Must a school inform parents and eligible students if the school non-consensually discloses PII from their education records to a community-based organization to which the school has outsourced an institutional service?

No.  While there is no specific notification requirement regarding disclosures under the exceptions to consent, FERPA does require that each school or LEA annually notify parents and eligible students of their rights under FERPA.  34 CFR § 99.7.  As a part of the annual notice, the school or LEA must include in the notification a specification of the criteria for determining who constitutes a school official and what constitutes a legitimate educational interest.  34 CFR § 99.7(3)(iii).  Additional information about the annual notification of rights can be found on the Family Policy Compliance Office’s (FPCO’s) website at: http://www.ed.gov/policy/gen/guid/fpco/index.html. For a model of a K-12 annual notice, see Model Notification of Rights for Elementary and Secondary Schools.

As a best practice for transparency, we recommend that schools and districts post information on their websites about the information they collect about students, how they protect the information, how they use it, parties with whom they share it, and why.