Changes/Updates to the FERPA Rules
In December 2008, the following amendments were made to the FERPA Rules in order to implement provisions of the USA Patriot Act and the Campus Sex Crimes Prevention Act.
This revised the definition of directory information to include a student's ID number. If a student ID number cannot be used to access records or communicate electronically without one or more additional factors to authenticate the user's identity, then the educational institution may treat it as directory information
Student Identification and Communication in Class
Previously, an opt-out from directory information was not addressed as it applied to the identification of a student in the classroom setting. The amended regulations provides that an opt-out from directory information does not prevent the institution from identifying a student in the classroom by either name or email. This further clarifies that a student's opt-out from directory information does not include the right to be anonymous within the classroom.
Registered Sex Offenders
The regulations now simply allows disclosure without consent of any information concerning registered offenders provided to an educational agency or institution under 42 U.S.C. 14071 and applicable Federal guidelines.
Redisclosure of Education Records and Recordkeeping by State and Local Educational Authorities and Federal Officials and Agencies
- Provides that a State or local educational authority or Federal official or agency that makes further disclosures of information from education records must record the names of the additional parties to which it discloses information on behalf of an educational agency or institution and their legitimate interests.
- Provides that a State or local educational authority or Federal official or agency that records further disclosures of information may maintain the record by the student's class, school, district or other appropriate grouping rather than by the name of the student.
- Provides that upon request of an educational agency or institution, a State or local educational authority or Federal official or agency that maintains a records of further disclosures must provide a copy of the record of further disclosures to the educational agency or institution within a reasonable period of time not to exceed 30 days.
- Requires educational agencies and institutions to list in each student's record of disclosures the names of the State and local educational authorities and Federal officials or agencies that may make further disclosures of the information on behalf of the educational agency or institution.
- Requires an educational agency or institution to obtain a copy of the record of further disclosures maintained by a State or local educational authority or Federal official or agency and make it available in response to a parent's or student's request to review the student's records of disclosures.
- Provides that the study must be conducted in a manner that does not permit personally identifiable information of parents or students by anyone other than representatives of the organization that have legitimate interest in the information.
- Requires the written agreement to specify the purpose, scope, and duration of the study and the information to be disclosed; requires the organization to use personally identifiable information from education records only to meet the purpose or purposes of the study; limits any disclosures of information; and requires the organization to destroy or return to the educational agency all personally identifiable information when it is no longer needed for the purposes of the study.
Personally Identifiable Information and De-Identified Records and Information
- Added the definition of biometric record, which means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints, retinal and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting.
- Removed the requirement that the requestor have "direct, personal knowledge," and revised that to state personally identifiable information means information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the record relates.
In 2008, amendments to the Federal Register expanded the "school official" exception to include contractors, consultants, volunteers, and other outside service providers used by a school districtict or post secondary institution to perform institutional services and functions. This means that outside service providers can have access to educational records, if they fall under the following provisions:
- They are performing an institutional service or function for which the institution would otherwise use employees.
- They are under the direct control of the institution with respect to the use and maintenance of the educational records.
- They are subject to the FERPA rules governing the use and redisclosure of personally identifiable information from education records.
An institution may not disclose educational records to an outside service provider under this exception unless it has specified in its annual FERPA notification that it uses contractors, consultants, volunteers, etc., as school officials to provide certain institutional services and functions.
Notification of subpoena
Clarification was required about who is responsible for notifying the parents and eligible students before any third party outside the educational agency or institution discloses educational records to comply with a lawfully issued subpoena or court order. The FERPA regulation has been revised to provide that the burden to notify a parent or eligible student rests with the recipient of the subpoena or court order.
Health or Safety Emergencies
This provision has been amended to read that if there is an articulable and significant threat to the health or safety of the student or other individuals, an educational agnecy or institution may disclose information to appropriate parties.
The term "articulable and significant threat" just means that the institution must be able to articulate what the threat is when it makes and records the disclosure.