Who is responsible for obtaining written consent from the parent or eligible student - the school or the community-based organization?

FERPA requires that the parent or eligible student “provide a signed and dated written consent” before a school or LEA discloses PII from a student’s education record, unless one of the conditions in § 99.31 of the regulations applies.  There is nothing in FERPA that would preclude a community-based organization from obtaining a signed and dated written consent as long as the consent: (1) specifies the education records that may be disclosed, (2) states the purpose of the disclosures; and (3) identifies the organization or other parties to whom the disclosure may be made.  34 CFR § 99.30(b).