# Family Educational Rights and Privacy

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3AE8-28864

## Record

- **Collection:** Federal Register
- **Document type:** Rule
- **Published:** December 9, 2008
- **Citation:** 73 FR 74806

## Text

DEPARTMENT OF EDUCATION
34 CFR Part 99
RIN 1855-AA05
[Docket ID ED-2008-OPEPD-0002]
Family Educational Rights and Privacy

AGENCY:

Office of Planning, Evaluation, and Policy Development, Department of Education.

ACTION:

Final regulations.

SUMMARY:

The Secretary amends our regulations implementing the Family Educational Rights and Privacy Act (FERPA), which is section 444 of the General Education Provisions Act. These amendments are needed to implement a provision of the USA Patriot Act and the Campus Sex Crimes Prevention Act, which added new exceptions permitting the disclosure of personally identifiable information from education records without consent. The amendments also implement two U.S. Supreme Court decisions interpreting FERPA, and make necessary changes identified as a result of the Department's experience administering FERPA and the current regulations.

These changes clarify permissible disclosures to parents of eligible students and conditions that apply to disclosures in health and safety emergencies; clarify permissible disclosures of student identifiers as
directory information;
allow disclosures to contractors and other outside parties in connection with the outsourcing of institutional services and functions; revise the definitions of
attendance, disclosure, education records, personally identifiable information,
and other key terms; clarify permissible redisclosures by State and Federal officials; and update investigation and enforcement provisions.

DATES:

These regulations are effective January 8, 2009.

FOR FURTHER INFORMATION CONTACT:

Frances Moran, U.S. Department of Education, 400 Maryland Avenue, SW., room 6W243, Washington, DC 20202-8250. Telephone: (202) 260-3887.

If you use a telecommunications device for the deaf (TDD), you may call the Federal Relay Service (FRS) at 1-800-877-8339.

Individuals with disabilities may obtain this document in an alternative format (
e.g.
, Braille, large print, audiotape, or computer diskette) on request to the contact person listed under
FOR FURTHER INFORMATION CONTACT
.

SUPPLEMENTARY INFORMATION:

On March 24, 2008, the U.S. Department of Education (the Department or we) published a notice of proposed rulemaking (NPRM) in the
Federal Register
(73 FR 15574). In the preamble to the NPRM, the Secretary discussed the major changes proposed in that document that are necessary to implement statutory changes made to FERPA, to implement two U.S. Supreme Court decisions, to respond to changes in information technology, and to address other issues identified through the Department's experience in administering FERPA.

We believe that the regulatory changes adopted in these final regulations provide clarification on many important issues that have arisen over time with regard to how FERPA affects decisions that school officials have to make on an everyday basis. Educational agencies and institutions face considerable challenges, especially with regard to maintaining safe campuses, protecting personally identifiable information in students' education records, and responding to requests for data on student progress. These final regulations, as well as the discussion on various provisions in the preamble, will assist school officials in addressing these challenges in a manner that complies with FERPA and protects the privacy of students' education records.

Notice of Proposed Rulemaking

In the NPRM, we proposed regulations to implement section 507 of the USA Patriot Act (Pub. L. 107-56), enacted October 26, 2001, and the Campus Sex Crimes Prevention Act, section 1601(d) of the Victims of Trafficking and Violence Protection Act of 2000 (Pub. L. 106-386), enacted October 28, 2000. Other major changes proposed in the NPRM included the following:

• Amending § 99.5 to clarify the conditions under which an educational agency or institution may disclose personally identifiable information from an eligible student's education records to a parent without the prior written consent of the eligible student;

• Amending § 99.31(a)(1) to authorize the disclosure of education records without consent to contractors, consultants, volunteers, and other outside parties to whom an educational agency or institution has outsourced institutional services or functions;

• Amending § 99.31(a)(1) to ensure that teachers and other school officials only gain access to education records in which they have legitimate educational interests;

• Amending § 99.31(a)(2) to permit educational agencies and institutions to disclose education records, without consent, to another institution even after the student has enrolled or transferred so long as the disclosure is for purposes related to the student's enrollment or transfer;

• Amending § 99.31(a)(6) to require that an educational agency or institution may disclose personally identifiable information under this section only if it enters into a written agreement with the organization specifying the purposes of the study and the use and destruction of the data;

• Amending § 99.31 to include a new subsection to provide standards for the release of information from education records that has been de-identified;

• Amending § 99.35 to permit State and local educational authorities and Federal officials listed in § 99.31(a)(3) to make further disclosures of personally identifiable information from education records on behalf of the educational agency or institution; and

• Amending § 99.36 to remove the language requiring strict construction of this exception and add a provision stating that if an educational agency or institution determines that there is an articulable and significant threat to the health or safety of a student or other individual, it may disclose the information to any person, including parents, whose knowledge of the information is necessary to protect the health or safety of the student or other individuals.

Significant Changes From the NPRM

These final regulations contain several significant changes from the NPRM as follows:

• Amending the definition of
personally identifiable information
in § 99.3 to provide a definition of
biometric record;

• Removing the proposed definition of
State auditor
in § 99.3 and provisions in § 99.35(a)(3) related to State auditors and audits;

• Revising § 99.31(a)(6) to clarify the specific types of information that must be contained in the written agreement between an educational agency or institution and an organization conducting a study for the agency or institution;

• Removing the statement from § 99.31(a)(16) that FERPA does not require or encourage agencies or institutions to collect or maintain information concerning registered sex offenders;

• Requiring a State or local educational authority or Federal official or agency that rediscloses personally identifiable information from education records to record that disclosure if the

educational agency or institution does not do so under § 99.32(b); and

• Revising § 99.32(b) to require an educational agency or institution that makes a disclosure in a health or safety emergency to record information concerning the circumstances of the emergency.

These changes are explained in greater detail in the following
Analysis of Comments and Changes.

Analysis of Comments and Changes

In response to the Secretary's invitation in the NPRM, 121 parties submitted comments on the proposed regulations. An analysis of the comments and of the changes in the regulations since publication of the NPRM follows.

We group major issues according to subject, with applicable sections of the regulations referenced in parentheses. We discuss other substantive issues under the sections of the regulations to which they pertain. Generally, we do not address technical and other minor changes, or suggested changes that the law does not authorize the Secretary to make. We also do not address comments pertaining to issues that were not within the scope of the NPRM.

Definitions (§ 99.3)

(a) Attendance

Comment:
We received no comments objecting to the proposed changes to the definition of the term
attendance.
Three commenters expressed support for the changes because the availability and use of alternative instructional formats are not clearly addressed by the current regulations. One commenter suggested that the definition could avoid obsolescence by referring to the receipt of instruction leading to a diploma or certificate instead of listing the types of instructional formats.

Discussion:
We proposed to revise the definition of
attendance
because we received inquiries from some educational agencies and institutions asking whether FERPA was applicable to the records of students receiving instruction through the use of new technology methods that do not require a physical presence in a classroom. Because the definition of
attendance
is key to determining when an individual's records at a school are education records protected by FERPA, it is essential that schools and institutions understand the scope of the term. To prevent the regulations from becoming out of date as new formats and methods are developed, the definition provides that attendance may also include “other electronic information and telecommunications technologies.”

While most schools are aware of the various formats distance learning may take, we believe it is informative to list the different communications media that are currently used. Also, we believe that parents, eligible students, and other individuals and organizations that use the FERPA regulations may find the listing of formats useful.

We do not agree that the definition of
attendance
should be limited to receipt of instruction leading to a diploma or certificate, because this would improperly exclude many instructional formats.

Changes:
None.

(b) Directory Information (§§ 99.3 and 99.37)

(1) Definition (§ 99.3)

Comment:
We received a number of comments on our proposal to revise the definition of
directory information
to provide that an educational agency or institution may not designate as directory information a student's social security number (SSN) or other student identification (ID) number. The proposed definition also provided that a student's user ID or other unique identifier used by the student to access or communicate in electronic systems could be considered directory information but only if the electronic identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the student's identity.

All commenters agreed that student SSNs should not be disclosed as directory information. Several commenters strongly supported the definition of
directory information
as proposed, noting that failure to curtail the use of SSNs and student ID numbers as directory information could facilitate identity theft and other fraudulent activities.

One commenter said that the proposed regulations did not go far enough to prohibit the use of students' SSNs as a student ID number, placing SSNs on academic transcripts, and using SSNs to search an electronic database. Another commenter expressed concern that the proposed regulations could prohibit reporting needed to enforce students' financial obligations and other routine business practices. According to this commenter, restrictions on the use of SSNs in FERPA and elsewhere demonstrate the need for a single student identifier that can be tied to the SSN and other identifying information to use for grade transcripts, enrollment verification, default prevention, and other activities that depend on sharing student information. Another commenter stated that institutions should not be allowed to penalize students who opt out of directory information disclosures by denying them access to benefits, services, and required activities.

Several commenters said that the definition in the proposed regulations was confusing and unnecessarily restrictive because it treats a student ID number as the functional equivalent of an SSN. They explained that when providing access to records and services, many institutions no longer use an SSN or other single identifier that both identifies and authenticates identity. As a result, at many institutions, the condition specified in the regulations for treating electronic identifiers as directory information,
i.e.
, that the identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user's identity, often applies to student ID numbers as well because they cannot be used to gain access to education records without a personal identification number (PIN), password, or some other factor to authenticate the user's identity. Some commenters suggested that our nomenclature is the problem and that regardless of what it is called, an identifier that does not allow access to education records without the use of authentication factors should be treated as directory information. According to one commenter, allowing institutions to treat student ID numbers as directory information in these circumstances would improve business practices and enhance student privacy by encouraging institutions to require additional authentication factors when using student ID numbers to provide access to education records.

One commenter strongly opposed allowing institutions to treat a student's electronic identifier as directory information if the identifier could be made available to parties outside the school system. This commenter noted that electronic identifiers may act as a key, offering direct access to the student's entire file, and that PINs and passwords alone do not provide adequate security for education records. Another commenter said that if electronic identifiers and ID numbers can be released as directory information, then password requirements need to be more stringent to guard against unauthorized access to information and identity theft.

Some commenters recommended establishing categories of directory information, with certain information

made available only within the educational community. One commenter expressed concern about Internet safety because the regulations allow publication of a student's e-mail address. Another said that FERPA should not prevent institutions from printing the student's ID number on an ID card or otherwise restrict its use on campus but that publication in a directory should not be allowed.

Two commenters asked the Department to confirm that the regulations allow institutions to post grades using a code known only by the teacher and the student.

Discussion:
We share commenters' concerns about the use of students' SSNs. In general, however, there is no statutory authority under FERPA to prohibit an educational agency or institution from using SSNs as a student ID number, on academic transcripts, or to search an electronic database so long as the agency or institution does not disclose the SSN in violation of FERPA requirements. As discussed elsewhere in this preamble, FERPA does prohibit using a student's SSN, without consent, to search records in order to confirm directory information.

Some States prohibit the use of SSNs as a student ID number, and some institutions have voluntarily ceased using SSNs in this manner because of concerns about identity theft. Students are required to provide their SSNs in order to receive Federal financial aid, and the regulations do not prevent an agency or institution from using SSNs for this purpose. We note that FERPA does not address, and we do not believe that there is statutory authority under FERPA to require, creation of a single student identifier to replace the SSN. In any case, the Department encourages educational agencies and institutions, as well as State educational authorities, to follow best practices of the educational community with regard to protecting students' SSNs.

We agree that students should not be penalized for opting out of directory information disclosures. Indeed, an educational agency or institution may not require parents and students to waive their rights under FERPA, including the right to opt out of directory information disclosures. On the other hand, we do not interpret FERPA to require educational agencies and institutions to ensure that students can remain anonymous to others in the school community when using an institution's electronic communications systems. As a result, parents and students who opt out of directory information disclosures may not be able to use electronic communications systems that require the release of the student's name or electronic identifier within the school community. (As discussed later in this notice in our discussion of the comments on § 99.37(c), the right to opt out of directory information disclosures may not be used to allow a student to remain anonymous in class.)

The regulations allow an educational agency or institution to designate a student's user ID or other electronic identifier as directory information if the identifier functions essentially like the student's name, and therefore, disclosure would not be considered harmful or an invasion of privacy. That is, the identifier cannot be used to gain access to education records except when combined with one or more factors that authenticate the student's identity.

We have historically advised that student ID numbers may not be disclosed as directory information because they have traditionally been used like SSNs,
i.e.
, as both an identifier and authenticator of identity. We agree, however, that the proposed definition was confusing and unnecessarily restrictive because it failed to recognize that many institutions no longer use student ID numbers in this manner. If a student identifier cannot be used to access records or communicate electronically without one or more additional factors to authenticate the user's identity, then the educational agency or institution may treat it as directory information under FERPA regardless of what the identifier is called. We have revised the definition of
directory information
to provide this flexibility.

We share the commenters' concerns about the use of PINs and passwords. In the preamble to the NPRM, we explained that PINs or passwords, and single-factor authentication of any kind, may not be reasonable for protecting access to certain kinds of information (73 FR 15585). We also recognize that user IDs and other electronic identifiers may provide greater access and linking to information than does a person's name. Therefore, we remind educational agencies and institutions that disclose student ID numbers, user IDs, and other electronic identifiers as directory information to examine their recordkeeping and data sharing practices and ensure that, when these identifiers are used, the methods they select for authenticating identity provide adequate protection against the unauthorized disclosure of information in education records.

We also share the concern of commenters who stated that students'e-mail addresses and other identifiers should be disclosed as directory information only within the school system and should not be made available outside the institution. The disclosure of directory information is permissive under FERPA, and, therefore, an agency or institution is not required to designate and disclose any student identifier (or any other item) as directory information. Further, while FERPA does not expressly recognize different levels or categories of directory information, an agency or institution is not required to make student directories and other directory information available to the general public just because the information is shared within the institution. For example, under FERPA, an institution may decide to make students' electronic identifiers and e-mail addresses available within the institution but not release them to the general public as directory information. In fact, the preamble to the NPRM suggested that agencies and institutions should minimize the public release of student directories to mitigate the risk of re-identifying information that has been de-identified (73 FR 15584).

With regard to student ID numbers in particular, an agency or institution may print an ID number on a student's ID card whether or not the number is treated as directory information because under FERPA simply printing the ID number on a card, without more, is not a disclosure and, therefore, is not prohibited.
See
20 U.S.C. 1232g(b)(2). If the student ID number is not designated as directory information, then the agency or institution may not disclose the card, or require the student to disclose the card, except in accordance with one of the exceptions to the consent requirement, such as to school officials with legitimate educational interests. If the student ID number is designated as directory information in accordance with these regulations, then it may be disclosed. However, the agency or institution may still decide against making a directory of student ID numbers available to the general public.

We discuss codes used by teachers to post grades in our discussion of the definition of
personally identifiable information
elsewhere in this preamble.

Changes:
We have revised the definition of
directory information
in § 99.3 to provide that directory information includes a student ID number if it cannot be used to gain access to education records except when used with one or more other factors to authenticate the user's identity.

(2) Conditions for Disclosing Directory Information

(i) 99.37(b)

Comment:
All comments on this provision supported our proposal to clarify that an educational agency or institution must continue to honor a valid request to opt out of directory information disclosures even after the student no longer attends the institution. One commenter stated that the proposed regulations appropriately provided former students with the continuing ability to control the release of directory information and remarked that this will benefit students and families. One commenter asked how long an opt out from directory information disclosures must be honored. Another commenter said that students may object if their former schools do not disclose directory information without their specific written consent because the school is unable to determine whether the student previously opted out. This could occur, for example, if a school declined to disclose that a student had received a degree to a prospective employer.

Discussion:
The regulations clarify that once a parent or eligible student opts out of directory information disclosures, the educational agency or institution must continue to honor that election after the student is no longer in attendance. While this is not a new interpretation, school districts and postsecondary institutions have been unclear about its application and have not administered it consistently. The inclusion in the regulations of this longstanding interpretation is necessary to ensure that schools clearly understand their obligation to continue to honor a decision to opt out of the disclosure of directory information after a student stops attending the school, until the parent or eligible student rescinds it.

Educational agencies and institutions are not required under FERPA to disclose directory information to any party. Therefore, parents and students have no basis for objecting if an agency or institution does not disclose directory information because it is not certain whether the parent or student opted out. The regulations provide an educational agency or institution with the flexibility to determine the process it believes is best suited to serve its population as long as it honors prior elections to opt out of directory information disclosures.

Changes:
None.

(ii) § 99.37(c)

Comment:
We received two comments in support of our proposal to clarify in this section that parents and students may not use the right to opt out of directory information disclosures to prevent disclosure of the student's name or other identifier in the classroom.

Discussion:
We appreciate the commenters' support.

Changes:
None.

(iii) § 99.37(d)

Comment:
Two commenters supported the prohibition on using a student's SSN to disclose or confirm directory information unless a parent or eligible student provides written consent. One of these commenters questioned the statutory basis for this interpretation.

Several commenters asked whether, under the proposed regulations, a school must deny a request for directory information if the requester supplies the student's SSN. One commenter asked whether a request for directory information that contains a student's SSN may be honored so long as the school does not use the SSN to locate the student's records. One commenter stated that the regulations could more effectively protect students' SSNs but was concerned that denying a request for directory information that contains an SSN may inadvertently confirm the SSN.

One commenter expressed concern that the prohibition on using a student's SSN to verify directory information would leave schools with large student populations unable to locate the appropriate record because they will need to rely solely on the student's name and other directory information, if any, provided by the requester, which may be duplicated in their databases. This commenter said that students would object if institutions were unable to respond quickly to requests by banks or landlords for confirmation of enrollment because the request contained the student's SSN.

One commenter suggested that the regulations require an educational agency or institution to notify a requester that the release or confirmation of directory information does not confirm the accuracy of the SSN or other non-directory information submitted with the request. Another commenter asked whether the regulations apply to confirmation of student enrollment and other directory information by outside service providers such as the National Student Clearinghouse.

Discussion:
The provision in the proposed regulations prohibiting an educational agency or institution from using a student's SSN when disclosing or verifying directory information is based on the statutory prohibition on disclosing personally identifiable information from education records without consent in 20 U.S.C. 1232g(b). The prohibition applies also to any party outside the agency or institution providing degree, enrollment, or other confirmation services on behalf of an educational agency or institution, such as the National Student Clearinghouse.

A school is not required to deny a request for directory information about a student, such as confirmation whether a student is enrolled or has received a degree, if the requester supplies the student's SSN (or other non-directory information) along with the request. However, in releasing or confirming directory information about a student, the school may not use the student's SSN (or other non-directory information) supplied by the requester to identify the student or locate the student's records unless a parent or eligible student has provided written consent. This is because confirmation of information in education records is considered a disclosure under FERPA. See 20 U.S.C. 1232g(b). A school's use of a student's SSN (or other non-directory information) provided by the requester to confirm enrollment or other directory information implicitly confirms and, therefore, discloses, the student's SSN (or other non-directory information). This is true even if the requester also provides the school with the student's name, date of birth, or other directory information to help identify the student.

A school may choose to deny a request for directory information, whether or not it contains a student's SSN, because only a parent or eligible student has a right to obtain education records under FERPA. Denial of a request for directory information that contains a student's SSN is not an implicit confirmation or disclosure of the SSN.

These regulations will not adversely affect the ability of institutions to respond quickly to requests by parties such as banks and landlords for confirmation of enrollment that contain the student's SSN because students generally provide written consent for schools to disclose information to the inquiring party in order to obtain banking and housing services. We note, however, that if a school wishes to use the student's SSN to confirm enrollment or other directory information about the student, it must ensure that the written consent provided by the student includes consent for the school to

disclose the student's SSN to the requester.

There is no authority in FERPA to require a school to notify requesters that it is not confirming the student's SSN (or other non-directory information) when it discloses or confirms directory information. However, when a party submits a student's SSN along with a request for directory information, in order to avoid confusion, unless a parent or eligible student has provided written consent for the disclosure of the student's SSN, the school may indicate that it has not used the SSN (or other non-directory information) to locate the student's records and that its response may not and does not confirm the accuracy of the SSN (or other non-directory information) supplied with the request.

We recognize that with a large database of student information, there may be some loss of ability to identify students who have common names if SSNs are not used to help identify the individual. However, schools that do not use SSNs supplied by a party requesting directory information, either because the student has not provided written consent or because the school is not certain that the written consent includes consent for the school to disclose the student's SSN, generally may use the student's address, date of birth, school, class, year of graduation, and other directory information to identify the student or locate the student's records.

Changes:
None.

(c) Disclosure (§ 99.3)

Comment:
Two commenters said that the proposal to revise the definition of
disclosure
to exclude the return of a document to its source was too broad and could lead to improper release of highly sensitive documents, such as an individualized education program (IEP) contained in a student's special education records, to anyone claiming to be the creator of a record. One of the commenters stated that changing the definition was unnecessary, as schools already have a means of verifying documents by requesting additional copies from the source. Both commenters also expressed concern that, because recordation is not required, a parent or eligible student will not be aware that the verification occurred.

We also received comments of strong support for the proposed change to the definition of
disclosure
. The commenters stated that this change, targeted to permit the release of records back to the institution that presumably created them, will enhance an institution's ability to identify and investigate suspected fraudulent records in a timely manner.

Discussion:
For several years now, school officials have advised us that problems related to fraudulent records typically involve a transcript or letter of recommendation that has been altered by someone other than the responsible school official. Under the current regulations, an educational agency or institution may ask for a copy of a record from the presumed source when it suspects fraudulent activity. However, simply asking for a copy of a record may not be adequate, for example, if the original record no longer exists at the sending institution. In these circumstances, an institution will need to return a record to its identified source to be able to verify its authenticity. The final regulations permit a targeted release of records back to the stated source for verification purposes in order to provide schools with the flexibility needed for this process while preserving a more general prohibition on the release of information from education records.

We do not agree that the term disclosure as proposed in the NPRM is too broad and could lead to the improper release of highly sensitive documents to anyone claiming to be the creator of the record. School officials have not advised us that they have had problems receiving IEP records and other highly sensitive materials from parties who did not in fact create or provide the record. Therefore, we do not believe that the proposed definition of disclosure is too broad.

The commenters are correct that the return of an education record to its source does not have to be recorded, because it is not a disclosure. We do not consider this problematic, however, because the information is merely being returned to the party identified as its source. This is similar to the situation in which a school is not required under the regulations to record disclosures of education records made to school officials with legitimate educational interests. As in that instance, there is no direct notice to a parent or student of either the disclosure of the record or the information in the record. We also believe that if a questionable document is deemed to be inauthentic by the source, the student will be informed of the results of the authentication process by means other than seeing a record of the disclosure in the student's file. There appears to be little value in notifying a parent or student that a document was suspected of being fraudulent if the document is found to be genuine and accurate.

Finally, we note that a transcript or other document does not lose its protection under FERPA, including the written consent requirements, when an educational agency or institution returns it to the source. The document and the information in it remains an “education record” under FERPA when it is returned to its source. As an education record, it may not be redisclosed except in accordance with FERPA requirements, including § 99.31(a)(1), which allows the source institution to disclose the information to teachers and other school officials with legitimate educational interests, such as persons who need to verify the accuracy or authenticity of the information. If the source institution makes any further disclosures of the record or information, it must record them.

Changes:
None.

Additional Changes to the Definition of Disclosure

Comment:
Several commenters requested additional changes to the definition of
disclosure
. One commenter requested that any transfer of education records to a State's longitudinal data system not be considered a disclosure. Several commenters requested that additional changes be made so that a school could provide current education records of students back to the students' former schools or districts. A commenter recommended excluding from the definition of
disclosure
statistical information that is personally identifiable because of small cell sizes when the recipient agrees to maintain the confidentiality of the information.

Discussion:
The revised definition of
disclosure
, which excludes the return of a document to its stated source, clarifies that information provided by school districts or postsecondary institutions to State educational authorities, including information maintained in a consolidated student records system, may be provided back to the original district or institution without consent. There is no statutory authority, however, to exclude from the definition of
disclosure
a school district's or institution's release or transfer of personally identifiable information from education records to its State longitudinal data system. (We discuss the
disclosure
of education records in connection with the development of consolidated, longitudinal data systems in our response to comments on redisclosure and recordkeeping requirements elsewhere in this preamble.) Likewise, there is no statutory authority to exclude from the definition of disclosure the release of personally identifiable information from

education records to parties that agree to keep the information confidential. (See our discussion of personally identifiable information and de-identified records and information elsewhere in this preamble.)

The revised regulations do not authorize the disclosure of education records to third parties who are not identified as the provider or creator of the record. For example, a college may not send a student's current college records to a student's high school under the revised definition of
disclosure
because the high school is not the stated source of those records. (We discuss this issue elsewhere in the preamble under
Disclosure of Education Records to Students' Former Schools
.)

Changes:
None.

(d) Education Records

(1) Paragraph (b)(5)

Comment:
Several commenters supported our proposal to clarify the existing exclusion from the definition of
education records
for records that only contain information about an individual after he or she is no longer a student, which we referred to as “alumni records” in the NPRM, 73 FR 15576. One commenter suggested that the term “directly related,” which is used in the amended definition in reference to a student's attendance, is inconsistent with the use of the term “personally identifiable” in other sections of the regulations and could cause confusion.

One commenter asked whether a postsecondary school could provide a student's education records from the postsecondary school to a secondary school that the student attended previously.

Several commenters objected to the proposed regulations because, according to the commenters, the regulations would expand the records subject to FERPA's prohibition on disclosure of education records without consent. A journalist stated that the settlement agreement cited in the NPRM is an example of a record that should be excluded from the definition and that schools already are permitted to protect too broad a range of documents from public review because the documents are education records. The commenter stated that information from education records such as a settlement agreement is newsworthy, unlikely to contain confidential information, and that disclosure of such information provides a benefit to the public. Another commenter expressed concern that the regulations allow schools to collect negative information about a former student without giving the individual an opportunity to challenge the content because the information is not an education record under FERPA.

Discussion:
It has long been the Department's interpretation that records created or received by an educational agency or institution on a former student that are directly related to the individual's attendance as a student are not excluded from the definition of
education records
under FERPA, and that records created or received on a former student that are not directly related to the individual's attendance as a student are excluded from the definition and, therefore, are not “education records.” The proposed regulations in paragraph (b)(5) were intended to clarify the use of this exclusion, not to change or expand its scope.

Our use of the phrase “directly related to the individual's attendance as a student” to describe records that do not fall under this exclusion from the definition of
education records
is not inconsistent with the term “personally identifiable” as used in other parts of the regulations and should not be confused. The term “personally identifiable information” is used in the statute and regulations to describe the kind of information from education records that may not be disclosed without consent.
See
20 U.S.C. 1232g(b); 34 CFR 99.3, 99.30. While “personally identifiable information” maintained by an agency or institution is generally considered an “education record” under FERPA, personally identifiable information does not fall under this exclusion from the definition of education records if the information is not directly related to the student's attendance as a student. For example, personally identifiable information related solely to a student's activities as an alumnus of an institution is excluded from the definition of education records under this provision. We think that the term “directly related” is clear in this context and will not be confused with “personally identifiable.”

A postsecondary institution may not disclose a student's postsecondary education records to the secondary school previously attended by the student under this provision because these records are directly related to the student's attendance as a student at the postsecondary institution. (We discuss this issue further under
Disclosure of Education Records to Students' Former Schools.
)

We do not agree that documents such as settlement agreements are unlikely to contain confidential information. Our experience has been that these documents often contain highly confidential information, such as special education diagnoses, educational supports, or mental or physical health and treatment information. Our changes to the definition were intended to clarify that schools may not disclose this information to the media or other parties, without consent, simply because a student is no longer in attendance at the school at the time the record was created or received. A parent or eligible student who wishes to share the student's own records with the media or other parties is free to do so.

Neither FERPA nor the regulations contains a provision for a parent or eligible student to challenge information that is not contained in an education record. FERPA does not prohibit a parent or student from using other venues to seek redress for collection and release of information in non-education records.

Changes:
None.

(2) Paragraph (b)(6)

Comment:
We received several comments supporting the proposed changes to the definition of
education records
that would exclude from the definition grades on peer-graded papers before they are collected and recorded by a teacher. These commenters expressed appreciation that this revision would be consistent with the U.S. Supreme Court's decision on peer-graded papers in
Owasso Independent School Dist. No. I-011
v.
Falvo
, 534 U.S. 426 (2002) (
Owasso
). Two commenters asked how the provision would be applied to the use of group projects and group grading within the classroom.

Discussion:
The proposed changes to the definition of
education records
in paragraph (b)(6) are designed to implement the U.S. Supreme Court's 2002 decision in
Owasso
, which held that peer grading does not violate FERPA. As noted in the NPRM, 73 FR 15576, the Court held in
Owasso
that peer grading does not violate FERPA because “the grades on students' papers would not be covered under FERPA at least until the teacher has collected them and recorded them in his or her grade book.” 534 U.S. at 436.

As suggested by the Supreme Count in
Owasso
, 534 U.S. at 435, FERPA is not intended to interfere with a teacher's ability to carry out customary practices, such as group grading of team assignments within the classroom. Just as FERPA does not prevent teachers from allowing students to grade a test or homework assignment of another student or from calling out that grade in class, even though the grade may eventually become an education record,

FERPA does not prohibit the discussion of group or individual grades on classroom group projects, so long as those individual grades have not yet been recorded by the teacher. The process of assigning grades or grading papers falls outside the definition of
education records
in FERPA because the grades are not “maintained” by an educational agency or institution at least until the teacher has recorded the grades.

Changes:
None.

(e) Personally Identifiable Information

Comments on the proposed definition of
personally identifiable information
are discussed elsewhere in this preamble under the heading
Personally Identifiable Information and De-identified Records and Information.

(f) State Auditors and Audits (§§ 99.3 and Proposed 99.35(a)(3))

Comment:
Several commenters supported the clarification in proposed § 99.35(a)(3) that State auditors may have access to education records, without consent, in connection with an “audit” of Federal or State supported education programs under the exception to the written consent requirement for authorized representatives of “State and local educational authorities.” All but one of the commenters, however, disagreed strongly with the proposed definition of
audit
in § 99.35(a)(3), which was limited to testing compliance with applicable laws, regulations, and standards and did not include the broader concept of evaluations.

In general, the commenters said that the proposed definition of
audit
was too narrow and would prevent State auditors from conducting performance audits and other services that they routinely provide in accordance with professional auditing standards, including the U.S. Comptroller's Government Auditing Standards.
See www.gao.gov/govaud/ybk01.htm.
A State legislative auditor noted, for example, that 45 State legislatures have established legislative program evaluation offices whose express purpose is to provide research and evaluation for legislative decision making, and that these offices regularly use personally identifiable information from education records for their work. Some of the commenters also questioned whether financial audits and attestation engagements would be excluded under the proposed definition.

One commenter said that the State auditor provisions in proposed §§ 99.3 and 99.35(a)(3) should be expanded to apply to other non-education State officials responsible for evaluating publicly funded programs. Another commenter recommended that the regulations include examination of education records by health department officials to improve compliance with mandated immunization schedules.

The majority of the comments we received with respect to the inclusion of local auditors in the proposed definition of
State auditor
in § 99.3 supported permitting local auditors to have access to personally identifiable information for purposes of auditing Federal or State supported education programs. One commenter said that local auditors should not be included in the definition, while another commenter stated that auditors for the city health department need access to FERPA-protected information to determine the accuracy of claims for payment and asked for further clarification on the issue.

Discussion:
We explained in the preamble to the NPRM that the statute allows disclosure of personally identifiable information from education records without consent to authorized representatives of “State educational authorities” in connection with an audit or evaluation of Federal or State supported education programs. 73 FR 15577. Legislative history indicates that Congress amended the statute in 1979 to “correct an anomaly” in which the existing exception to the consent requirement in 20 U.S.C. 1232g(b)(3) was interpreted to preclude State auditors from obtaining access to education records for audit purposes.
See
H.R. Rep. No. 338, 96th Cong., 1st Sess. at 10 (1979),
reprinted in
1979 U.S. Code Cong. & Admin. News 819, 824. However, because the amended statutory language in 20 U.S.C. 1232g(b)(5) refers only to “State and local educational officials,” the proposed regulations sought to clarify that this included “State auditors” or auditors with authority and responsibility under State law for conducting audits. Due to the breadth of this inclusion, however, the proposed regulations also sought to limit access to education records by State auditors by narrowing the definition of
audit.

The Secretary has carefully reviewed the comments and, based upon further intradepartmental review, has decided to remove from the final regulations the provisions related to State auditors and audits in §§ 99.3 and 99.35(a)(3). We share the commenters' concerns about preventing State auditors from conducting activities that they routinely perform under applicable auditing standards. However, because our focus was on the narrow definition of
audit
, we proposed a very broad definition of
State auditor
in § 99.3 and did not examine which of the various types of officials, offices, committees, and staff in executive and legislative branches of State government should be included in the definition. We are concerned that without the narrow definition of
audit
as proposed in § 99.35(a)(3), the proposed definition of
State auditor
may allow non-consensual disclosures of education records to a variety of officials for purposes not supported by the statute. The Department will study the matter further and may issue new regulations or guidance, as appropriate. In the interim, the Department will provide guidance on a case-by-case basis.

Changes:
We are not including the definition of
State auditor
in § 99.3 and the provisions related to State auditors and audits in § 99.35(a)(3) in these final regulations.

Disclosures to Parents (§§ 99.5 and 99.36)

Comment:
A majority of commenters approved of the Secretary's efforts to clarify that, even after a student has become an eligible student, an educational agency or institution may disclose education records to the student's parents, without the consent of the student, if certain conditions are met. Those commenters stated that the clarification was especially helpful, particularly in light of issues that arose after the April 2007 shootings at the Virginia Polytechnic Institute and State University (Virginia Tech). A commenter stated that the clarification will assist emergency management officials on college and university campuses and help school officials know when they can properly share student information with parents and students. One commenter expressed support for the proposed regulations, because it has been her experience that colleges do not share information with parents on their children's financial aid or academic status.

Some commenters disagreed with the proposed changes. One stated that, due to varying family dynamics, disclosures should not be limited only to parents, but should also include other appropriate family members. Another commenter objected to the phrase in § 99.5(a)(2) that would permit disclosure to a parent without the student's consent if the disclosure meets “any other provision in § 99.31(a).” The commenter stated that this “catch-all phrase” exceeded statutory authority.

Noting the sensitivity of financial information included in income tax returns, a few commenters raised concerns about the discussion in the

NPRM in which we explained that an institution can determine that a parent claimed a student as a dependent by asking the parent to supply a copy of the parent's most recent Federal tax return. Another commenter stated that the NPRM did not go far enough and recommended specifically requiring an institution to rely on a copy of a parent's most recent Federal tax return to determine a student's dependent status, while another commenter recommended that we change the regulations to indicate that only the parent who has claimed the student as a dependent may have access to the student's education records.

A commenter noted that some States have high school students who are concurrently enrolled in secondary schools and postsecondary institutions as early as ninth grade and supported the clarification that postsecondary institutions may disclose information to parents of students who are tax dependents.

Discussion:
Parents' rights under FERPA transfer to a student when the student reaches age 18 or enters a postsecondary institution. 20 U.S.C. 1232g(d). However, under § 99.31(a)(8), an educational agency or institution may disclose education records to an eligible student's parents if the student is a dependent as defined in section 152 of the Internal Revenue Code of 1986. Under § 99.31(a)(8), neither the age of a student nor the parent's status as custodial parent is relevant to the determination whether disclosure of information from an eligible student's education records to that parent without written consent is permissible under FERPA. If a student is claimed as a dependent for Federal income tax purposes by either parent, then under the regulations, either parent may have access to the student's education records without the student's consent.

The statutory exception to the consent requirement in FERPA for the disclosure of records of dependent students applies only to the parents of the student. 20 U.S.C. 1232g(b)(1)(H). Accordingly, the Secretary does not have statutory authority to apply § 99.31(a)(8) to any other family members. However, under § 99.30(b)(3), an eligible student may provide consent for the school to disclose information from his or her education records to another family member. In some situations, such as when there is no parent in the student's life or the student is married, a spouse or other family member may be considered an appropriate party to whom a disclosure may be made, without consent, in connection with a health or safety emergency under §§ 99.31(a)(10) and 99.36.

In most cases, when an educational agency or institution discloses education records to parents of an eligible student, we expect the disclosure to be made under the dependent student provision (§ 99.31(a)(8)), in connection with a health or safety emergency (§§ 99.31(a)(10) and 99.36), or if a student has committed a disciplinary violation with respect to the use or possession of alcohol or a controlled substance (§ 99.31(a)(15)). This is the reason we mention these provisions specifically in the regulations. However, inclusion of the phrase “of any other provision in § 99.31(a)” in § 99.5(a)(2) is necessary and within our statutory authority because there may be other exceptions to FERPA's general consent requirement under which an agency or institution might disclose education records to a parent of an eligible student, such as the directory information provision in § 99.31(a)(11) and the provision permitting disclosure in compliance with a court order or lawfully issued subpoena in § 99.31(a)(9).

As we explained in the NPRM, institutions can determine that a parent claims a student as a dependent by asking the parent to submit a copy of the parent's most recent Federal income tax return. However, we do not think it is appropriate to require an agency or institution to rely only on the most recent tax return to determine the student's dependent status because institutions should have flexibility in how to reach this determination. For instance, institutions may rely instead on a student's assertion that he or she is not a dependent unless the parent provides contrary evidence. We agree that financial information on a Federal tax return is sensitive information and, for that reason, in providing technical assistance and compliance training to school officials, we have advised that parents may redact all financial and other unnecessary information that appears on the form, as long as the tax return clearly shows the parent's or parents' names and the fact that the student is claimed as a dependent.

In addition, in the fall of 2007, we developed two model forms that appear on the Department's Family Policy Compliance Office (FPCO or the Office) Web site that institutions may adapt and provide to students at orientation to indicate whether they are a dependent and, if not, obtaining consent from the student for disclosure of information to parents:
http://www.ed.gov/policy/gen/guid/fpco/ferpa/safeschools/modelform.html
and
http://www.ed.gov/policy/gen/guid/fpco/ferpa/safeschools/modelform2.html.

With regard to the comment about high school students who are concurrently enrolled in postsecondary institutions as early as ninth grade, FERPA not only permits those postsecondary institutions to disclose information to parents of the high school students who are dependents for Federal income tax purposes, it also permits high schools and postsecondary institutions who have dually-enrolled students to share information. Where a student is enrolled in both a high school and a postsecondary institution, the two schools may share education records without the consent of either the parents or the student under § 99.34(b). If the student is under 18, the parents still retain the right under FERPA to inspect and review any education records maintained by the high school, including records that the college or university disclosed to the high school, even though the student is also attending the postsecondary institution.

Changes:
None.

Outsourcing (§ 99.31(a)(1)(i)(B))

(a) Outside Parties Who Qualify as School Officials

Comment:
A few commenters disagreed with the proposal to expand the “school officials” exception in § 99.31(a)(1)(i)(B) to include contractors, consultants, volunteers, and other outside parties to whom an educational agency or institution has outsourced institutional services or functions it would otherwise use employees to perform. They believed that the modifications undermined the plain language of the statute and congressional intent. Several other commenters supported the proposed regulations, saying that it was helpful to include in the regulations what has historically been the Department's interpretation of the “school officials” exception. A majority of commenters, while not agreeing or disagreeing with the proposed changes in § 99.31(a)(1)(i)(B), raised a number of issues concerning the proposal.

Several commenters expressed concern that the requirement that an outside party must perform an institutional service or function for which the agency or institution would otherwise use employees is too restrictive and impractical. One commenter noted that some functions that a contractor performs could not be performed by a school official.

Some commenters said we should clarify the regulations to explain the

circumstances under which volunteers may serve as school officials and have access to personally identifiable information from education records in connection with their services or responsibilities to the school. One commenter noted that this clarification was needed especially for parent-volunteers working at a school attended by their own children where they are likely to know other students and their families.

Several commenters asked that we clarify in the regulations that § 99.31(a)(1) also applies to school transportation officials, school bus drivers, and school bus attendants who need access to education records in order to safely and efficiently transport students. Another commenter asked for clarification whether, under the proposed regulations, practicum students, fieldwork students, and unpaid interns in schools would be considered “school officials.” One commenter asked whether § 99.31(a)(1) permits outsourced medical providers to be considered “school officials.”

One commenter asked how proposed § 99.31(a)(1) would apply to parties other than educational agencies and institutions. The commenter was concerned about permitting SEAs to disclose personally identifiable information to outside parties under § 99.31(a)(1)(i)(B) because SEAs are not subject to § 99.7, which requires educational agencies and institutions to annually notify parents and eligible students of their rights under FERPA, including a specific requirement in § 99.7(a)(3)(iii) that an educational agency or institution that has a policy of disclosing information under § 99.31(a)(1) must include in its annual notice a specification of criteria for determining who constitutes a school official and what constitutes a legitimate educational interest. A number of commenters requested clarification about the applicability of § 99.31(a)(1)(i)(B) to State authorities that operate State longitudinal data systems that maintain records of local educational agencies (LEAs) or institutions and are responsible for certain reporting requirements under the No Child Left Behind Act. Some of these commenters believe that State authorities operating these systems are “school officials” under § 99.31(a)(1) who should be able to disclose education records for the purpose of outsourcing under § 99.31(a)(1)(i)(B).

One commenter recommended that the regulations permit the disclosure of education records to non-educational State agencies for evaluation purposes under § 99.31(a)(1). Another commenter asked that we revise the regulations to permit representatives of the Centers for Disease Control and Prevention to access education records for the purpose of public health surveillance under the “school officials” exception.

Another commenter requested further guidance on how § 99.31(a)(1) would apply to local law enforcement officers who work in collaboration with schools in various capacities and whether education records could be shared with these officers in order to ensure safe campuses.

Discussion:
The Secretary does not agree that the proposed changes to § 99.31(a)(1) go beyond the plain reading of the statute and congressional intent. As we explained in the NPRM, FERPA's broad definition of
education records
includes records that are maintained by “a person acting for” an educational agency or institution. 20 U.S.C. 1232g(a)(4)(A)(ii);
see
34 CFR 99.3. (In floor remarks describing the meaning of the definition of
education records,
Senators James Buckley and Claiborne Pell, principal sponsors of the December 1974 FERPA amendments, specifically referred to materials that are maintained by a school “or by one of its agents.” See “Joint Statement in Explanation of Buckley/Pell Amendment” (Joint Statement), 120 Cong. Rec. S21488 (Dec. 13, 1974).) Although the Secretary is concerned that educational agencies and institutions not misapply § 99.31(a)(1), the changes to the regulations are necessary to clarify the scope of the “school officials” exception in FERPA.

We disagree with commenters that the requirement in § 99.31(a)(1)(i)(B)(
1
) that the outside party must perform an institutional service or function for which the agency or institution would otherwise use employees is too restrictive or unworkable. The requirement serves to ensure that the “school officials” exception does not expand into a general exception to the consent requirement in FERPA that would allow disclosure any time a vendor or other outside party wants access to education records to provide a product or service to schools, parents, and students. As explained in the preceding paragraphs and in the NPRM, 73 FR 15578-15579, the statutory basis for expanding the “school officials” exception to outside service providers is that they are “acting for” the agency or institution, not selling products and services. This means, for example, that a school may not use the “school officials” exception to disclose personally identifiable information from a student's education record, such as the student's SSN or student ID number, without consent, to an insurance company that wishes to offer students a discount on auto insurance because the school is not outsourcing an institutional service or function for which it would otherwise use its own employees.

Further, the requirement that the outside party must be performing services or functions an employee would otherwise perform does not mean that a school employee must be able to perform the outsourced service in order for the outside party to be considered a school official under § 99.31(a)(1)(i)(B)(
1
). For example, many school districts outsource their legal services on an as-needed basis. Even though these school districts may have never hired an attorney as an employee, they may still disclose personally identifiable information from education records to outside legal counsel to whom they have outsourced their legal services. FERPA does not otherwise restrict whether a school may outsource institutional services and functions; it only addresses to whom and under what conditions personally identifiable information from students' education records may be disclosed.

Once a school has determined that an outside party is a “school official” with a “legitimate educational interest” in viewing certain education records, that party may have access to the education records, without consent, in order to perform the required institutional services and functions for the school. These outside parties may include parents and other volunteers who assist schools in various capacities, such as serving on official committees, serving as teachers' aides, and working in administrative offices, where they need access to students' education records to perform their duties.

The disclosure of education records under any of the conditions listed in § 99.31, including the “school officials” exception, is permissive and not required. (Only parents and eligible students have a right under FERPA to inspect and review their education records.) Therefore, schools should always use good judgment in determining the extent to which volunteers, as well as other school officials, need to have access to education records and to ensure that school officials, including volunteers, do not improperly disclose information from students' education records.

We decline to adopt commenters' suggestion that we include in § 99.31(a)(1)(i)(B) a list of the types of parties who may serve as school officials and receive personally identifiable information from education

records in connection with the institutional services and functions outsourced by the school. We think it would be impossible to provide a comprehensive listing and believe that agencies and institutions are in the best position to make these determinations. At the discretion of a school, school officials may include school transportation officials (including bus drivers), school nurses, practicum and fieldwork students, unpaid interns, consultants, contractors, volunteers, and other outside parties providing institutional services and performing institutional functions, provided that each of the requirements in § 99.31(a)(1)(i)(B) has been met.

Under § 99.31(a)(1), a university could outsource the practical training of students. The information disclosed to the hospital, clinic, or business conducting the practical training may only be used for the purposes for which it was disclosed. In the NPRM, we discuss in more detail the types of services and functions covered under § 99.31(a)(1)(i)(B). (73 FR 15578-15580.)

In response to the comment about the applicability of § 99.31(a)(1)(i)(B) to State educational authorities that operate State longitudinal data systems, such officials are not “school officials” under FERPA. Rather, these officials are generally considered authorized representatives of a State educational authority, and LEAs typically disclose information from students' education records to a longitudinal data system maintained by an SEA or other State educational authorities under the exception to the consent requirement for disclosures to authorized representatives of State and local educational authorities, § 99.31(a)(3)(iv)), not the “school officials” exception. This issue is explained in more detail elsewhere in this preamble under
Educational research (§§ 99.31(a)(6), 99.31(a)(3).
We also discuss disclosures to non-educational agencies, such as to public health agencies, in the section of this preamble entitled
Disclosure of Education Records to Non-Educational Agencies.

Members of a school's
law enforcement unit,
as defined in § 99.8 of the regulations, who are employed by the agency or institution qualify as school officials under § 99.31(a)(1)(i)(A) if the school has complied with the notification requirements in § 99.7(a)(3)(iii). As school officials, they may be given access to personally identifiable information from those students' education records in which the school has determined they have legitimate educational interests. The school's law enforcement unit must protect the privacy of education records it receives and may disclose them only with consent or under one of the exceptions to consent listed in § 99.31. For that reason, it is advisable that officials of a law enforcement unit maintain education records separately from law enforcement unit records, which are not subject to FERPA requirements. As we explained in
Balancing Student Privacy and School Safety: A Guide to the Family Educational Rights and Privacy Act for Elementary and Secondary Schools,
investigative reports and other records created by an institution's law enforcement unit are excluded from the definition of
education records
under § 99.3 and, therefore, are not subject to FERPA requirements. Accordingly, schools may disclose information from law enforcement unit records to anyone, including local police and other outside law enforcement authorities, without consent. This brochure can be found on FPCO's “Safe Schools & FERPA” Web page:
http://www.ed.gov/policy/gen/guid/fpco/ferpa/safeschools/index.html.

Outside police officers or other non-employees to whom the school has outsourced its safety and security functions do not qualify as “school officials” under FERPA unless they meet each of the requirements of § 99.31(a)(1)(i)(B). If these police officers or other outside parties do not meet the requirements for being a school official under FERPA, they may not have access to students' education records without consent, unless there is a health or safety emergency, a lawfully issued subpoena or court order, or some other exception to FERPA's general consent requirement under which the disclosure falls.

With respect to our amendment to the “school officials” exception, we note that § 99.32(d) excludes from the recordation requirements disclosures of education records that educational agencies and institutions make to school officials. This exclusion from the recordation requirement will apply as well to disclosures to contractors, consultants, volunteers, and other outside parties to whom an agency or institution discloses education records under § 99.31(a)(1)(i)(B). The Department has long recognized that FERPA does not prevent schools from outsourcing institutional services and functions; to require schools to record disclosures to these outside parties serving as school officials would be overly burdensome and unworkable.

An educational agency or institution that complies with the notification requirements in § 99.7(a)(3)(iii) by specifying its policy regarding the disclosure of education records to contractors and other outside parties serving as school officials provides legally sufficient notice to parents and students regarding these disclosures. We have posted model notifications on our Web site, one for postsecondary institutions and one for LEAs. See
http://www.ed.gov/policy/gen/guid/fpco/ferpa/ps-officials.html
and
http://www.ed.gov/policy/gen/guid/fpco/ferpa/lea-officials.html.

Changes:
None.

(b)
Direct Control

Comment:
Some commenters asked the Department to clarify what the term “direct control” means as used in § 99.31(a)(1)(i)(B)(
2)
. This section provides that in order to be considered a “school official” an outside party must be under the direct control of the agency or institution. Some commenters asked if this term means that the school must monitor the operations of the outside party, and how it affects an agency's or institution's relationship with subcontractors or third- or fourth-party database hosting companies. One commenter stated that the regulations should not distinguish between whether the education records are hosted in a vendor's offsite network or within the institution's local network servers, while another commenter asked for clarification of how § 99.31(a)(1)(i)(B) applies to outsourcing electronic mail (e-mail) services to third parties such as Microsoft or Google.

One commenter stated that institutions should be required to verify that parties to whom they outsource services have the necessary resources to safeguard education records provided to them.

A commenter suggested that, instead of the proposed “direct control” standard, the Department adopt language similar to the safeguarding standard found in the Gramm-Leach-Bliley Act (GLB) (Pub. L. 106-102, November 12, 1999). The commenter suggested that, as adapted in FERPA, the standard would require that for an outside party, acting on behalf of an educational institution, to be considered a “school official,” the institution would have to: (1) Take reasonable steps to select and retain contractors, consultants, volunteers, or other outside parties that are capable of maintaining appropriate safeguards with respect to education records; and (2) mandate by contract that the outside party implement and maintain such safeguards.

Discussion:
The term “direct control” in § 99.31(a)(1)(i)(B)(
2
), is intended to

ensure that an educational agency or institution does not disclose education records to an outside service provider unless it can control that party's maintenance, use, and redisclosure of education records. This could mean, for example, requiring a contractor to maintain education records in a particular manner and to make them available to parents upon request. We are revising the regulations, however, to provide this clarification.

Neither the statute nor the FERPA regulations specifically requires that educational agencies and institutions verify that outside parties to whom schools outsource services have the necessary resources to safeguard education records provided to them. However, as discussed in the NPRM, educational agencies and institutions are responsible under FERPA for ensuring that they themselves do not have a policy or practice of releasing, permitting the release of, or providing access to personally identifiable information from education records, except in accordance with FERPA. This includes ensuring that outside parties that provide institutional services or functions as “school officials” under § 99.31(a)(1)(i)(B) do not maintain, use, or redisclose education records except as directed by the agency or institution that disclosed the information.

The “direct control” requirement is intended to apply only to the outside party's provision of specific institutional services or functions that have been outsourced and the education records provided to that outside party to perform the services or function. It is not intended to affect an outside service provider's status as an independent contractor or render that party an employee under State or Federal law.

We believe that the use of the “direct control” standard strikes an appropriate balance in identifying the necessary and proper relationship between the school and its outside parties that are serving as “school officials.” The recommendation that we adopt a standard more closely aligned with the GLB standard does not appear workable, especially with regard to requiring that schools enter into formal contracts with each outside party performing services, including parent-volunteers. However, one way in which schools can ensure that parties understand their responsibilities under FERPA with respect to education records is to clearly describe those responsibilities in a written agreement or contract.

Exercising direct control could prove more challenging in some situations than in others. Schools outsourcing information technology services, such as web-based and e-mail services, should make clear in their service agreements or contracts that the outside party may not use or allow access to personally identifiable information from education records, except in accordance with the requirements established by the educational agency or institution that discloses the information.

Changes:
We have revised § 99.31(a)(1)(B)(
2
) to clarify that the outside party must be under the direct control of the agency or institution with respect to the use and maintenance of information from education records.

(c) Protection of Records by Outside Parties Serving as School Officials

Comment:
We received several comments on proposed § 99.31(a)(1)(i)(B)(
3
), which provides that an outside party serving as a “school official” is subject to the requirement in § 99.33(a), regarding the use and redisclosure of personally identifiable information from education records. One commenter stated that, while he supported and welcomed this clarification, the proposed regulations did not go far enough to clarify that these outside third parties could not use education records of multiple institutions for which they serve as a contractor to engage in activities not associated with the service or function they were providing.

Some commenters suggested that the regulations should require all school officials who handle education records, including parties to whom institutional services and functions are outsourced, to participate in annual training and to undergo fingerprint and background investigations.

Another commenter stated that any disclosures associated with the outsourcing of institutional services and functions should include a record that will serve as an audit trail. The commenter noted that both the Health Insurance Portability and Accountability Act (HIPAA) and the Privacy Act of 1974 require the maintenance of audit trails or an accounting of disclosures of records.

Discussion:
An agency or institution must ensure that an outside party providing institutional services or functions does not use or allow access to education records except in strict accordance with the requirements established by the educational agency or institution that discloses the information. Section 99.33(a)(2) of the FERPA regulations applies to employees and outside service providers alike and prohibits the recipient from using education records for any purpose other than the purposes for which the disclosure was made. This includes ensuring that outside parties do not use education records in their possession for purposes other than those specified by the institution that disclosed the records.

FERPA does not specifically require that educational agencies and institutions provide annual training to school officials that handle education records, and we decline to establish such a requirement in these regulations. Educational agencies and institutions should have flexibility in determining the best way to ensure that school officials are made aware of the requirements of FERPA. However, for entities subject to the Individuals with Disabilities Education Act (IDEA), 34 CFR 300.623(c) provides that all persons collecting or using personally identifiable information must receive training or instruction regarding their State's policies and procedures under 34 CFR 300.123 (Confidentiality of personally identifiable information) and 34 CFR Part 99, the FERPA regulations. We note that while schools are certainly free to implement a policy requiring school officials and parties to whom services have been outsourced to undergo fingerprint and background investigations, there is no statutory authority in FERPA to include such a requirement in the regulations.

We note also that the Department routinely provides compliance training on FERPA for school officials. Typically, presentations are made throughout the year to national, regional, or State educational association conference workshops with numerous institutions in attendance. Training sessions are also scheduled for State departments of education and local school districts in the vicinity of any conference.

For a discussion of the comment that recommended that the regulations require that schools maintain an audit trail or an accounting of disclosures to school officials, including outside providers, see the discussion under the following section entitled
Control of Access to Education Records by School Officials
.

Changes:
None.

Control of Access to Education Records by School Officials (§ 99.31(a)(1)(ii))

Comment:
Many commenters supported proposed § 99.31(a)(1)(ii), which requires an educational agency or institution to use reasonable methods to ensure that school officials have access to only those education records in which the official has a legitimate educational interest. In this section, we also proposed that an educational

agency or institution that does not use physical or technological access controls must ensure that its administrative policy for controlling access to education records is effective and that it remains in compliance with the “legitimate educational interest” requirement.

One commenter who supported the proposed regulations expressed concern that not all districts and institutions have the financial or technological resources to create or purchase an electronic system that provides fully automated access control and that an institution using only administrative controls would be required to demonstrate that each school official who accessed education records possessed a legitimate educational interest in the education records to which the official gained access. According to the commenter, the regulations seem to omit the “reasonable methods” concept for those schools that utilize administrative controls rather than physical or technological controls. The commenter was concerned that smaller schools that lack resources to create or purchase a system that fully monitors record access would be disadvantaged by having to meet a higher standard of ensuring a legitimate educational interest on the part of the school officials that access the records.

One commenter expressed concern that the standard in § 99.31(a)(1)(ii) is too restrictive and asked whether the Department would use flexibility and deference in taking into consideration an institution's efforts in compliance with the requirement.

Another commenter requested that we include in the regulations a requirement that contractors hosting data at offsite locations must institute effective access control measures. The commenter stated that many schools and contractors are uncertain as to whether the school or the contractor is responsible for ensuring that access controls are applied to data hosted by contractors.

One commenter stated that the regulations created an unnecessary burden, as school districts already do their best to comply with FERPA and an occasional mistake should be excused. The commenter, however, was pleased that the regulations do not require the use of technological controls. The commenter was concerned that schools are unable to pre-assign risk levels to categories of records in order to determine appropriate methods to mitigate improper access. The commenter supported the use of effective administrative controls as determined by a district to ensure that information is available only to those with a legitimate educational interest.

One commenter expressed concern that the requirement to use reasonable methods to ensure appropriate access was not sufficiently restrictive, because under the regulations, all volunteers would be designated as school officials. The commenter believed that the regulations would enable volunteers to gain access more easily to confidential and sensitive information in education records.

A commenter who is a parent of a special education student also expressed concern that the language in the regulations was not adequate. The commenter described a software package used by her district that permits all school officials unrestricted access to the IEPs of all special education students.

Discussion:
Section 99.30 requires that a parent or eligible student provide written consent for a disclosure of personally identifiable information from education records unless the circumstances meet one of the exceptions to consent, such as the release of information to a school official with a legitimate educational interest. Thus, a district or institution that makes a disclosure solely on the basis that the individual is a school official violates FERPA if it does not also determine that the school official has a legitimate educational interest. The regulations in § 99.31(a)(1)(ii) are designed to clarify the responsibility of the educational agency or institution to ensure that access to education records by school officials is limited to circumstances in which the school official possesses a legitimate educational interest.

We believe that the standard of “reasonable methods” is sufficiently flexible to permit each educational agency or institution to select the proper balance of physical, technological, and administrative controls to effectively prevent unauthorized access to education records, based on their resources and needs. In order to establish a system driven by physical or technological access controls, a school would generally first determine when a school official has a legitimate educational interest in education records and then determine which physical or technological access controls are necessary to ensure that the official can access only those records. The regulations require a school that uses only administrative controls to ensure that its administrative policy for controlling access to education records is effective and that the school is in compliance with the legitimate educational interest requirement in § 99.31(a)(1)(i)(A). However, the “reasonable methods” standard applies whether the control is physical, technological, or administrative.

The regulations permit the use of a variety of methods to protect education records, in whatever format, from improper access. The Department expects that educational agencies and institutions will generally make appropriate choices in designing records access controls, but the Department reserves the right to evaluate the effectiveness of those efforts in meeting statutory and regulatory requirements.

The additional language that one commenter requested concerning outsourcing is already included in the regulations in § 99.31(a)(1). That section specifically provides that contractors are subject to the same conditions governing the access and use of records that apply to other school officials. As long as those conditions are met, the physical location in which the contractor provides the service is not relevant.

Because the regulations permit the use of a variety of methods to effectively reduce the risk of unauthorized access to education records, we do not believe the requirement to establish “reasonable methods” for controlling access is unduly burdensome. Schools have the flexibility to decide the method or methods best suited to their own circumstances. For the many schools, districts, and institutions that already meet the standard, no operational changes should be necessary.

The regulations do not designate all volunteers as school officials. Rather, the regulations clarify that schools may designate volunteers as school officials who may be provided access to education records only when the volunteer has a legitimate educational interest. Schools can and should carefully assess and limit access by any school official, including volunteers. This issue is discussed in more detail previously in this preamble under the section entitled
Outsourcing
.

With regard to the parent who expressed concern that the language in the regulations was not adequate to address the problem of software that permits all school officials to access the IEPs of all special education students, we believe that the language in § 99.31(a)(1)(ii) is sufficient. As previously noted, FERPA prohibits school officials from having access to education records unless they have a legitimate educational interest. The commenter's point illustrates the need for educational agencies and institutions to ensure that adequate controls are in

place to restrict access to education records only to a school official with a legitimate educational interest.

Changes:
None.

Transfer of Education Records to Student's New School (§§ 99.31(a)(2) and 99.34(a))

Comment:
All of the comments we received on proposed §§ 99.31(a)(2) and 99.34(a) supported the clarification that an educational agency or institution may disclose a student's education records to officials of another school, school system, or institution of postsecondary education not just when the student seeks or intends to enroll, but after the student is already enrolled, so long as the disclosure is for purposes related to the student's enrollment or transfer. Some commenters noted that this clarification reduces legal uncertainty about how long a school may continue to send records or information to a student's new school; other commenters noted that this clarification will be helpful in serving students who are homeless or in foster care because these students are often already enrolled in a new school system while waiting for records from a previous enrollment.

A few commenters asked us to clarify the requirement that the disclosure must be for purposes related to the student's enrollment or transfer. The commenters asked whether this meant that only records specifically related to the new school's decision to admit the student or records related to the transfer of course credit could be disclosed, or whether the agency or institution could also disclose information about previously undisclosed disciplinary actions related to the student's ongoing attendance at the new institution. One commenter suggested that we remove the requirement that the disclosure must be for purposes of the student's enrollment or transfer because it was confusing and unnecessary. Some commenters asked the Department to provide guidance about the types of records that may be sent under the regulations to a student's new school, noting that the preamble to the NPRM stated that the regulations allow school officials to disclose any and all education records, including health and disciplinary records, to the new school (73 FR 15581).

One commenter asked us to clarify that any school, not just the school the student attended most recently, may disclose information from education records to the institution that the student currently attends. Another commenter asked whether the amended regulations would permit the disclosure of education records to an institution in which a student seeks information or services but not enrollment, such as when a charter school student requests an evaluation under the IDEA from the student's home school district.

Two commenters asked whether mental health and other treatment records of postsecondary students, which are excluded from the definition of
education records
under FERPA, could be disclosed to the new school. Other commenters asked whether FERPA places any limits on the transfer of information about student disciplinary actions to colleges and universities and what information a postsecondary institution may ask for and receive regarding a student's disciplinary actions. A few commenters asked us to address the relationship between these regulations and guidance issued by the Department's Office for Civil Rights (OCR) prohibiting the pre-admission release of information about a student's disability under section 504 of the Rehabilitation Act of 1973, as amended, and Title II of the Americans with Disabilities Act of 1990, as amended.

Discussion:
The regulations are intended to eliminate uncertainty about whether, under § 99.31(a)(2), an educational agency or institution may send education records to a student's new school even after the student is already enrolled and attending the new school. The requirement that the disclosure must be for purposes related to the student's enrollment or transfer is not intended to limit the kind of records that may be disclosed under this exception. Instead, the regulations are intended to clarify that, after a student has already enrolled in a new school, the student's former school may disclose any records or information, including health records and information about disciplinary proceedings, that it could have disclosed when the student was seeking or intending to enroll in the new school.

These regulations apply to any school that a student previously attended, not just the school that the student attended most recently. For example, under § 99.31(a)(2), a student's high school may send education records directly to a graduate school in which the student seeks admission, or is already enrolled. Section 99.34(b), which explains the conditions that apply to the disclosure of information to officials of another school, school system, or postsecondary institution, allows a public charter school or other agency or institution to disclose the education records of one of its students in attendance to the student's home school district if the student receives or seeks to receive services from the home school district, including an evaluation under the IDEA. We note, however, that the confidentiality of information regulations under Part B of the IDEA contain additional consent requirements that may also apply in these circumstances.

Under section 444(a)(4)(B)(iv) of FERPA, 20 U.S.C. 1232g(a)(4)(B)(iv), medical and psychological treatment records of eligible students are excluded from the definition of
education records
if they are made, maintained, and used only in connection with treatment of the student and disclosed only to individuals providing the treatment, including treatment providers at the student's new school. (While the comment concerned records of postsecondary students, we note that the treatment records exception to the definition of
education records
applies also to any student who is 18 years of age or older, including 18 year old high school students.) An educational agency or institution may disclose an eligible student's treatment records to the student's new school for purposes other than treatment provided that the records are disclosed under one of the exceptions to written consent under § 99.31(a), including § 99.31(a)(2), or with the student's written consent under § 99.30. If an educational agency or institution discloses an eligible student's treatment records for purposes other than treatment, the treatment records are no longer excluded from the definition of
education records
and are subject to all other FERPA requirements, including the right of the eligible student to inspect and review the records and to seek to have them amended under certain conditions. In practical terms, this means that an agency or institution may disclose an eligible student's treatment records to the student's new school either with the student's written consent, or under one of the exceptions in § 99.31(a), including § 99.31(a)(2), which permits disclosure to a school where a student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student's enrollment or transfer.

FERPA does not contain any particular restrictions on the disclosure of a student's disciplinary records. Further, Congress has enacted legislation to ensure that schools transfer disciplinary records to a student's new school in certain circumstances. In particular, section 444(h) of the statute, 20 U.S.C. 1232g(h), and the implementing regulations in § 99.36(b) provide that nothing in FERPA prevents an educational agency

or institution from including in a student's records and disclosing to teachers and school officials, including those in other schools, appropriate information about disciplinary actions taken against the student for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community. This authority is in addition to any other authority in FERPA for the disclosure of education records without consent, including the authority under § 99.36(a) to disclose education records in connection with a health or safety emergency. In addition, section 4155 of the Elementary and Secondary Education Act of 1965 (ESEA), 20 U.S.C. 7165, as amended by the No Child Left Behind Act of 2001 (NCLB), requires a State that receives funds under the ESEA to have a procedure in place to facilitate the transfer of disciplinary records, with respect to a suspension or expulsion, by LEAs to any private or public elementary school or secondary school for any student who is enrolled or seeks, intends, or is instructed to enroll, on a full-or part-time basis, in the school.

There are, however, other Federal laws, such as the IDEA, section 504 of the Rehabilitation Act of 1973, as amended (Rehabilitation Act), and Title II of the Americans with Disabilities Act of 1990, as amended (ADA), with different requirements that may affect the release of student information. For example, educational agencies and institutions that are “public agencies” or “participating agencies” under the IDEA must comply with the requirements in the Part B confidentiality of information regulations.
See,

e.g.,
34 CFR 300.622(b)(2) and (3). By way of further illustration, because educational agencies and institutions receive Federal financial assistance, they must comply with the regulations implementing section 504 of the Rehabilitation Act, which generally prohibit postsecondary institutions from making pre-admission inquiries about an applicant's disability status. See 34 CFR 104.42(b)(4) and (c). However, after admission, in connection with an emergency and if necessary to protect the health or safety of a student or other persons as defined under FERPA and its implementing regulations, section 504 of the Rehabilitation Act and Title II of the ADA do not prohibit postsecondary institutions from obtaining information and education records concerning a current student, including those with disabilities, from any school previously attended by the student. See the discussion in the section entitled
Health or Safety Emergency (§ 99.36).

Changes:
None.

Ex Parte Court Orders Under the USA Patriot Act (§ 99.31(a)(9))

Comment:
Two commenters expressed support for the proposed regulations, which incorporate statutory changes that allow an educational agency or institution to comply with an
ex parte
court order issued under the USA Patriot Act. One commenter said that it would be helpful to add to the regulations a statement from the preamble to the NPRM that an institution is not responsible for determining the relevance of the information sought or the merits of the underlying claim for the court order.

Several commenters opposed § 99.31(a)(9). One commenter said that the USA Patriot Act is unconstitutional and that its provisions will sunset in 2009. Another commenter said that the regulations harm its ability to preserve the confidentiality of education records, particularly those of foreign students. The commenter asked us to change the regulations to permit institutions to notify students when records are requested, unless the
ex parte
court order specifically states that the student should not be notified. Another commenter said that schools should be required to notify parents when records are requested and to record the disclosure.

Discussion:
The USA Patriot Act amendments to FERPA have not been ruled unconstitutional, and its provisions relevant to FERPA do not sunset in 2009. Therefore, we are implementing these provisions in our regulations at this time.

Under the USA Patriot Act, the U.S. Attorney General, or a designee in a position not lower than an Assistant Attorney General, may apply for an
ex parte
court order to collect, retain, disseminate, and use certain education records in the possession of an educational agency or institution without regard to any other FERPA requirements, including in particular the recordkeeping requirements. 20 U.S.C. 1232g(j)(3) and (4). The USA Patriot Act amendments to FERPA also provide that an educational agency or institution that complies in good faith with the court order is not liable to any person for producing the information. Nothing in these amendments, including the “good faith” requirement, requires an educational agency or institution to evaluate the underlying merits or legal sufficiency of the court order before disclosing the requested information without consent. As with any court order or subpoena that forms the basis of a disclosure without consent under § 99.31(a)(9), the agency or institution must simply determine whether the
ex parte
court order is facially valid. We see no reason to include this general requirement in the regulations.

Section 99.31(a)(9)(ii) requires an agency or institution to make a reasonable effort to notify a parent or eligible student of a judicial order or lawfully issued subpoena in advance of compliance, except for certain law enforcement subpoenas if the court has ordered the agency or institution not to disclose the existence or contents of the subpoena or information disclosed. An
ex parte
order is by definition an order issued without notice to or argument from the other party, including the party whose education records are sought, and the USA Patriot Act amendments provide that the Attorney General may collect and use the records without regard to any FERPA requirements, including the recordation requirements. Under this statutory authority, the regulations properly provide that the agency or institution is not required to notify the parent or eligible student before complying with the order or to record the disclosure.

We do not agree with the commenter's request that we amend the regulations to allow agencies and institutions to notify parents and students and record these disclosures. We note that FERPA does not prohibit an educational agency or institution from notifying a parent or student or recording a disclosure made in compliance with an
ex parte
court order under the USA Patriot Act. However, an agency or institution that does so may violate the terms of the court order itself and may also fail to meet the good faith requirements in the USA Patriot Act for avoiding liability for the disclosure. We would also recommend that agencies and institutions consult with legal counsel before notifying a parent or student or recording a disclosure of education records made in compliance with an
ex parte
court order under the USA Patriot Act.

Changes:
None.

Registered Sex Offenders (§ 99.31(a)(16))

Comment:
One commenter asked for clarification whether the proposed regulations authorizing the disclosure of personally identifiable information from education records concerning registered sex offenders authorize only the disclosure of information that is received from local law enforcement officials, or whether disclosure could

also include other information from a student's education records, such as campus of attendance. A second commenter expressed appreciation that the regulations clarify that school districts are not required or encouraged to collect or maintain information on registered sex offenders and that these disclosures are permissible but not required.

Discussion:
The Campus Sex Crimes Prevention Act (CSCPA) amendments to FERPA allow educational agencies and institutions to disclose any information concerning registered sex offenders provided to the agency or institution under section 170101 of the Violent Crime Control and Law Enforcement Act of 1994, 42 U.S.C. 14071, commonly known as the Wetterling Act. Since publication of the NPRM, we have determined that the proposed regulations were confusing, because they limited these disclosures to information that was obtained and disclosed by an agency or institution in compliance with a State community notification program. In fact, the CSCPA amendments to FERPA cover any information provided to an educational agency or institution under the Wetterling Act, including not only information provided under general State community notification programs, which are required under subsection (e) of the Wetterling Act, 42 U.S.C. 14071(e), but also information provided under the more specific campus community notification programs for institutions of higher education, which are required under subsection (j), 42 U.S.C. 14071(j).

The Wetterling Act requires States to release relevant information about persons required to register as sex offenders that is necessary to protect the public, including specific State reporting requirements for law enforcement agencies having jurisdiction over institutions of higher education. The exception to the consent requirement in FERPA allows educational agencies and institutions to make available to the school community any information provided to it under the Wetterling Act. We interpret this to also include any additional information about the student that is relevant to the purpose for which the information was provided to the educational agency or institution—protecting the public. This could include, for example, the school or campus at which the student is enrolled.

The proposed regulations included a sentence stating that FERPA does not require or encourage agencies or institutions to collect or maintain information about registered sex offenders. We have determined through further review, however, that this sentence could be confusing and should be removed. Participating institutions are required under section 485(f)(1) of the Higher Education Act of 1965, as amended, 20 U.S.C. 1092(f)(1), to advise the campus community where it may obtain law enforcement agency information provided by the State under 42 U.S.C. 14071(j) concerning registered sex offenders. Further, the Department does not wish to discourage educational agencies and institutions from disclosing relevant information about a registered sex offender in appropriate circumstances.

Changes:
We have revised the regulations to remove the reference to the disclosure of information obtained by the educational agency or institution in compliance with a State community notification program. The regulations now simply allow disclosure without consent of any information concerning registered offenders provided to an educational agency or institution under 42 U.S.C. 14071 and applicable Federal guidelines. We also have removed the sentence stating that neither FERPA nor the regulations requires or encourages agencies or institutions to collect or maintain information about registered sex offenders.

Redisclosure of Education Records and Recordkeeping by State and Local Educational Authorities and Federal Officials and Agencies (§§ 99.31(a)(3); 99.32(b); 99.33(b); 99.35(a)(2); 99.35(b))

(a) Redisclosure

Comment:
We received a number of comments on the proposed changes in § 99.35(b) that would permit State and local educational authorities and Federal officials and agencies listed in § 99.31(a)(3) to redisclose personally identifiable information from education records on behalf of educational agencies and institutions without parental consent under the existing redisclosure authority in § 99.33(b). (Section 99.33(b) allows an educational agency or institution to disclose personally identifiable information from education records with the understanding that the recipient may make further disclosures of the information on behalf of the agency or institution if the disclosure falls under one of the exceptions in § 99.31(a) and the agency or institution has complied with the recordation requirements in § 99.32(b).) Many commenters said that the proposed change would ease administrative burdens on State and local educational authorities, agencies, and institutions. For example, under the proposed regulations, a student's new school district or institution would be able to obtain the student's prior education records from a single State agency instead of contacting and waiting for records from separate districts or institutions. Commenters noted, however, that certain issues had not been addressed in the proposed regulations and that further clarification was required. Commenters also supported the new redisclosure authority to the extent that it facilitates the exchange of education records among State educational authorities, educational agencies and institutions, and educational researchers through consolidated, statewide systems or separate data sharing arrangements.

Two commenters expressed substantial concerns that the regulations inappropriately expanded the situations in which personally identifiable information could be redisclosed without parental or student consent. One commenter noted that the theoretical benefits of maintaining large, consolidated data systems, which allow users to track individual students over time, do not outweigh the need to protect individual privacy. Another commenter stated that the regulations should not allow State and local educational authorities and the Federal officials and agencies listed in § 99.31(a)(3) to set up and operate record systems containing personally identifiable information that parents and students have no right to review or amend, and may not even know about. Barring the withdrawal of these regulations, these commenters urged the Department to strengthen or at least preserve the safeguards and protections that accompany this new data sharing authority. One commenter asked us to require any State or Federal entity that maintains education records to provide parents and students with annual notification and the right to review and amend the students' records.

Many commenters indicated their strong support for allowing State educational authorities to respond to requests for information from education records and redisclose personally identifiable information, whether for data sharing systems, transferring records to a student's new school, or other purposes authorized under § 99.31(a), without involving school districts and postsecondary institutions. These commenters generally thought that State educational authorities and Federal officials listed in § 99.31(a)(3) should not be required to consult with educational agencies and institutions when redisclosing information from education records. One commenter

asked us to clarify the role of the SEA or other State educational authority as the custodian of education records and its authority to act for educational agencies and institutions. Several commenters urged us to revise the regulations to make clear that the redisclosing official is authorized to make further disclosures under § 99.31(a) without approval from, or further consultation with, the original source of the records and maintain the appropriate record related to the redisclosure.

One commenter said that the regulations must allow State educational authorities to transfer records on behalf of LEAs and postsecondary institutions. One commenter strongly supported the changes in § 99.35(b) because they would allow the State McKinney-Vento coordinator to control transfer of education records of abused and homeless students to their new schools and prevent potential abusers from locating the student.

Some commenters believed that current regulations impede the ability of States to establish and operate data sharing systems and that regulatory changes must allow all educational agencies, institutions, SEAs, and other State educational authorities to exchange data among themselves and work with researchers. One commenter recommended that we create a specific exception in § 99.31(a) that would allow data sharing across State educational authorities in order to establish and operate consolidated, longitudinal data systems.

Several commenters asked for clarification of the requirement in § 99.35(a)(2) that authority for an agency or official listed in § 99.31(a)(3) to conduct an audit, evaluation, or compliance or enforcement activity is not conferred by FERPA or the regulations and must be established under other Federal, State, or local law, including valid administrative regulations. One commenter supported data sharing among pre-school, K-12, and postsecondary institutions, provided that appropriate legal authority for the underlying audit, evaluation, or compliance and enforcement activity is established as required under § 99.35(a)(2). One commenter asked whether citation to a specific law or regulations will be required, or whether general State laws that provide joint authority to evaluate programs at all levels are sufficient for parties to enter into data sharing agreements under the regulations.

One commenter indicated that its State has no laws or regulations that specifically allow the State-level advisory council to audit or evaluate education programs, or that allow a K-12 school district to audit or evaluate the programs offered by postsecondary institutions, and vice versa, and the commenter asked whether general authority for these entities to act under State law would be sufficient. Two commenters whose States do not house their K-12 and postsecondary systems within the same agency expressed concern whether they will be able to develop consolidated databases under the regulations if their K-12 and postsecondary agencies do not have appropriate authority to audit or evaluate each other's programs.

Discussion:
We continue to believe that State and local educational authorities and Federal officials that receive education records under §§ 99.31(a)(3) and 99.35 should be permitted to redisclose education records on behalf of educational agencies and institutions in accordance with the existing regulations governing the redisclosure of information in § 99.33(b). We agree with the commenters that this change will ease administrative burdens at all levels and facilitate the creation and operation of statewide data sharing systems that support the student achievement, program accountability, transfer of records, and other objectives of Federal and State education programs while protecting the privacy rights of parents and students in students' education records.

We respond first to commenters' concerns about the requirement in § 99.33(b) that any redisclosure of personally identifiable information from education records must be made on behalf of the educational agency or institution that disclosed the information to the receiving party, including any requirement for consulting with or obtaining approval from the educational agency or institution that disclosed the information. The statutory prohibitions on the redisclosure of education records apply to education records that SEAs, State higher educational authorities, the Department, and other Federal officials receive under an exception to the written consent requirement in FERPA, such as §§ 99.31(a)(3) and 99.35 (for audit, evaluation, compliance and enforcement purposes) and § 99.31(a)(4) (for financial aid purposes). As explained in the preamble to the NPRM, § 99.33(b) allows an educational agency or institution to disclose education records with the understanding that the recipient may make further disclosures on its behalf under one of the exceptions in § 99.31 (73 FR 15586-15587). In that case, the disclosing agency or institution must record the names of the additional parties to which the receiving party may redisclose the information on behalf of the educational agency or institution and their legitimate interests under § 99.31.

Under the regulatory framework for redisclosing education records in § 99.33(b), educational agencies and institutions retain primary responsibility for disclosing and authorizing redisclosure of their education records without consent. (We note again that the only disclosures of education records that are mandatory under FERPA are those made to parents and eligible students.) The purpose of § 99.33(b), which allows redisclosure of education records notwithstanding the general statutory restrictions, has always been to ease administrative burdens on educational agencies and institutions that disclose education records. The legal basis for this accommodation is that the recipient is acting “on behalf of” the agency or institution from which it received information from education records and making a further disclosure that the agency or institution would otherwise make itself under § 99.31(a). Section 99.33(b) does not confer on any recipient of education records independent authority to redisclose those records apart from acting “on behalf of” the disclosing educational agency or institution.

The Department recognizes that the State and local educational authorities and Federal officials that receive education records without consent under § 99.31(a)(3) are responsible for supervising and monitoring educational agencies and institutions and that many of them also maintain centralized data systems that constitute a valuable resource of information from education records. The proposed changes to § 99.35(b) would allow these State and Federal authorities and officials to redisclose information received under § 99.31(a)(3) under any of the exceptions in § 99.31(a), including transferring education records to a student's new school under § 99.31(a)(2), sharing information among other State and local educational authorities and Federal officials for audit or evaluation purposes under § 99.31(a)(3), and using researchers to conduct evaluations and studies under § 99.31(a)(3) or § 99.31(a)(6), without violating the statutory prohibitions on redisclosing education records provided certain conditions have been met. In the event that an educational agency or institution objects to the redisclosure of information it has provided, the State or

local educational authority or Federal official or agency may rely instead on any independent legal authority it has to further disclose the information.

We agree that current regulations were unclear about the ability of States to establish and operate data sharing systems with educational agencies and institutions, which is why we amended § 99.35(b). As explained in the NPRM (73 FR 15587), §§ 99.35(a)(2) and 99.35(b) allow SEAs, higher education authorities, and educational agencies and institutions, including local school districts and postsecondary institutions, to share education records in personally identifiable form with one another, provided that Federal, State, or local law authorizes the recipient to conduct the audit, evaluation, or compliance or enforcement activity in question. Accordingly, data sharing arrangements among State and local educational authorities and educational agencies and institutions generally must meet these requirements to be permissible under FERPA. (Data sharing with educational researchers is discussed below under
Educational research
.)

With respect to the comments recommending that we create a specific exception in § 99.31(a) to allow data sharing across State educational authorities in order to establish and operate consolidated, longitudinal data systems and other data sharing arrangements, there is no provision in FERPA that allows disclosure or redisclosure of education records, without consent, for the specific purpose of establishing and operating consolidated databases and data sharing systems, and, therefore, we are without authority to establish one in these regulations.

In response to the questions concerning the need for Federal, state, or local legal authority to disclose education records for audit or evaluation purposes, we note that, in general, FERPA allows educational agencies and institutions to disclose (and authori

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3AE8-28864. Public record. Not legal advice.