FERPA

​The Family Educational Rights and Privacy Act was originally passed in 1974.

​It was updated in 2008 and 2011.

• ​Review and inspect the student's education record.

• ​Request that inaccurate or misleading information be updated or amended by the educational institution.

• ​Have a hearing if the educational institution denied the request to amend or correct the information. (Must be fulfilled within 45 days... sooner in some places.)

​

​

​(Eligible students have reached the age of 18 or have already gone to a higher education institution.)

• ​Parents and eligible students must be notified yearly of their rights under FERPA. (Educational institutions must make sure their notifications are "effectively provided" for disabled individuals and parents whose home language is not English.)

• ​a withdrawing student's new school

• ​certain auditing and evaluation officials

• ​individuals trying to determine eligibility for financial aid

• ​organizations conducting studies to develop, validate, or administer predictive tests or student aid programs, or improve instruction

• ​accrediting organizations

• ​authorized parties in a court case

• ​Health and safety officials in an emergency

• ​Juvenile justice system authorities

• ​Not considered to be harmful or an invasion of privacy.

​It includes:

• ​Name, address, ​telephone number, email address, ​photo, date and place of birth, grade level, ​dates of attendance, participation in activities and sports, weight and height of sports teams members, degrees, honors and awards, and the most recent educational institution attended.

• ​Does not include social security number, but can include student ID number if it can't be used to access records.

• ​Can be shared without prior written consent, but not with educational partners or technology providers.

​Can access personally identifiable student information without prior written consent if:

• ​There is a legitimate educational interest

• ​Reasonable methods have been used to limit access

• ​Access must be limited to "need to know" information that will help educators perform their jobs. (This is called The  “rule/role-based access”.

  ​Information can only be shared with another school official with a "legitimate educational interest in the data".

• ​​Laws are in place to limit access to specific data to  protect students.

• The laws regarding student data is pretty clear. Educators are not  permitted to do anything more with it except to meet the legitimate “educational” interest. The data may only be shared with someone who has also been designated as a school official with a legitimate educational interest in that data.

• Every person with access to the data is held accountable for complying with the protocols for the data policies.

  If an outside vendor has a legitimate educational interest in receiving personal identifiable student data, it is possible to designate them as one of our school officials.

• There may be several stipulations to make an outside party a school official such as vetting them through a centralized process by making a series of legal and policy determinations.

• When sharing personally identifiable student information with a school official, the educational institution must maintain “direct control” over the use of data and records. Direct control means that the educational institution chooses what happens with the education records within and after the contract.

• ​Student data may be disclosed without prior consent if certain data fields are removed or masked.

• ​A record of each request by individuals and technology providers must be maintained.

• ​FERPA is enforced by the Family Policy Compliance Office of the Education Department.

• ​They are authorized to review and investigate complaints.

• ​Vendors in violation will receive a notice and steps to follow in order to comply.

• ​Requires that obligations are met to receive federal funds.