Family Educational Rights and Privacy Act (FERPA) protects student education records’ privacy in the United States. The law applies to all schools that receive funds under the U.S. Department of Education’s applicable program. FERPA applies to any public or private elementary, secondary, or post-secondary school and any state or local education agency that receives funding under appropriate U.S. Department of Education programming.

 

FERPA allows “school officials” access to a student’s education records without consent if the official has “legitimate educational interests” in the information.

 

To prevent breaching FERPA, your organization’s disclosure should define “school official” and “legitimate educational interests” in a way that includes fundraising—disclosing types of information that are shared (name, address, date of birth, degree information, athletic team participation, etc.).

 

Fundraising departments are allowed to be in contact with campus partners, including admissions. These information transfers should happen only after a student has accepted their offer of admission. This is because parent prospecting and alumni fundraising are not problematic once the applicant is officially a student. But the data transfer should only include basic personally identifiable information.

 

Education Records

 

Education records include records—whether handwriting, print, computer, videotape, audiotape, film, microfilm, microfiche, or e-mail—of an institution that contains information directly related to the student.

 

Education records do not include:

 

• medical records;
• employment records (when employment is not contingent on being a student);
• law enforcement records;
• alumni records; and
• parents’ or eligible students’ rights.

 

Schools must have written permission from the parent or eligible student to release any information from a student’s education record. Schools that fail to comply with FERPA risk losing federal funding.

 

How FERPA Helps

 

FERPA gives parents certain rights regarding their student’s education records. These rights transfer to the student when a student reaches the age of 18 or attends secondary education.

 

Current regulations exclude records with information about an individual once they become an alumnus. Schools must be cautious not to mistakenly interpret this provision to mean any document created or received by the institution after a student is no longer enrolled—regardless of the subject matter—because it is not an educated record under FERPA, whether they were created or received by the institution.

 

Parent Rights

 

Parents or eligible students have the right to inspect and review the student’s education records maintained by the school. Schools are not required to provide copies of records unless parents or eligible students can’t review them.

 

Schools must have written permission from the parent or eligible student to release any information from a student’s education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions:

 

• school officials with legitimate educational interest;
• other schools to which a student is transferring;
• specified officials for audit or evaluation purposes;
• appropriate parties in connection with financial aid to a student;
• organizations conducting certain studies for or on behalf of the school;
• accrediting organizations;
• to comply with a judicial order or lawfully issued subpoena;
• appropriate officials in health and safety emergencies; and
• state and local authorities within a juvenile justice system.

 

Schools may disclose, without consent, “directory” information such as a student’s name, address, telephone number, date and place of birth, honors, awards, and attendance dates. But schools must tell parents and eligible students about directory information and allow them to refrain from disclosure.

 

Parents and eligible students must be notified annually of their rights under FERPA. Communication can be completed through a letter, school bulletin, student handbook, or newspaper article—the method of communication is at the school’s discretion.

 

Unintentionally Violating FERPA

 

Carelessly disposing of old student records indirectly violates FERPA.

 

Under FERPA, schools are responsible for how vendors use data. That means that if a vendor unintentionally misuses a student’s education records, the school will be found at fault. This also includes online fundraisers.

 

Know when to release and withhold records. It is a violation of FERPA if schools deny parents access to student records if they are under the age of 18.

 

Proceed with caution when talking about student-related information that you may have experienced indirectly. For example, teachers can speak about a student incident if they witness it firsthand. But if a senior administrator reads a report about that incident, the senior administrator cannot talk about it publicly. These concepts apply to social media usage.

 

Here are some other dos and don’ts when it comes to FERPA and fundraising.

 

Do understand the difference between a directory and non-directory information, but don’t make this information available to the public.

 

Do know students can grant written consent, but don’t disclose non-directory information without student written consent.

 

Do check for a FERPA restriction before communicating directory information, but don’t disclose the information if that student has a FERPA restriction.

 

Do understand parents can receive non-directory information in cases of emergencies, but don’t share non-directory or non-public directory information with parents if the student is over the age of 18 without written consent.

 

Do use blind carbon copy (bcc) when electronically communicating with multiple students, but don’t use carbon copy (cc) with numerous students, parents, or constituents.

 

To make sure your FERPA disclosures are inclusive, contact your admissions office or legal counsel.