The Family Educational Rights and Privacy Act (FERPA) ostensibly protects a student’s right to access and to keep private his or her educational records. However, a lack of sufficient and reasonable mechanisms to enforce the law makes these rights illusory. FERPA provides no statutory remedy to students whose privacy is violated, nor does it support a cause of action in federal or state court. The law also confers no individual rights, which nullifies any federal claim under 42 U.S.C. § 1983. As a result, injured students may only pursue ancillary state-law claims for damages—claims that are often unsuccessful. This allows offending schools to go completely unpunished, notwithstanding the hollow threat of federal defunding if the school refuses to voluntary comply with the law.
FERPA must be amended to better effectuate its purpose. The current law can be divided into two distinct and independently enforceable parts: one providing student access to educational records and one creating a right to privacy in those educational records. Separating these functions allows for the imposition of punishments which are commensurate with the severity of the offense:Schools face modest civil penalties for minor violations of the law, while students may pursue civil action for harms caused by misconduct. This scheme ensures that a student’s right to privacy is not only recognized, but that this right is enforceable at both the administrative and individual level.
FERPA was offered as a floor amendment during Congress’ reauthorization of the Elementary and Secondary Education Amendments (ESEA) in January of 1973. The amendment’s principal sponsor was Senator James Buckley.The act was frequently referred to as the “Buckley Amendment” prior to gaining wider notoriety as FERPA. No “traditional” legislative history exists for FERPA as it was not subject to Committee consideration—a peculiarity that exacerbates uncertainty in both the legal and educational communities as to its purpose and application. However, it is arguable that FERPA’s introduction was consistent with Congress’ broader legislative interest in regulating and protecting informational privacy during that time.Scholars point to the passage of the Privacy Act in 1974 as a not coincidental, but emblematic of a heightened concern around governmental use and dissemination of private, individual information followingthe Watergate scandal.
In response to requests for clarification on the intent and scope of FERPA, Senators Buckley and Pell drafted and submitted the “Joint Statement in Explanation of Buckley/Pell Amendment” four months after the Act was signed into law. The Senators made clear that the
purpose of the Act . . . [was] . . . to assure parents of students, and students themselves if they are over the age of 18 or attending an institution of postsecondary education, access to their education records and to protect such individuals’ right to privacy by limiting the transferability of their records without their consent.
Additionally, Senators Buckley and Pell further expanded the Act’s definition of “educational records” by amending the law to include “those records, files, documents and other materials which(i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution.” Although the Senators undoubtedly hoped that this statement would resolve the most critically ambiguous portionsof FERPA, there is still significant disagreement as to these two aspects of the law: Whether FERPA creates an individual right to privacy in one’s educational records and what actually constitutes an “educational record.”
As proposed by Senator Buckley, FERPA became § 438 of the General Education Provisions Act (Title IV of the ESEA) and was codified at 20 U.S.C. § 1232g. Enacted under Congress’ spending power, FERPA creates conditions for the receipt of federal funding for all public and private schools (preschool through post-secondary). The law provides for seven areas of privacy protection, although, only three requirements are sources of controversy. Broadly, these three provisions comprise the essential “rights” of students and parents under FERPA:
These three provisions represent two distinct, but occasionally overlapping areas of regulation under FERPA: the rights of individuals in accessing their own educations records (disclosures to the student) and the rights of third-parties to access the educational records of others (disclosures to a third-party). Despite fundamental differences in the rights and interests of the parties involved in these areas, FERPA does little to recognize this reality. Any school found in violation of any of these enumerated rights is subject to the same punishment. FERPA states that, “[n]o funds shall be made available under any applicable program to any educational agency or institution which has a policy or practice . . .” whichfails to comply with any of the above provisions.
What conduct, and more specifically whose conduct, violatesFERPA is open to interpretation. The “Joint Statement” provides clarification on the purpose of the law, but it is silent as to the scope of the Act’s provisions. Absent legislative direction, the courtgenerally holds the phrase policy or practicerequiresa pattern of misconduct, that is, multiple instances of the same type of violation. Individual instances of misconduct at the institutional level are not covered under the law. Additionally, the Supreme Court found that FERPA’s provisions “speak only in terms of institutional policy and practice, not individual instances of disclosure.”FERPA is only enforceable against schools or institutions that evidence broad, campus-wide policies of misconduct, not individual teachers or school employees. The actions of individuals—no matter how egregious or malicious—are nonactionable under FERPA.
III. Potential Violations of FERPA
Under the current law, it is impossible to ascertain exactly how many FERPA violations occur each year. Neither schools nor the Department of Education(DOE) publish data detailing the number of complaints filed each year. Even if summaries were available, it is questionable if the number reported would be accurate: students do not realize misconduct has occurred or may elect not to pursue a formal complaint due to temporal, procedural, or perceptional barriers. It is also highly likely that students may choose to file a complaint only with the school itself and, because FERPA imposes no reporting requirement, these complaints would be dealt with privately through a school’s internal adjudication process. As a result,complaints reach the public almost exclusivelythroughlawsuits involving serious personal and financial harms. There is no other public notification when a school is investigated by the DOE for alleged misconduct.
The most frequently litigated cases related to FERPA-protected information involve unlawful public disclosures of private information by an individual school employee. A student’s advisor or teacher will improperly share true, but damaging information regarding the student’s conduct or academic performance with a third-party, resulting in lost opportunities or employment. There is also a line of cases which involve harmful, unlawful disclosures of untrue information about a student. Often, these cases involve alleged student conduct or behavior issues. Although the plaintiffs in these cases are harmed, these suits are rarely successful because no cause of action is provable.
Another area related to public disclosures which is ripe for potential litigation is FERPA’s treatment of personally identifiable information (PII). The Act makes unlawful, “. . . the release of educational records (or personally identifiable information contained therein other than directory information) . . . .” However, FERPA’s definition of “directory information” is quite expansive and allows for the release of sensitive information well in excess of many other statutory or administrative privacy regulations. Unless expressly disallowed by the student, a school may release:
. . . the student’s name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, degrees and awards received, and the most recent previous educational agency or institution attended by the student.
While there is no single, superseding definition of what constitutes PII, more modern regulations broadly protect informational privacy by specifically prohibiting the dissemination of information that “permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.” In other contexts, such as employment, direct-identifiers (name, address, telephone number), as well as indirect-identifiers (birthdate, geographic indicators) are protected information. This discrepancy highlights an important distinction: FERPA protects students’ privacy only in specific educational records, it does not confer or enforce a general right to privacy in schools. For example, no provision in FERPA precludes colleges and universities from selling student “directory information” to credit card companies or banks for use in direct marketing and sales campaigns (until the FTC intervened in 2003). Operating under a narrow definition of PII creates many unnecessary risks for students, including the facilitation of crimes like stalking or identity theft. It is reasonable to foresee a lawsuit originating from one such disclosure, particularly in a state with more comprehensive privacy laws.
Personally identifiable information which is protected under FERPA may not be released in any form without the express written consent of the student. Third-parties who request, or are authorized to access student records (i.e. researchers) must do so in a manner as “. . . will not permit the personal identification of students . . . .” Although these provisions offer ostensibly broad protection, they may be preempted by a state freedom of information act (FOIA) which requires state-funded agencies to disclose public records. The majority of these requests come from the media who tend to target state colleges and universities to gain access to admissions or student disciplinary records. In these cases, the DOE argues that this information constitutes an “educational record” and, even if personally identifiable information is redacted, it may be possible to identify individual students in direct violation of FERPA.Additionally, releasing this information, in any form, may have a chilling effect on the student conduct adjudication process, particularly for victims or witnesses of sexual assault. Ultimately, whether the information is released depends on the scope of a particular states’ FOIA and the court’s definition of “educational records.” Courts have compelled at least partial disclosures of students’ educational records in Illinois, Ohio, Florida, and Washington State. Students affected by these disclosures cannot contest the release of their information and have no legal recourse for any resulting injuries.
III. Statutory Enforcement Provisions
FERPA contains two provisions for enforcement. As legislation enacted under Congress’ spending power, one remedy for noncompliance is the termination of federal funds. However, no school has ever been financially penalized for a FERPA violation.The other remedy is administrative review. FERPA authorizes the Secretary of Education to investigate potential misconduct and seek voluntary compliance with the law. Neither of these measures supportcompensation or alternate recourse for an injured student. As a result, privacy and students’ rights advocates are highly critical of FERPA as a toothless law: a law without real power, consequence, or meaningful effect.
Under §1232g(g), the Secretary of Education is required to establish a review board within the Department of Education for “investigating, processing, reviewing, and adjudicating violations [of FERPA].”Pursuant to this provision, the Family Policy Compliance Office (FPCO) was formed. This office maintains a staff of only eight people (five of whom are contract employees).As the sole investigators and enforcers of FERPA, the FPCO office maintains a system for receiving student complaints and, when misconduct is found, a process for seeking voluntary compliance from offending schools. However, the exact contours of the FPCO’s adjudication process are unknown: it has “no hearing requirement, no timeline for processing complaints, nor, in fact, any requirement that complaints be processed, and no compensation or other recourse for the student.”The FPCO may also unilaterally dismiss a claim without cause and has no obligation to notify a student when it has done so. The FPCO’s primary method of resolving complaints is letter writing—it sends complaint notices to schools, which it archives on its website.
While the FPCO is tasked with receiving and reviewing complaints, the Secretary of Education alone retains the authority to terminate the assistance of any school that fails to comply substantially with any FERPA requirement. Because, this is an all or nothing proposition, Congress hedged this grant of authority by requiring the Secretary of Education to find that “compliance cannot be secured by voluntary means.” It is difficult to imagine a scenario in which a school refuses a DOE request for compliance. Whether that school enacts meaningful changes to ensure continued compliance is a more uncertain issue. And, the DOE has no other penalty or sanction to impose if a school fails to maintain lawful practices. As a method of enforcement, FERPA’s binary enforcement scheme is both impractical and unreasonable. The elimination of all federal funding is simply too draconian to represent a viable punishment; for virtually all violations of the law, it is the equivalent of “launching a missile to kill a mouse.”
Conversely, a compliance letters is too lenient to address serious misconduct. This penalty provides a disproportionately weak response, particularly to malicious, intentional, and extreme violations of the law. And, most troubling, none of these enforcement provisions speak to the injury suffered by the student; the actual victim has no remedy under the law.
Although the court upholds its narrow enforceability, FERPA’s lack of available remedies is highly criticized by the judiciary. It is recognized that although “the Secretary may withhold authorized federal funding if an educational institution fails to correct an identified violation, [they] cannot be expected to threaten and/or act upon this drastic remedy for each and every minor FERPA violation, nor does this  threat necessarily respond to the harm suffered by aggrieved individuals.” Indeed, attempting to exhaust the remedies available under FERPA
“. . . would have the effect of ‘exhausting’ the complainant without any meaningful possibility of enforcement by the Secretary.”Over the forty-four years that FERPA has been law, the Secretary of Education has sought its judicial enforcement only once: Injunctive relief was awarded against Miami University prohibiting the school from releasing to a third-party thousands of student records, many of which contained sensitive personally identifiable information.Yet, Miami University was able to maintain its federal funding, despite fulfilling similar data requests in the past. To date, no school has ever lost federal funding for a FERPA violation.
Even if a school were to lose federal funding, it is difficult to argue that this would be a just outcome. Federal funding is generally disbursed through grant, aid, and loan programs that directly benefit students. In 2016, the Department of Education provided over $68 billion dollars for Pell grants, special education programs, and programs that support at-risk and low-income students.In addition, spending for federal student aid programs for post-secondary students reached $125.7 billion dollars. Eliminating this funding would have serious and catastrophic consequences for all students, but particularly those facing significant socioeconomic disadvantage. School and/or program closures would derail students’ academic progress and delay or prevent graduation, as well as impose potential financial losses through additional tuition, moving, or transportation expenses. Ironically, defunding would have the most immediate and harmful effect on the individuals FERPA seeks to protect. In effect, a student whose privacy is violated only risks further injury by attempting to enforce his or her protections under the law. Given the outcomes, students have little incentive to pursue a complaint and the Department of Education has few reasons to punish an offending school.
In addition to denying students meaningful relief, FERPA also fails to provide a legal remedy to injured parties. “Every court which has addressed the issue has concluded that FERPA does not provide a private cause of action.” Through the Act’s enforcement scheme, the legislature did not evidence the requisite intent to allow private parties to pursue legal action for money damages.The law contains no provision that explicitly empowers private parties to sue. Moreover, this right cannot be implied given the inclusion of mechanisms for federal enforcement (defunding and administrative review). Pursuant to the maxims of statutory interpretation, FERPA alonecannot serve as the basis to assert a legal claim: absent another cause of action, a student may not sue school for damages resulting from a violation.
While the courts do not recognize a private cause of action under FERPA, one legal theory which received mixed treatment was the applicability of its enforcement under 42 U.S.C. § 1983. Section 1983 provides that any person who deprives a citizen of “any rights, privileges, or immunities secured by the Constitutions and laws, shall be liable to the party injured in an action at law, suit in equity, or other proper proceeding . . . .”Complainants argued that FERPA created a right to privacy in one’s educational records and that, although the law did not support an independent cause of action, it does support a pendent claim under § 1983 in state court.In support, the Supreme Court had previously held that rights created by a federal statute could be enforced against state actors.In Gonzaga University v. Doe, however, the Supreme Court foreclosed this action by ultimately determining that FERPA created no personal rights.In so ruling, the Court effectively extinguished any future judicial claims based on FERPA.
In distinguishing FERPA from a line of similar § 1983 claims, the Court found that the language of the Actwas intended to regulate the conduct of schools, not to grantindividual privacy rights to students. The central provisions of FERPA do not identify a particular benefitted class, nor are they concerned with the needs of any particular person.Rather, FERPA provides that “[no] funds shall be made available . . . to any educational agency . . . which has a policy or practice of permitting the release of educational records . . . .” The objects in this provision are policies or procedures and schools, not individuals. Thus, the statute must be interpreted as focusing entirely on the “person regulated rather than the individuals protected . . . .”Accordingly, FERPA does not confer an individual entitlement nor recognize an individual right; the law is actually “two steps removed from the interests of individual students and parents.”As written, the Court holds that the law is unenforceable under § 1983.
The Court also cited the statute’s comprehensive scheme for enforcement as evidence of Congress’ intent to disallow private lawsuits.Legislation passed under Congress’ spending power impliedly confers no individual rights because violations are remedied by the Federal Government, not through a private cause of action. FERPA’s enforcement provisions expressly authorize the Secretary of Education to “take appropriate actions to enforce . . . and to deal with violations [of the law].”This text clearly evinces an intention by Congress for FERPA to be federally enforced at the administrative level. Additionally, individual parties are provided a non-judicial remedy for alleged violations: they may file a complaint with a federal agency. By the plain language of the statute, “it is implausible to presume that . . . Congress nonetheless intended private suits to be brought before thousands of federal—and state court judges . . . .”To support a private cause of action, FERPA must not prescribe a centralized administrative process to review or enforce statutory violations.
Without a statutorily provided remedy and no grounds for private action under FERPA, injured parties must seek relief only in state courts. However, the success of these claims is highly dependent on the laws of the particular jurisdiction. The vast majority of suits are unsuccessful.The facts surrounding a violation, which is almost always an unauthorized disclosure, may constitute a violation FERPA, but they do not often meet the elements of a cause of action under tort or contract law. Absent a standard of conduct, which FERPA does not provide, it is difficult to prove that a student maintains a right of privacy in the released records or that the disclosure itself is unlawful. However, injured partiesmay attempt to assert negligence, defamation, and intentional or negligent infliction of emotions distress claims. Students attending a private school or a college/university may attempt to assert breach of contract claims, although courts generally do not recognize punitive damages for a violation of the right to privacy within this context.
Torts claims apply only to offenses involving the disclosure of private information. Most involve an offender—a school employee—improperly disclosing private, but true information to a third-party for some arguably legitimate reason. Under this fact pattern, almost all torts claims are defeated. First, the fact that the information disclosed is true is dispositive. Defamation and false-light publicity claims require a knowingly false statement. Second, the disclosure is ostensibly committed for a valid reason: safety, pedagogy, or a third-party interest being frequent examples. Seldom do these circumstances evidence the extreme or outrageous conduct necessary for an intentional infliction of emotional distress claim.This type of disclosure may support an invasion of privacy claim, however, no plaintiff has pursued this cause of action, possibly due to states’ inconsistent recognition of this tort.
FERPA allows unconsented disclosure to third-parties “who have been determined by [an] agency or institution to have legitimate educational interests” in the released records. This provision creates a significant hurdle to claimants asserting a negligence or negligent hiring claim. To prove that a school violated its duty, the student must show that the disclosee’s interest was illegitimate. Not only is this determination inherently subjective, but it represents a significant shift in the burden of proof required by the plaintiff. Additionally, FERPA does not establish a standard of conduct for individual school employees. Therefore, unless the disclosure occurs as a result of a school-level policy or practice—that is, multiple instances of the same misconduct—FERPA cannot serve as the basis for a negligence per se claim.
A student injured by a disclosure or by a school’s failure to release or maintain the student’s record may sue on theory of breach of contract, but only if a contractual relationship exists. This action is limited to students attending a private or postsecondary school, asthe tuition paid for attendance creates a bargained-for agreement. In such cases, the school’s records policies form the terms and conditions of the contract. If the school violates these terms by releasing student information without consent, that conduct constitutes a breach. However, the damages awarded to the student are unlikely to compensate for any noneconomic harms suffered. Contract jurisprudence recognizes that the “purposes of awarding . . . damages is to compensate the injured party . . . not award damages to punish the party in breach or to serve as an example to others unless the conduct constituting the breach is also a tort for which punitive damages are recoverable.”If the information disclosed is untrue, or if the injured party can prove that the disclosure caused real and calculable damages, only then will a cause of action for breach provide for enhanced damages.
For all claims involving an unlawful disclosure under FERPA, the court must also decide whetherthe student maintained a reasonable expectation of privacy in that information. In many circumstances, the third-party doctrine applies to records maintained by schools. While final grades and test scores are recognized as objectively private, other types of records—particularly those involving information which is observable or knowable by third-parties—may not treated as such. Citing the impracticalities of a broad interpretation of “educational records” under FERPA, the Supreme Court found that “records” were those “institutional records kept by a single central custodian, such as a registrar . . . .” A contrary holding would see federal law disallowing, “a happy face, a gold star, or a disapproving remark on a classroom assignment” if other students could see it.While not dispositive to every private cause of action, the Court’s findings, even in dicta, are particularly significant given the limited case law involving FERPA. Subsequent to Owasso, the Supreme Court has declined to hear another FERPA case and has therefore never fully definedthe boundaries of a student’s reasonable expectation of privacy.
FERPA does not accomplish what Senators Buckley and Pell intended. Although the law seeks to confer a right of access and privacy in students’ educational records, the inadequacy of its enforcement provisions ensures that these rights are illusory. By prescribing a single penalty—the complete loss of federal funding—Congress ultimately guarantees that no schoolcantruly be held accountable for misconduct.The mechanism for enforcement is too harsh and too simplistic to be reasonably applied to the full range of possible violations. Thus, without alternate, scalable penalties, unlawful conduct may persist without financial repercussions. And, while schools are theoretically prohibited from adopting unlawful policies and practices, students remain vulnerable to the conduct of individual offenders whose behavior falls outside of the statute. In failing to grant any rights to student—to privacy, access, or otherwise—FERPA supports no cause of action, nor any claim under 42 U.S.C. § 1983. An injured party mayseek a remedy in only state court using whatever laws are controlling in that jurisdiction. Accordingly, FERPA could cease to exist and students’ options under the laweffectively remainunchanged.
By amending its enforcement provisions, FERPA can fulfill its intended purpose of providing students’ rights to access and privacy in educational records. Addressing its fundamental flaws, however, must begin with the recognition that its two aims, regulating disclosures to students and restricting disclosures to the public, are best effectuated via different enforcement mechanisms. The law should be divided into two separate acts according to these purposes. The first, a series of amendments to § 1232(g)deals exclusively with students’ rights in accessing their own educational records and the requirements for maintaining and correcting those records. As a purely regulatory scheme, it imposes civil penalties based on the severity of a school’s noncompliance. The second, a proposed bill, addresses third-party access to educational records by conferring students a right to privacy in their records and information. As rights-granting legislation, it supports a federal cause of action against violations committed at boththe individual and school level.
A.Proposed Amendments: The Family Educational and Access Rights Act
Ensuring students access to their own educational records and providing an opportunity to correct those records are not interests inherently related to privacy. Under the current law, the entirety of § 1232g(a) deals only with intra-school treatment of student information.None of the regulated conduct involves disclosure or release of student information outside the school. Moreover, given the limited circumstances that constitute a violation of this section, and the relatively minor harm inflicted by such misconduct, it is most appropriate to model these provisions after other regulatory statutes contained at20 U.S.C. § 1092. No similar regulations under this code use defunding as an enforcement mechanism, instead, commensurate civil penalties are imposed based on the severity of the offense.Additionally, schools are required to count and self-report potential violations. This mandatory reporting allows the Department of Education to ascertain patterns of misconduct, which is not possible under FERPA.
The amended act adoptsthe structure and enforcement provisions of The Campus Security Act or “Clery Act.” This act confers a similar “right of information” to students by requiring schools to disclose the institution’s campus security policy and also summarize the number of incidents of crimes on campus.In the amended statute, Section 3(A) adopts this reporting requirementand imposes mandatory disclosure of: (1) the number of record access requests received from students, (2) the number of complaints received regarding access, and (3) the number of hearings conducted to review incorrect information. Mandatory reporting serves two important purposes. First, it expands the scope of the conduct regulated by the law. Schools are required to report both administrative policy violations, as well as violations committed by individual employees. Second, the Department of Education can determine the prevalence with which these violations occur and ascertain patterns of misconduct at particular schools. Under the current law, violations are reported only by students, which in a disaggregated, isolated state, cannot sufficiently describe the extent of potential misconduct at a school.
Even if a school demonstrates a pattern of repeated and egregious violations of § 1232g(a), the misconduct and the resulting harms are simply too minor to warrant thecomplete loss of federal funds. Accordingly, all language related to defunding is removed. In its place, borrowing from The Campus Security Act, are provisions for the imposition of civil penalties pursuant to § 1094(c)(3)(B). Section 1094 authorizes the Secretary of Education to impose a penalty of no more than $25,000 upon any institution which has violated or failed to carry out any provision of the act. In determining the fine, the Secretary has the discretion to reduce the amount based on the “gravity of the violation, failure, or misrepresentation” and may consider the size of the institution. Under the amended act, denying students access to educational records, failing to provide a process to amend records, and failing to submit or submitting an incorrect summarizing report, all constitute fineable violations. In addition, the amended act also contains an anti-retaliation provisionto ensure that schools will not actively discourage or attempt to suppress student complaints.This conduct, too, is a fineable offense. Through these amendments, FERPA is significantly easier to enforce. The imposed penalties are of a sufficient amountto deter misconduct, but not so large as to be unreasonable. Coupled with the mandatory reporting requirement, these fines will also influence how schools train and retain staff—habitual offenders may be routinely fined until violations decrease and/or staff alter their behavior.
As the amended act is not intended to protect student privacy per se, references to student privacy are removed. This includes the somewhat incongruous sections related to “directory information,” which is not referenced in any provision of § 1232(g)(a). These aspects of the law are better actualized in a separate, narrowly-drafted statute that deals solely with a student’s right to privacy.
20 U.S.C. § 1232g
(a)Conditions for availability of fundscivil penalties to educational agencies or institutions; inspection and review of education records; specific information to be made available; procedure for access to education records; reasonableness of time for such access; hearings; written explanations by parents; reporting requirements; definitions
(1)(A)No funds shall be made available under any applicable program to anyNo program at any educational agency or institution which hasshall have a policy of denying, or which effectively prevents[ing],the parents of students who are or have been in attendance at a school of such agency or at such institution, as the case may be, the right to inspect and review the education records of their children. If any material or document in the education record of a student includes information on more than one student, the parents of one of such students shall have the right to inspect and review only such part of such material or document as relates to such student or to be informed of the specific information contained in such part of such material. Each educational agency or institution shall establish appropriate procedures for the granting of a request by parents for access to the education records of their children within a reasonable period of time, but in no case more than forty-five days after the request has been made.
(B)No funds under any applicable program shall be made available to anyNoState educational agency (whether or not that agency is an educational agency or institution under this section) that hasshall havea policy of denying, or which effectively prevents[ing], the parents of students the right to inspect and review the education records maintained by the State educational agency on their children who are or have been in attendance at any school of an educational agency or institution that is subject to the provisions of this section.
(. . .)
(2)No funds shall be made available under any applicableprogram to anyNo program at any educational agency or institution unlessshall have a policy of denying or effectively preventing the parents of students who are or have been in attendance at a school of such agency or at such institution are providedan opportunity for a hearing by such agency or institution, in accordance with regulations of the Secretary, to challenge the content of such student’s education records, in order to insure that the records are not inaccurate, misleading, or otherwise in violation of the privacy rights of students, and to provide an opportunity for the correction or deletion of any such inaccurate, misleading or otherwise inappropriate data contained therein and to insert into such records a written explanation of the parents respecting the content of such records.
(3)(A)All educational agencies or institutions, shall on August 1, 2018, begin to collect the following information with respect to student educational records, and beginning September 1, 2019, and each year thereafter, prepare and file with the Secretary an annual report containing at the least the following information:
(i)a statement of current agency or institution policies regarding student educational record access.
(ii)a statement of current agency or institution policies regarding educational record hearings.
(iii) Statistics concerning the occurrence, at the educational agency or institution, during the most recent calendar year, and during the 2 preceding calendar years for which data are available—of the following educational record requests:
(I) the number of requests received by a student or parent to view the student’s educational records
(II)the number of complaints received from a student or parent regarding access to the student’s educational records
(III)the number of hearings conducted for the purpose of a student or parent challenging the content of such student’s educational records and the number of business days between the student or parent’s request and the corresponding hearing.
(4)(A) On an annual basis, each educational agency or institution shall submit to the Secretary a copy of the statistics required to be made under paragraph (3)(A). The Secretary shall:
(i) review such statistics and to assess compliance with paragraphs 1(A),1(B), and 2 under this subchapter.
(5)Upon a determination pursuant to 20 U.S.C § 1094(c)(3)(B) of this title that an institution of higher education has substantially violated any of the requirements under this subsection, the Secretary shall impose a civil penalty upon the institution in the same amount and pursuant to the same procedures as a civil penalty is imposed under 20 U.S.C. § 1094(c)(3)(B) of this title.
(6) No officer, employee, or agent of an educational agency or institution participating in any program under this subchapter shall retaliate, intimidate, threaten, coerce, or otherwise discriminate against any individual for exercising their rights or responsibilities under any provision of this subsection.
(. . .)
(5)(A) For the purposes of this section the term “directory information” relating to a student includes the following: the student’s name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended by the student.
(B) Any educational agency or institution making public directory information shall give public notice of the categories of information which it has designated as such information with respect to each student attending the institution or agency and shall allow a reasonable period of time after such notice has been given for a parent to inform the institution or agency that any or all of the information designated should not be released without the parent’s prior consent.
[20 U.S.C. § 1094(relevant sections)
(i)Upon determination, after reasonable notice and opportunity for a hearing, that an eligible institution—
(I)has violated or failed to carry out any provision of this subchapter or any regulation prescribed under this subchapter; or
(II)has engaged in substantial misrepresentation of the nature of its educational program, its financial charges, and the employability of its graduates,the Secretary may impose a civil penalty upon such institution of not to exceed $25,000 for each violation or misrepresentation.
(ii)Any civil penalty may be compromised by the Secretary. In determining the amount of such penalty, or the amount agreed upon in compromise, the appropriateness of the penalty to the size of the institution of higher education subject to the determination, and the gravity of the violation, failure, or misrepresentation shall be considered. The amount of such penalty, when finally determined, or the amount agreed upon in compromise, may be deducted from any sums owing by the United States to the institution charged.]
Schools are entrusted with a significant amount of sensitive, private information. Academic, behavioral, financial, and medical records—materials requiring the highest levels of security and care—are maintained for every student, often for many years after attendance. The decisions schools make regarding these records can seriously affect a student’s academic, social, and economic futures. Recognizing a need to protect students’ informational privacy was the overarching intention of the Buckley Amendment: students are entitled to at least basic privacy rights in their educational records. As enacted, however, FERPA fails to confer any individual rights (to privacy or otherwise) and cannot be enforced as such. Private information can be disclosed, violating a student’s privacy, without any recourse. The proposed bill seeks to correct this nonfulfillment. The Privacy of Student Educational Records Act confers an individual right to privacy. The bill incorporates the requisite “right-creating” language into the existing framework of §§ 1232g(b), 1232g(c) with sufficient clarity and intentionality to satisfy the Court’s applications of thePennhurst and Blessing tests used in Gonzaga. Accordingly, the proposed bill is presumptively enforceable by the court under 42 U.S.C. § 1983. Injured students can pursue a private cause of action and seek compensatory damages commensurate with the egregiousness of the violation and the harm suffered.
In determining whether a law confers individual rights, the Court first considers whether Congress manifests this intention by speaking with a “clear voice.”The terms must unambiguously confer “entitlements sufficiently specific and definite to qualify as enforceable rights.”As currently written, FERPA recognizes students’ rights, but only indirectly through the regulation of specific school conduct. Thus, schools and the requirements for school funding are interpreted to be the focus of the law. Conversely, the proposed bill centers on specific student interests and only indirectly implicates school conduct. The intent of the bill is clear: it expressly confers privacy rights to students in their educational records. A student is entitled to protection against:(1) unconsented disclosure; (2) direct or indirect personal identification; (3)disclosures by third-parties; and (4) releases of personally identifiable information. These protections are simply restatements of various provisions in § 1232g, but rephrased to focus on individual students, not on offending school policies. In this respect, the proposed bill introduces no new privacy protections. However, the bill is predicated on a “standard” that students’ have a right to privacy in educational records that pertain to the student, which are “created, maintained, or possessed” by a school. Thus, the proposed bill offers broad individual protections, but in a narrowly tailored context: only in the student’s records as defined in section (1).The structure of the proposed bill models Title IX—a similar rights-granting specifically recognized by the Court as passing the requisite statutory analysis to be enforceable under 42 U.S.C. § 1983.
Regulatory statutes “. . .focus on the person regulated rather than the individuals protected create ‘no implication’ of an intent to confer rights on a particular class of persons.” Shifting the focus of the law to individual studentsand away from school policy evidences not onlyanintention to confer private rights, but it also signals thedisaggregated-focus required by the Court.Conversely, FERPA only regulates only the policies and practices of schools, thereby creating “. . . a yardstick for the Secretary to measure systemwide performance of a [school’s] program.”To ascertain compliance, the “Secretary must [then] look to the aggregate services provided by the [school], not to whether the needs of any particular person have been satisfied.”As a result, FERPA cannot create a private right. Following the rulefromBlessing v. Freestone, the proposed bill strikes all language related to “policy or practice.” Violations are determined by whether an individual student’s rights are violated, not by the existence of a particular institutional policy that has an unlawful effect. This is further clarified by the inclusion of individual acts among the prohibited conduct. The proposed bill specifically recognizes a school’s “employees or agents” as potential offenders. Additionally, the bill’sbroad definition of students’ rights impliedly makes unlawfulall conduct that might violate those rights—at the school or individual level, as defined or undefined by the law. In so doing, the proposed bill demonstrates unequivocal concern for the needs of individual students.
Injured student must rely on 42 U.S.C. § 1983 to compensate for any harms incurred: the proposed bill has no provisions for enforcement. “Plaintiffs suing under § 1983 do not have the burden of showing an intent to create a private remedy because § 1983 generally supplies a remedy for the vindication of rights secured by federal statutes.”In fact, including such a provision would likely preclude students from receiving anyfederal remedy. The Court cited FERPA’s inclusion of a federal review mechanism as evidence that Congress did not intend to create a private cause of action.Enforcement via the termination of federal funds evinces a regulatory scheme, not an intention to confer federal rights. Similarly, the FPCO provides an alternate federal review mechanism outside the litigation stream. None of these provisions are present in the proposed bill. By conferring a right to privacy, injured students may pursue a private cause of action under § 42 U.S.C. § 1983 against offending schools or individuals employed therein. This allows the court to adjudicate alleged violations and apply appropriate discretion in determining the severity and scope of misconduct. The court is best positioned to determine culpability against the total weight of the circumstances. Additionally, the court mayadjust damages based on the willfulness, anomalousness, and egregiousness of individual conduct. Allowing for punitive damages will have an enhanced effect on a school’s motivation to comply with the law. In general, the risk of a potential lawsuit ensures broad compliance with the law. Including the conduct of individual employees within the scope of the law also encourages better training, hiring, and supervision of staff.
As a final evidence that the proposed bill seeks to confer an individual right to privacy, the protections it provides for student’s PII are greatly improved. FERPA’s provisions pertaining to directory information clearly reflect its focus on regulating processes, not ensuring studentprivacy. As all schools now assign students a unique, school-specific ID number, the proposed bill makes use of that information in place of address, date and place of birth, and telephone number.Overall, this provision is updated to reflect modern views on PII and makes unlawful the release of private, sensitive information that may be used to identify (and locate) individual students.
Privacy of Student Educational Records
(1)Standard. A studenthas an absolute right to privacy in those educational records which pertain to the student and are created, maintained, or possessed by any educational institution.
(2)(A)Protection against disclosure. Except as provided in paragraph (B) of this section, a student’s educational records shall not be disclosed without that student’s written consent.
(B)Exceptions to a student’s right to nondisclosure of educational records. Disclosure of a student’s educational records is permitted without that student’s written consent to the following:
(A)(i)other school officials, including teachers within the educational institution or local educational agency, who have been determined by such agency orinstitution to have legitimate educational interests, including the educational interests of the child for whom consent would otherwise be required;
(B)(ii)officials of other schools or school systems in which the student seeks or intends to enroll, upon condition that the student’s parents beis notified of the transfer, receives a copy of the record if desired, and havehas an opportunity for a hearing to challenge the content of the recordpursuant to § 1232g(2);
(. . .)
(C) Protection against direct or indirect personal identification.Third-parties permitted access to educational records may not use or disaggregate data in such a manner as to directly or indirectly identify individual students.
(i) Information used for research or study must be destroyed when it is no longer needed for the purpose for which it was requested and released.
(3)(A)Protection against third-party dissemination of a student’s educational records. With respect to this subsection, personal information Educational records or information contained therein shall only be transferred to a third party on the condition that such party will not permit any other party to have access to such information without the written consent of the parents of the student. If a third party outside the educational agency or institution permits access to information in violation of paragraph (2)(A), or fails to destroy information in violation of paragraph (1)(F), the educational agency or institution shall be prohibited from permitting access to information from education records to that third party for a period of not less than five years.
(4)Protection of a student’s personally identifiable information. Educational institutions, its employees and agents, are permitted to release only the following student information without express written consent:
(A) Directory information defined as the student’s name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended by the student, [and] the last four digits of the student’s university-assigned identification number may be released to a third-party.
(i) No directory information may be released to a third-party for any commercial purpose.
(ii) Educational institutions must maintain a process by which a student can restrict or limit the release of the student’s directory information.
(. . .)
(f)Enforcement; termination of assistance
The Secretary shall take appropriate actions to enforce this section and to deal with violations of this section, in accordance with this chapter, except that action to terminate assistance may be taken only if the Secretary finds there has been a failure to comply with this section, and he has determined that compliance cannot be secured by voluntary means.
(g)Office and review board; creation; functions
The Secretary shall establish or designate an office and review board within the Department for the purpose of investigating, processing, reviewing, and adjudicating violations of this section and complaints which may be filed concerning alleged violations of this section. Except for the conduct of hearings, none of the functions of the Secretary under this section shall be carried out in any of the regional offices of such Department.
Why Work with Us
Top Quality and Well-Researched Papers
We ensure that our writers and editors work within the work guidelines and follow all paper instructions to the letter. When placing an order, you choose the academic field and expert level (high school, college, university, or professional). Our team then assigns your paper to a writer with a respective qualification or degree to ensure that you receive quality work.
Professional and Experienced Academic Writers
We employ professional writers with more than two years of experience in academic and business writing. Most of our writers and editors are native English speakers to ensure quality and professional work. We are confident that our team of professional writers can handle all types of business and academic writing work.
Free Unlimited Revisions
We provide a free revision service for all orders. If you feel that our writers missed something, you can request a revision of your paper at no additional cost. When we deliver your work, you have seven days to go through it and request a revision or modification if you are not satisfied. You can also contact our support team directly for any clarifications and queries on revision.
Prompt Delivery and 100% Money-Back-Guarantee
We ensure that all papers are delivered on time. In case we need more time to master your paper requirements and deliver quality work, we may contact you and discuss a deadline extension. If a deadline extension is not feasible, depending on the work and submission deadlines, we guarantee a 100% refund.
Original & Confidential
To ensure that we deliver plagiarism-free work, we use various writing and plagiarism checking tools. Our professional editors' team carefully goes through all work and references used in papers to ensure proper referencing and that original work has been done. We also guarantee confidentiality in all the services that we provide.
24/7 Customer Support
Our support team is available round the clock for any customer queries and communication. We guarantee 24/7 customer support and assistance. Feel free to contact us at any time of day for questions and follow-ups.
Try it now!
How it works?
Follow these simple steps to get your paper done
Place your order
Fill in the order form and provide all details of your assignment.
Proceed with the payment
Choose the payment system that suits you most.
Receive the final file
Once your paper is ready, we will email it to you.
You do not have to spend sleepless nights worrying about your paper. We got you covered. We offer all kinds of writing services.
Regardless of the type of academic paper you need and its urgency, we have writers on call ready to work on your paper. Feel free to choose the field, educational level, and type of paper you want, and we will deliver it at an affordable price. We are here for all your academic and business paper needs. With our round the clock service, we guarantee that you will receive your work on time.
Admission Essays & Business Writing Help
Admission essays are written by students wishing to join a college, graduate school or university, as applications for enrollment. We guarantee quality admission essays and business papers with our professional writing and customer care support services.
We have experienced academic writers and editors who are on standby to make all the necessary changed to your paper at your request. We ensure that your paper is polished and appropriately formatted (APA, Harvard, Chicago/Turabian, MLA formats) before it is delivered.
We provide revision support, where you can request a revision of a delivered paper if you feel that it can be improved or repolished. Your paper is checked by an experienced writer or editor for revamping and improvement upon a revision request. Revision service is free, and you can use it as many times as you wish until you are satisfied with your paper.