The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at: Be sure to update your bookmarks accordingly!

May the community-based organization receiving PII from education records redisclose PII from education records without written consent?

No.  Regardless of whether the community-based organization received the PII under the school official, studies, or audit/evaluation exception, the answer is the same – the community-based organization may not redisclose it unless such redisclosure is on behalf of the disclosing entity and is consistent with FERPA.  (34 CFR § 99.33).  If further redisclosure is contemplated, we recommend that provisions addressing authorized redisclosures be included in any agreement with the community-based organization.

A community-based organization may make further disclosures of PII from education records if the disclosure of the information is on behalf of the educational agency or institution, the disclosure meets one of the exceptions to consent (listed in § 99.31), and the educational agency or institution has complied with any applicable recordkeeping requirements in § 99.32(b).  Thus, any community-based organization receiving PII from a school or LEA may only use it for the purposes for which the disclosure was made, and is not permitted to further disclose it to other parties unless authorized to do so by the school or LEA under one of the exceptions to consent.