Can off-duty police officers or School Resource Officers (SROs) be considered school officials under FERPA and, therefore, have access to students’ education records?

Yes, if certain conditions are met.  FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party: 

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records; 
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records. 

As indicated in the listing above, local police officers acting as school officials may only use PII from education records for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of the students.  See §§ 99.31(a)(1)(i)(B)(3) and 99.33(a)(2).  In addition, these officers are subject to FERPA’s redisclosure requirements in § 99.33(a).  This means that a local police officer who is acting as a “school official” under FERPA may not redisclose PII from education records to others, including other employees of his or her police department who are not acting as school officials without consent, unless the disclosure fits within one of the exceptions to consent in FERPA.

Other exceptions may also permit police officers or other outside parties access to PII from students’ education records without consent, such as the subpoena or court order exception, the health or safety emergency exception, or the directory information exception. If the directory information exception is used, the school should verify that the parent or eligible student in question has not opted out of the disclosure of directory information.