Personal Privacy in an Information Society. Recommendations


As a result of its inquiry into educational record-keeping practices and its analysis of the Family Educational Rights and Privacy Act, the Commission has concluded that even with FERPA, the interests of students and parents in education records and record-keeping practices are not well enough protected. Serious gaps in the coverage of FERPA make this situation particularly serious in the admissions processes of post-secondary institutions.

If students and their parents are to be protected properly from intrusive or unfair practices in the collection, use, and dissemination of education records, educational institutions must bear a large part of the burden for protecting them. Relying solely on individuals to protect their own interests simply is not good enough in view of the broad authority that educational institutions must have to carry out their missions. To give an individual all the procedural protections he would need to safeguard his own interests in every decision made about him, could well paralyze the educational system. On the other hand, sole reliance on institutional responsibility for the protection of an individual's interests in record keeping would require prescriptive regulation by Federal or State governments that would have its own paralyzing effect.

While institutions recognize the need to protect the interests of students and parents, the bureaucratic setting that dominates most educational institutions today tends to make institutional interests in record-keeping practices overshadow those of the individual. There is a serious imbalance between an institution's incentive to protect its own interests on the one hand, and its incentive to protect student interests on the other. FERPA does little to correct this imbalance.

Since the quality of education always depends ultimately on human judgment, protections must be designed carefully so that they will not lead to further depersonalization in the relationship between student and institution. An educational institution must make difficult and sensitive decisions regarding such things as the placement of children in special programs, the admission of only a few qualified applicants to a graduate or professional school, and the choice of the proper mix of rewards and punishments to help a child learn social responsibility. There is already great pressure on schools to rely on information about individuals that has been converted into standard measurements of ability or performance, and to use it to make decisions in a way that eliminates the consideration of individual differences. Such processes are often adopted without considering their impact on society and on the individual. Overly restrictive protections for the individual often cause educators to rely even more heavily on decision making based on standard measurements in order to protect themselves against the threat of liability to the individuals affected by the decisions. Until quite recently, education records mattered little in the educational process. They have now become significant. Record keeping has evolved to meet many changes and pressures, but the evolution has occurred at the expense of students' rights. The situation requires not the rapid imposition of untested requirements to restore the balance, but a careful reshaping of the record-keeping practices of educational institutions so that all of the stakeholders will be fairly represented.

In sum, the Commission finds that FERPA is a solid foundation upon which to restore the balance in educational record-keeping practices between the interests of students and parents and the needs of educational institutions. FERPA not only recognizes the individual's interest in education records, and provides the baseline for developing a minimum set of rights and responsibilities, but does so with a sound sense of both the limits of regulation and the proper roles of the various parties in implementing its requirements. Nevertheless, further steps are needed to achieve a proper balance.

The Commission's approach to formulating protections for the individual's interest in education records is not to limit the authority of educational institutions, but to strengthen the accountability of those institutions to the individual and to society. The Commission's approach depends on the tradition of stewardship among educational institutions and seeks ways that will make institutions continually aware of, and responsive to, that tradition.

Educators recognize that they have a stake in protecting and promoting the interests of the individual and in maintaining public confidence in their ability to do so. Not all of them recognize that their record-keeping practices are undermining that confidence among citizens generally, as well as among students and parents. The fear and mistrust of schools may be vague, ill-defined, and sometimes unjustified, but it exists nonetheless. Educators are only beginning to be aware of these attitudes. The Commission places great emphasis on the value of openness, both to dispel unfounded fears and to identify and resolve real problems.

In formulating its recommendations, the Commission had three objectives:

(1) to expand and strengthen FERPA's minimum requirements so as to place additional responsibility for the quality of records and record-keeping practices on educational institutions, and to broaden the spectrum of institutions and records subject to the Act's requirements;

(2) to make educational institutions more accountable for their record-keeping practices than they now are by giving the individual effective remedies for specific abuses; putting record-keeping policy and practice on the agenda of local bodies and groups that hold educational institutions accountable for their actions; limiting Federal enforcement to cases of systemic abuse; and providing more effective Federal sanctions; and

(3) to expand the latitude of each educational institution or agency in meeting its increased responsibilities and adapting the basic requirements of FERPA to local circumstances within the context of strengthened accountability.


FERPA currently forbids an educational institution or agency to have a policy that denies individuals the rights recognized by the statute, but does not require an affirmative policy to implement the Act's requirements. The Department of Health, Education and Welfare sought to remedy this deficiency by promulgating regulations that require institutions to formulate and adopt affirmative policies. [45 C.F.R. 99.5] The Commission agrees that to create the conditions under which an individual car. exercise his rights under FERPA, and to foster an atmosphere of cooperation rather than confrontation, institutions must be required to take affirmative steps to meet their obligations to the individual and to create policies and procedures consistent with FERPA requirements. Therefore, the Commission recommends:

Recommendation (1):

That the Family Educational Rights and Privacy Act be amended to require an educational agency or institution to formulate, adopt, and promulgate an affirmative policy to implement FERPA requirements, as well as the additional requirements recommended by the Commission.


FERPA and the DHEW regulations oblige educational institutions only to assure that individuals are given the opportunity to inspect and correct their records and to exercise limited control over the use and dissemination of those records. The Commission believes, however, that an educational institution should be obligated to protect the interest of a student or parent in an education record it maintains. The institution's obligation should be threefold: (a) to attend to the content and quality of the records it maintains on individuals; (b) to provide redress for an individual when a decision has been based on a record subsequently found to be erroneous, incomplete, misleading, or otherwise inappropriate; and (c) to protect the rights of students whenever it permits or undertakes survey and other data collection activities.

The problem of standards for the content of records is crucial, both for effective educational service delivery and protection of the individual. The relevance and necessity of each category of information, the reliability of information for certain types of decisions, the accuracy and completeness of information in an anecdotal record, and the appropriateness of sources and reporting standards for records are all significant problems for educational record keepers, especially those in elementary and secondary schools. Many of the complaints that led to FERPA's passage were directed at institutional failures to assure the quality of education records and the resulting unfair treatment of students. The Commission realizes that setting such standards is difficult and is well aware of the lack of consensus about the need for standards and what the standards should be. It does not believe that the government should set standards, except where there is a clear consensus about the need for them and what they should be. It does believe, however, that an institution must assume responsibility, and be accountable, for the content and quality of its records about individuals.

Levying responsibility for the content and quality of records on educational institutions would not totally prevent the inclusion of erroneous, incomplete, or misleading information in them. It would, however, reduce the recording of such information, and would assure that the individual's rights of access and correction are not the only means by which the quality of records is monitored.

Correcting a record does not assure that previous decisions based on it will be reviewed or corrected because there is no assurance that the correction will come to the decision maker's attention, or even if it does, that the decision maker will reconsider his previous decisions. Hence, the Commission believes that an educational institution should be required to take steps to assure that decisions based on inaccurate information are reviewed. The Commission's intent is not to allow a challenge of the substance of a decision if the inaccurate information had no bearing on it, but merely to assure that procedures exist to review decisions once information bearing on the decision has been corrected.

FERPA recognizes the responsibility of educational institutions and agencies to protect the privacy of students when they conduct or authorize data collection activities, but the DHEW regulations fail to specify any minimum requirements for such activities. A decision to conduct, assist, or authorize such activities may be influenced by a variety of factors, including professional interests and pressures on an institution to cooperate with various agencies of the Federal government or with a university that provides much of the continuing education for the school's teachers and administrators. Within large school systems, moreover, individual administrators in units of the system often have both de facto autonomy and strong incentives to authorize data collection activities. Chapter 15 recommends specific guidelines for institutional review of research and statistical activities in addition to requirements for notice and consent before research is carried out on captive populations such as students. The Commission feels that an educational institution should assume responsibility for protecting individuals from intrusive data collection whether or not the organization conducting the research does so. Educational institutions and agencies should not only assure that proposals for data gathering are centrally reviewed, but should also assume responsibility for assuring that research about an individual will not be carried out without his informed consent. Accordingly, the Commission recommends:

Recommendation (2):

That the Family Educational Rights and Privacy Act be amended to require an educational agency or institution to include in its institutional policy to implement FERPA reasonable procedures to protect against unwarranted intrusiveness and against unfairness in its education record-keeping practices including:

(a) reasonable procedures to prevent the collection and maintenance of inaccurate, misleading, or otherwise inappropriate education records;

(b) procedures that provide a student or parent a reasonable opportunity for reconsideration of an administrative decision regarding the student that is based in whole or in part on an education record about the student that has been corrected or amended as a result of rights exercised under FERPA subsequent to the decision; and

(c) procedures to assure that except as specifically required by law, no survey or data collection activity will be conducted, assisted, or authorized by an educational agency or institution unless:

(i) the proposal for such an activity has been reviewed and approved by the educational agency or institution, and not a component thereof, to eliminate unwarranted intrusion on the privacy of students or their families; and

(ii) parents of affected students have been notified of such activity, provided a reasonable opportunity to review the collection materials, and allowed to refuse participation in such activity by their children or families.


Several significant areas of educational record keeping are currently beyond the purview of FERPA. The records and record-keeping practices of organizations that perform testing and data-assembly services for educational institutions are not subject to the Act. Nor does the Act protect an applicant for admission who does not subsequently matriculate. In addition, the waiver provision and the regulation that allows an institution to request such a waiver [20 U.S.C. 1232g(a)(1)(B) and (C); 45 C.F.R. 99.12] have effectively encouraged students to sign away their right of access to letters of recommendation which, although of debatable usefulness, are required in most admissions processes.

While testing and data-assembly services organizations have shown a sense of responsibility to individuals, and have incorporated many of the requirements of FERPA into their policies and practices, the individual has no legally assertible interest in records maintained by such organizations. That is, he has no way of assuring that policies adopted voluntarily will be followed. This is especially a problem where such policies prove costly, or where a testing and data-assembly organization comes under pressure from its clients to compile a record which, if compiled by the client, would be subject to FERPA. As the Commission has observed in other chapters of this report, a service organization that serves a number of clients engaging in the same type of activity (e.g., the Medical Information Bureau, which serves insurers, or the independent authorization services that support credit grantors) will attenuate the relationship between the primary record keeper (the insurer or credit grantor) and the individual unless it is subject to the same fairness and accountability requirements as the primary record keeper. Thus, the Commission recommends:

Recommendation (3):

That the Family Educational Rights and Privacy Act be amended to broaden the definition of an "educational agency or institution" to include organizations that provide testing or data-assembly services under contract to educational agencies or institutions or consortiums thereof, except that such organizations should not be subject to Section (b)(3) of the Act which requires educational institutions to permit access by Federal auditors to educational records without the consent of the student or his parent.

The Commission believes that the applicant who is not admitted to an educational institution has above all others an interest in securing correction or amendment of an education record, as well as reconsideration of a decision based on faulty or inappropriate information. It understands and sympathizes with the difficulties faced by an institution in making admissions decisions, and also realizes the temptation for a disappointed applicant to challenge a rejection on whatever grounds he can muster. The Commission is also aware, however, of the enormous importance of an admissions decision to an individual. It does not seek to eliminate human judgment from the decision process, nor does it believe that providing the FERPA protections to applicants will lead to that result. An admissions decision is necessarily a comparative judgment. While making records about applicants subject to FERPA would not lay bare the selection process, it would assure that an individual was being judged on the basis of accurate, timely, complete, and relevant information. Therefore, the Commission recommends:

Recommendation (4):

That the Family Education Rights and Privacy Act be amended to:

(a) broaden the definition of "student" to include an applicant for student status;

(b) make all provisions of FERPA applicable to education records pertaining directly to an applicant; and

(c) require that records created about an unsuccessful applicant be maintained by an educational agency or institution for 18 months from the close of the application process, after which time they must be destroyed.

FERPA specifically allows only waiver of the right of access to letters of recommendation. The DREW regulations implementing FERPA provide, however, that any right recognized by FERPA may be waived, although they forbid an educational institution or agency to require a parent or student to waive a right. Although the whole concept of waiver is inconsistent with the spirit of FERPA, it was included for letters of recommendation at the urging of educators in post-secondary schools. As noted earlier, the Commission found no consensus about the value of letters of recommendation nor about the impact on their credibility of allowing Record Keeping in the Education Relationship 435 students access to them. Nevertheless, preventing students from having access to letters of recommendation is somewhat of a cause celebre for educators. Many regard such letters as private communications and thus keeping them confidential as a professional prerogative. Many faculty members who write letters of recommendation fear that student access might expose them to liability or retaliation. Many educational institutions fear that openness would make letters less candid. The evidence presented to the Commission does not support these arguments, but it does show that many institutions and faculty members feel strongly about the confidentiality of letters of recommendation.38

The Commission believes that evaluations are part of the professional responsibility of any educator, and that candid professional judgment should be sought and expected in letters of recommendation. Furthermore, analysis of case law indicates that evaluations of students communicated without malice in the course of official duties do not make an educator vulnerable to libel or slander.39 Of course, any evaluation creates some risk of physical reprisal but the risk does not relieve the educator of his duty to render judgments about students.

The Commission believes, moreover, that candor is a professional obligation and should not carry the price of secrecy or potential unfairness. A student can, if he chooses, make an informal agreement with a professor that he will not exercise his right of access as the price for securing a letter of recommendation, but it is difficult to justify the formal blanket waiver of this right which institutions now solicit.

While it is difficult to argue against the individual's right to waive any of his rights, it is also difficult to conceive of ways to maintain the right to waive while assuring that it is exercised on a purely voluntary basis. The Commission does not wish to preclude any individual from choosing not to exercise his right to see a record, but it does wish to prevent him from forfeiting that right. Thus, the Commission recommends:

Recommendation (5):

That the Family Educational Rights and Privacy Act be amended to provide that the right of a student or his parent to inspect and review letters and statements of recommendation not be subject to waiver by the student or his parent, provided further, however, that letters and statements of recommendation solicited with a written assurance of confidentiality, or sent and retained with a documented understanding of confidentiality rior to the effective date of the statutory change not be subject to inspection and review by students or parents.


The Commission has recommended that substantial responsibilities to protect individuals from unfairness in record keeping be levied on educational institutions. The Commission also believes that steps should be taken to strengthen an institution's incentive to live up to its responsibility, and that to make that happen, problems and abuses must be brought to the institution's attention.

As noted earlier, the size and degree of decentralization of educational institutions and agencies, and the many problems and responsibilities that compete for their time, attention, and resources, have meant that existing mechanisms for assuring accountability (e.g., parent or student involvement in governance, due process, administrative control procedures, and public governance structures) have not focused on record-keeping practices and their impact on the individual. FERPA allows substantial local discretion, but does not attempt to utilize fully existing local accountability mechanisms to enforce institutional responsibilities for fair record keeping.

The record-keeping policies and practices of an educational institution will not be effective unless they take into account the views and experience of students and parents as well as those of teachers and administrators. Protections for the individual depend on the development of good policies and practices because asserting interests on a case-by-case basis in remedy of specific abuses does not always provide the impetus for institutional change that will prevent future abuses. All of the mechanisms mentioned in the Commission's recommendations that appear below are now in place in most educational institutions. The Commission believes that the best way to assure that institutions respond effectively to the challenge of reforming their record-keeping practices is to focus the attention of these existing mechanisms for assuring accountability on record-keeping issues, so that public pressure will encourage the development of procedural standards. Accordingly, the Commission recommends:

Recommendation (6):

That the Family Educational Rights and Privacy Act be amended to require an educational agency or institution that conducts instructional programs to provide for parent or student participation in the establishment and review of its policies and practices implementing FERPA; and further

Recommendation (7):

That the Family Educational Rights and Privacy Act be amended to require an educational agency or institution that conducts instructional programs to have procedures whereby parents or students may challenge its policies or practices implementing FERPA.

The Commission believes that the regulations implementing FERPA as amended pursuant to Recommendations (6) and (7) should require each agency or institution that conducts instructional programs40 to establish procedures to hear and resolve complaints about FERPA policies or practices that (a) provide for the participation of parents or students; (b) require the agency or institution to state its reasons if it does not take any action to change its policy or practice in response to a complaint; (c) require the agency or institution to maintain a public record of the complaint and its disposition; and (d) provide for an appeal to the governing body of such agency or institution.

Further, the Commission recommends:

Recommendation (8):

That the Family Educational Rights and Privacy Act be amended to require that an educational agency or institution establish, promulgate, and enforce administrative sanctions for violations of its policy implementing FERPA. Such sanctions should be levied upon chief executive officers of educational agencies and components thereof who are negligent in pursuit of institutional compliance as well as upon employees who violate provisions of such policy.


Federal administrative agencies, even those with regulatory powers, cannot effectively correct each particular abuse, especially when the area being regulated is as large and decentralized as education. Even if FERPA provided a more effective sanction than the withdrawal of Federal funds, DHEW could not attempt to monitor each institution's performance or pursue each individual complaint. The Federal role should be much as DHEW currently interprets it to be-an instrument for assuring that educational agencies and institutions meet the minimum Federal requirements. The Commission believes that Federal administrative agencies should intervene if an institution's policies fail to comply with FERPA's requirements or when an institution systematically departs from its own policy. It is also convinced that to reserve DHEW as the court of last resort for complaints of systematic institutional failure to comply with FERPA is feasible, reasonable, and preferable to requiring Federal review and approval of each local policy. The Commission strongly approves of DHEW's current system of enforcement which, like compulsory arbitration, seeks to obtain voluntary compliance. It recognizes, however, that the Secretary of Health, Education, and Welfare needs a more credible and flexible sanction to make these efforts to secure voluntary compliance effective. Hence, the Commission recommends:

Recommendation (9):

That the Family Educational Rights and Privacy Act be amended to provide that all or any portion of DREW funds earmarked for education purposes may be withheld from an educational agency or institution when its policy does not comply with FERPA requirements or when evidence of systematic failure on its part to implement its policy is presented to the Department of Health, Education, and Welfare. Such withholding of funds should only be imposed if the Secretary has determined that compliance cannot be secured through voluntary means or that systematic failures to implement policy have previously been brought to the attention of the educational agency or institution and it has not taken sufficient steps to correct such failures. The amount withheld should be appropriate to the nature of the violation, and should provide incentives for future compliance.

An individual needs some further remedy when, because of inertia, inefficiency, recalcitrance, or ignorance on the part of school officials at the operating level, a school or other component of a large and decentralized educational system refuses to permit him to exercise his FERPA rights. None of the Commission's recommendations so far outlined provide, individually or collectively, such a remedy. Civil action can provide timely relief, and the threat of it increases the incentive for institutions to be responsive. Such civil action, however, should be corrective rather than punitive, and thus limited to assuring that institutions accord individuals their FERPA rights. Therefore, the Commission recommends:

Recommendation (10):

That the Family Educational Rights and Privacy Act be amended to permit an individual (in the case of a minor, his parents or guardian) to commence a civil action on his behalf to seek injuctive relief against an educational agency or institution that fails to provide him with a right granted him by FERPA. The district courts should have jurisdiction, without regard to the amount in controversy or the citizenship of the parties, to order an educational agency or institution to perform such act or duty as may be required by FERPA and to grant costs of the litigation, including reasonable attorney's fees.


The section of this chapter that describes problems in educational record keeping under FERPA cites a number of examples of where FERPA is prescriptive rather than permissive insofar as the exercise of local discretion is concerned. The examples cited involved the conflicting interests of the individual in the use of desk drawer notes in diagnostic and treatment situations; the conflict between privacy and freedom of information in the matter of directory information; the tension between individual protections and societal benefits in research; and the school's relationship with other societal agencies that share responsibility for the child's welfare and the rights of the individual.

In the Commission's judgment, FERPA's attempts to prescribe the proper balance in these situations have created more problems than they solve. Thus, the final set of Commission recommendations seeks ways of giving educational institutions more responsibility for striking the balance. The Commission believes that the accountability mechanisms called for in Recommendations (6), (7), (8), (9), and (10) will assure that the responsibility is not abused.

Desk Drawer Notes. FERPA provides that a student or his parents may have access to an educator's desk drawer notes about the student only if the educator shares information from them with someone other than a substitute. This restriction may often be harmful to a student and may reduce the effectiveness of the educational program. The provision tries to resolve two real concerns about the sharing of such information: (1) the possible stigmatization of an individual by information whose nature and quality are not subject to institutional control; and (2) the possibility that desk drawer notes will be hidden from parents and students but used in institutional decision making. The latter problem can be solved by giving an individual access to all the data used in making administrative decisions about him, and recourse if those data are erroneous or incomplete. Since desk drawer notes serve primarily as a memory aid to assist in diagnosing the problems of a child and as such have only a temporary value, the threat of stigmatization can be alleviated by arranging for the destruction of desk drawer notes at the end of each regular academic reporting period, unless they are incorporated into the official record system of the educational institution. Sharing information in desk drawer notes during that period is unlikely to result in stigmatizing an individual. If such information is so difficult for an educator to remember that it must be written down, one might fairly assume that it will be forgotten quickly. If some particular bit of information in a desk drawer note is significant enough to stigmatize an individual, then it will probably be remembered and shared with others whether or not it is recorded. Indeed, desk drawer notes seem to have sufficient educational value to argue for their improvement; not for their abolition. The dangers inherent in maintaining them can be controlled by routinely destroying them or by exposing them to the same access and correction rules to which other education records are subject. Therefore, the Commission recommends:

Recommendation (11):

That the Family Educational Rights and Privacy Act be amended to make it permissible for records of instructional, supervisory, and administrative personnel of an educational agency or institution, and educational personnel ancillary thereto, which records are in the sole possession of the maker thereof, to be disclosed to any school official who has been determined by the agency or institution to have legitimate educational interests in the records, without being subject to the access provision of FERPA, provided, however:

(a) that such records are incorporated into education records of the agency or institution or destroyed after each regular academic reporting period;

(b) that such records are made available for inspection and review by a student or parent if they are used or reviewed in making any administrative decision affecting the student; and

(c) that all such records of administrative officers with disciplinary responsibilities are made available to parents or students when any disciplinary decision is made by that officer.

Directory Information. The purpose of establishing an exemption for the disclosure of directory information was to let institutions create a category of information about students that is freely available to the public. FERPA requires that categories of directory information be defined in an institution's FERPA policy and that students and parents be informed of what information the categories include. Given the mechanisms to assure accountability recommended by the Commission, it is highly unlikely that an institution would characterize any information as directory information whose disclosure might cause harm or embarrassment to an individual. Because the administrative burden and the cost of permitting students to specify that some or all directory information about them may not be released is substantial, and because the only information normally characterized as directory information that is likely to create problems for the student if disclosed is information that serves to locate him, the Commission recommends:

Recommendation (12):

That the Family Educational Rights and Privacy Act be amended to provide that insofar as directory information is concerned, a student or parent may only require that address and phone number not be published without his consent or that it only be disclosed to persons who have established to the satisfaction of the institution a legitimate need to know.

Disclosures for Research and Statistical Purposes. The Commission believes that its recommendations regarding the disclosure of administrative records for research or statistical purposes in Chapter 15 should apply equally to education records. Adoption of the Commission's recommendations on research and statistics would allow educational institutions to permit the use of administrative records for any legitimate research or statistical purpose, but would, at the same time, make it easier for them to resist requests which they consider unwarranted. It would also give them more control over the conditions of disclosure, because the research organization seeking administrative records would have to sign a written agreement accepting the conditions stipulated by the educational institution. The Commission also believes that the decision to disclose records for research and the stipulation of the conditions under which they will be disclosed should be made by a central authority in an educational institution or agency and not a component thereof. Therefore, the Commission recommends:

Recommendation (13):

That the Family Educational Rights and Privacy Act be amended to permit an educational agency or institution to use or disclose an education record or information contained therein in individually identifiable form for a research or statistical purpose without parent or student consent, provided that the agency or institution:

(a) determines that such use or disclosure in individually identifiable form does not violate any conditions under which the information was collected;

(b) ascertains that such use or disclosure in individually identifiable form is necessary to accomplish the research or statistical purpose for which the use or disclosure is to be made;

(c) determines that the research or statistical purpose for which any use or disclosure is to be made warrants the risk to the individual from additional exposure of the record or information;

(d) requires that adequate safeguards to protect the record or information from unauthorized disclosure be established and maintained by the user or recipient, including a program for removal or destruction of identifiers;

(e) prohibits any further use or redisclosure of the record or information in individually identifiable form without its express authorization;

(f) prohibits any individually identifiable information resulting from such research from being used to make any decision or take any action directly affecting the individual to whom it pertains;

(g) makes any disclosure pursuant to a written agreement with the proposed recipient which attests to all of the above;

and provided further, that all such determinations, requirements, and prohibitions are made by the educational agency or institution (and not a component thereof).

Disclosures to Social Services Agencies. While the Commission understands the importance of the free flow of information between educational institutions and agencies and other social services agencies, it is also concerned that education records not become a source of information for purposes that are not acceptable to the individuals to whom they pertain. The achievement of educational goals, however, often depends upon ancillary services provided by other institutions, and the Commission believes that an educational agency should get all the help possible in meeting the needs of its students. The Commission's recommendations stress the need for participation by students, parents, and the public in the development of FERPA policies, vesting responsibility for record keeping in an educational institution's central authority rather than in components of the institution, and using a variety of mechanisms to assure that parent and student rights are protected. Given such protections, the Commission believes that educational institutions should be permitted to make determinations regarding whether certain routine disclosures of information are necessary for the educational agency to accomplish its own mission, and thus what disclosures should be permitted without the consent of students or parents. The burden should be on the educational institution to demonstrate the educational purpose of such disclosures, and the policy should be specific as to the agencies and types of information involved in such disclosure. The Commission, therefore, recommends:

Recommendation (14):

That the Family Educational Rights and Privacy Act be amended so as to permit an educational agency or institution to designate in its policy implementing FERPA that disclosures may be made on a routine basis without the authorization of the parent or student to a particular welfare or social service agency for a specified purpose that directly assists the educational agency or institution in achieving its mission, provided that the categories of information which may be disclosed to such agency are also specified and that further redisclosure by such agency is prohibited.

Disclosure to Law Enforcement Units. Current FERPA requirements make it difficult for an educational institution to deal with both its own law enforcement unit, if it has one, and with local law enforcement agencies. In the first case, if an educational institution discloses student records to its own law enforcement unit, all records of that unit become subject to FERPA. In the second case, while restricting disclosures of student records to local law enforcement agencies is laudable in most instances, it creates a problem when the educational institution is a party of interest in a criminal investigation or when disciplinary problems and delinquency problems involving violations of law are difficult to differentiate. The Commission believes this problem demands a three-part resolution: (a) assuring that a parent or student has access to any recorded information used to make any disciplinary decision about the student; (b) holding an educational institution responsible for the quality of the information it uses to make disciplinary decisions about students or discloses to third parties that will make such decisions; and (c) assuring that an educational institution is in a position to get the help it needs from both its own law enforcement unit and local law enforcement units to protect the safety of employees or students and the property of the schools and individuals.

The measures thus far recommended by the Commission, if adopted, would guarantee that students and parents have the right to see and challenge all records of disciplinary officials, including desk drawer notes, when a disciplinary decision is made about a student. They would also require educational institutions to have reasonable procedures to assure the accuracy, timeliness, completeness, and relevance of such records for educational purposes, and mechanisms to force continual review of the adequacy of such procedures. Given these recommended protections, the Commission sees no reason to recommend that an educational institution have less latitude to exchange information with its own security or law enforcement unit than it does to make disclosures to law enforcement units outside the educational institution. Therefore, the Commission believes that a law enforcement unit of an educational institution should be allowed to exchange information with the rest of the educational institution without making its law enforcement records subject to FERPA. At the same time, educational institutions should be able to share education records, including disciplinary records, with their law enforcement unit only to the same extent as they can share such records with other law enforcement agencies.

Current FERPA requirements prohibit disclosure of education records to law enforcement agencies without parent or student consent, except under judicial order with advance notice to the parent, or in an emergency when such disclosure is necessary to protect the health or safety of the student of other persons. In effect, this prevents educational institutions from sharing information legally with law enforcement units in cases where the safety and welfare of students, faculty, and school property are involved. The emergency exception does not permit routine cooperation with law enforcement agencies even when the educational institution may be a party of interest. The DHEW regulations make this clear by including as one criterion of an emergency, that time be of the essence, and by stressing that the emergency clause is to be construed strictly. In many urban and suburban schools, however, there are extortion rings, gang violence, theft rings, hard drug traffic, and other continuing criminal activities. While education records are seldom vital to the conduct of a criminal investigation, they can sometimes be extremely helpful. It is the Commission's judgment that educational institutions should be allowed to make the determination that a disclosure is necessary as long as it is publicly accountable for its decision.

Therefore, the Commission recommends:

Recommendation (15):

That the Family Educational Rights and Privacy Act be amended to provide:

(a) that records collected or maintained by the security or law enforcement branch of an educational agency or institution solely for a law enforcement purpose-

(i) shall not be considered to be education records subject to the provisions of FERPA when the security or law enforcement branch does not have access to education records maintained by the agency or institution; and

(ii) may be disclosed only to law enforcement agencies of the same jurisdication and to school officials responsible for disciplinary matters;

(b) that disclosure of information may be made by an educational

agency or institution to law enforcement officials without the

consent of the student or parent, provided that:

(i) an official determination is made by the educational agency or institution (and not by a component thereof) that the information disclosed is necessary to an authorized investigation of ongoing violations of law which threaten the welfare of the educational agency or institution or its students or faculty; and

(ii) each determination is publicly reported to the governing board of the agency or institution including the type of information disclosed, the number of individuals involved, and the justification for such disclosure, but not the names of the individuals involved.

The Commission believes that its recommendations will strengthen the protections afforded parents and students by the Family Educational Rights and Privacy Act and will give localities greater latitude in formulating FERPA policies that meet their particular needs and circumstances. The Commission also feels that the Department of Health, Education, and Welfare should provide substantial technical assistance to educational institutions to facilitate and expedite the development and implementation of such policies. Federal assistance might take the form of grants to consortiums of schools to develop and promulgate model policies, public information projects to inform schools, parents and students of their rights and responsibilities, and projects to identify and disseminate information about model practices. DHEW's experience with FERPA places it in a unique position to provide or sponsor such assistance.