The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at: Be sure to update your bookmarks accordingly!

Should the school or LEA contact FPCO if the community-based organization has violated FERPA?

While FERPA does not require that you notify us, we recommend that you contact FPCO if a community-based organization violates FERPA and provide us with information concerning the violation and any actions that you have taken.  FPCO has the authority to impose what is informally known as “the five-year rule ban” against the community-based organization if FPCO determines that it has violated certain provisions under FERPA.  The five-year rule means that FPCO can instruct the originating LEA or school to not provide the community-based organization with further access to PII from students’ education records for a minimum period of five years.  FPCO may impose a longer period of time in which the community-based organization may not have access to PII.  The five-year rule ban applies regardless of whether the community-based organization is a recipient of Department funds.  For more information on penalties for FERPA violations, see 34 CFR § 99.67.