Note to reader: This is Chapter 10 of Personal Privacy in an Information Society: The Report of the Privacy Protection Study Commission transmitted to President Jimmy Carter on July 12, 1977. The full Table of Contents is listed below.
An individual's relationships with educational institutions help shape his personal development and may substantially affect the degree to which he can enter into and benefit from all other social and economic activities and relationships. The records about individuals that the education relationship generates affect almost everyone, for nearly every American has or will have spent some time in at least one educational institution.1
Within an educational institution, education records2 form a back-ground against which decisions about an individual student's status or progress are made, not only at the major turning points in his educational career, but also on a daily basis where they shape unobtrusive but significant decisions about him. Educational record-keeping practices, however, vary substantially by size of institution and sophistication of administrative practices. They also vary as students move along the continuum from pre-school toward post-graduate education, because the role of educational institutions varies along the same continuum.
Society grants educational institutions substantial authority over students and substantial freedom to gather, record, and use information about them without their consent or the consent of their parents. This is considered necessary if educational institutions are to provide basic instructional services and maintain an environment conducive to learning and personal development. Nonetheless, the authority to act in loco parentis carries with it the responsibilities of stewardship. Report cards, conferences, and parent-teacher associations are all devices by which educational institutions are held directly accountable to parents and students. In addition, through the election of school officials, as well as through licensing, accrediting, and the enactment of State education codes, educational institutions are held accountable to the society as a whole.
The accelerated pace of social change in recent decades has subjected the stewardship role of educational institutions to unprecedented stress. The population explosion of the past thirty years, the growing mobility of the American population, and the rapid increases in the breadth and specializa-tion of knowledge have all had a direct impact on educational institutions. Parents, students, and society as a whole have developed new expectations as to the skills educational institutions should impart. Courses now cover subjects ranging from woodworking and driver education to regression analysis and zero-based budgeting. With this growth in size and scope of responsibility, have come bureaucratic forms of administration, larger budgets, mounting pressures to demonstrate effectiveness, and a heightened drive for autonomy and special prerogatives on the part of professional educators.
Over the last fifteen years, the Federal government has affected all levels of education through financial assistance programs aimed at helping educational institutions to meet their responsibilities, and also at using educational institutions to further other social purposes, such as equal opportunity. This has reinforced the educational system's own gravitation toward bureaucratic administration and professional specialization. It has also altered record-keeping requirements and practices, modified power balances within educational institutions, and made many educators wary of Federal regulation.
The combined impact of all these changes on record keeping about students has been the focus of Commission concern. Educational institu-tions make and keep more records about students today than ever before. More people participate in making and keeping education records, and more people outside the educational system want access to them for other than educational purposes. Moreover, the emphasis in educational record keeping has shifted from reporting progress to parents and supplementing personal contact in instructing and making decisions about students to serving not only as a management tool but also as a means of justifying an educational institution's actions and budget, and as a surrogate for personal contact with students. These changes have elevated the importance of education records in American society, and thus the importance of good school record-keeping practices.
The importance of educational record keeping today was formally recognized in 1974, when the Congress enacted the Family Educational Rights and Privacy Act (hereinafter FERPA). [20 U.S.C. 1232g] This legislation gives parents of minor students, and students who are over 18, the right to inspect, correct, amend, and control the disclosure of information in education records. It obliges educational institutions to inform parents and students of their rights, and to establish policies and procedures through which their rights can be exercised.
FERPA represents an alternative to the omnibus approach to regulating record keeping. taken by the Privacy Act of 1974. The Privacy Act, applicable to all Federal agencies, levies a broad set of requirements on a diverse mix of records and record-keeping institutions. FERPA, in contrast, is targeted on education records, the individuals to whom they pertain, and the institutions that keep them.
FERPA, the Department of Health, Education, and Welfare (DHEW) regulations implementing it [45 C.F.R. 99], and the activities of the Department in carrying out its responsibilities under the law, exemplify, albeit imperfectly, a novel regulatory strategy that might be termed "enforced self-regulation." The regulated institutions are responsible for developing and implementing policies and procedures that meet minimum requirements established by law. Those legal requirements state objectives for the development and implementation of local substantive and procedur-al requirements, but do not prescribe detailed substantive standards or impose fine-grained procedures. Such a strategy entails penalties for violations of locally established standards and procedures, but does not impose any particular interpretation of substantive standards. Rather, it relies on making an institution accountable to those whom it most directly affects without requiring either prior Federal approval of local policies and procedures or systematic Federal monitoring of each institution's performance.
To evaluate the merits of FERPA as a privacy protection statute, the Commission held public hearings in October and November 1976 to learn about the experiences of parents, students, professional educators, and educational institutions in complying with the law. At the time of the hearings, the Department of Health, Education, and Welfare's final FERPA regulations had been in effect less than nine months, although the statute had been in force for almost two years. Many institutions were still developing, or had only recently begun to implement, their FERPA policies and procedures.
In the Commission's view, however, the hearing testimony confirms the necessity and validity of most FERPA requirements and the potential effectiveness of "enforced self-regulation." The hearing record also indicates that some features of the statute and regulations make implementation difficult or dilute its effectiveness. Nonetheless, FERPA is apparently leading educational institutions to respect some basic record-keeping rights that were not uniformly accorded students or parents before the Act was passed.
Educators, parents, and students have generally accepted FERPA's principles despite some minor problems and misunderstandings, and the extreme sensitivity of educational institutions to Federal regulation. In spite of the substantial delay in issuing regulations and the resulting lack of awareness and even misunderstanding of the law, the testimony of educational institutions indicates that enforced self-regulation can take hold, and, if strengthened, can be an effective tool for striking the proper balance among individual, institutional, and societal interests.3
This chapter reports the results of the Commission's assessment of the Family Educational Rights and Privacy Act of 1974 and recommends some changes in the Act that will make it better able to achieve the Commission's public-policy goals of minimizing intrusiveness, maximizing fairness, and creating legitimate, enforceable expectations of confidentiality. The first section focuses on the role of record keeping about students. It summarizes the missions and functions of the various types of educational institutions and describes the records they keep and how they collect, use, and disclose information about individual students. This section also describes the testing and data-assembly service organizations whose highly specialized education records play a major role in post-secondary admissions and financial-aid decisions.
The second section describes the Family Educational Rights and Privacy Act, its accompanying DHEW regulations, and the experience to date in implementing the law. The third section assesses how well personal privacy is protected by FERPA, and presents the Commission's basic conclusions. The focus in the third section is on specific record-keeping problems that arise in the various types of educational institutions and the tools the individual currently has for coping with them. The final section recommends additional steps to clarify and strengthen FERPA as an instrument for achieving the basic objectives of the Commission as they relate to educational record keeping.
RECORD-KEEPING PRACTICE IN EDUCATION
Some 60 million students are currently enrolled in formal educational programs provided by educational institutions. As a student moves from one point to another in the education system, his path is blazed by records concerning his performance, his behavior, and his own, and often his family's, life circumstances. These records are created by an educational institution mainly to record the student's progress, to help make decisions about him, and to improve the effectiveness of the educational programs the institution provides.
Education records are generated in many different organizational settings from pre-school through post-graduate institutions. For most individuals, the educational experience is a progression through a number of organizations with differing missions, roles, functions, and authorities with respect to both the individual and society. It is important to recognize that the record-keeping practices of educational institutions reflect those differences.
The mission and role of an educational institution are key determinants of its record-keeping practices. The mission of a pre-school is to care for and nurture children and to lay a foundation for the academic tasks they will confront in elementary school. The elementary school's mission is nurturant and custodial, but also includes formal instruction in reading, mathematics, and other subjects. As the child moves through the elementary years, the school's custodial role is augmented by a greater concern for socialization. Gradually, the school's nurturant role is overshadowed by its role in developing fundamental academic skills until the junior high-school years, when the nurturant role disappears altogether. The custodial role remains as long as compulsory education laws force children to attend school, but the school's emphasis shifts towards maintaining the order necessary to carry out its academic mission.
The post-secondary educational mission is almost exclusively one of intellectual development and training; it includes only vestiges of custodial care and behavioral control. In most post-graduate and professional schools a concern with socialization reappears, but is much more narrowly focused on inculcating professional mores and ethics. Thus, while the instructional mission runs as a common thread throughout all schooling, there are, in fact as well as in law, two quite distinct educational systems in this country: elementary and secondary education on the one hand, and post-secondary education on the other.
ELEMENTARY AND SECONDARY EDUCATIONAL INSTITUTIONS
The ways in which record keeping about students in elementary and secondary education differs from record keeping about students in higher education can be understood by examining six features of the record-keeping relationship in the two systems: (1) the role of records in decision making; (2) institutional decision-making responsibilities and authorities; (3) variations in organizational settings; (4) the ways in which records are created and used; (5) record-keeping responsibilities and authorities; and (6) disclosure practices.
THE ROLE OF RECORDS IN DECISION MAKING
Elementary and secondary educational institutions share responsibility for the intellectual, social, and ethical development of a student with the student's parents and with others who deal with youth, such as child welfare and juvenile justice agencies. In pursuing this broad mission of child development, schools provide instructional services, regulate behavior, report to parents on academic performance and social conduct, diagnose student needs, and conduct special programs for students. The visible decisions they make concern matters such as class placement and promotion, eligibility for special educational programs (such as for handicapped or gifted children), eligibility for public assistance and social services programs (school breakfast and lunch programs, for example), and major disciplinary decisions, such as suspension or expulsion. Much less visible are the series of small decisions they make which subtly shape a student's educational career: decisions about the speed with which a child's development should be fostered in specific areas of academic course work or personal conduct, for example, or about the sanctions and rewards that should be used to discipline or encourage a child.
The main characteristic of decision making about students in elementary and secondary education is that it is contextual. Regardless of the philosophy of education a school espouses, elementary and secondary school professionals generally believe that decisions must be made on the basis of the "whole child"; that is, that intellectual and social development are intimately related. This encourages schools to assemble so much information about students that it becomes difficult to determine which information is or was the basis for a particular decision. Both in routine decision making, such as when class placement or promotion is at issue, and in decision making based on fairly specific criteria, such as when public assistance or social services eligibility must be decided or suspension or expulsion proceedings concluded, the practice is to look at such a multiplicity of factors that the relationship between specific items of information and the ultimate decision becomes increasingly unclear.
INSTITUTIONAL DECISION-MAKING RESPONSIBILITIES AND AUTHORITIES
Public schools are given broad authority to make decisions about students. Public elementary and secondary institutions must deal with all children. Admission is not selective, nor can public schools set performance standards that would eliminate certain students from the student body or narrow the variety of programs that will be offered. Thus, while they strive to cooperate with parents, the degree to which public schools share authority with parents has been largely left to schools to decide.
Most public educational institutions are special-purpose local governments created by State law, accountable to the people of the school district through locally elected and appointed school boards and school officials. State education laws place limits on the authority of schools, and prescribe due process procedures that order decision making and reinforce parental control. Nevertheless, a State code cannot regulate all placement and treatment decisions, and many such decisions are not visible enough to parents to induce their involvement. Parents of private and parochial school students have the option of withdrawing their children from the school if they dislike the manner in which the school exercises its authority, but beyond that, parents have little ability to control decisions made by elementary and secondary schools about their children, even in the private school setting.
VARIATIONS IN ORGANIZATIONAL SETTING
Elementary and secondary education occurs in a diversity of organizational settings. Despite a strong trend toward consolidation, there are still more than 15,000 school districts in this country. Within and among districts there is also great variation in size, organizational complexity, types of special services offered, and intensity of involvement in economic and social issues, such as racial balance, drug use, juvenile crime, and cultural disadvantage. The Los Angeles Unified School District, for example, serves over 600,000 students. It has more employees providing administrative and special educational services than classroom teachers, different organizational structures for its instructional services than for its special ones, and its own police force to cope with juvenile crime problems. It also receives massive Federal funding.4 In contrast, some small consolidated rural school districts serve fewer than 10,000 students, maintain a high teacher-to-suppport staff ratio, offer only a few special services, have few delinquency problems, and receive minimum Federal support.
Despite these differences in organizational setting, however, all schools today have some common characteristics that affect the way they collect, maintain, use, and disclose information about students.
CREATION AND USE OF RECORDS
The content of school records is to some extent required by State education laws and local school boards. Information such as the child's name and birthdate, immunizations, and a certain amount of descriptive information about family background at the time of enrollment are usually required. Thereafter, grades and credits are added to a student's record, along with health information, test scores, actions authorized by the school, parental authorizations or prohibitions, and family financial data. In addition, a student record now almost always includes information about the behavior and personality of the student, his social life; and the status, attitudes, and behavior of his family. For example, one school district's guidelines5 allow the accumulation of information about
Much of the information about a student is kept at the school in a cumulative record, but some information-such as psychological test data, records of family visits by school social workers, eligibility for special programsis maintained separately.
Methods of collecting information vary. Much of it is provided to the school directly by the student or his parents, while other information comes from test scores and teacher or administrative evaluations. So-called "anecdotal information" is created by the institution on its own initiative from observation of the student; from analysis, interpretation, and synopsis of information already on record; and from interpretations made by the person creating the record when information provided by the student or parent is insufficient.
Anecdotal information tends to be negative. Elementary and secondary institutions normally have resources available to them for the detection and treatment of special student problems. Thus, the task of detecting problems early and providing special treatment to remedy them creates a diagnostic bias toward negative information. This bias may grow when there are institutional or fiscal incentives to over-identify problems. It also can grow when the methods of diagnosing a problem leave room for interpretation, or when the person making the entry is not professionally qualified to report a diagnosis (e.g., the diagnosis of unruly children as hyperkinetic by people who are not medical professionals).
There are few limits on a school's internal use of education records in making administrative and instructional decisions about students. School authorities do not hesitate to seek and use whatever information about the student's background and personality might seem to bear on his academic performance. Even those special programs to which a child is assigned on the basis of some specific characteristic tend to use a broad base of information in making decisions about him once he is in the program. Individualized instruction, "mainstreaming" (i.e., incorporating educationally handicapped children and programs designed especially for them into the normal classroom situation) and team teaching-all popular innovations in elementary and secondary education today-are likely to intensify rather than diminish this reliance on a large number of factors in evaluating a student.
Standards regarding the content and use of records often exist on paper but are rarely put into practice. The best information management practices are found in academic grading. Grades are systematically created by processes generally known to parents and students and are documented and regularly reported to them. For other types of records, however, there are few generally accepted standards of relevance or propriety. Administrative control of record keeping is minimal. While most institutions define what they consider to be basic information, individual educators generate a wealth of other records. For example, many individualized instruction programs require a diagnostic profile of each child to be used in making day-to-day instructional decisions about him. Without systematic quality control, however, the information in records of this type is bound to reflect the varying competencies of the professionals who create them.
Some elementary and secondary school districts have guidelines specifying the kinds of information members of the school staff may enter in a student's cumulative record. For example, a guideline might specify that entries include only firsthand observations, noting the time and place of the observation and the identity of the observer. To make such guidelines effective, however, the staff must be trained to follow them and student records must be systematically reviewed for compliance.
Given the multiple functions and broad responsibilities of elementary and secondary schools, the differences among them, and the emphasis on the whole child, there is understandable disagreement about what standards for record keeping should be. Even if standards for relevance, propriety, and reliability of information were firmly established, it would be difficult to monitor their application because record keeping in most school systems is so decentralized.
RECORD-KEEPING RESPONSIBILITY AND AUTHORITY
The authority of educational institutions to collect, use, and disclose information about students is even broader than their authority to make administrative and instructional decisions. State laws usually do not restrict the collection of information, nor do they surround the information that forms the basis of educational decisions with due process protections.
Local boards of education seldom involve themselves in developing record-keeping policies, leaving it to professional educators, whose primary concern is school management, to establish such policies. Educators, in turn, have given the matter little attention and have seldom consulted parents and students about what information is collected or how it is used. As records come to substitute for personal interaction, educators understandably come to view records as their own and view the involvement of parents and students in decisions about record keeping as a threat to their autonomy and an implied insult to their integrity.
DISCLOSURE PRACTICES
Most elementary and secondary institutions have a tradition of treating records about students as "within the family," that is, as entrusted to the school for use by the school. The tradition is being challenged by both internal and external pressures. Increased specialization has divided responsibility within the school among teachers, psychologists, social workers, security personnel, and professional school administrators. Each type of school employee tends to have different relations to outside agencies and professionals. Thus, a school social worker, for example, relates as much to a colleague in a child welfare or corrections agency as he does to his. school principal. Moreover, he often needs the assistance of professionals in those agencies who turn to him for assistance as well.
Some believe that schools exceed the limits of justifiable sharing of information about students or their families. For example, in school districts troubled by gang violence or drug abuse, school disciplinarians may informally share information about student behavior with local law enforcement agencies. In Maryland, for example, a county government began collecting information about students' families ostensibly to establish the students' eligibility to attend county schools, but the information was routinely shared with motor vehicle and taxing authorities for purposes having little or nothing to do with the educational mission of the school district.6
A school district may also transfer individually identifiable information from student records to other State agencies in order to establish the district's eligibility for categorical funds. In addition, school districts also share individually identifiable records with State and Federal agencies or their contractors for audit, program evaluation, research, and statistical purposes. Decisions to use student records for research purposes are usually made at the level of the individual school, whether or not policies regarding such use exist at the district level.
The Commission's findings indicate that practices with respect to research use of student records in elementary and secondary school districts vary widely.7 In some districts the outside researcher is considered a nuisance. In others, it appears that close relationships exist between school personnel and university-based researchers who share a common interest in the use of student records for research purposes. In most cases, however, research has little or nothing to do with the immediate education of the child whose records are used, nor does it directly benefit the child or the school. While some schools seek parental consent before disclosing records for research purposes, or parental participation if the project entails the collection of new information, practices at the elementary and secondary level seem to present few barriers to the use of student records for research purposes.
Education records, like hospital records, public assistance and social services records, and other administrative records are becoming a valuable commodity for large-scale studies. Schools are finding it more difficult to resist research demands on their records or to control the conditions of use and redisclosure, especially if the research is sponsored by an agency that supplies them with funds.
PRINCIPAL RECORD-KEEPING PROBLEMS
While any generalizations about a world as large and diverse as elementary and secondary education must have numerous exceptions, the Commission's inquiry led it to the following general conclusions with respect to the records elementary and secondary educational institutions generate about students.
POST-SECONDARY EDUCATIONAL INSTITUTIONS
The primary mission of post-secondary institutions is academic and vocational, and focuses on the development of intellectual and technical skills. Because most students in institutions of higher education are adults, the institution shares responsibility for their development not with parents and other social institutions, but with the students themselves. Normally, institutions of higher education do not actively seek to identify students who are potentially eligible for assistance that supplements academic training. The institution may or may not assist a student in obtaining public assistance and social services, for example, but if it does, acceptance of those services by the student is voluntary; the institution does not have custodial responsibility.
The difference in institutional mission and responsibility is the key to understanding the differences between the record-keeping practices of elementary and secondary schools and those of post-secondary schools. In post-secondary education, the minimal institutional responsibility for socialization of the student and the lack of custodial responsibility creates a simpler and more differentiated set of relationships between the institution and the individual.
THE ROLE OF RECORDS IN DECISION MAKING
The limited and narrowly focused mission of post-secondary institutions results in a more limited and clearly defined set of functions and types of decisions. The primary functions are to provide instruction, to order a student's progression through a broad but highly standardized set of instructional programs, and to provide academic counseling. In addition, most post-secondary institutions provide a range of ancillary services such as medical care, financial assistance, and housing.
The majority of post-secondary institutions draw a clear line between instructional and ancillary services. The student's academic relationship with the institution is usually clearly segregated from his financial, medical, or housing relationships. The basic decisions that relate to admission, to evaluation of academic performance, and determination of eligibility for financial aid are characterized by highly rational, comparative decision making based upon well known criteria.
INSTITUTIONAL DECISION-MAKING RESPONSIBILITIES AND AUTHORITY
The relationship between a post-secondary institution and its students is voluntary and contractual in nature. Generally, the rights and responsibilities of both are spelled out in advance. Rules of conduct, and sanctions for violations, are made known to students. Academic requirements, in terms of required courses and performance levels, are clearly defined. Admission is usually selective except in some State systems, so most institutions can use performance standards to control enrollment. Individual institutions can also control the variety of programs they offer.
Post-secondary institutions have much broader authority than do elementary and secondary institutions. Public institutions are established and regulated by State law, but generally are delegated broad authority. Private institutions are subject to some government regulation, but it does not usually affect their authority over students. Nevertheless, post-secondary institutions have in recent years increasingly shared both responsibility and authority with students. The involvement of students in governance at the departmental, college, and even university level is common, especially insofar as program planning, standard setting, and developing due process mechanisms for decision making are concerned. Colleges and universities, particularly those that are public, have permitted, and in some cases encouraged, strong student organizations to negotiate with faculty and administrators on matters of mutual interest.
VARIATIONS IN ORGANIZATIONAL SETTING
There is a strong trend toward large and diversified public higher education systems with huge campuses. Some states like California have a university system in which each campus has a full array of undergraduate, graduate, and professional schools; a state college system in which each campus has a full complement of undergraduate institutions and some graduate and professional schools; and a number of community colleges. Nonetheless, there are still many private institutions, including sectarian or liberal arts colleges, with fewer than 1,000 students.
The size of student bodies in post-secondary schools can vary from a few hundred to 50,000. Some campuses are urban while others are located in communities with a smaller population than the campus. In the latter case, the community may be economically and socially dependent on the school. Some campuses have more than 100 departments offering specialized training and more than 15 quasi-autonomous schools or colleges. Some of the larger campuses have annual budgets of over $300 million and more than 10,000 employees. Most post-secondary schools have some kind of law enforcement unit or special arrangement with local law enforcement units. Some use Federal funds only for Basic Opportunity Grants for Handicapped Students; others receive up to 40 percent of their total budget from Federal agencies.
Again, however, there are certain characteristics common to all of these diverse organizational settings that affect the collection, maintenance, use, and dissemination of records about students.
CREATION AND USE OF RECORDS
Post-secondary institutions maintain many different kinds of records about students. Some are centralized; others are created solely for the use of a department, committee, or individual faculty member. Some are conscientiously used for only one purpose; others are segregated in theory but are actually used widely for many purposes. Some are uniform in content, format, and method of collection; others differ widely in those respects. The problem for the individual in a post-secondary institution arises from the difficulty of finding out what records are being kept, by whom they are being kept, and for what purposes they are being used.
The records on students that are centralized are primarily academic records (e.g., courses, credits, grades, letters of recommendation), attendance records, and financial records. Such records seldom include much information about a student's family or social life, and only rarely include anything about a student's personality and behavior.
The centralized record about a student starts with admission. In most of the public undergraduate institutions, admissions is a fairly straightforward and simple process. The applicant supplies most of the information needed, including academic, financial, and health information, and often letters of recommendation to verify and supplement the academic record. Registrars' offices usually maintain the official academic record, which includes information regarding course work, credits earned, and grades. Health and financial records are maintained separately.
In private undergraduate institutions, and in both public and private graduate and professional schools, the admissions process generates a detailed record on the applicant, only part of which is supplied to the school by the applicant himself. Such records may include the results of faculty and staff interviews, letters of recommendation, indicators of expected performance generated from analysis of transcripts, ratings or rankings created by the admissions process, and documentation of the actions taken by admissions officers and committees with respect to the individual applicant. The admissions decisions of these institutions often allow for considerable exercise of professional judgment, unsupported by documentation. Admissions criteria often include vaguely defined attributes such as "character" and "morals."8 Although some admission decisions are made on the basis of objective information, in many cases highly subjective data on applicants is collected and used. Institutional controls on the relevance, propriety, and reliability of the information collected do not appear to exist.
Letters of recommendation, whether written at the request of the applicant or the institution, play a role in some but not all admissions decisions. While there is great variation in attitudes toward the value of letters of recommendation, the professors preparing them, and the institutions receiving them have tended to treat them as confidential communications that should not be made available to the applicant.
Universities usually set minimum record-keeping requirements for colleges and academic departments, but academic record keeping outside the registrar's office is extremely decentralized. Colleges and universities have very few restrictions or even guidelines on content, format, or method of collecting information for records kept at the department or college level. There are, moreover, few incentives for an academic department to cede any professional or departmental control over record keeping to a centralized authority within the institution. This is especially true if control impinges on activities that faculty members perceive as professional prerogatives and which, therefore, crucially affect faculty-administration relationships. Nonetheless, problems such as grade inflation suggest that the professional standards of judgment in academic performance evaluation are inconsistent, relatively weak, and often of no great interest to those making such udgments. Faculty members are not specifically trained to evaluate student performance. While standards are difficult to set, and the evaluation process will always rely heavily on professional judgment, records of evaluators normally do not include the evidence underlying the judgments they contain.
As written records tend to be substituted for the unrecorded personal knowledge of faculty and administrators, "second-order" student records have been increasingly generated. An example of such second-order records are those created by teaching assistants to enable a faculty member to operate in a system which presumes he has personal knowledge of his students, even though his class may include 400 students. Another illustration is the records created by academic supervisory committees to develop and monitor a graduate student's curriculum. Such records may or may not be official, and they often differ within colleges or even within departments of the same institution. Information in these kinds of records is, however, almost always limited to academic performance and performance evaluation. They are not used for diagnosis or specialized treatment because students in post-secondary schools are expected to make decisions about courses without the benefit of someone else's analysis of special needs.
Ancillary services can be quite elaborate in post-secondary institutions. Many university counseling centers, for example, provide psychotherapy for students, and almost all maintain student health centers staffed by physicians. Many even have hospital facilities for student use. Financial aid services, too, may be quite extensive, and may generate extensive records about students and their parents. These financial records are not commingled with other centralized records, however, and information in them is rarely disclosed or used within the university for other than financial-aid purposes.
Post-secondary institutions usually keep disciplinary records on students, and many institutions have campus security units that maintain their own records. Student records are often shared between administrators responsible for discipline and campus security forces.9 Such information does not affect academic decision making, although academic records are often used in evaluating students who have created a disciplinary problem. Nevertheless, there are few internal limits on the use of academic or disciplinary records. For example, the turbulent period of the late 1960's and early 1970's provided many examples of the ability of institutions to collect and use information about students in order to control them.10 The boundaries between academic and disciplinary decision making are sometimes more nebulous than the institutions like to admit, and in times of political stress, professional ethics are a poor substitute for legal controls over the internal uses of records.
RECORD-KEEPING RESPONSIBILITY AND AUTHORITY
Post-secondary institutions have almost unlimited freedom to collect and use records about students. Few proscriptions regarding the collection or use of records appear in law or university policy. The public accountability structures in both public and private institutions, while powerful, are neither sufficiently focused on administrative questions nor responsive enough to students' interests to limit record-keeping autonomy. In practice, professional standards, and the recent trend toward student involvement in university governance, do provide some limits on institutional autonomy. As noted above, however, record keeping in higher education is predominantly a professional prerogative.
DISCLOSURE PRACTICES
In post-secondary education, there is little occasion for information to flow beyond the bounds of the educational institution. Colleges and universities have a tradition of limiting the release of information about students to external organizations, in effect holding the information in "trust" for the students. Traditionally, they have released information regarding attendance, degrees received, courses taken, and honors received, but most will not transfer records of a student's academic performance or financial situation to other institutions unless a student requests that they do so.11
Much of the current demand for information in student records comes from commercial interests developing mailing lists, or from Federal agencies conducting research, evaluating programs, or auditing financial records. For example, controversy arose recently over the use of student information by the Veterans Administration (VA) in auditing VA student-aid programs administered by institutions of higher education. The VA auditors compare records of students who do not receive its funds with the records of students who do, and inspect student records without the consent of the students involved.12 In at least one reported instance, records on students were physically removed from a school to another location where they were inaccessible to students.13 Still, research using information in records on students in individually identifiable form in higher education is not extensive. In addition, while institutions may permit such use without the consent of the individual under certain circumstances, universities are usually quick to demand guarantees of confidentiality from the researchers. 14
The most sensitive disclosures made by post-secondary institutions are to law enforcement authorities. In the recent past, a number of universities have collaborated with law enforcement and intelligence agencies to generate and share information on the political activities of student radicals. Many post-secondary institutions depend on local law enforcement agencies for campus security and may share information with these agencies. This sharing occurs most often in institutions that have campus security units. These units, usually staffed by law enforcement professionals, are more likely to follow the professional law enforcement norm of widespread sharing of information with other law enforcement authorities than the norm of strict confidentiality generally followed by educational, institutions. The information shared is often trivial-for example, the fine for a parking ticket given by a campus policeman may have to be paid to the local city government at the latter's offices, an arrangement which entails a record transfer of minimal import. In other situations, such as in cases involving drug traffic, major thefts, or threats of violence, the information shared may be much more extensive and consequential.
PRINCIPAL RECORD-KEEPING PROBLEMS
The Commission's inquiry led it to the following general conclusions with respect to the records post-secondary institutions generate about students.
TESTING AND DATA-ASSEMBLY SERVICE ORGANIZATIONS
As the number of persons seeking admission and financial aid began to tax the capabilities of post-secondary educational institutions, they formed coalition organizations such as the College Entrance Examination Board (CEEB) and the Law School Admissions Council to help collect and process the information used to make admissions and financial-aid decisions. Through these coalition organizations, post-secondary institutions have since fostered the growth of other organizations that test and assemble information on applicants. Best known among them are the Educational Testing Service (ETS) and the American College Testing Program (ACT).
Testing and data-assembly service organizations have become a gate through which a student's education records must pass if he is to gain admission to accredited institutions and to qualify for certain types of financial aid. The student must pay fees for taking tests and for having information assembled, stored, and forwarded to the educational institutions he designates. Because testing and data-assembly service organizations provide their services under contract to organizations like the College Entrance Examination Board and the Law School Admissions Council rather than to post-secondary institutions, policy regarding their record-keeping practices is set by the former rather than the latter, and the students they serve have no role whatsoever.
Testing and data-assembly service organizations are highly specialized and rely heavily on information supplied to them by the applicant. Their procedures for collecting, generating, and maintaining information are also highly automated. Their sophistication and technical proficiency make them sensitive to record-keeping issues and they have strong fiscal incentives for efficient and effective information management, and do not often make serious errors, but they sometimes have difficulty detecting the errors they do make.
Testing and data-assembly organizations usually inform an individual about the principal uses they make of the information they collect about him. Moreover, their policies generally limit the uses they make of their records to the purposes communicated to the individual. Testing and data-assembly organizations take special precautions to protect individually identifiable data when their records are used for research. They also have strong confidentiality standards. One such organization has repeatedly gone to court to resist attempts by the Internal Revenue Service to subpoena student financial data.15 Nevertheless, a testing and data-assembly service organization is not in a position to assume total responsibility for record-keeping policies that would operate to safeguard the interests of the individual, since its policies reflect those of its clients, the coalition organizations representing post-secondary institutions. The Commission's hearing record indicates that the oversight post-secondary institutions exercise over the operations of testing and data-assembly service organizations tends to serve their own interests somewhat better than it does the interests of applicants.16 Thus, although such organizations deal directly with individual applicants, and collect and process mountains of information about them, they are less accountable to the individuals on whom they keep records than any other type of record-keeping institution in higher education.
THE FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACTTHE ORIGINS OF FERPA
The growing importance of records about students and of the record-keeping practices of educational institutions has not gone unnoticed. Litigation and the professional literature have drawn attention in recent years to the misuse of personal information in the placement of minority children in programs for the educationally handicapped.17 Research has highlighted the impact of stigmatization on the educational achievements of children and has pointed to the impact on educational decisions of erroneous or incomplete information about students. Court cases prior to the passage of FERPA in 1974 increasingly recognized that decisions made by schools can result in harm to students and that students and parents must therefore have a right of redress.18
Several studies carried out in the early 1970's documented record-keeping problems in both higher education and elementary and secondary schools. In 1970, the Russell Sage Foundation convened a conference on the Ethical and Legal Aspects of School Record Keeping to clarify principles for the management of elementary and secondary school records. Release of the conference report19 was followed by a second conference on Student Records in Higher Education and a second report.20 The recommendations in these reports helped to crystallize concern about the creation, use, and disclosure of school records.
The stimulus for the passage of FERPA was a 1974 study of the National Council of Citizens in Education (NCCE).21 In this report the NCCE identified the following as the most prevalent abuses in elementary and secondary school record keeping:
On May 14, 1974, Senator James L. Buckley succeeded in getting a floor amendment to the General Education Provision's Act of 1974 which aimed to correct these problems. The two main provisions of the amendment, which applied to any school that receives Federal funds through the U.S. Office of Education (Department of Health, Education, and Welfare), required procedures to assure students and parents access to those records and restricted disclosure of records to third parties. Although the amendment had not been the subject of Congressional hearings, it was adopted by the conference committee on the General Education Provision's Act later that summer and signed into law on August 21, 1974.22 At the time, few educators were aware of it.
During the weeks after its enactment, however, educational institutions and other interested parties around the country launched a massive letter-writing campaign to members of Congress. At this point, the Senate and House Education Subcommittees and the Department of Health, Education, and Welfare Legislative Office took the lead in working out a compromise measure, which Senator Buckley sponsored. Representatives of educational institutions and of parent and student groups contributed to the drafting of the revision, which became known as the Family Educational Rights and Privacy Act. It was passed by both Houses of Congress and signed into law in December 1974.23
The process by which FERPA was enacted had a significant impact on its subsequent implementation. Several factors are important in understanding this impact. First, professional educators were not involved in drafting the original legislation nor even aware of its existence. Although key groups were brought in during the redrafting, their role could only be responsive, not creative, and was, in the main, defensive. Because there had been no national debate or public hearings on the measure, and only a minimum of congressional debate, neither the affected parties (i.e., educational institutions, parents, and students) nor the Department of Health, Education, and Welfare, which had to develop regulations to implement the Act, received much guidance on the manner in which the Act should be interpreted.
Second, FERPA was primarily designed to address documented problems in elementary and secondary schools, but it was made applicable to higher education on the too simple assumption that the problems in both areas are similar and thus that the same principles would apply equally well in both places. Representatives of higher education who participated in drafting the compromise amendment considered the final version to be a vast improvement over the original measure. Nevertheless, they continued to be convinced that FERPA addressed a set of record-keeping problems that were different from those that arise in higher education and thus that the requirements of FERPA would create substantial burdens without benefiting students.
THE REQUIREMENTS OF FERPA
The principal requirements of FERPA are straightforward: they give a student or his parent the right to inspect and review, and request correction or amendment of, an education record maintained about him [20 U.S.C. 1232g(a)(1) and (2)]; and give a student or his parents some measure of control over the disclosure of information from an education record about him [20 U.S.C. 1232g(b)(1)]. FERPA obligates educational institutions to provide procedures for inspection and review of records within 45 days from the time it receives a request for access to them. [20 U.S.C. 1232g(a)(1)(A)] It also exempts the following types of records from parent and student access:
FERPA requires educational institutions to allow students or parents to have a hearing to challenge information in records they believe to be inaccurate, misleading, or otherwise in violation of their privacy rights. It also obligates an educational institution to correct or delete challenged information or, if it refuses to make the requested correction, to insert in the record the student or parent's written explanation regarding the disputed information. [20 U.S.C. 1232g(a)(2)]
In addition, FERPA requires written consent from a student or parent before a student's record or any personally identifiable information in it may be disclosed to a third party. Consent is not required, however, when the disclosure is to:
FERPA also permits an educational institution to disclose directory information (i.e., information about the identity or status of the student which has been publicly designated by the institution as directory information) without the consent of the student or his parent, provided the student or parent has had a reasonable opportunity to inform the institution that any or all of the information should not be released without the student's prior consent. [20 US. C. 1232g(a)(5)] An educational institution must keep an accounting of all disclosures requested or obtained, and allow a student or parent to review the accounting. [20 U.S.C. 1232g(b)(4)(A)]
FERPA instructs the Secretary of Health, Education, and Welfare to promulgate regulations to protect the rights of students and their families in surveys or data-collection activities conducted, assisted, or authorized by the DHEW or an educational institution. [20 U.S.C. 1232g(c)] Finally, it places a requirement on educational institutions to inform students and parents of their rights under the Act. [20 U.S.C. 1232g(e)]
FERPA applies to any institution receiving U.S. Office of Education funding and provides for the termination of such funding if an institution fails to comply with it and compliance cannot be secured voluntarily. [20 U.S.C. 1232g(f)] DHEW is required to set up an office and a review board to investigate, review, and adjudicate violations and complaints alleging violations. [20 U.S.C. 1232g(g)]
The Commission believes that FERPA represents a reasonably successful attempt to establish a clear set of minimum requirements for the protection of students' and parents' privacy rights. At the same time, its gives each educational institution considerable latitude in establishing its own procedures to fulfill these requirements. Ironically, FERPA's most specific provisions are the exceptions to its requirements, and most of them were added at the request of representatives of educational institutions and Federal agencies during the drafting of the compromise measure.
REGULATIONS IMPLEMENTING FERPA
In preparing the regulations, DHEW consulted extensively with representatives of educational institutions, and generally did not interpret the Act in such a way as to reduce the flexibility given educational institutions by the statute. The regulations require educational institutions and agencies to formulate a policy that specifies their procedures for effectuating the rights given students and parents by FERPA. Insofar as disclosure is concerned, the policy must specify rules and criteria for determining which educational purposes are legitimate and which school officials within the institution or agency can gain access to records. It must also specify what categories of information are to be considered directory information. The regulations include broad guidelines for hearing procedures, general conditions for disclosure in emergencies affecting the health and safety of an individual, and a definition of the term "student" that denies students in one component of an institution (an undergraduate college, for example) access to their admissions records in another component of the same institution (such as a law school or medical school).
The statute did not require DHEW to review and approve each institution's policies, or to pass judgment on the substance of policies when complaints are made, and the Department has not done so. Responsibility for judgments of that sort has been left to local institutions, and wisely so in the view of the Commission.
EXPERIENCE IN IMPLEMENTING FERPA TO DATE
The implementation of FERPA has been plagued by confusion, misunderstanding, and delay. Because the Congress did not authorize additional funds for DHEW to implement the law, the Department has not been able to spend much money doing so. The Department's small Fair Information Practice Staff was designated as the office responsible for developing and promulgating the regulations required by the statute, answering questions and offering assistance in interpreting the statute and regulations, handling complaints about violations of FERPA requirements, and mediating solutions to conflicts over interpretations.
The FERPA regulations were not issued until June 1976, some 18 months after passage of the Act. Inadequate staffing and funding were not the only reasons for the delay. Extensive consultations with representatives of educational institutions took time, especially because many educators were still poorly informed about FERPA and resistant to Federal government regulation of any sort. As a consequence, many institutions did nothing to implement the Act pending the issuance of the regulations, while others attempted to develop policies based on interpretations derived from the Russell Sage and NCCE studies or those developed by their legal counsels.
The long delay generated confusion and misunderstanding that was not easily alleviated by issuing the regulations. While the DHEW staff was available to answer questions, not many educators turned to them for answers, and there was no systematic program to inform school officials or the public about the law. Rumors and misinterpretations have been widespread. For example, the Privacy Commission received an indignant complaint from an educator responsible for record-keeping policy in a large elementary and secondary school district who did not know that FERPA regulations, issued six months previously, had completely obviated the complaint.
Another serious implementation problem arose because FERPA was introduced into an environment that has come to expect the Federal regulatory role to be prescriptive. The underlying strategy of FERPA, which leaves to educational institutions most of the responsibility for defining the details of procedures to assure individual protection, has been viewed by educators as a weakness rather than a strength of the law. For example, the president of a local university recently complained to a reporter from the university's student newspaper that "the Buckley Amendment is one of the prime examples of poor legislation, poor administration and everything that goes into it. Just about every institution has a different interpretation of FERPA."24
What educators perceive to be ambiguity has led many of them to make unnecessarily labored and highly defensive interpretations of the law. Instead of taking the latitude afforded by the statute as a challenge to their professional skill, and as an opportunity for innovation in concert with parents, students, and colleagues, educators have turned to their legal counsels for safety. In many cases, legally sound advice has been unnecessarily burdensome and on occasion educationally unsound.
In the Commission's judgment, the major problem in implementing FERPA has been the lack of understanding among educators, parents, students, and the general public both about the requirements of the Act and the strategy of enforced self- regulation that underlies it. Where understanding of these factors exists, the Commission has found little objection on the part of educational institutions to either FERPA's principles or its requirements.25 Contrary to their expectations, educators have found that offering students and parents access to their records does not unleash a tidal wave of demands for access and correction that immobilizes educational institutions. Implementing FERPA has not been burdensome for those institutions with sound record-keeping practices, or for those that have sought in good faith to develop policies consonant with the spirit of the law.26
A few of the complaints about unnecessary burdens are doubtless justified. Examples of possibly burdensome requirements include the requirement to keep a record available to students and parents of all requests for disclosure, whether granted or not [20 U.S.C. 1232g(b)(4)(19)]; the requirement to identify and list all record systems in a central place rather than simply requiring each component to have such a list available on request [45 C.F.R. 99.5(2)(iv)]; and the requirement to allow a student to restrict the disclosure of any or all categories of directory information. [20U.S.C. 1232g(a)(5)(B)]; In addition, educators in some elementary and secondary schools have found restrictions on the sharing of information with social services agencies unnecessarily burdensome, and some schools at all levels have found it difficult to control access to student files by federally funded researchers.
Claims that FERPA imposes unreasonable costs appear to be largely rhetorical. Typical of the rhetoric is the statement of a university administrator that universities are "stockpiling lawyers like countries are stockpiling nuclear warheads in the cold war."27 In reality, this administrator's own large State university has met the added burden of FERPA requirements by retaining the part-time services of an attorney who was also enrolled as a graduate student.
In response to the Commission's direct request for data on the cost of implementing FERPA, only one institution produced evidence of extra expenditures. Its estimate, after careful analysis, was that FERPA cost about one extra dollar per year per student and, in doing the analysis, it discovered several places in which the flexibility FERPA allows would enable it to cut even that cost without detriment to the individual student.28 Had the cost of implementing FERPA been as great as the rhetoric would suggest, the Commission's request for data would surely have produced budgeting and planning documents reflecting the costs from institutions that had found them to be burdensome. While there are obviously some costs incurred in implementing the law-an extra page or two of printing, an extra form for those who wish directory information withheld, and the cost of discussions with faculty, staff, and administrators-it seems safe to infer that they are insignificant.
The cost of implementing FERPA depends of course on the quality of an institution's records and the efficiency of its record-keeping practices prior to the enactment of the statute. If the quality of an institution's records were so poor that it receives many requests to correct them, or is subjected to other legal action, then the cost of implementing FERPA might very well become substantial. The prospect of such costs provides a valuable incentive to develop better record-keeping policies and practices.
Even when policies are well conceived, difficulties can arise in implementing them. At the elementary and secondary school level, there are strong indications that in a large school district with a uniform policy, there is often little uniformity of practice among schools within the district. Parent and student groups have documented the allegation that student records are still being disclosed to law enforcement agencies without notice to, or authorization from, students or parents and that, in some cases, "desk drawer" notes have been used as official records, rather than solely as the personal records of a teacher.29 Student groups testified to the Commission that universities or faculty members were subtly coercing students into waiving their right of access to letters of recommendation.30 Further, the Commission could find little evidence that educational institutions are doing a very good job of informing students and parents of their rights under the Act.
The Commission found substantial evidence that neither parents nor educators consider the system for enforcing FERPA satisfactory, as it depends on complaints being filed with DHEW for mediation, and the only sanction for failure to comply with the law is withdrawal of all U.S. Office of Education funding. DHEW has not received many complaints, possibly because Washington seems too far away, or because the only available sanction is so harsh that it is rarely ever imposed and thus is not credible, or because the sanction would not in any case secure the desired result-prompt compliance. Educators resent, in principle, the idea of withdrawal of Federal funds and view its threat with disdain because it is not likely to be exercised.
THE INDIVIDUAL UNDER THE FAMILY EDUCATIONALRIGHTS AND PRIVACY ACT
In spite of the limited and rather uneven implementation experience to date, the Commission was able to draw some reasonably reliable conclusions about the degree to which practices under FERPA meet the Commission's recommended public-policy objectives. The concerns expressed in its objectives are precisely those that led to the passage of FERPA: namely, minimizing intrusiveness; keeping recorded information from being a source of unfairness in decisions made on the basis of it; and establishing a legitimate, enforceable expectation of confidentiality. The complaints and abuses documented by parent and student groups, and the guidelines from the two Russell Sage studies cited above, also centered on these three objectives.
The statute, however, does not fully achieve the Commission's three objectives. There are significant gaps in its coverage of institutions and types of records, and the enforcement mechanisms it relies on are too weak to support its strategy of enforced self-regulation.
CONTROL OVER THE COLLECTION OF INFORMATION
FERPA seeks to minimize intrusiveness in several ways. It requires educational institutions that collect and maintain records about students to pay due regard to the "appropriateness" of information and the privacy rights of students. Currently, the only tool for enforcing it is the right of the student or his parent to inspect and challenge the contents of records. Although FERPA specifically requires the DHEW Secretary to issue regulations to protect the privacy of students and their families in connection with any surveys or data-gathering activities conducted, assisted, or authorized by an administrative head of an educational agency, the regulations have never been issued.
As the first section of this chapter indicates, intrusiveness in elementary and secondary schools is a serious problem, not only of surveys but also in the routine creation of records on students. An individual has little control over data collected directly from him, generated from observations of his behavior, or created by analysis of his student record. Yet FERPA does not address such collection and recording of information.
Reliance on access and correction as a remedy for intrusiveness has several deficiencies. Access and correction are at best remedial, not preventive, and do not address the problem of stigmatization. Parents are not and could not be notified of every entry made in the record of a student, so that substantial harm can be done before they can request correction of stigmatizing information. A student is stigmatized less by a particular item of information than by the composite impression the record as a whole conveys, which makes it difficult for parents to determine which items should be corrected or amended. An addendum to the record giving the student's or parent's side of the story seldom repairs damage to a student's reputation.
In addition, individual access to a record and the right to request that it be corrected cannot lead to preventive action in a highly decentralized system unless specific abuses are either concentrated in one location or are prevalent. If a serious abuse occurs only rarely, steps to prevent its recurrence may be taken only at the location where the abuse occurred, not throughout a system.
Intrusiveness is a problem of information collection. It is simply not realistic for students and parents to exercise control over what information is collected, but it is realistic for institutions to establish standards of propriety and relevance. Adequate standards not only minimize intrusiveness, but provide a context in which the individual can effectively exercise his right to challenge the content of a record, and thereby help the institution to maintain and improve its standards.
Intrusive surveys and other data collection activities are a major problem. Students are a captive population and as such are vulnerable not only to intrusive questioning but also to dangers that arise simply from too much questioning. As pointed out earlier, individuals in component units of decentralized systems often have the autonomy and incentive to authorize or engage in surveys and other data-collection activities. Part of the reason that DHEW has been slow to issue regulations applicable to these activities is that the Department has already promulgated regulations to protect the rights of all human research subjects [45 C.F.R. 46 et seq.] and is now in the process of revising them. Nevertheless, the regulations covering human research subjects apply only to DHEW funded activities, and leave to the data collector rather than the educational institution the responsibility of defining the interest of the individual in that research.
Although most of the data-collection activities in schools are sponsored by the Federal government, and the organizations carrying them out are covered by the research on human subjects regulations, some are not. Moreover, what the researcher, educator, and parent might consider appropriate may differ substantially. Parental complaints about intrusive surveys and other data-collection activities were one reason for the enactment of FERPA;31 yet intrusive data-collection activities continue, notwithstanding DHEW's regulations regarding research on human subjects.
In post-secondary institutions, intrusiveness is not a major problem either in routine record keeping or in special data-collection activities. The organization and management of information by purpose and the comparatively clear standards for the content of records are important protections in themselves. The admissions process does, however, pose intrusiveness problems by virtue of the fact that FERPA places no obligation on an institution to establish standards of relevance and propriety with regard to the information collected and used in the admissions process, or to inform the applicant of the types of information that will be collected about him, and also by virtue of the fact that FERPA allows admissions records containing highly subjective information about him to be kept secret. [20 U.S.C. 1232g(a)(6), (a)(B)(ii) and (iii); 45 C.F.R. 99.12(2) and (3)]
Another intrusiveness danger arises in institutions that have law enforcement or campus security units that engage in investigative activities. FERPA tries to build a wall between the records maintained by such a unit and those maintained by the rest of the educational institution. It does so by exempting the records of a law enforcement unit from the FERPA access and correction requirements, provided the law enforcement unit's records are used and disclosed solely for law enforcement purposes, and the law enforcement unit does not have access to education records. [20 U.S.C 1232g(a)(4)(B)(ii); 45 C.F.R. 99.3] This creates a problem because some of the information a law enforcement unit collects can be useful in maintaining school order and discipline. Yet, if a law enforcement unit shares such information with other school officials, even on a limited basis, all of its records must be open to student or parent access and no record maintained by the unit could be shared with local law enforcement agencies without student or parent consent, even though it could be disclosed and used widely within the educational institution. Most importantly, FERPA imposes no requirement that standards of appropriateness, relevance, or accuracy for such information be established and the Commission has found that the current statute in fact encourages a law enforcement unit to share information surreptitiously with other components of an educational institution.32
PROTECTIONS FOR FAIRNESS
Fairness is a major objective of FERPA. The basic tools for achieving it are the right of a parent or student to inspect, review, and challenge the contents of his record; and the obligation levied on the institution to provide a hearing, to correct or delete the challenged portion of a record, or to incorporate into the record a parent or student's explanatory statement. Again, however, these tools are not enough to achieve the Commission's objectives.
Particularly in elementary and secondary schools, the record-keeping practices that lead to unfairness also weaken the effectiveness of access and correction rights as protections against unfairness. Identifying unfair record-keeping practices requires the ability to relate records to decisions. In the educational process, however, parents are often unaware that important decisions are being made about their children. In fact, schooling can be looked upon as a continuous set of decisions, and it is unlikely that an institution could keep parents informed of each and every decision made about their child even if it tried to do so. Moreover, if rights of access and correction are tied to "adverse decisions," as the Commission recommends in other chapters of this report, is difficult to do in education because it is so difficult to define an adverse decision. Is placing a child in a compensatory program, for example, an "adverse" decision?
There are, of course, many decisions about which parents are informed, such as promotion, major disciplinary actions, or placement in particular academic programs. In some of these decisions, the role of records is clear and it is easy to label a certain outcome as negative or positive for the student. There are, however, many more decisions made about students that either parents do not know about, that are not clearly based on easily identified items of information, or whose effect on the child is difficult to assess. Such decisions can be based on so many factors that it is difficult for a parent to assess whether information in a record is inaccurate, misleading, or irrelevant as it relates to the decision. Standing alone, the right to inspect and request correction of a record places the total burden for assuring the reliability of records on the individual who often does not understand the system well enough to use the right effectively.
Particularly at the elementary and secondary level, there are also pressures on a student or his parent not to exercise such rights lest they be stigmatized as troublemakers or malcontents. In any relationship between an individual and an institution that has discretion to grant or deny him a benefit, there is the danger that the individual will be penalized for exercising a record-keeping right, unless the institution has strong incentives, legal or economic, not to retaliate. As far as schools are concerned,
testimony presented to the Commission confirmed that educational institutions do sometimes retaliate, and that a number of parent and student organizations believe that they do so frequently.33 Moreover, as pointed out in the discussion of intrusiveness, access and correction rights for individuals are at best remedial, not preventive, and do not readily lead to systemic improvements. An individual can contribute to improving the quality of information about him in records, but only if he knows what the record-keeping standards of an institution are. FERPA does not address the issue; it neither places an obligation upon educational institutions to establish standards nor requires that parents and students be informed about the record-keeping standards of the institution.
Because elementary and secondary schools treat individuals over time, they engage in substantial problem diagnosis. Hence, like any other treatment institution, they have established dual record systems-the official records kept by the institution and the so-called "desk drawer" notes that individual teachers, administrators, or ancillary personnel keep primarily for their own use. The latter type of record usually contains observations, impressions, questions, or even tentative interpretations and diagnoses. FERPA recognized that student or parent access to such information can be a two-edged sword in that it can deter the keeping of records and knowledge of what is in the records can impede an individual's course of treatment. Therefore, FERPA tried to balance the need for this type of record against the equally compelling argument that access to records by their subjects is an essential component of fairness in record keeping. The FERPA solution was to exempt desk drawer notes from student or parent access provided they are not revealed to any person other than a person substituting for the note taker. Educators have argued that this has reduced the value of such notes and thus has discouraged school personnel from keeping them. Educators argue that desk drawer notes work to the overall benefit of the student, but some parent and student groups contend that the notes of administrators with disciplinary responsibilities have in effect become secret record systems used to support disciplinary decisions.
In higher education, access and correction rights to most records are effective tools because institutions have standards for the content of records and their use. Nonetheless, when standards for the content of records are not clearly established, or when students are not clearly informed of those standards, as is the case with departmental records, the inadequacies of these FERPA requirements are the same as in elementary and secondary school systems. The pressures against the exercise of such rights are even stronger in post-secondary institutions than they are in elementary and secondary schools because the emphasis on professionalism and on the autonomy of faculty members is much stronger. The student is so dependent upon the professional judgments of individual faculty members that he is not likely to risk prejudicing them by asserting his rights.
An equally serious problem in post-secondary education is that FERPA grants no right of access or correction to records regarding admissions. This is the one area in which access and correction rights alone could be important protections. As in admissions, a record is compiled for a single decision of unquestionable importance to the individual. To assure fairness in making admission decisions, an individual needs to be able to challenge the contents of a record and request its correction so that the record will truly reflect facts about himself, his background, and his previous performance. Denying the applicant access to his admissions record and an opportunity to request correction of it leaves a serious breach in his defense against unfairness. This is especially true for a rejected applicant, because a successful applicant can have access to his admission record when he becomes a student, as such records must by law be maintained. for 18 months.
The FERPA provision that permits a student to waive his right of access to letters of recommendation is another loophole in the statute that has special import for post-secondary students. While FERPA recognizes the individual's right to inspect such letters, the waiver provision can have the effect of placing a student under substantial pressure to relinquish his right at a time when he is most vulnerable to pressure. Empirical evidence presented to the Commission indicates that waiving one's right of access to a letter of recommendation has no discernible impact on the content and quality of such letters, although the myth persists that a student's refusal to do so inevitably debases the quality and thus the usefulness of the letter.34 One university proposed barring waivers, but had to withdraw the proposal in the face of student assertions that accepting it would weaken their competitive position for admission to other institutions.35 This is an even greater problem than it might otherwise appear to be by virtue of the fact that there are no content standards for letters of recommendation.
Another major deficiency of FERPA is that it does not aply to testing and data-assembly service organizations. Hence, an applicant has no legal right to inspect and challenge information in their tiles. This is significant because, despite their elaborate quality control procedures, the testing and data-assembly organizations have been known to transmit erroneous information about an individual,36 and to be unable to detect errors that do not occur on a large scale. In addition, these organizations create records without the knowledge of the individual, such as lists of "unacknowledged repeaters,"37 or "weighted" scores for individuals based on information supplied by the client institution. Such secret records or special scores may stigmatize an applicant or student (as when "unacknowledged repeaters" are branded as "cheaters") or subject the individual to an adverse decision (as when an applicant is rejected because his "weighted" score is too low).
Finally, FERPA makes no provision for an individual at any level of schooling to have a decision based on erroneous, incomplete, or inappropriate information reconsidered. The Act merely provides that a student or his parent can request correction or amendment of a record. Although there are due process mechanisms in schools that can be used to force reconsideration when the decision is a major one, many decisions do not lend themselves to formal reconsideration, nor is correction or amendment of a record always enough to repair or halt the damage. In decentralized educational organizations, corrections or amendments may not be propagated through-out the systems; and in large systems, where administrative decisions are separated from the process of correcting or amending records, corrections may not come to the attention of decision makers. Moreover, in certain types of selection processes where there are more applicants than available places, as in the case of programs for gifted children or admission to professional schools, the institution may have strong incentives to overlook a correction or amendment made by a rejected applicant. The right to correct an erroneous record may be a hollow remedy if the individual has no way to challenge a decision based on that record.
CONTROL OVER DISCLOSURE OF INFORMATION
Limiting the disclosure of education records is a primary goal of FERPA. The Act firmly establishes the principle that parent or student consent for disclosure of all education records is the rule, rather than the exception. Its restrictions extend even to those records maintained by schools that are not commonly considered education records. For example, law enforcement records maintained by schools may be disclosed only for law enforcement purposes and only to law enforcement agencies of the same jurisdiction [20 US. C. 1232g(a)(4)(B)(ii)]; medical records may be disclosed only for medical treatment purposes [20 U.S.C. 1232g(a)(4)(B)(iv)]; desk drawer notes may be seen only by substitutes [20 U.S. C 1232g(a)(4)(B)(i)]; and letters of recommendation may be used only for the purpose for which they were acquired. [20 U.S.C. 1232g(a)(1)(C)] Moreover, exemptions from the requirement of parental or student consent for disclosure are all conditioned on an assurance that records will not be redisclosed. [20 U.S.C. 1232g(b)(4)(B)] A school's policy under FERPA must state the criteria by which it decides which school officials may have access to records and for what purposes. [45 C.F.R. 99.5] When records are transferred to another school, parents must be notified and given a copy of the record, and must have an opportunity to challenge the contents of the record in a hearing. Auditors, evaluators, or researchers who are allowed to have access to records without parent or student consent must destroy their copies of the records when they are no longer needed. [20 U.S.C 1232g(b)(1)(F); 45 C.F.R. 99.31] Pursuant to FERPA, a student can bar disclosure of any item of directory information in his record. [20 U.S.C. 1232g(a)(5); 45 C.F.R. 99.37]
Despite these protections, the extensive exceptions to the basic presumption of confidentiality create problems. Some of the exceptions weaken an educational institution's ability to prevent disclosure when it wishes to do so. This is particularly true with regard to Federal agencies seeking access to student records for evaluation or research purposes. Although Federal and State agencies can receive student records only on the condition that they do not redisclose them, no written agreement barring redisclosure is required, and therefore neither the institution nor the individual can hold Federal or State agencies, or their contractors, accountable for failure to abide by the redisclosure prohibition. Moreover, when government agencies request access to information in individually identifiable form, they do not have to show that such access is either required by law or demonstrably necessary to accomplish the purpose for which they are requesting the information. Once such an agency has information about a student, neither FERPA nor the Privacy Act of 1974, in the case of Federal agencies, prevents the information from being passed from agency to agency within Federal or State governments without obtaining the consent of the individual to whom it pertains.
Another weakness in FERPA's confidentiality provisions involves the use of records for research purposes in a decentralized system. FERPA does not require central review of requests for access to education records for research purposes, nor does it require that parents or students be notified that records will be used for such purposes.
A major confidentiality problem arises from FERPA's failure to require student or parent consent to the disclosure of records maintained by school law enforcement units or security forces to law enforcement officials of the same jurisdiction. The main concern in this regard was that school law enforcement units were, or would become, conduits for information about a student's behavior, background, and character. Although this problem affects only a limited number of students-an alleged juvenile delinquent in elementary and secondary school, or a radical activist in higher education-it has great import both for these students and for an educational institution.
The relationship of educational institutions to law enforcement agencies varies according to the social, economic, and cultural environment in which a school or school system operates. FERPA, however, gives an educational institution almost no flexibility in dealing with disclosure to law enforcement agencies.
There are other examples of inflexible disclosure rules in FERPA that work to the disadvantage of the student, the school, or other institutions, or all three. For example, a school's relationship with social services agencies varies from community to community. FERPA, however, does not take account of these different working relationships. The Act dictates one inflexible rule regarding disclosure-that school records may not be disclosed to social services agencies without student or parent consent. FERPA leaves no flexibility for sharing any information about students with any social service agency for any purpose except in connection with a financial-aid program. For example, under a strict interpretation of FERPA, schools cannot assist local services agencies that provide clothing to needy children, by giving those agencies information to identify potential candidates. Nor can schools report cases of possible child neglect to local services agencies without parental consent.
The same lack of flexibility is apparent in the FERPA provision that permits disclosures for research purposes without individual consent only if the research is done for, or on behalf of, an educational institution for a specific educational purpose. As Chapter 15 of this report points out, because administrative records are a vital tool in research and statistical activities they should be available for research or statistical purposes provided that stringent precautions are taken to protect the individuals to whom the records pertain from harm.
Finally, it is puzzling that, of all of the exemptions from FERPA's restrictions on disclosure without individual consent, the exemption for the least sensitive information-directory information-is qualified by rigid protections for the individual. FERPA permits an individual to bar the disclosure without his consent of any or all directory information. The requirement is an economic and administrative burden whether many or only a few students exercise the option. In addition, the requirement has frustrated press access to information, made it possible for individuals to claim credentials or honors falsely without fear of being discovered, and will even make it difficult for the Bureau of the Census to get resident student housing information necessary for drawing census sample frames for the 1980 Census. Moreover, the requirement effectively limits the freedom of many States in creating or modifying public-record and freedom of information statutes. If such statutes were to designate as a matter of public record information included under FERPA as directory information, the State would force educational institutions to choose between losing needed Federal funds or being in violation of State law.
THE FERPA ENFORCEMENT MECHANISMS
Statutory protections are seldom effective unless the statute provides strong incentives to comply or credible sanctions for failure to comply, or both. Unfortunately, FERPA provides neither. In this respect, FERPA's "enforced self-regulation strategy" is deficient in that it calls for educational institutions to exercise substantial discretion in formulating procedures while failing to make them locally accountable for doing so. Enforcement of FERPA must begin with a complaint to DHEW, and the only penalty for failure to comply is a financial sanction that lacks credibility because it is so rarely used.
FERPA and its implementing regulations depend on four mechanisms to achieve "enforced self-regulation": (1) educational institutions must provide parents and students with the means to exercise the rights the Act establishes; (2) educational institutions must inform parents and students of their rights and the procedures for exercising those rights; (3) the Department of Health, Education, and Welfare must establish an office to investigate, process, review, and adjudicate violations; and (4) if adjudication fails, termination of Federal funding through the U.S. Office of Education is a last resort.
While these mechanisms may be theoretically sound, in practice they give the individual little protection. Abuses of FERPA requirements normally occur at the operational level, and are perpetrated by individual employees at a specific school. The effectiveness of FERPA currently depends upon more centralized control than most educational institutions have. What should be required instead is local handling of complaints and internal sanctioning systems. The entire burden of enforcement of FERPA currently falls on parents and students, but the only way for an individual to exercise the initiative that will lead to enforcement is to file a formal complaint to DHEW. This process is not only burdensome to the individual, but is unlikely to provide timely relief, and is therefore not likely to be used.
The sanction of total withdrawal of Federal funds is so disproportionate to the nature of most FERPA violations that it lacks credibility and thus serves only as a poor incentive for institutions to prevent or correct systematic violations or unfair practices. In addition, it does nothing to redress injustices to a particular individual. The penalty, if enforced, would in effect punish all students and parents, including those whose rights have been violated, by forcing the curtailment of essential educational programs. Moreover, it would nullify FERPA's protections since it would remove the sanctioned institution from FERPA's jurisdiction.
Thus, the individual who tries to protect his rights has little hope of success, and if he succeeds, he may threaten the survival of the educational institution, thereby diminishing the well-being of other students and parents as well as his own. The net result is that an individual's rights will only be protected, as they were before FERPA, by the initiative and sense of responsibility of the educational institution. FERPA itself, may, however, undermine even that protection. By failing to obligate institutions to monitor their own practices, and by giving students and parents the role of monitoring practices and reporting the institution's misdeeds to the Federal government, FERPA stresses an adversary, not a cooperative, relationship. In so doing, it forces an aggrieved student or parent who has complained to DHEW to assume the risk that the school will retaliate and puts the school in a defensive posture toward its students and their parents.
RECOMMENDATIONS
As a result of its inquiry into educational record-keeping practices and its analysis of the Family Educational Rights and Privacy Act, the Commission has concluded that even with FERPA, the interests of students and parents in education records and record-keeping practices are not well enough protected. Serious gaps in the coverage of FERPA make this situation particularly serious in the admissions processes of post-secondary institutions.
If students and their parents are to be protected properly from intrusive or unfair practices in the collection, use, and dissemination of education records, educational institutions must bear a large part of the burden for protecting them. Relying solely on individuals to protect their own interests simply is not good enough in view of the broad authority that educational institutions must have to carry out their missions. To give an individual all the procedural protections he would need to safeguard his own interests in every decision made about him, could well paralyze the educational system. On the other hand, sole reliance on institutional responsibility for the protection of an individual's interests in record keeping would require prescriptive regulation by Federal or State governments that would have its own paralyzing effect.
While institutions recognize the need to protect the interests of students and parents, the bureaucratic setting that dominates most educational institutions today tends to make institutional interests in record-keeping practices overshadow those of the individual. There is a serious imbalance between an institution's incentive to protect its own interests on the one hand, and its incentive to protect student interests on the other. FERPA does little to correct this imbalance.
Since the quality of education always depends ultimately on human judgment, protections must be designed carefully so that they will not lead to further depersonalization in the relationship between student and institution. An educational institution must make difficult and sensitive decisions regarding such things as the placement of children in special programs, the admission of only a few qualified applicants to a graduate or professional school, and the choice of the proper mix of rewards and punishments to help a child learn social responsibility. There is already great pressure on schools to rely on information about individuals that has been converted into standard measurements of ability or performance, and to use it to make decisions in a way that eliminates the consideration of individual differences. Such processes are often adopted without considering their impact on society and on the individual. Overly restrictive protections for the individual often cause educators to rely even more heavily on decision making based on standard measurements in order to protect themselves against the threat of liability to the individuals affected by the decisions. Until quite recently, education records mattered little in the educational process. They have now become significant. Record keeping has evolved to meet many changes and pressures, but the evolution has occurred at the expense of students' rights. The situation requires not the rapid imposition of untested requirements to restore the balance, but a careful reshaping of the record-keeping practices of educational institutions so that all of the stakeholders will be fairly represented.
In sum, the Commission finds that FERPA is a solid foundation upon which to restore the balance in educational record-keeping practices between the interests of students and parents and the needs of educational institutions. FERPA not only recognizes the individual's interest in education records, and provides the baseline for developing a minimum set of rights and responsibilities, but does so with a sound sense of both the limits of regulation and the proper roles of the various parties in implementing its requirements. Nevertheless, further steps are needed to achieve a proper balance.
The Commission's approach to formulating protections for the individual's interest in education records is not to limit the authority of educational institutions, but to strengthen the accountability of those institutions to the individual and to society. The Commission's approach depends on the tradition of stewardship among educational institutions and seeks ways that will make institutions continually aware of, and responsive to, that tradition.
Educators recognize that they have a stake in protecting and promoting the interests of the individual and in maintaining public confidence in their ability to do so. Not all of them recognize that their record-keeping practices are undermining that confidence among citizens generally, as well as among students and parents. The fear and mistrust of schools may be vague, ill-defined, and sometimes unjustified, but it exists nonetheless. Educators are only beginning to be aware of these attitudes. The Commission places great emphasis on the value of openness, both to dispel unfounded fears and to identify and resolve real problems.
In formulating its recommendations, the Commission had three objectives:
(1) to expand and strengthen FERPA's minimum requirements so as to place additional responsibility for the quality of records and record-keeping practices on educational institutions, and to broaden the spectrum of institutions and records subject to the Act's requirements;(2) to make educational institutions more accountable for their record-keeping practices than they now are by giving the individual effective remedies for specific abuses; putting record-keeping policy and practice on the agenda of local bodies and groups that hold educational institutions accountable for their actions; limiting Federal enforcement to cases of systemic abuse; and providing more effective Federal sanctions; and
(3) to expand the latitude of each educational institution or agency in meeting its increased responsibilities and adapting the basic requirements of FERPA to local circumstances within the context of strengthened accountability.
EXPANDING AND STRENGTHENING INSTITUTIONAL RESPONSIBILITY
FERPA currently forbids an educational institution or agency to have a policy that denies individuals the rights recognized by the statute, but does not require an affirmative policy to implement the Act's requirements. The Department of Health, Education and Welfare sought to remedy this deficiency by promulgating regulations that require institutions to formulate and adopt affirmative policies. [45 C.F.R. 99.5] The Commission agrees that to create the conditions under which an individual car. exercise his rights under FERPA, and to foster an atmosphere of cooperation rather than confrontation, institutions must be required to take affirmative steps to meet their obligations to the individual and to create policies and procedures consistent with FERPA requirements. Therefore, the Commission recommends:
Recommendation (1):
That the Family Educational Rights and Privacy Act be amended to require an educational agency or institution to formulate, adopt, and promulgate an affirmative policy to implement FERPA requirements, as well as the additional requirements recommended by the Commission.
ADDITIONAL INSTITUTIONAL OBLIGATIONS
FERPA and the DHEW regulations oblige educational institutions only to assure that individuals are given the opportunity to inspect and correct their records and to exercise limited control over the use and dissemination of those records. The Commission believes, however, that an educational institution should be obligated to protect the interest of a student or parent in an education record it maintains. The institution's obligation should be threefold: (a) to attend to the content and quality of the records it maintains on individuals; (b) to provide redress for an individual when a decision has been based on a record subsequently found to be erroneous, incomplete, misleading, or otherwise inappropriate; and (c) to protect the rights of students whenever it permits or undertakes survey and other data collection activities.
The problem of standards for the content of records is crucial, both for effective educational service delivery and protection of the individual. The relevance and necessity of each category of information, the reliability of information for certain types of decisions, the accuracy and completeness of information in an anecdotal record, and the appropriateness of sources and reporting standards for records are all significant problems for educational record keepers, especially those in elementary and secondary schools. Many of the complaints that led to FERPA's passage were directed at institutional failures to assure the quality of education records and the resulting unfair treatment of students. The Commission realizes that setting such standards is difficult and is well aware of the lack of consensus about the need for standards and what the standards should be. It does not believe that the government should set standards, except where there is a clear consensus about the need for them and what they should be. It does believe, however, that an institution must assume responsibility, and be accountable, for the content and quality of its records about individuals.
Levying responsibility for the content and quality of records on educational institutions would not totally prevent the inclusion of erroneous, incomplete, or misleading information in them. It would, however, reduce the recording of such information, and would assure that the individual's rights of access and correction are not the only means by which the quality of records is monitored.
Correcting a record does not assure that previous decisions based on it will be reviewed or corrected because there is no assurance that the correction will come to the decision maker's attention, or even if it does, that the decision maker will reconsider his previous decisions. Hence, the Commission believes that an educational institution should be required to take steps to assure that decisions based on inaccurate information are reviewed. The Commission's intent is not to allow a challenge of the substance of a decision if the inaccurate information had no bearing on it, but merely to assure that procedures exist to review decisions once information bearing on the decision has been corrected.
FERPA recognizes the responsibility of educational institutions and agencies to protect the privacy of students when they conduct or authorize data collection activities, but the DHEW regulations fail to specify any minimum requirements for such activities. A decision to conduct, assist, or authorize such activities may be influenced by a variety of factors, including professional interests and pressures on an institution to cooperate with various agencies of the Federal government or with a university that provides much of the continuing education for the school's teachers and administrators. Within large school systems, moreover, individual administrators in units of the system often have both de facto autonomy and strong incentives to authorize data collection activities. Chapter 15 recommends specific guidelines for institutional review of research and statistical activities in addition to requirements for notice and consent before research is carried out on captive populations such as students. The Commission feels that an educational institution should assume responsibility for protecting individuals from intrusive data collection whether or not the organization conducting the research does so. Educational institutions and agencies should not only assure that proposals for data gathering are centrally reviewed, but should also assume responsibility for assuring that research about an individual will not be carried out without his informed consent. Accordingly, the Commission recommends:
Recommendation (2):
That the Family Educational Rights and Privacy Act be amended to require an educational agency or institution to include in its institutional policy to implement FERPA reasonable procedures to protect against unwarranted intrusiveness and against unfairness in its education record-keeping practices including:(a) reasonable procedures to prevent the collection and maintenance of inaccurate, misleading, or otherwise inappropriate education records;
(b) procedures that provide a student or parent a reasonable opportunity for reconsideration of an administrative decision regarding the student that is based in whole or in part on an education record about the student that has been corrected or amended as a result of rights exercised under FERPA subsequent to the decision; and
(c) procedures to assure that except as specifically required by law, no survey or data collection activity will be conducted, assisted, or authorized by an educational agency or institution unless:
(i) the proposal for such an activity has been reviewed and approved by the educational agency or institution, and not a component thereof, to eliminate unwarranted intrusion on the privacy of students or their families; and(ii) parents of affected students have been notified of such activity, provided a reasonable opportunity to review the collection materials, and allowed to refuse participation in such activity by their children or families.
EXPANDING THE RECORDS AND INSTITUTIONS COVERED BY FERPA
Several significant areas of educational record keeping are currently beyond the purview of FERPA. The records and record-keeping practices of organizations that perform testing and data-assembly services for educational institutions are not subject to the Act. Nor does the Act protect an applicant for admission who does not subsequently matriculate. In addition, the waiver provision and the regulation that allows an institution to request such a waiver [20 U.S.C. 1232g(a)(1)(B) and (C); 45 C.F.R. 99.12] have effectively encouraged students to sign away their right of access to letters of recommendation which, although of debatable usefulness, are required in most admissions processes.
While testing and data-assembly services organizations have shown a sense of responsibility to individuals, and have incorporated many of the requirements of FERPA into their policies and practices, the individual has no legally assertible interest in records maintained by such organizations. That is, he has no way of assuring that policies adopted voluntarily will be followed. This is especially a problem where such policies prove costly, or where a testing and data-assembly organization comes under pressure from its clients to compile a record which, if compiled by the client, would be subject to FERPA. As the Commission has observed in other chapters of this report, a service organization that serves a number of clients engaging in the same type of activity (e.g., the Medical Information Bureau, which serves insurers, or the independent authorization services that support credit grantors) will attenuate the relationship between the primary record keeper (the insurer or credit grantor) and the individual unless it is subject to the same fairness and accountability requirements as the primary record keeper. Thus, the Commission recommends:
Recommendation (3):
That the Family Educational Rights and Privacy Act be amended to broaden the definition of an "educational agency or institution" to include organizations that provide testing or data-assembly services under contract to educational agencies or institutions or consortiums thereof, except that such organizations should not be subject to Section (b)(3) of the Act which requires educational institutions to permit access by Federal auditors to educational records without the consent of the student or his parent.
The Commission believes that the applicant who is not admitted to an educational institution has above all others an interest in securing correction or amendment of an education record, as well as reconsideration of a decision based on faulty or inappropriate information. It understands and sympathizes with the difficulties faced by an institution in making admissions decisions, and also realizes the temptation for a disappointed applicant to challenge a rejection on whatever grounds he can muster. The Commission is also aware, however, of the enormous importance of an admissions decision to an individual. It does not seek to eliminate human judgment from the decision process, nor does it believe that prov