Family Educational Rights and Privacy Act (FERPA) regulations allow colleges and universities to disclose personal information from a student’s education records without consent when the disclosure is to school officials with “legitimate educational interests.” What does it mean to (i) be a school official and (ii) have a legitimate educational interest in a record?
School officials
FERPA and its regs do not specify who (other than teachers) school officials are for purposes of disclosing student records.
But the U.S. Department of Education’s Family Policy Compliance Office (FPCO) suggests that institutions of higher education can interpret “school official” broadly to include a wide array of people under a variety of circumstances. The FPCO “generally interprets the term to include parties such as: professors; instructors; administrators; health staff; counselors; attorneys; clerical staff; trustees; members of committees and disciplinary boards; and a contractor, volunteer or other party to whom the school has outsourced institutional services or functions.” One FPCO guidance letter found that even a student could be classified as a “school official” when performing an official task on behalf of the institution. See Letter re: Enforcement of students’ rights (Middlesex Community College) (FPCO 11/30/2000).
When it comes to third parties, they may qualify as school officials if
- They perform an institutional function for which the school would otherwise use employees;
- They are under the direct control of the school with regard to the records;
- They are subject to redisclosure requirements; and
- The school uses reasonable controls.
Legitimate educational interest
Similarly, “legitimate educational interest” is broadly considered to be an interest (a) in the particular student to which an education record applies or (b) in the administration of education at an institution more generally. The FPCO says a school official has a proper interest if “the official needs to review an education record in order to fulfill his or her professional responsibility.” For example, the FPCO concluded that a professor would generally have a legitimate educational interest in obtaining information from a student’s academic file simply for the purpose of understanding the student’s educational background. See Letter re: Students’ right to nondisclosure (Anonymous Student) (FPCO 8/22/2008).
What this means to you
FERPA regulations emphasize that, under the “legitimate educational interest” exception to privacy requirements (and other exceptions), schools should use “reasonable methods” (effective physical, technological or administrative controls) to ensure only appropriate access. Among other related issues, consider whether (1) your technology systems lock out all but those with appropriate interests and (2) your contracts with third parties who may have access under this exception specify FERPA compliance.
Also, while the Department has interpreted “school official” and “legitimate educational interest” broadly, and gives institutions significant leeway in determining what these terms entail at their schools, the FPCO requires schools to have “written criteria for determining which school officials have a legitimate education interest in specific education records.” See also Letter re: Student’s right to nondisclosure (Ellis College) (FPCO 8/21/2008).