Personal Privacy in an Information Society. Control Over Disclosure of Information

07/12/1997

Limiting the disclosure of education records is a primary goal of FERPA. The Act firmly establishes the principle that parent or student consent for disclosure of all education records is the rule, rather than the exception. Its restrictions extend even to those records maintained by schools that are not commonly considered education records. For example, law enforcement records maintained by schools may be disclosed only for law enforcement purposes and only to law enforcement agencies of the same jurisdiction [20 US. C. 1232g(a)(4)(B)(ii)]; medical records may be disclosed only for medical treatment purposes [20 U.S.C. 1232g(a)(4)(B)(iv)]; desk drawer notes may be seen only by substitutes [20 U.S. C 1232g(a)(4)(B)(i)]; and letters of recommendation may be used only for the purpose for which they were acquired. [20 U.S.C. 1232g(a)(1)(C)] Moreover, exemptions from the requirement of parental or student consent for disclosure are all conditioned on an assurance that records will not be redisclosed. [20 U.S.C. 1232g(b)(4)(B)] A school's policy under FERPA must state the criteria by which it decides which school officials may have access to records and for what purposes. [45 C.F.R. 99.5] When records are transferred to another school, parents must be notified and given a copy of the record, and must have an opportunity to challenge the contents of the record in a hearing. Auditors, evaluators, or researchers who are allowed to have access to records without parent or student consent must destroy their copies of the records when they are no longer needed. [20 U.S.C 1232g(b)(1)(F); 45 C.F.R. 99.31] Pursuant to FERPA, a student can bar disclosure of any item of directory information in his record. [20 U.S.C. 1232g(a)(5); 45 C.F.R. 99.37]

Despite these protections, the extensive exceptions to the basic presumption of confidentiality create problems. Some of the exceptions weaken an educational institution's ability to prevent disclosure when it wishes to do so. This is particularly true with regard to Federal agencies seeking access to student records for evaluation or research purposes. Although Federal and State agencies can receive student records only on the condition that they do not redisclose them, no written agreement barring redisclosure is required, and therefore neither the institution nor the individual can hold Federal or State agencies, or their contractors, accountable for failure to abide by the redisclosure prohibition. Moreover, when government agencies request access to information in individually identifiable form, they do not have to show that such access is either required by law or demonstrably necessary to accomplish the purpose for which they are requesting the information. Once such an agency has information about a student, neither FERPA nor the Privacy Act of 1974, in the case of Federal agencies, prevents the information from being passed from agency to agency within Federal or State governments without obtaining the consent of the individual to whom it pertains.

Another weakness in FERPA's confidentiality provisions involves the use of records for research purposes in a decentralized system. FERPA does not require central review of requests for access to education records for research purposes, nor does it require that parents or students be notified that records will be used for such purposes.

A major confidentiality problem arises from FERPA's failure to require student or parent consent to the disclosure of records maintained by school law enforcement units or security forces to law enforcement officials of the same jurisdiction. The main concern in this regard was that school law enforcement units were, or would become, conduits for information about a student's behavior, background, and character. Although this problem affects only a limited number of students-an alleged juvenile delinquent in elementary and secondary school, or a radical activist in higher education-it has great import both for these students and for an educational institution.

The relationship of educational institutions to law enforcement agencies varies according to the social, economic, and cultural environment in which a school or school system operates. FERPA, however, gives an educational institution almost no flexibility in dealing with disclosure to law enforcement agencies.

There are other examples of inflexible disclosure rules in FERPA that work to the disadvantage of the student, the school, or other institutions, or all three. For example, a school's relationship with social services agencies varies from community to community. FERPA, however, does not take account of these different working relationships. The Act dictates one inflexible rule regarding disclosure-that school records may not be disclosed to social services agencies without student or parent consent. FERPA leaves no flexibility for sharing any information about students with any social service agency for any purpose except in connection with a financial-aid program. For example, under a strict interpretation of FERPA, schools cannot assist local services agencies that provide clothing to needy children, by giving those agencies information to identify potential candidates. Nor can schools report cases of possible child neglect to local services agencies without parental consent.

The same lack of flexibility is apparent in the FERPA provision that permits disclosures for research purposes without individual consent only if the research is done for, or on behalf of, an educational institution for a specific educational purpose. As Chapter 15 of this report points out, because administrative records are a vital tool in research and statistical activities they should be available for research or statistical purposes provided that stringent precautions are taken to protect the individuals to whom the records pertain from harm.

Finally, it is puzzling that, of all of the exemptions from FERPA's restrictions on disclosure without individual consent, the exemption for the least sensitive information-directory information-is qualified by rigid protections for the individual. FERPA permits an individual to bar the disclosure without his consent of any or all directory information. The requirement is an economic and administrative burden whether many or only a few students exercise the option. In addition, the requirement has frustrated press access to information, made it possible for individuals to claim credentials or honors falsely without fear of being discovered, and will even make it difficult for the Bureau of the Census to get resident student housing information necessary for drawing census sample frames for the 1980 Census. Moreover, the requirement effectively limits the freedom of many States in creating or modifying public-record and freedom of information statutes. If such statutes were to designate as a matter of public record information included under FERPA as directory information, the State would force educational institutions to choose between losing needed Federal funds or being in violation of State law.