Personal Privacy in an Information Society. Regulations Implementing Ferpa


In preparing the regulations, DHEW consulted extensively with representatives of educational institutions, and generally did not interpret the Act in such a way as to reduce the flexibility given educational institutions by the statute. The regulations require educational institutions and agencies to formulate a policy that specifies their procedures for effectuating the rights given students and parents by FERPA. Insofar as disclosure is concerned, the policy must specify rules and criteria for determining which educational purposes are legitimate and which school officials within the institution or agency can gain access to records. It must also specify what categories of information are to be considered directory information. The regulations include broad guidelines for hearing procedures, general conditions for disclosure in emergencies affecting the health and safety of an individual, and a definition of the term "student" that denies students in one component of an institution (an undergraduate college, for example) access to their admissions records in another component of the same institution (such as a law school or medical school).

The statute did not require DHEW to review and approve each institution's policies, or to pass judgment on the substance of policies when complaints are made, and the Department has not done so. Responsibility for judgments of that sort has been left to local institutions, and wisely so in the view of the Commission.


The implementation of FERPA has been plagued by confusion, misunderstanding, and delay. Because the Congress did not authorize additional funds for DHEW to implement the law, the Department has not been able to spend much money doing so. The Department's small Fair Information Practice Staff was designated as the office responsible for developing and promulgating the regulations required by the statute, answering questions and offering assistance in interpreting the statute and regulations, handling complaints about violations of FERPA requirements, and mediating solutions to conflicts over interpretations.

The FERPA regulations were not issued until June 1976, some 18 months after passage of the Act. Inadequate staffing and funding were not the only reasons for the delay. Extensive consultations with representatives of educational institutions took time, especially because many educators were still poorly informed about FERPA and resistant to Federal government regulation of any sort. As a consequence, many institutions did nothing to implement the Act pending the issuance of the regulations, while others attempted to develop policies based on interpretations derived from the Russell Sage and NCCE studies or those developed by their legal counsels.

The long delay generated confusion and misunderstanding that was not easily alleviated by issuing the regulations. While the DHEW staff was available to answer questions, not many educators turned to them for answers, and there was no systematic program to inform school officials or the public about the law. Rumors and misinterpretations have been widespread. For example, the Privacy Commission received an indignant complaint from an educator responsible for record-keeping policy in a large elementary and secondary school district who did not know that FERPA regulations, issued six months previously, had completely obviated the complaint.

Another serious implementation problem arose because FERPA was introduced into an environment that has come to expect the Federal regulatory role to be prescriptive. The underlying strategy of FERPA, which leaves to educational institutions most of the responsibility for defining the details of procedures to assure individual protection, has been viewed by educators as a weakness rather than a strength of the law. For example, the president of a local university recently complained to a reporter from the university's student newspaper that "the Buckley Amendment is one of the prime examples of poor legislation, poor administration and everything that goes into it. Just about every institution has a different interpretation of FERPA."24

What educators perceive to be ambiguity has led many of them to make unnecessarily labored and highly defensive interpretations of the law. Instead of taking the latitude afforded by the statute as a challenge to their professional skill, and as an opportunity for innovation in concert with parents, students, and colleagues, educators have turned to their legal counsels for safety. In many cases, legally sound advice has been unnecessarily burdensome and on occasion educationally unsound.

In the Commission's judgment, the major problem in implementing FERPA has been the lack of understanding among educators, parents, students, and the general public both about the requirements of the Act and the strategy of enforced self- regulation that underlies it. Where understanding of these factors exists, the Commission has found little objection on the part of educational institutions to either FERPA's principles or its requirements.25 Contrary to their expectations, educators have found that offering students and parents access to their records does not unleash a tidal wave of demands for access and correction that immobilizes educational institutions. Implementing FERPA has not been burdensome for those institutions with sound record-keeping practices, or for those that have sought in good faith to develop policies consonant with the spirit of the law.26

A few of the complaints about unnecessary burdens are doubtless justified. Examples of possibly burdensome requirements include the requirement to keep a record available to students and parents of all requests for disclosure, whether granted or not [20 U.S.C. 1232g(b)(4)(19)]; the requirement to identify and list all record systems in a central place rather than simply requiring each component to have such a list available on request [45 C.F.R. 99.5(2)(iv)]; and the requirement to allow a student to restrict the disclosure of any or all categories of directory information. [20U.S.C. 1232g(a)(5)(B)]; In addition, educators in some elementary and secondary schools have found restrictions on the sharing of information with social services agencies unnecessarily burdensome, and some schools at all levels have found it difficult to control access to student files by federally funded researchers.

Claims that FERPA imposes unreasonable costs appear to be largely rhetorical. Typical of the rhetoric is the statement of a university administrator that universities are "stockpiling lawyers like countries are stockpiling nuclear warheads in the cold war."27 In reality, this administrator's own large State university has met the added burden of FERPA requirements by retaining the part-time services of an attorney who was also enrolled as a graduate student.

In response to the Commission's direct request for data on the cost of implementing FERPA, only one institution produced evidence of extra expenditures. Its estimate, after careful analysis, was that FERPA cost about one extra dollar per year per student and, in doing the analysis, it discovered several places in which the flexibility FERPA allows would enable it to cut even that cost without detriment to the individual student.28 Had the cost of implementing FERPA been as great as the rhetoric would suggest, the Commission's request for data would surely have produced budgeting and planning documents reflecting the costs from institutions that had found them to be burdensome. While there are obviously some costs incurred in implementing the law-an extra page or two of printing, an extra form for those who wish directory information withheld, and the cost of discussions with faculty, staff, and administrators-it seems safe to infer that they are insignificant.

The cost of implementing FERPA depends of course on the quality of an institution's records and the efficiency of its record-keeping practices prior to the enactment of the statute. If the quality of an institution's records were so poor that it receives many requests to correct them, or is subjected to other legal action, then the cost of implementing FERPA might very well become substantial. The prospect of such costs provides a valuable incentive to develop better record-keeping policies and practices.

Even when policies are well conceived, difficulties can arise in implementing them. At the elementary and secondary school level, there are strong indications that in a large school district with a uniform policy, there is often little uniformity of practice among schools within the district. Parent and student groups have documented the allegation that student records are still being disclosed to law enforcement agencies without notice to, or authorization from, students or parents and that, in some cases, "desk drawer" notes have been used as official records, rather than solely as the personal records of a teacher.29 Student groups testified to the Commission that universities or faculty members were subtly coercing students into waiving their right of access to letters of recommendation.30 Further, the Commission could find little evidence that educational institutions are doing a very good job of informing students and parents of their rights under the Act.

The Commission found substantial evidence that neither parents nor educators consider the system for enforcing FERPA satisfactory, as it depends on complaints being filed with DHEW for mediation, and the only sanction for failure to comply with the law is withdrawal of all U.S. Office of Education funding. DHEW has not received many complaints, possibly because Washington seems too far away, or because the only available sanction is so harsh that it is rarely ever imposed and thus is not credible, or because the sanction would not in any case secure the desired result-prompt compliance. Educators resent, in principle, the idea of withdrawal of Federal funds and view its threat with disdain because it is not likely to be exercised.