The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at:  https://studentprivacy.ed.gov. Be sure to update your bookmarks accordingly!

Would a CWA or tribal organization be subject to FERPA’s “five-year rule” if it improperly redisclosed PII from education records?

Yes.  FERPA requires that entities to which educational agencies and institutions disclose PII from education records protect that information from further disclosure.  See § 99.33.  Additionally, § 99.67(e) of the FERPA regulations provides that if the Family Policy Compliance Office (FPCO) determines that a third party outside the LEA or school improperly redisclosed PII from education records in violation of § 99.33 of the FERPA regulations, then the educational agency or institution may not provide that third party access to education records for a minimum period of five years.  Thus, if FPCO determines that a CWA or tribal organization improperly redisclosed PII from the education records that it had received from the school or LEA, the school or LEA then would be banned from providing the CWA or tribal organization with access to education records for a minimum of five years.