United StatesFamily Educational Rights and Privacy Act (FERPA), disclosure of education records to contractors and redisclosure limits
20 U.S.C. 1232g(b); 34 CFR 99.31(a)(1)(i)(B), 99.33
In force since .
A sensitive categories rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Consent, Prohibition
As of .
What it requires
- To receive personally identifiable information from a school's education records without the parent's or eligible student's consent as a school official, perform an institutional service or function for which the school would otherwise use employees, stay under the school's direct control with respect to the use and maintenance of the records, and accept the use and redisclosure limits of section 99.33(a) (34 CFR 99.31(a)(1)(i)(B)).
- Use personally identifiable information from education records only for the purposes for which the school disclosed it (34 CFR 99.33(a)(2)).
- Do not disclose personally identifiable information from education records to any other party without the prior consent of the parent or eligible student, unless an exception in 34 CFR 99.33(b) or (c) applies (34 CFR 99.33(a)(1)).
- Release education records or information from them without consent only after removing all personally identifiable information, on a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases and taking into account other reasonably available information (34 CFR 99.31(b)(1)).
These lines are LexLint's reading of the law's text, as of . Also read by: U.S. Department of Education, Student Privacy Policy Office, Privacy Technical Assistance Center (guidance, recorded ); Gonzaga University v. Doe, 536 U.S. 273 (2002) (recorded ).
Who enforces it
Enforcement body
U.S. Department of Education, Office of the Chief Privacy Officer
Settledness
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USREPORTS-536/pdf/USREPORTS-536-273.pdf
- Guidance link
- https://studentprivacy.ed.gov/resources/protecting-student-privacy-while-using-online-educational-services-requirements-and-best
- Case citation
- Gonzaga University v. Doe, 536 U.S. 273 (2002)
- Guidance body
- U.S. Department of Education, Student Privacy Policy Office, Privacy Technical Assistance Center
- Open questions
- When is an outside party “under the direct control of the agency or institution with respect to the use and maintenance of education records” under 34 CFR 99.31(a)(1)(i)(B)(2)?
- What counts as an “institutional service or function for which the agency or institution would otherwise use employees” under 34 CFR 99.31(a)(1)(i)(B)(1) when an outside party supplies a school's software service?
What this law does
The Family Educational Rights and Privacy Act withholds federal education funds from an educational agency or institution that has a policy or practice of releasing students' education records, or the personally identifiable information in them, without the written consent of their parents, except to the parties the Act lists.
The regulations in 34 CFR Part 99 apply to an educational agency or institution to which funds have been made available under any program administered by the Secretary of Education.
A contractor, consultant, volunteer or other party to whom the school has outsourced institutional services or functions may be considered a school official, and so receive personally identifiable information from education records without consent, if it performs an institutional service or function for which the school would otherwise use employees, is under the school's direct control with respect to the use and maintenance of education records, and is subject to the use and redisclosure requirements of section 99.33(a).
Under section 99.33(a), the school may disclose the information only on the condition that the recipient will not disclose it to any other party without the prior consent of the parent or eligible student, and the recipient's officers, employees and agents may use it only for the purposes for which the disclosure was made.
If the Department's enforcement Office finds that a third party outside the school improperly rediscloses personally identifiable information from education records in violation of section 99.33, or fails to give a notification section 99.33(b)(2) requires, the school from which the information originated may not allow that party access to personally identifiable information from education records for at least five years.
The Secretary of Education enforces the Act, and may terminate assistance only on finding a failure to comply that cannot be secured by voluntary means. The Supreme Court's 2002 decision in Gonzaga University held that the relevant provisions of the Act create no personal rights enforceable under section 1983 of title 42.
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app serves under-18s.