The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at: Be sure to update your bookmarks accordingly!

Letter to Miami University re: Disclosure of Information Making Student's Identity Easily Traceable

October 19, 2004

Ms. Robin Parker
General Counsel
Miami University
Roudebush Hall
Oxford, Ohio 45056-3653

Dear Ms. Parker:

This is to respond to your September 15, 2004, letter informing this Office about three requests for student disciplinary information that Miami University (University) has received from Channel 8 Fox News (Channel 8) in Cleveland, Ohio. This Office administers the Family Educational Rights and Privacy Act (FERPA) and is responsible for providing technical assistance to educational agencies and institutions to ensure compliance with the statute and regulations (20 U.S.C. § 1232g; 34 CFR Part 99).

You provided the following information about the three requests from Channel 8:

1. On April 7, 2004, Channel 8 requested student disciplinary information, from January 1, 1999, to date, under 34 CFR § 99.31(a)(14) and the Ohio Public Records Act. In response to the request, and in accordance with FERPA, the University provided the following information with respect to each student who was an alleged perpetrator of a crime of violence or non-forcible sex offense found responsible for committing a violation of the Miami University Code of Student Conduct:

  • Name of the Student,
  • Section of the Code of Student Conduct violated, and
  • Sanction imposed by the institution.

2. On August 12, 2004, Channel 8 requested "redacted copies of incident reports and victim statements related to all student disciplinary proceedings between January 1, 1999 through the present, in which it was ultimately determined the student violated Section 103 of the Code of Student Conduct by perpetrating an act of physical or sexual assault." Under Ohio's Public Records Act (ORC 149.43) and in accordance with both the state and federal court decisions in The Miami Student v. Miami Universitylawsuits, the University is required to release student disciplinary records after redacting all personally identifiable information. Your letter indicates that because Channel 8 "had previously received personally identifiable information for some of these records in response to [the reporter's] first request for disciplinary information under 34 C.F.R. 99.31(a)(14), we are taking great care in redacting the records response to [their] August 12, 200[4] request to ensure that all personally identifiable information is redacted." However, it is not clear from your letter how much information you believe needs to be removed in order to protect the identity of the students. You stated that the University expects to produce these redacted records in the near future.

3. August 26, 2004, Channel 8 sent a request to the University's Police Department, which is a law enforcement unit under FERPA. The request contained a list of the names of students who had been found to have violated the Code of Student Conduct, Section 103, Physical or Mental Abuse or Harm that the University gave to Channel 8 in response to its first request. Channel 8 requested copies of any and all police reports in which any of the listed students were identified as suspects. The University informed Channel 8 that it would only provide reports of those individuals who had actually been charged with a crime. The University also stated that Police reports regarding uncharged suspects are not public records under Ohio's Public Records Act. These reports are public records once a suspect has been charged with a crime.

Your letter concludes:

Although we have complied with all applicable provisions of FERPA and Ohio's Public Records Act ... the cumulative effect of this compliance is the release of the names of student victims and witnesses that can be easily linked to identified student disciplinary actions. As you know, 34 C.F.R. 99.31(a)(14)(ii) provides that the institution may not disclose the name of any other student, including a victim or witness, without the prior written consent of the other student... Obviously we must comply with the applicable law and regret that the effect of compliance has been the release of student victim and witness names."

An educational agency or institution subject to FERPA may not have a policy or practice of disclosing education records, or non-directory personally identifiable information from education records, without the prior written consent of the parent or eligible student1except as provided by law. 20 U.S.C. § 1232g(b); 34 CFR Subpart D. "Education records" are defined as "those records, files, documents, and other materials which -

  1. contain information directly related to a student; and
  2. are maintained by an educational agency or institution or by a person acting for such agency or institution.

20 U.S.C. § 1232g(a)(4)(i) and (ii). See also 34 CFR § 99.3 "Education records." Excluded from the definition of "education records" are records of the law enforcement unit of an educational agency or institution, but only under the conditions described in § 99.8 of the FERPA regulations. See 20 U.S. § 1232g(a)(4)(i) and (ii) and 34 CFR § 99.3 "Education records."

In 1998, Congress amended FERPA as follows to allow postsecondary institutions to disclose without meeting the prior written consent requirements limited information from certain kinds of disciplinary proceedings:

(B) Nothing in this section shall be construed to prohibit an institution of postsecondary education from disclosing the final results of any disciplinary proceeding conducted by such institution against a student who is an alleged perpetrator of any crime of violence (as that term is defined in section 16 of title 18, United States Code), or a nonforcible sex offense, if the institution determines as a result of that disciplinary proceeding that the student committed a violation of the institution's rules or policies with respect to such crime or offense.

(C) For the purpose of this paragraph, the final results of any disciplinary proceeding--

(i) shall include only the name of the student, the violation committed, and any sanction imposed by the institution on that student; and

(ii) may include the name of any other student, such as a victim or witness, only with the written consent of that other student.

Pub. L. No. 105-244, § 951, 105th Cong., 2nd Sess. (October 7, 1998). (Emphasis added.) Under this amendment, postsecondary institutions may - but are not required by FERPA to - disclose the name of the student who was disciplined and the final results of a disciplinary proceeding in which the institution determines that the student is an alleged perpetrator of a crime of violence or non-forcible sex offense and the student has committed a violation of the institution's rules or policies. See specifical § 99.31(a)(14) and § 99.39 for the regulatory provisions that implement this amendment. In enacting this amendment to FERPA, Congress made it clear that a postsecondary institution may not disclose the name of any other student that might be part of a disciplinary proceeding against a student - such as a victim or witness - unless that other student has provided prior written consent under FERPA.

FERPA also permits an educational agency or institution to disclose education records without meeting the written consent requirements in § 99.30 if it has removed all "personally identifiable information" from the records. "Personally identifiable information" includes, but is not limited to, the following information:

  1. the student's name;
  2. the name of the student's parent or other family member;
  3. the address of the student or the student's family;
  4. a personal identifier, such as the student's social security number or student number;
  5. a list of personal characteristics that would make the student's identity easily traceable; or
  6. other information that would make the student's identity easily traceable.

34 CFR § 99.3, "Personally identifiable information." (Emphasis added.) Thus, FERPA-protected information may not be released in any form that would make the student's identity easily traceable (unless there is a specific exception to the written consent requirement).

Occasionally, a student's identity may be "easily traceable," even after removal or redaction of nominally identifying information from student-level records. This may be the case, for example, with a highly publicized disciplinary action, or one that involved a well-known student, where the student could be easily identified in the community even after the record has been "scrubbed" of identifying data. In these circumstances, FERPA does not allow disclosure of the education record in any form without consent because the irreducible presence of "personal characteristics" or "other information" make the student's identity "easily traceable."

A student's identity may also be "easily traceable" in the release of aggregated or statistical information derived from education records. See, for example, our September 25, 2003, letter to the Board of Regents of the University System of Georgia available The Board had asked about a newspaper's request for sensitive data about students in aggregate form categorized into specific groupings that the Board believed could be used to identify students, especially through multiple releases. This Office advised the Board that in these circumstances we had insufficient information to determine whether the disclosures would violate FERPA, that the institution itself had to make the determination whether a student's identity would be easily traceable and, if so, they could not disclose the information in that form. This decision was based on our recognition that at least at the outset, agencies and institutions themselves are clearly in the best position to analyze and evaluate this requirement based on their own data, and under FERPA the burden is on the agency or institution not to release either aggregated or de-identified ("redacted") student level data if it believes that personal identity is easily traceable based on the specific circumstances under consideration. We also recognized in the letter to the Board of Regents of the University System of Georgia that FERPA prohibits the disclosure of personally identifiable information from education records without consent even where an individual's personal identity is revealed through a series or combination of requests that are available to those in possession of the data.

In the present inquiry, we have not had an opportunity to review and evaluate any of the disclosures you have made or propose to make in response to Channel 8's request. However, we do wish to register our concern regarding your statement that the cumulative effect of your compliance with FERPA and Ohio's Public Record Act is "the release of the names of student victims and witnesses that can easily be linked to identified student disciplinary actions." As explained below, the University would not be in compliance with FERPA if the identities of student victims and witnesses were easily traceable, even after their names and other identifying information had been redacted from incident reports and victim statements, because of the release of other, unredacted disciplinary records and law enforcement unit records.

The University may disclose, without prior written consent, law enforcement unit records because they are excluded from the definition of education records under FERPA. Similarly, the University may disclose, without prior written consent, the final results of disciplinary proceedings in which the student was an alleged perpetrator of a crime of violence or non-forcible sex offense and it was determined that the student violated the University's rules or policies with respect to that allegation because there is a statutory exception in FERPA that permits this disclosure.

However, it appears that your planned decision to release redacted copies of incident reports and victim statements relating to certain disciplinary proceedings in response to Channel 8's August 12th request would not comply with FERPA. Previous State and Federal court decisions involving the University discuss the amount of redaction of certain items of information that is required before releasing, pursuant to an open records request, disciplinary records not subject to any statutory exception to the prior written consent requirement under FERPA. While the redaction of these items of information (student's name, social security number, student ID number, and the exact date and time of the incident) may generally be sufficient to remove all "personally identifiable information" under FERPA, and may have been sufficient under the circumstances involved in those cases, the facts are clearly different here because the University has already disclosed other documents to Channel 8 that contain information that you state will make the identities of student victims and witnesses easily traceable. As we have advised previously, redaction of nominally identifying information may not be sufficient to prevent a student's identity from being easily traceable with respect to a highly publicized incident, or with respect to a series of requests for information that make a student's identity easy to trace due to the disclosure of related information.

In sum, where a disclosure of personally identifiable information in education records does not fall within an exception to the prior written consent rule, we believe that the University itself is in the best position to determine, at least at the outset, what information must be removed from education records in order to ensure that a student's identity is not easily traceable. If, because of other records that have been released, the redaction of names, identification numbers, and dates and times of incidents is not sufficient to prevent the identification of a student involved in a disciplinary proceeding, including, but not limited to, student victims and student witnesses, then FERPA prohibits the University from having a policy or practice of releasing the information as such. The University either must remove or redact all of the information in the education record that would make a student's identity easily traceable or refuse to release the requested education record at all.

Thank you for contacting us regarding this matter. I trust this guidance will assist you in complying with FERPA in this regard.



LeRoy S. Rooker
Family Policy Compliance Office

[1] "Eligible student" means a student who has reached 18 years of age or is attending an institution of postsecondary institution at any age. See 34 CFR § 99.3 "Eligible student." The rights under FERPA belong to the parents of students under the age of 18 at the elementary/secondary level and transfer to the student when he or she becomes an "eligible student."