The Family Educational Rights and Privacy Act (FERPA), also commonly know as the Buckley Amendment, become law in November 1974 to protect the privacy of personally identifiable information in a student’s education record. However, the courts have been clear that not every document that names or refers to a student is a FERPA record and have typically limited the reach of the statute in a common-sense way to records that have something to do with educational activity
FERPA serves a two-fold purpose: (1) to grant parents (and students 18 or older) access to information in the student’s education record, and (2) to protect that information from disclosure to third parties without parental consent.
FERPA applies to any educational institution that receives any federal funding, which includes all public schools and the vast majority of private institutions. On request, a school must allow a parent (or eligible student) to:
A school MAY NOT CHARGE FEES for granting access to inspect and review the record. However, FERPA does not require the school to provide copies of a record, so the school may charge a fee for copies made at the school’s discretion.
The law withholds federal funds from any school with “a policy or practice of permitting the release of education records” or of the “personally identifiable information” contained in those records, unless the adult student or parent has consented or another exception in the law applies. In other words, if a school has a policy or practice of improperly disclosing students’ education records (or not disclosing information it is required to disclose), it could potentially lose all federal funding. As discussed below, the Department of Education has never imposed such a drastic penalty and demonstrating that a school has a “policy or practice” of violating FERPA is different from demonstrating an occasional violation.
It is crucial to note that FERPA only prevents the disclosure of education records. Nevertheless, schools and colleges persistently cite FERPA as a convenient all-purpose excuse to deny journalists’ requests for public records, even when the records have little relation to a student’s “educational life,” including:
While the original goal of the law was to protect the privacy of student files, FERPA has been amended and interpreted so many times that today it can be difficult to determine exactly what information is and is not protected as part of an education record.
There are two essential criteria for a document to be considered part of an “education record” under FERPA: (1) the record must “directly relate” to a student, and (2) must be “maintained by an educational agency or institution or by a person acting for such agency or institution.”
Many of the documents that schools and colleges mistakenly believe to be FERPA records – for example, the footage from a security video shot aboard a school bus – do not usually qualify as “education records” under this definition. There is no right of a parent to have a hearing to challenge the accuracy of a security video, or to insert explanatory comments into the video. Thus, the Department itself has taken the position that FERPA applies only to the types of records that, in Senator McIntyre’s words, would be “used by the institution in making decisions that affect the life of the student.”
For a record to directly relate to a student, the student must be the focus of the record, not simply in the background or incidental to a report. For example, in a photograph depicting two students playing at a basketball game, the DOE has said the photo would not directly relate to any of the students pictured in the background, as they were not the focus of the photo.
Another example comes from a 2011 case where the University of Florida refused to release tapes and transcripts of Student Senate meetings under FERPA. A judge ordered the release of the transcripts, finding that, although the documents contained the names and voices of students, they were not the records “of” any particular student for FERPA purposes.
The Supreme Court has described education records as “institutional records kept by a single central custodian, such as a registrar . . .” In other words, for FERPA to apply, the record in question must be systematically maintained by the school. For example, psychological evaluations and notes on disciplinary actions are considered education records subject to FERPA.
Examples of records that are NOT centrally maintained and subject to FERPA include:
Directory Information: FERPA recognizes a class of basic demographic information known as “directory information,” that can safely be released without violating FERPA. This includes such data as a student’s name, address, phone number, honors and awards, and other basic demographics. Schools must tell parents (or eligible students) what will be disclosed and give them an opportunity to submit an opt-out form. For those who opt out, even directory information is not to be disclosed.
However, even basic directory information can be subject to FERPA if “when one or more pieces of information are combined it would allow a reasonable person to identify a child.” In a 2017 case, the Louisiana Court of Appeals ruled that even general information such as the total number of students enrolled in each grade, ethnic group designations, disability statistics, and how many students qualify for free or reduced lunch could be protected from disclosure under FERPA because that information could be “linkable to a specific student . . . with reasonable certainty” even by someone “who does not have personal knowledge of the relevant circumstances.”
Interestingly, in 2008 and 2011, the DOE expanded its definition of “school officials” to include contractors or other parties with whom the school has a contract for institutional services, including companies like Google and Facebook. According to a report by the National Center for Education Policy at the University of Colorado at Boulder, this means that “without consent, school officials may release student records for any educational purpose they deem legitimate.” In other words, many schools are free to release information on students to any company that operates under an education contract without violating FERPA. This is causing increasing concern for parents and students who are worried about their personal information being used for market research without their knowledge or consent.
General Information: FERPA applies to the disclosure of tangible records and information derived from those records. However, FERPA does not protect the confidentiality of information in general, and, therefore, does not apply to information derived from a source other than education records (even if education records exist that contain that information). As a general rule, information that is obtained through personal knowledge or observation (and not from an education record) is not protected under FERPA. This should be reassuring for student journalists, because it affirms that information students gather during interviews (like a student’s discussion of his failing grades or his disciplinary record) or as part of a student media-run survey does not fall under FERPA, so publication of that information does not violate privacy law.
Police Reports: Congress amended FERPA in 1992 to expressly remove privacy protection for records created by a police or campus security agency “for the purpose of law enforcement.” As a result of this change, it is illegitimate for a police or public safety department to cite FERPA in refusing to release an arrest record, an incident report, or the identities of students named in those documents.
However, a 2018 case clarified that FERPA allows a school to redact personally identifiable information — the kind that would already be protectable under FERPA, such as student numbers, student ID photos, and disciplinary emails to students — from campus police records.
Universities and other schools have avidly used FERPA to deny the disclosure of information about sexual assaults perpetrated by or against students. In a 2014 survey of 110 campuses conducted by the Student Press Law Center and the Columbus Dispatch, twenty-two schools refused to disclose basic campus crime information under FERPA, even though the requested information was explicitly exempt on the face of the law. In 2016, the University of Kentucky went even further, bringing a suit against the school’s independent newspaper, the Kentucky Kernel, to prevent the release of records related to an investigation of sexual assaults on campus.
However, FERPA expressly exempts and does not prohibit disclosure of the final results of disciplinary proceedings against students who committed serious crimes, including sex crimes and crimes of violence. In 2017, the University of North Carolina at Chapel Hill denied a request for the records of persons who had been found responsible sexual misconduct by the university, claiming that even though the documents were exempted from FERPA, the university still had sole discretion on whether to release the documents. The Court of Appeals for North Carolina clarified that FERPA does not give the university discretion on whether to release public information that is otherwise subject to open record laws, and that FERPA cannot be interpreted to preempt state open record laws. (Although the court was careful to note that “FERPA only authorizes disclosure of ‘the name of the student, the violation committed, and any sanction imposed by the institution on that student’ from the general rule of non-disclosure of disciplinary records.”
Other documents: The law explicitly exempts several types of documents from the definition of “education records,” including teachers’ notes and records of non-student employees.
For more information, check out our page on FERPA Status of Frequently Asked Records.
Every state has a public-records law requiring state and local government agencies – including public schools and colleges (though not private ones) – to disclose upon request the documents they maintain. These laws go by different names – “sunshine laws,” freedom-of-information acts, or open-records acts – but all of them work in basically the same way: government agencies must, within a reasonable time (or within a specified number of days) allow inspection and copying of any type of medium that records information. The requester need not provide any justification for wanting the information, and if access is denied, the burden is on the government agency to point to a justification in the law. Refusal to produce public records can result in fines, awards of attorney fees, and under some state laws, even jail time.
Courts generally give state open-records laws the broadest possible interpretation, and any exception to disclosure is applied as narrowly as possible. The benefit of the doubt is supposed to go to the party requesting access.
Even without FERPA, there are safeguards in place to deter the release and publication of non-newsworthy information about private individuals. Every state open-records act excludes certain categories of records from disclosure because legislators have decided there is no overriding public interest in the information. These exclusions commonly include medical information, confidential attorney-client communications, and “identity theft” information such as Social Security numbers. Almost every state open-records act also incorporates a discretionary balancing test that enables an agency to refuse a request for records if disclosure would constitute an unwarranted invasion of individual privacy. Moreover, every state recognizes a legal claim for invasion of privacy if severely embarrassing and non-newsworthy personal information is published without consent.
The courts have been clear that, once all identifying information is removed from a document (“redacted”), it ceases to be a FERPA “education record,” and if it is otherwise subject to the state’s open-records law, it must be turned over.
For example, in 2007, the Montana Supreme Court ruled that transcripts of NCAA compliance hearings regarding the punishment of two students for shooting people with pellet guns were not FERPA records because the student-athletes’ names were blacked out. Similarly, an Indiana appeals court in 2003 starkly rejected the argument that a 1,000 page document could be withheld due to a single line of FERPA-protected information.
The Department of Education, however, has given unclear guidance on this subject. The department revised its FERPA rules effective January 2009 to broaden the definition of “education records.” Under the Department’s revised interpretation, schools are to deny requests for records (even with all identifying information removed) if information in the records could be linked to a particular student by someone in the school community with inside knowledge (even if the general public would have no idea of the student’s identity). Nor may schools release name-withheld records to a requester the school “reasonably believes knows the identity of the student to whom the education record relates.”
The Department’s interpretation stands on shaky legal footing and may be vulnerable to challenge as an unreasonable expansion of the law. It is inconsistent with the way courts have interpreted FERPA – most notably with the Cut Bank Pioneer Press ruling. In that case, it was clear that the journalists knew who the two disciplined students were – journalists had interviewed the students’ parents at a school board hearing – yet that played no part in the court’s application of FERPA. Whether the rule can withstand legal challenge remains to be tested.
However, the Department of Education also noted that in the case of photos or videos containing depictions of multiple students, if the school can reasonably redact or segregate parts of a video or photo related to other students without destroying the meaning of the document, it must do so prior to providing access. If not, only students to whom the video directly relates should have access.
The U.S. Department of Education (“DOE”) is in charge of enforcing FERPA. The DOE publishes binding rules for FERPA compliance in the Federal Register. The DOE’s Family Policy Compliance Office also issues opinion letters that, while not legally binding, serve as authoritative guidance as to what the Department does and does not consider a FERPA violation.
In a 2002 ruling, the U.S. Supreme Court held that individual citizens who believe their education records have been released improperly have no right to bring suit under FERPA. The only remedy for a FERPA violation is through a DOE enforcement action. Students or parents who feel that their right to access information of amend a file have been infringed can fill out a FERPA complaint form online or can obtain a complaint form by calling (202) 260-3887.
Financial penalties are to be imposed only if, after issuing a notice of violation and a plan of correction, the Department determines that the school will refuse to comply with FERPA voluntarily in the future. Because the FERPA penalty amounts to a total revocation of eligibility to receive federal education funding, to date, the Department has never imposed a financial penalty on anyone for a FERPA violation.
In the absence of clear guidance from Congress or the Department of Education, abuses of FERPA are common. It has become routine for some schools and colleges to cry “FERPA” in response to virtually any open-records request, putting requesters in the position of having to wage a costly, time-consuming public-records lawsuit to get answers. Journalists can apply some common-sense reporting techniques to maximize their chances of obtaining needed information without a legal battle. Doing so often requires educating school officials about their disclosure responsibilities and about the limits of FERPA.
When FERPA has been raised as an obstruction to journalists’ requests for public records, the courts have overwhelmingly applied a narrow, common-sense reading of FERPA that covers only academic and disciplinary records, or records of that nature, that directly identify students and are maintained by the school in an official, central location. Nonetheless, many schools and colleges continue operating under the oversimplified shorthand that if a document names or refers to a student, it is a FERPA record, without exception. Congress and the Department of Education have been slow to acknowledge the need for reform, even though FERPA’s primary Senate author, James Buckley has decried the way the law is being used. In the absence of federal reform, journalists can still obtain much of the essential information they need to perform their watchdog function if they learn the law, insist on a faithful application of it, and publicize the most egregious abuses.
