Department of Education Release New Family Educational Rights and Privacy Act (“FERPA”) Guidance

In February of 2019, the U.S. Department of Education (“Department”) released new guidance (“Guidance”) regarding school resource officers, school law enforcement units, and the Family Educational Rights and Privacy Act (“FERPA”). FERPA applies to all education agencies and institutions receiving funds from the Department. However, the Guidance frequently notes that the information provided in the document, while applicable to all educational agencies and institutions, focuses generally on the elementary and secondary schools.

Background

Education Records are records that are related to the student and maintained by the school. FERPA defines Education Records as: records, files, documents and other materials which (i) contain information directly related to the student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution.

Generally, schools are required to maintain a record of each disclosure and request for access to PII from the Education Record of each student for as long as the Education Records are maintained. The Guidance notes two categories of records which are not protected by FERPA because they are specifically excluded from the definition of Education Records including: records of Law Enforcement Units and Directory Information.

Law Enforcement Unit records are records that are: (1) created by a Law Enforcement Unit; (2) created for a law enforcement purpose; and (3) maintained by the Law Enforcement Unit. The Guidance advises Law Enforcement Units to maintain their records separately from Education Records. Directory Information can include the student’s name, address, telephone listing, email address, photograph, date and place of birth, grade level, dates of attendance, and participation in officially recognized activities and sports.

Exceptions to Written Consent Requirement

FERPA requires a school to have written consent from a parent or eligible students in order to disclose the student’s PII from Education Records. There are several identified exceptions to the general written consent requirement which are explored below.

Directory Information

A school may disclose Directory Information to third parties without prior consent, as long as the school has given proper public notice to parents and eligible students. Notice requires the following information:

1. The types of PII that is designated as Directory Information;
2. The right of parent or eligible student to restrict disclosure of Directory Information; and
3. The period of time within which a parent or eligible student has to notify the educational agency or institution in writing that he or she does not want any or all of those types of information designated as Directory Information.

School Officials: Law Enforcement Units and Threat Assessment Teams

If certain conditions apply, Law Enforcement Unit officials who are employees of a school may be considered School Officials under FERPA if they meet the school’s identified criteria of a School Official. Recall, FERPA regulations do not expressly identify roles or job duties that are considered School Officials; instead, a school must enumerate specific criteria to be used for determining who constitutes a School Official and must provide the specific criteria in their annual notification of FERPA rights. Law Enforcement Unit officials who are off-duty police officers or SROs may be considered school officials if the school has outsourced security to the Law Enforcement Unit officials. To qualify as a school official under FERPA, Law Enforcement Unit officials should:

1. Perform an institutional service or function for which the school or district would otherwise use employees (e.g., to ensure school safety);
2. Are under the “direct control” of the school or district with respect to the use and maintenance of the Education Records;
3. Are subject to FERPA’s use and re-disclosure requirements in 34 CFR 99.33(a), which provides that the PII from Education Records may be used only for the purposes for which the disclosure was made, and which limits the re-disclosure of PII from Education Records; and
4. Meet the criteria specified in the school or district’s annual notification of FERPA rights for being school officials with legitimate education interest in the Education Records.
   The Guidance recommends having Law Enforcement Unit officials complete a Memorandum of Understanding in regard to the provisions above. In some instances a school may want to involve outside law enforcement officials, mental health officials, and other experts in the community to serve on the school’s Threat Assessment Team. Such members may qualify as School Officials if they meet the school’s identified criteria. The Guidance suggests ensuring members of Threat Assessment Teams are knowledgeable and aware of FERPA requirements by having team members sign an acknowledgment form.

Health or Safety Emergency

FERPA permits school officials to disclose, without consent, Education Records to appropriate parties in connect with an emergency if knowledge of that information is necessary to protect the health or safety of the students or other individuals. This exception is limited to the period of the emergency and does not allow for a blanket release of PII from a student’s Education Records. The Guidance does not necessarily provide any new insight regarding FERPA regulation in this area. The Department remains mostly deferential to schools in regards to determining the existence of health or safety emergency and the appropriate approach to a threat or potential threat. This permits schools to consider cases and the potential disclosure of information without consent on a case by case basis provided there was reasonable belief of an “articulable and significant threat” and that an “appropriate party”² to receive information was notified.

Sapphire M. Andersen, 2L
Sean T. Nakamoto

^{1 The Guidance states that an “articulable and significant threat” is a flexible standard in which “a school official is able to explain, based on all the information available at the time, what the threat is and why it is significant when he or she makes and records the disclosure.” 34 CFR 99.36.
2 The Guidance determines that an “appropriate party” under FERPA is “a party whose knowledge of such information is necessary to protect the health and safety of the student or other persons.”}