The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at: Be sure to update your bookmarks accordingly!

Are there limitations as to how the community-based organization may use the PII from education records it receives from a school under the school official exception?

Yes.  A community-based organization acting as a school official must be under the ‘‘direct control’’ of the school or LEA with respect to the use and maintenance of education records (§ 99.31(a)(1)(i)(B)(2)) and is also subject to FERPA’s use and redisclosure requirements in § 99.33(a).  The community-based organization must not disclose the information it receives as a school official to any other party without the prior consent of the parent or eligible student, and the organization may only use the information for the purposes for which the disclosure was made.  One way of achieving that direct control is through a written agreement, requiring that any PII from education records provided to the community-based organization by the school only be used to perform the outsourced service or function and may not be used for any other purpose.