The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at:  https://studentprivacy.ed.gov. Be sure to update your bookmarks accordingly!

Are there limitations as to how the community-based organization may use the PII from education records it receives from a school under the school official exception?

Yes.  A community-based organization acting as a school official must be under the ‘‘direct control’’ of the school or LEA with respect to the use and maintenance of education records (§ 99.31(a)(1)(i)(B)(2)) and is also subject to FERPA’s use and redisclosure requirements in § 99.33(a).  The community-based organization must not disclose the information it receives as a school official to any other party without the prior consent of the parent or eligible student, and the organization may only use the information for the purposes for which the disclosure was made.  One way of achi

Can schools disclose education records to community-based organizations performing outsourced tutoring programs using the school official exception?

Yes.  If a school chooses to outsource to a community-based organization a tutoring program that it would otherwise use school employees to provide, then the school may disclose the education records without the consent of the parents or eligible students under the school official exception.  However, the community-based organization must meet all the requirements in § 99.31(a)(1)(i)(B) to be considered a school official before the school may disclose the education records to the organization.   

If a school or LEA discloses PII from education records to a community-based organization under a FERPA exception to consent, what and how much PII from education records can it disclose to the organization?

The school or LEA has discretion under FERPA to decide what and how much PII from education records to disclose to community-based organizations (except in certain cases such as a court order or a subpoena).  The school or LEA should determine which data elements are necessary for the activity in question and provide only those elements.  Often LEAs and schools will discover that the organization can do the work in question without receiving PII from education records.

Are there ways that a school or LEA may disclose PII from education records (other than directory information) to a community-based organization without obtaining written consent of the parent or eligible student?

Yes.  If the disclosure meets one of the exceptions set forth in § 99.31 of the regulations, a school or LEA may disclose PII from an education record of a student without consent to a community-based organization.  We note, however, that there are three exceptions to the written consent requirement that schools or LEAs most often consider when disclosing PII from education records to community-based organizations.  These exceptions are the “school official,” “studies,” and “audit/evaluation” exceptions (see 34 CFR §§ 99.31(a)(1), 99.31(a)(6), and 99.31(a)(3) and 99.35, respectivel

May a school disclose de-identified data to community-based organization?

Yes. Schools do not need to obtain written consent or to inform parents or eligible students when releasing properly de-identified information.  For additional information on de-identified data and recommended practices, see § 99.31(b)(1) of the regulations and a relevant case study released by the Department, Case Study #5: Minimizing Access to PII: Best Practices for Access Controls and Disclosure Avoidance Techniques.

May a school disclose directory information to a community-based organization without written consent?

Generally yes.  FERPA allows schools that have adopted directory information policies to disclose properly designated directory information without consent on students whose parents (or eligible students) have not opted out of the disclosure of directory information.  See § 99.37(a).  However, if a school adopts a directory information policy specifying that disclosure of directory information will be limited to specific parties, for specific purposes, or both, then the school is required to limit its directory information disclosures to those specified in its public notice.  S

Who is responsible for obtaining written consent from the parent or eligible student - the school or the community-based organization?

FERPA requires that the parent or eligible student “provide a signed and dated written consent” before a school or LEA discloses PII from a student’s education record, unless one of the conditions in § 99.31 of the regulations applies.  There is nothing in FERPA that would preclude a community-based organization from obtaining a signed and dated written consent as long as the consent: (1) specifies the education records that may be disclosed, (2) states the purpose of the disclosures; and (3) identifies the organization or other parties to whom the disclosure may be made.  34 CFR § 99.30(b)

Is prior written consent of the parent or eligible student required to disclose information to community-based organizations?

In most cases, yes.  Written consent is generally required before personally identifiable information (PII) from students’ education records may be disclosed to community-based organizations.  Except as set forth in § 99.31 of the regulations and in the statutory exceptions to consent at 20 U.S.C.

How does a school know when a health or safety emergency exists so that a disclosure may be made under this exception to consent?

An educational agency or institution must make this determination on a case-by-case basis, taking into account the totality of the circumstances pertaining to a threat to the health or safety of a student or others.  If the school determines that there is an articulable and significant threat to the health or safety of a student or other individuals and that a third party needs PII from education records to protect the health or safety of the student or other individuals, it may disclose that information to appropriate parties without consent. 

Pages

Subscribe to Family Policy Compliance Office RSS