North Dakota State University

The Family Educational Rights and Privacy Act of 1974 (FERPA) affords students certain rights with respect to their educational records.

• Notification of Rights Under FERPA & Directory Information
• FERPA Guidelines for Faculty & Staff

Under FERPA (Family Educational Rights and Privacy Act of 1974), third parties that have appropriately received non-directory information cannot disclose any data to another third party unless that other third party would have had initial eligibility to have received the information directly. Any such re-disclosure must be done on behalf of the institution and  must be recorded with the name of the party to whom data was re-disclosed and the legitimate interest that party had to the data.

Per the Family Educational Rights and Privacy Act (FERPA), NDSU is responsible for maintaining a record of each request for access for personally identifiable information from education records. Furthermore, any personally identifiable student data that is released to authorized individuals, including state educational authorities, whether in electronic or hard-copy format, must be protected to ensure the confidentiality of the student information. FERPA also requires the proper destruction of information once it is no longer needed for its original purpose.

The disposal of Student Records must occur in accord with NDSU and state retention schedules. Any document (paper, form, microfilm, report, etc.) that contains personally identifiable student information, even if it is not considered to be an official student record, must be destroyed in a secure manner. Such documents include but are not limited to computer-generated files, microfilm/fiche, notes, letters/memos, and forms. See Disposal Resources.

Notes:

• Paper records containing confidential information should be shredded, burned and/or pulped, not simply thrown out with other classes of records or with miscellaneous trash. The use of university-contracted secure document destruction vendors is highly recommended.
• Electronic records containing confidential information require confidential destruction. Deletion of the contents of digital files and emptying of the desktop "trash" is the first step. It also is recommended that commercially available software applications be utilized to remove all data from the hard drive storage. It is recommended that disks and back-up tapes containing sensitive information be physically destroyed.
• Film, audio and videotapes containing confidential information should also be physically destroyed, not simply thrown away.