The U.S. Department of Education is required to notify annually each state educational agency (SEA) and each local educational agency (LEA) of their obligations under the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA). This letter serves to provide that notification to the LEA and to provide you general guidance and reference information for each of the laws discussed below.
The Family Educational Rights and Privacy Act (FERPA)
Statute: 20 U.S.C. § 1232g. Regulations: 34 CFR Part 99.
Rights of Parents
FERPA provides that an LEA that receives Department funds may not have a policy or practice of denying parents the right to:
- Inspect and review education records within 45 days of a request (34 CFR § 99.10);
- Seek to amend education records believed to be inaccurate (34 CFR §§ 99.20, 99.21, and 99.22); and
- Consent to the disclosure of personally identifiable information from education records except as specified by law (34 CFR §§ 99.30 and 99.31).
These rights transfer to the student when he or she turns 18 years of age or enters a post-secondary educational institution at any age (“eligible student”). The Family Policy Compliance Office (FPCO) in the Department has issued guidance documents about FERPA for parents and for eligible students. Those documents are available on FPCO’s website: www2.ed.gov/policy/gen/guid/fpco/ferpa/parents.html and www2.ed.gov/policy/gen/guid/fpco/ferpa/students.html.
Regulatory Changes
On Dec. 9, 2008, and again on Dec. 2, 2011, the Department published final regulations in the Federal Register amending the FERPA regulations.
Link to 2011 changes: www.gpo.gov/fdsys/pkg/FR-2011-12-02/pdf/2011-30683.pdf.
Link to 2011 Guidance on Reasonable Methods and Written Agreements: www2.ed.gov/policy/gen/guid/fpco/pdf/reasonablemtd_agreement.pdf
Link to 2008 changes: www2.ed.gov/legislation/FedRegister/finrule/2008-4/120908a.pdf
Annual Notice
LEAs must annually notify parents and eligible students of their rights under FERPA. 34 CFR § 99.7. A model FERPA notification for LEAs is enclosed and is also available on FPCO’s website: www2.ed.gov/policy/gen/guid/fpco/ferpa/lea-officials.html. The annual notification must include:
- The procedure to inspect and review education records;
- The procedure to request amendment of education records;
- A specification of criteria for determining who constitutes a school official and what constitutes a legitimate educational interest if the educational agency or institution discloses or intends to disclose personally identifiable information to school officials without consent; and
- The right of parents to file a complaint with the FPCO in the Department.
In addition, LEAs may want to include with their annual notification of rights under FERPA directory information public notices, as discussed below.
Directory Information
If the LEA or educational institution under the LEA chooses to designate directory information, which can be disclosed from education records without consent, it is required by 34 CFR § 99.37 to notify parents and eligible students concerning its use of directory information. A model “directory information” notice is available on FPCO’s website: www.ed.gov/policy/gen/guid/fpco. The notice must notify parents and eligible students of:
- The types of information the LEA (or institution) has designated as directory information (see 34 CFR § 99.3 “Directory information” for definition); and
- The right to opt out of disclosure of directory information.
An LEA or educational institution is not required to have directory information, but most institutions find that it is very useful. Proper designation of directory information permits a school to use directory information to publish items such as yearbooks, graduation announcements, newsletters, or honor roll announcements without having to get written consent from each student’s parent each time information is disclosed for these types of activities.
In 2011, the Department amended the FERPA regulations, making three changes to the directory information provisions.
- The definition of “directory information” in § 99.3 was modified to clarify that an educational agency or institution may designate as directory information and non-consensually disclose a student ID number or other unique personal identifier that is displayed on a student ID card or badge if the identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity, such as a PIN, password or other factor known or possessed only by the authorized user.
- Section 99.37(c) was amended to clarify that parents and eligible students may not use their right to opt out of directory information disclosures to prevent an educational agency or institution from requiring students to wear or otherwise disclose student ID cards or badges that display information that may be designated as directory information under § 99.3 and that has been properly designated by the educational agency or institution as directory information under §99.37(a)(1).
- A new § 99.37(d) was added to clarify that an educational agency or institution may specify in the public notice concerning directory information that it provides to parents and eligible students in attendance (§ 99.37(a)) that disclosure of directory information will be limited to specific parties, for specific purposes, or both. An LEA or school that adopts a limited directory information policy must limit its directory information disclosures only to those parties and purposes that were specified in the directory information notice.
Redisclosure and Recordation
LEAs must also comply with FERPA’s recordation and redisclosure provisions, set forth in 34 CFR §§ 99.32 and 99.33, except for disclosures that are specifically exempted. In 2008, amendments were made to both of these provisions, including: requiring a state or local educational authority or federal official or agency that rediscloses personally identifiable information from education records to record that disclosure if the educational agency or institution does not do so under § 99.32(b); revising § 99.32(b) to require an educational agency or institution that makes a disclosure in a health or safety emergency to record information concerning the circumstances of the emergency; and amending § 99.33(b) to permit state and local educational authorities and federal officials that receive education records under § 99.31(a)(3) and 99.35 to disclose education records on behalf of educational agencies and institutions in accordance with the longstanding requirements in § 99.33(b), which applied to other parties that receive education records.
Safeguarding Recommendations
The Dec. 9, 2008, final regulations amending FERPA requirements contained helpful recommendations for handling and protecting education records. Seepages 74843-74844 of the Federal Register notice at the following link on our website: www.ed.gov/legislation/FedRegister/finrule/2008-4/120908a.pdf.
ESEA Provisions Affecting FERPA
Section 4155(b) of the Elementary and Secondary Education Act (ESEA), as amended, 20 U.S.C. § 7165(b), requires that each state that receives funds under the ESEA have “a procedure in place to facilitate the transfer of disciplinary records, with respect to a suspension or expulsion, by local educational agencies to any private or public elementary school or secondary school for any student who is enrolled or seeks, intends, or is instructed to enroll, on a full- or part-time basis, in the school.” Section 99.31(a)(2) of the FERPA regulations provides specifically that an educational agency or institution may disclose education records, without parental consent, to a school in which the student seeks or intends to enroll, subject to conditions set forth in 34 CFR § 99.34. FERPA also allows disclosure of appropriate information regarding specified disciplinary actions to teachers and school officials, including those in other schools, who have legitimate educational interests in the behavior of the student. See 34 CFR § 99.36(b). LEAs should include a notice in their annual notification of rights under FERPA that they forward education records to other schools that have requested the records and in which the student seeks or intends to enroll (34 CFR §§ 99.7, 99.31(a)(2), and 99.34(a)(ii)).
Section 9528 of the ESEA, as amended, 20 U.S.C. § 7908, as well as 10 U.S.C. § 503(c), require LEAs to:
- Give military recruiters the same access to secondary school students as provided to post-secondary institutions or to prospective employers; and
- provide students’ names, addresses and telephone listings to military recruiters, when requested, unless a parent has opted out of providing such information. (Military Recruiter Guidance is on FPCO website: www.ed.gov/policy/gen/guid/fpco/hottopics/ht10-09-02.html.)
Protection of Pupil Rights Amendment (PPRA)
Statute: 20 U.S.C. § 1232h. Regulations: 34 CFR Part 98.
PPRA applies to the programs and activities of an SEA, LEA or other recipient of funds under any program funded by the U.S. Department of Education. It governs the administration to students of a survey, analysis or evaluation that concerns one or more of the following eight protected areas:
- political affiliations or beliefs of the student or the student’s parent;
- mental or psychological problems of the student or the student’s family;
- sex behavior or attitudes;
- illegal, anti-social, self-incriminating or demeaning behavior;
- critical appraisals of other individuals with whom respondents have close family relationships;
- legally recognized privileged or analogous relationships, such as those of lawyers, physicians and ministers;
- religious practices, affiliations or beliefs of the student or student’s parent; or
- income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).
PPRA also concerns marketing surveys and other areas of student privacy, parental access to information and the administration of certain physical examinations to minors. The rights under PPRA transfer from the parents to a student who is 18 years old or an emancipated minor under state law.
LEAs must provide parents and eligible students effective notice of their rights under PPRA. The notice must explain that an LEA is required to obtain prior written consent from parents before students are required to submit to a survey that concerns one or more of the eight protected areas listed above, if the survey is funded in whole or in part by Department funds. For surveys that contain questions from one or more of the eight protected areas that are not funded in whole or in part with Department funds, LEAs must notify a parent at least annually, at the beginning of the school year, of the specific or approximate date(s) of the survey and provide the parent with an opportunity to opt his or her child out of participating. LEAs must also notify parents that they have the right to review, upon request, any instructional materials used in connection with any survey that concerns one or more of the eight protected areas and those used as part of the educational curriculum. (A model PPRA general notification for use by LEAs is enclosed and may also be obtained on FPCO’s website at: www2.ed.gov/policy/gen/guid/fpco/hottopics/index.html.)
PPRA requires LEAs to work with parents to develop and adopt policies on the following items, unless the LEA or SEA had established comparable policies on or before Jan. 8, 2002:
- The right of parents to inspect, upon request, a survey created by a third party before the survey is administered or distributed by a school to students and the procedure for granting a request by a parent for such access;
- Arrangements to protect student privacy that are provided by the LEA in the event of the administration of a survey to students containing one or more of the eight protected items of information noted above (including the right of parents to inspect, upon request, a survey that concerns one or more of the eight protected items of information);
- The right of parents to inspect, upon request, any instructional material used as part of the educational curriculum for students, and the procedure for granting a request by a parent for such access;
- Administration of physical exams or screenings of students;
- The collection, disclosure, or use of personal information (including items such as a student’s or parent’s first and last name, address, telephone number or social security number) collected from students for marketing purposes, or to sell or otherwise provide the information to others for marketing purposes, including the LEA’s arrangements for protecting student privacy in the event of collection, disclosure or use of information for these purposes; and
- The right of parents to inspect, upon request, any instrument used in the collection of personal information for marketing or sales purposes before the instrument is administered or distributed to a student and the LEA’s procedure for granting a parent’s request for such access.
LEAs must notify parents of their rights under PPRA and of these policies at least annually at the beginning of the school year. LEAs must also notify parents within a reasonable period of time if any substantive change is made to the policies. (This notification requirement may be included in the general notification of rights under PPRA.) An LEA is not required to develop and adopt new policies if the SEA or LEA had in place on Jan. 8, 2002, policies covering the requirements set forth in this law. However, the LEA must still provide annual notice of these policies to parents.
In addition, an LEA must “directly” notify, such as through U.S. Mail or email, parents of students who are scheduled to participate in the specific activities or surveys listed below and provide an opportunity for parents to opt their child out of participation in the specific survey or activity. The notification must be provided at least annually at the beginning of the school year and must provide the specific or approximate dates during the school year when activities described below are scheduled, or expected to be scheduled. If the LEA is unable to identify the specific or approximate dates of the activities or surveys requiring specific notification at the beginning of the school year, it must provide this notification to parents once the activity or survey is scheduled. Parents should be provided reasonable notification of the planned activities and surveys and be provided an opportunity to opt their child out, as well as be provided with an opportunity to review any pertinent surveys. A model specific notification for use by LEAs may be obtained on the following website: www.ed.gov/fpco. LEAs must offer an opportunity for parents to opt their child out of participating in the following activities:
- The administration of any survey concerning one or more of the eight protected areas listed above if it is not funded in whole or in part with Department funds. (LEAs must obtain active consent, and may not use an opt-out procedure, if the survey is funded in whole or in part with Department funds);
- Activities involving the collection, disclosure, or use of personal information collected from students for marketing purposes, or to sell or otherwise provide the information to others for marketing purposes; and
- Any non-emergency, invasive physical examination or screening that is 1) required as a condition of attendance; 2) administered by the school and scheduled by the school in advance; and 3) not necessary to protect the immediate health and safety of the student, or of other students. This law does not apply to any physical examination or screening that is permitted or required by state law, including physical examinations or screenings permitted without parental notification.
PPRA does not preempt applicable provisions of state law that require parental notification. Also, requirements concerning activities involving the collection and disclosure of personal information from students for marketing purposes do not apply to the collection, disclosure or use of personal information collected from students for the exclusive purpose of developing, evaluating or providing educational products or services for or to students or educational institutions, such as the following:
- College or other post-secondary education recruitment, or military recruitment;
- Book clubs, magazines, and programs providing access to low-cost literary products;
- Curriculum and instructional materials used by elementary schools and secondary schools;
- Tests and assessments used by elementary schools and secondary schools to provide cognitive, evaluative, diagnostic, clinical, aptitude or achievement information about students (or to generate other statistically useful data for the purpose of securing such tests and assessments) and the subsequent analysis and public release of the aggregate data from such tests and assessments;
- The sale by students of products or services to raise funds for school-related or education-related activities; and
- Student recognition programs.
Definitions of Some Terms Used in PPRA:
“Instructional Material” – instructional content that is provided to a student, regardless of its format, including printed or representational materials, audio-visual materials, and materials in electronic or digital formats (such as materials accessible through the Internet). The term does not include academic tests or academic assessments.
“Invasive Physical Examination” – any medical examination that involves the exposure of private body parts, or any act during such examination that includes incision, insertion or injection into the body, but does not include a hearing, vision or scoliosis screening.
“Personal Information” – individually identifiable information including:
- a student’s or parent’s first and last name;
- a home or other physical address (including a street name and the name of a city or town);
- a telephone number; or
- a social security number.
More information
- Write or call the Family Policy Compliance Office for more information:
Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, S.W.
Washington, D.C. 20202
202-260-3887 - Informal inquiries may be sent to FPCO via the following email addresses: FERPA@ed.gov and PPRA@ed.gov. The FPCO website is: www.ed.gov/fpco.