The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at:  https://studentprivacy.ed.gov. Be sure to update your bookmarks accordingly!

What should the school or LEA do if it finds that a community-based organization has misused or inappropriately redisclosed the PII from the education records it received from the school or LEA?

If the community-based organization misuses or inappropriately rediscloses PII from education records, the school or LEA should immediately take steps to address and mitigate any harm or damage caused by the violation.  The LEA or school should evaluate its options under the penalty and termination provisions of its written agreement, contract, or arrangement with the community-based organization and check any relevant State or local laws.  Depending on the severity of the circumstance, the LEA or school may decide to terminate its relationship with the community-based organization and require the organization to destroy or return the education records to the school or LEA.