Family Educational Rights and Privacy Act (FERPA)
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.
FERPA gives students rights to their education records when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are “eligible students.” Eligible students have the right to inspect and review the student’s education records maintained by the school.
Additionally, a school official with a legitimate educational interests is permitted to access education records.
Education Records: records directly related to a student and maintained by the institution or by a party acting for the institution. Examples include schedule of classes, official advising notes, student account and financial aid records, transcripts, and admission applications of current students.
School Officials: members of an institution who act in the student’s education interest within the limitations of their “need to know.” Examples include faculty, administration, clerical/professional employees, student employees, contractors and volunteers performing institutional functions, etc.
FERPA goes into effect the first day of classes, in-person or by correspondence, for new students and remains in effect until written notice of the student or death of the student.
Providing Access to Parents/Guardians/Spouses/Friends
If a Drew University student wishes, they may provide “proxy access” to parents/guardians/spouses/friends as desired to grant them access to their education information. This can be done by going online at treehouse.drew.edu using the Parent/Guardian Proxy Access tab. Students can itemize the areas to which their proxies may have access; for example, students may wish their proxy to be able to view the tuition bill, financial aid requirements, academic grades or schedule. By setting up proxy access, the student permits their proxy to view such information online, as well as their proxy to have discussions about such information with university staff members. Please watch this video or follow these instructions if you need assistance.
Requesting Review of Educational Records
Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information.
A student requesting to inspect his/her educational record must to do so in writing to the Registrar’s office specifying the records to be reviewed. The University Registrar will arrange an appropriate meeting time for the student to review the record within 45 days of receipt of the written request. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.
Cases involving disagreements about University data and records are heard by a committee convened by the University Registrar. If the committee rules against a student’s appeal, the student may place a statement in the permanent file challenging the accuracy of information in that file or further explaining the data. If a student believes that Drew University has not adequately redressed a grievance, the student may file an appeal with the Family Educational Rights and Privacy Act Office, Department of Education, 400 Maryland Avenue, Washington, DC 20202.
Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31)*:
- School officials with legitimate educational interest;
- Other schools to which a student is transferring;
- Specified officials for audit or evaluation purposes;
- Appropriate parties in connection with financial aid to a student;
- Organizations conducting certain studies for or on behalf of the school;
- Accrediting organizations;
- To comply with a judicial order or lawfully issued subpoena;
- Appropriate officials in cases of health and safety emergencies; and
- State and local authorities, within a juvenile justice system, pursuant to specific State law.
*One exception, which permits disclosure without consent, is disclosure to school officials with legitimate educational interests. A school official is a person employed by the school as an administrator, supervisor, instructor, or support staff member (including health or medical staff and law enforcement unit personnel) or a person serving on the school board. A school official also may include a volunteer or contractor outside of the school who performs an institutional service of function for which the school would otherwise use its own employees and who is under the direct control of the school with respect to the use and maintenance of PII from education records, such as an attorney, auditor, medical consultant, or therapist; a parent or student volunteering to serve on an official committee, such as a disciplinary or grievance committee; or a parent, student, or other volunteer assisting another school official in performing his or her tasks. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.
Schools may disclose, without consent, “directory” information that would not generally be considered harmful or an invasion of privacy if disclosed. FERPA does not require directory information to be released; it is at the discretion of the institution. It is Drew University’s practice not to provide mailing lists to third-parties, but may work with them to send information on their behalf to students. A third-party is considered any individual or organization other than the student and Drew University. Examples of “directory” information:
- Home/Local Address (city, state, country only)
- Class level (sophomore, junior, etc.)
- Enrollment status (full-time, part-time, etc.)
- Dates of attendance
- Degree, Honors and Awards received
- Student activities
- Student athlete sport, height, and weight
- Student’s photograph
A student wishing to block the release of “directory” information must do so in writing at the Office of the Registrar in the fall semester during the first two weeks of classes. This “block” will remain on the student’s record until such time as its release is requested in writing from the University Registrar.
Personally Identifiable Information that is Never Released
Personally identifiable information (PII) will not be released (even to parents/guardians) without prior written consent from the student. Examples of PII include:
- Social Security Number (SSN)
- Current class schedule
- Parent/Guardian names
- Country of citizenship
- Religious affiliation
- Disciplinary status
- Marital status
- Test/Exam scores
FERPA for Faculty and Staff
FERPA Overview for Faculty and Staff(6 minute video)
There is no guarantee of confidentiality in transmitting information electronically. However, if it is necessary to provide a student grade information outside of viewing the final grades in the registration system, faculty may e-mail grade information to the individual student via their institutional account (drew.edu). Grades should never be sent to a non-institutional assigned account since there is no way to verify the authenticity of the end user and the institution would be held responsible if an unauthorized third party gained access.
Posting student grades by name, SSN, or student ID is in violation of FERPA. You may only publicly post grades if the student is assigned a unique identifier known only to the student and faculty member. Additionally, grades should be listed randomly, not in alphabetical order.
FERPA and Virtual Learning
While class instruction is happening online, instructors need to be aware of FERPA and the platforms used as course content and student information are protected under FERPA.
- Zoom uses privacy practices and security to ensure data is FERPA protected.
- Google Classroom is FERPA compliant when using Google Apps for Education.
- Youtube is not FERPA compliant.
Video recordings that include student video and voices (personally identifiable information) require:
- Students needing to be informed at the beginning of the class that it will be recorded.
- Students needing to be allowed to keep their camera off if the class is recorded and they do not consent to sharing personally identifiable information.
- Language to be included in the syllabus about the possibility of recording class sessions, the appropriate use of the recordings by students, and that students cannot record the session on their own.
- That recordings are only shared with students registered for the class for the duration of the class and not posted on publicly accessible sites.
- That recordings should not be saved on personal computers past the end of the class.