What Is FERPA?

The Family Educational Rights and Privacy Act governs student education records at institutions in the United States receiving federal education funding, which is effectively all public schools and most higher education institutions.

It grants rights to parents, transferring to students at eighteen or on entering higher education, and restricts disclosure of education records without consent.

What counts as an education record

Records directly related to a student and maintained by the institution or someone acting for it. That is broad: grades, transcripts, disciplinary records, financial aid, health records held by the institution, and in many cases email correspondence about a student.

Excluded are records kept solely by their maker as a personal memory aid, law enforcement unit records, and certain employment records — exclusions that are narrower than institutions frequently assume.

Directory information and the opt-out

Institutions may designate certain categories — name, address, enrolment status, participation in activities — as directory information disclosable without consent, provided students are notified and given an opportunity to opt out.

That designation is a policy decision with real consequences. An expansive directory definition permits wide disclosure; a narrow one restricts routine operations. Either way the annual notice and the opt-out mechanism must actually work.

The school official exception

Disclosure without consent is permitted to school officials with a legitimate educational interest, and that category can include contractors and service providers performing an institutional function.

This is how educational technology vendors lawfully receive student data, and it carries conditions: the vendor must be under the institution's direct control regarding use and maintenance of the records, and must not redisclose. Those conditions belong in the contract.

The educational technology problem

Institutions use a great many third-party learning, assessment and administrative services, each receiving student data. Contracts are frequently signed at department level without privacy review.

Maintaining an inventory of which services hold student data, under what terms, is the practical foundation. Related state laws impose additional restrictions on educational technology vendors in several jurisdictions.

Enforcement and its shape

Enforcement is administrative rather than through private lawsuits. The ultimate sanction is withdrawal of federal funding, which is severe enough that it has not been used, so practical enforcement consists of investigations and required corrective action.

That makes reputational and contractual consequences the realistic risk, alongside the state laws that do carry penalties.

The related state and sector laws

Several states have enacted student data privacy laws that impose direct obligations on educational technology vendors — restrictions on advertising, profiling and secondary use — with penalties the federal statute lacks.

Institutions also frequently hold data covered by other regimes simultaneously: health records in student health services, payment card data in fee collection, and research data under its own requirements. Treating student records as the only applicable regime understates the compliance surface.

Where to start

Inventory the third-party services holding student data and check whether each contract restricts use and redisclosure. Departmental purchasing means the list is usually longer than the central record shows.

See data retention policy. GuardsArm runs compliance auditing.