Personal Privacy in an Information Society. The Ferpa Enforcement Mechanisms


Statutory protections are seldom effective unless the statute provides strong incentives to comply or credible sanctions for failure to comply, or both. Unfortunately, FERPA provides neither. In this respect, FERPA's "enforced self-regulation strategy" is deficient in that it calls for educational institutions to exercise substantial discretion in formulating procedures while failing to make them locally accountable for doing so. Enforcement of FERPA must begin with a complaint to DHEW, and the only penalty for failure to comply is a financial sanction that lacks credibility because it is so rarely used.

FERPA and its implementing regulations depend on four mechanisms to achieve "enforced self-regulation": (1) educational institutions must provide parents and students with the means to exercise the rights the Act establishes; (2) educational institutions must inform parents and students of their rights and the procedures for exercising those rights; (3) the Department of Health, Education, and Welfare must establish an office to investigate, process, review, and adjudicate violations; and (4) if adjudication fails, termination of Federal funding through the U.S. Office of Education is a last resort.

While these mechanisms may be theoretically sound, in practice they give the individual little protection. Abuses of FERPA requirements normally occur at the operational level, and are perpetrated by individual employees at a specific school. The effectiveness of FERPA currently depends upon more centralized control than most educational institutions have. What should be required instead is local handling of complaints and internal sanctioning systems. The entire burden of enforcement of FERPA currently falls on parents and students, but the only way for an individual to exercise the initiative that will lead to enforcement is to file a formal complaint to DHEW. This process is not only burdensome to the individual, but is unlikely to provide timely relief, and is therefore not likely to be used.

The sanction of total withdrawal of Federal funds is so disproportionate to the nature of most FERPA violations that it lacks credibility and thus serves only as a poor incentive for institutions to prevent or correct systematic violations or unfair practices. In addition, it does nothing to redress injustices to a particular individual. The penalty, if enforced, would in effect punish all students and parents, including those whose rights have been violated, by forcing the curtailment of essential educational programs. Moreover, it would nullify FERPA's protections since it would remove the sanctioned institution from FERPA's jurisdiction.

Thus, the individual who tries to protect his rights has little hope of success, and if he succeeds, he may threaten the survival of the educational institution, thereby diminishing the well-being of other students and parents as well as his own. The net result is that an individual's rights will only be protected, as they were before FERPA, by the initiative and sense of responsibility of the educational institution. FERPA itself, may, however, undermine even that protection. By failing to obligate institutions to monitor their own practices, and by giving students and parents the role of monitoring practices and reporting the institution's misdeeds to the Federal government, FERPA stresses an adversary, not a cooperative, relationship. In so doing, it forces an aggrieved student or parent who has complained to DHEW to assume the risk that the school will retaliate and puts the school in a defensive posture toward its students and their parents.