In recent months, a drumbeat of criticism has sounded with respect to how colleges apply the federal Family Educational Rights and Privacy Act, better known as Ferpa. In November, for example, The Chronicle reported that the Student Press Law Center, an organization that advocates for First Amendment rights and open governance on campuses, had accused officials at some universities of using Ferpa as “a catchall excuse to conceal information they wish to keep secret.”
That generalization is unfair to institutional officials whose jobs require them to apply Ferpa on a day-to-day basis. Ferpa is, first and foremost, a privacy statute—it’s what the “P” stands for. Under the law, an institution is required to adopt the default position that education records cannot be disclosed unless the student who is the subject of the record consents or unless disclosure without consent is explicitly authorized by an exception in the statute.
James L. Buckley, a U.S. senator from New York who sponsored Ferpa in 1974, said he had introduced the legislation “to strengthen the parental role by requiring schools that receive federal funding to provide parents, on request, with all information relating to their children.”
From the very beginning, Ferpa has always served two distinct purposes. Its first, simplest, and least controversial purpose is to confer on each student the right to inspect and correct any “education records” (more on that term in a moment) containing the student’s name or personally identifiable information about the student. The law’s provisions related to this are widely understood and cause little difficulty in practice. Second, it protects students’ privacy by prohibiting institutions from engaging in unauthorized disclosure of education records and by imposing on faculty and staff members the obligation to take reasonable precautions to prevent misuse or unauthorized disclosure of education records.
At Ferpa’s heart is this easy-to-state but highly restrictive rule: A college or university cannot disclose an education record unless either the student who is identified in the record consents in writing to the disclosure or disclosure is warranted without consent under a specific Ferpa exemption to the consent requirement. For example, the Chronicle article cites incidents in which universities rightly invoked Ferpa, in one case declining to release a copy of a police report about a campus pellet-gun incident, and in another case to withhold records relating to an alleged assault by a university football player.
Ferpa originally applied primarily to academic records. But Congress immediately recognized that the statutory definition of “education records” was too narrow and left important categories of records unprotected. Just weeks after enactment, Congress broadened the statutory definition to include any record, file, document, or other material maintained by the institution that contains any information directly related to a student. As higher-education lawyers have become accustomed to telling their clients, virtually any document containing the name of a current or former student or other identifying information about the student—any e-mail, letter, disciplinary record, fraternity communication, athletic-department form, or scholarship file—is “Ferpa-protected.”
When Ferpa was enacted, in 1974, it contained just five exceptions to the prohibition against nonconsensual disclosure. Over the last 38 years Congress has amended Ferpa 10 times, and today there are 16 circumstances in which disclosure may be made without consent. Some are logical and noncontroversial: The custodian of an education record may share it with other institutional officials who have a “legitimate educational interest” in viewing it, enabling a professor to give a course grade to the registrar, say, or allowing an administrator to cope with a health or safety emergency. Likewise, the directory-information exception enables colleges to compile campus phone directories and athletic-team rosters.
Other exceptions are more controversial. A recent amendment to the statute, for example, permits disclosure of records of disciplinary proceedings to officials at other schools to which the student has applied to do graduate work. Another exception—controversial because of its narrowness, not its breadth—allows an institution to share education records with a student’s parents, but only if the student is “dependent” within the meaning of that term in the Internal Revenue Code. Many tuition-paying parents are indignant when institutional officials tell them they are not entitled to see their son’s or daughter’s report card or disciplinary file—an outcome that ironically conflicts with the law’s original intent.
Controversies notwithstanding, Congress enacted those exceptions with thought and care. The U.S. Department of Education has provided lucid guidance about the scope, and in some instances the limitations, of the exceptions to the general statutory presumption of privacy. Ferpa may now be broader than what Senator Buckley intended in 1974, but its prohibitions against disclosure are clear, and the privacy protections it extends to education records are unequivocal.
If critics believe that Ferpa protects too many education records, the appropriate response is not to accuse institutional officials of concealment. It is to tell Congress to change the law.
