develop a process for securing student consent so that school staff can access student education records and help facilitate FAFSA completion.

Institutions operating future Pell-eligible prison education programs may also be required to collect data on various student activities and outcomes, including access to academic and career services, corrections transfers, post-release enrollment, completion rates, and job placement rates. Given that some institutions may gain access to sensitive student information (e.g., transfer facility, sentence length, time to release, etc.), ED guidance suggests institutions that receive such information that is not used in the determination of federal financial aid eligibility should develop internal policies on redaction in close collaboration with their counsel. Any decision to redact information appearing in incarcerated students’ records should follow applicable privacy laws, including FERPA.

To solve these challenges, some institutions are exploring the use of third-party technology to overcome facility restrictions and deliver distance education to incarcerated students or send FERPA-protected student data such as grades. As institutions consider implementing third-party technology and/or collecting student information from incarcerated students and the department of corrections (DOC), they must carefully evaluate how student consent and privacy of education records impact such efforts. For example, it is common practice for DOC to require students with online accounts to provide their passwords so DOC can access their information. In this context, it is important that data sharing agreements between DOCs and postsecondary institutions explicitly address protections for FERPA-related data.

Recommendations

ED recommendations for implementing FERPA in the context of prison education programs include the following:

• New language should be adopted when discussing FERPA issues, moving away from using “FERPA release” to “consent to share information.”
• Every request for students to provide consent for the college to share their information should be accompanied with a standard support letter from the education director of the state DOC.
• Conducting orientations/seminars on understanding FAFSA and the consent form should be mandatory. This step could be built into the current delivery of financial aid advisement.
• Sharing of the student’s education record as governed by student consent should include relevant DOC representatives rather than staff names. For example, the consent request could specify job titles, such as education director, education coordinator, site-based education navigator, or unit team counselor. If a postsecondary institution needs to list actual staff names, the consent must be collected every time there is a change in staff.

Additional Resources

ED runs the Privacy Technical Assistance Center (PTAC) as a one-stop resource for answering questions and addressing concerns related to privacy, confidentiality, and security practices. The center provides timely information and updated guidance on privacy, confidentiality, and security practices through a variety of resources, including training materials and opportunities to receive direct assistance with privacy, security, and confidentiality of student data systems. Institutions may also contact PTAC directly at https://studentprivacy.ed.gov/contact.

For additional resources and information related to federal student privacy laws, see https://studentprivacy.ed.gov/. Examples of resources offered by PTAC that contain extensive information on student privacy rights include the following:

• An Eligible Student Guide to the Family Educational Rights and Privacy Act (FERPA)
• FERPA 101: For Colleges & Universities
• FERPA 201: Data Sharing under FERPA
• Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices