Student Privacy Rights: FERPA and Beyond

Several federal laws protect student privacy rights. Student education records are protected. Particular student information obtained for marketing purposes cannot typically be disclosed (such as responses to surveys and online websites that collect information about children under 13). Tennessee also has laws that protect student data.

The Family Educational Rights and Privacy Act (FERPA)

FERPA is a federal law that protects the privacy of student education records. FERPA applies to every school that receives funds under an applicable United States Department of Education program. Parents have rights to review and examine their child’s education records until the child turns 18 or attends school beyond the high school level.

FERPA grants parents and eligible students the following rights:

• The right of review. Parents and eligible students have the right to inspect and review their school education records. Schools don’t have to provide copies of the records except where it’s just not practical. Schools can charge a fee for copying records.
• The right to request corrections. Parents can request that inaccurate and misleading records be corrected. If the request is denied, a request for a formal hearing can be made. If the school fails to comply after a hearing, the parents and eligible students have the right to provide their position in a written statement, which is placed with the education record.
• The right to control the release of the records. Generally, schools cannot release education records without the written consent of the parent. FERPA provides that records can be released to the following parties without parental consent:
  • School officials who have a legitimate educational interest
  • Schools to which the student is transferring
  • Certain parties, when there is a request for financial aid for the student
  • Accrediting organizations
  • Subpoenas and judicial orders
  • Authorized officials in instances of health or safety emergencies
  • According to Tennessee juvenile laws
  • “Specified officials for audit or evaluation purposes”

FERPA also authorizes the release, without consent of parents or eligible information, certain “directory” information – the student’s name, address, phone number, place and date of birth, honors, and dates of attendance. However, schools must inform parents and students a reasonable amount of time in advance so the parents/eligible students can request that the directory information be maintained as confidential and not be released.

FERPA requires that schools inform parents and students on a yearly basis of their FERPA rights. Each school has discretion as to the form of the notice – such as a PTA bulletin, student handbook, letter, or newspaper article.

Some other FEPRA details include the following:

• Attendance at a school includes attendance in person and by correspondence
• Attendance includes students who attend school by videoconference, Internet, satellite, or other telecommunication means
• Attendance does not include students who audit a class or who are accepted to a school but don’t attend that school
• Generally, educational record information can be disclosed if any and all information that might connect a specific student to the education record is removed
• There are time limits that govern when requests to review educational records must be filed

According to NACE, FERPA does not create a right to file a court complaint against the education institution for non-compliance. However, complaints can be filed with the Department of Education, which has a duty to investigate all issues. If the United States Department of Education finds that the school is not complying with FERPA, the school or school district may lose federal funding. Some states permit damages for the disclosure of private information.

The Protection of Pupil Rights Amendment

The US Department of Education states that the Protection of Pupil Rights Amendment, or PPRA, is a federal law that has additional education rights other than those provided by FERPA. These rights generally protect student information that may be collected, disclosed, or used for marketing purposes – such as student responses to surveys and other personal information. The PPRA also applies to the inspection of instructional material and certain physical exams. Generally, the information must be provided to parents for inspection before it can be released.

The PPRA also requires that schools obtain the consent of parents before students can participate if the personal information of the student may be disclosed for the following types of information:

• The student’s (or parent’s) political affiliations or beliefs
• Any mental health problems of the student or his/her family
• Sex behavior or attitudes
• The religious affiliations of the student or parents
• The income of the student or parent – except as necessary to determine financial assistance eligibility)
• “Illegal, anti-social, self-incriminating, or demeaning behavior”
• “Critical appraisals of other individuals with whom respondents have close family relationships”
• “Legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers”

Like FERPA, the PPRA applies to schools that receive federal funding through the US Department of Education.

The Children’s Online Privacy Protection Act (COPPA)

This law helps protect minors under 13 from information obtained from commercial websites, online services, and mobile applications. The law is enforced by the Federal Trade Commission (FTC). The law explains the steps these online sites and services must take to protect the privacy and safety of pre-teenagers. COPPA “specifies what an operator needs to include in a privacy policy, what their responsibilities are to protect child privacy and safety online, and when they need to seek verifiable consent from a parent or guardian. The law also sets restrictions on marketing to children under 13.”

While COPPA does not regulate schools, at times, it “may act as the parents’ agent in the consent process.”

According to the FTC, schools can grant consent on behalf of parents when the operator of a website, online service, or application is specific to “the educational context” and is providing a service that is “solely for the benefit of students and the school system.” In other words, the school’s ability to consent for the parent is limited to whether the service is used for school purposes.

Otherwise, the online site/service must obtain permission from the parents.

Tennessee’s Child Privacy Laws

The state of Tennessee also has its own set of privacy laws that protect the disclosure of student data. A few of these laws are:

• The Data Accessibility, Transparency and Accountability Act. This law governs the Tennessee public school employees’ collection of student data. The law “strengthens parental rights with respect to student data privacy.”
• The Student Online Personal Protection Act. This law “primarily addresses the actions of third parties outside of Tennessee schools and districts,” such as vendors, contractors, and online student service companies.

At The Law Office of Perry A. Craft PLLC, our Tennessee education lawyer understands the federal and state laws that protect children. We assert the rights that these laws provide on behalf of the students and their parents. To learn more about ensuring your child’s education is all that it should be, call us or complete our contact form to schedule a consultation.