The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at:  https://studentprivacy.ed.gov. Be sure to update your bookmarks accordingly!

May the LEA disclose PII from education records to a community-based organization under the audit or evaluate exception for the purpose of the community-based organization evaluating its own program?

Generally no.  The audit or evaluation by an community-based organization of its own program (i.e., to determine whether or not the organization’s program is effective) in most cases would not be permitted under the audit or evaluation exception because the audit or evaluation exception only permits the audit or evaluation of Federal- or State-supported education programs, which FERPA defines as any program principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special

Must the LEA have a written agreement with the community-based organization prior to disclosing PII from education records?

Yes.  The LEA must use a written agreement to designate the community-based organization as its authorized representative.  The written agreement must include certain mandatory components as described in § 99.35(a)(3)(ii) of the regulations.

May an LEA non-consensually disclose PII from education records to a community-based organization in order to conduct an audit or evaluation of the school system’s education programs?

Yes.  FERPA’s audit or evaluation exception allows an LEA to designate a community-based organization as its authorized representative and disclose PII from education records without consent of parents or eligible students to audit or evaluate a Federal- or State-supported education program, or to enforce or comply with Federal legal requirements that relate to those education programs (audit, evaluation, or enforcement or compliance activity).  See 34 CFR § 99.35.  (This provision does not apply to individual schools that are not considered local educational authorities under Stat

When the organization publishes the results of the study can it publish results in a way that allows individual students to be identified?

No.  Absent the prior, written consent from the parent or eligible student, FERPA prohibits PII from education records from being published in a way that would allow individual students and their parents to be identified.  The organization conducting the study can use PII from education records to conduct the study for the school, but results must be published in a way that protects the privacy and confidentiality of the individuals involved.

May the school or LEA non-consensually disclose PII from education records to a community-based organization that is conducting a study for the school or LEA?

Yes.  The studies exception allows for the disclosure of PII from education records without consent to community-based organizations conducting studies for, or on behalf of, the school or LEA.  FERPA limits the purpose of the studies conducted under this exception to:  (1) developing, validating, or administering predictive tests; (2) administering student aid programs; or (3) improving instruction.  See 34 CFR § 99.31(a)(6)(i).  

Must a school inform parents and eligible students if the school non-consensually discloses PII from their education records to a community-based organization to which the school has outsourced an institutional service?

No.  While there is no specific notification requirement regarding disclosures under the exceptions to consent, FERPA does require that each school or LEA annually notify parents and eligible students of their rights under FERPA.  34 CFR § 99.7.  As a part of the annual notice, the school or LEA must include in the notification a specification of the criteria for determining who constitutes a school official and what constitutes a legitimate educational interest.  34 CFR § 99.7(3)(iii).  Additional information about the annual notification of rights can be found on the Family Policy Complia

Must a school have a written agreement or contract with a community-based organization to which it non-consensually discloses education records to outsource an institutional service under the school official exception?

No.  While FERPA does not require written agreements or contracts when a school chooses to outsource an institutional service or function to a community-based organization under the “school official” exception, we highly recommend the use of written agreements in this context.  Written agreements help ensure that the community-based organization understands its obligations and responsibilities with respect to the use of and privacy protections accorded to the FERPA protected information.  Further, appropriate contractual provisions can establish the direct control required by FERPA

Pages

Subscribe to Family Policy Compliance Office RSS