72
1 FERPA in the Digital Age: What You Need to Know ECURE 10:30-12:00, October 12, 2001 Richard Rainsberger Coordinator, Admissions and Records Central Virginia Community College

1 FERPA in the Digital Age: What You Need to Know ECURE 10:30-12:00, October 12, 2001 Richard Rainsberger Coordinator, Admissions and Records Central Virginia

  • View
    223

  • Download
    5

Embed Size (px)

Citation preview

1

FERPA in the Digital Age: What You Need to Know

ECURE

10:30-12:00, October 12, 2001

Richard Rainsberger

Coordinator, Admissions and Records

Central Virginia Community College

2

FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT OF 1974

"A FEDERAL LAW DESIGNED TO PROTECT THE PRIVACY

OF EDUCATION RECORDS, TO ESTABLISH THE RIGHT OF

STUDENTS TO INSPECT AND REVIEW THEIR EDUCATION

RECORDS, AND TO PROVIDE GUIDELINES FOR THE

CORRECTION OF INACCURATE AND MISLEADING DATA

THROUGH INFORMAL AND FORMAL HEARINGS."

________________________________DEFINITIONS OF TERMS FOR ADMISSIONS AND RECORDS. Washington, D.C.: AACRAO, 1980, p. 28.

3

FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT OF 1974

THIS ACT IS ENFORCED BY THE

FAMILY POLICY COMPLIANCE OFFICE,

U.S. DEPARTMENT OF EDUCATION,

WASHINGTON, D.C.

4

Family Policy Compliance OfficeFamily Policy Compliance OfficeLeroy Rooker, DirectorLeroy Rooker, DirectorU.S. Dept. of EducationU.S. Dept. of Education400 Maryland Ave., SW400 Maryland Ave., SW

Washington,D.C. 20202-4605Washington,D.C. 20202-4605

(202) 260-9002 (fax) (202) 260-9002 (fax)[email protected]@ed.gov

www.ed.gov/offices/OM/fpco.htmlwww.ed.gov/offices/OM/fpco.html

The Authoritative Source

5

THE ESSENCE OF THE ACT

• COLLEGE STUDENTS MUST BE PERMITTED TO INSPECT THEIR OWN EDUCATION RECORDS.

• SCHOOL OFFICIALS MAY NOT DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION ABOUT STUDENTS NOR PERMIT INSPECTION OF THEIR RECORDS WITHOUT WRITTEN PERMISSION UNLESS SUCH ACTION IS COVERED BY CERTAIN EXCEPTIONS PERMITTED BY THE ACT.

6

An Additional Corollary for the High Tech Age Whether we are dealing with high-tech or

low-tech education, we only have one education records law:

7

An Additional Corollary for the High Tech Age

we do not change our policies simply because our educational delivery methods have changed.

And…

8

KEY CONCEPTS

Required annual notification Written permission of student required to disclose The exceptions to written permission Student's right to access their records The "musts" and "mays" in FERPA Parents/parental disclosure Legitimate Educational Interest

9

KEY TERMS

Education Record Directory Information School Official Personally Identifiable Eligible Student

10

WHAT IS AN EDUCATION RECORD? ANY RECORD, WITH CERTAIN EXCEPTIONS, MAINTAINED BY AN

INSTITUTION THAT IS DIRECTLY RELATED TO A STUDENT OR STUDENTS. THIS RECORD CAN CONTAIN A STUDENT'S NAME, OR STUDENTS' NAMES OR INFORMATION FROM WHICH AN INDIVIDUAL STUDENT, OR STUDENTS, CAN BE PERSONALLY (INDIVIDUALLY) IDENTIFIED

THESE RECORDS INCLUDE: FILES, DOCUMENTS, AND MATERIALS IN WHATEVER MEDIUM (HANDWRITING, PRINT, TAPES, DISKS, FILM, MICROFILM, MICROFICHE) WHICH CONTAIN INFORMATION DIRECTLY RELATED TO STUDENTS AND FROM WHICH STUDENTS CAN BE PERSONALLY (INDIVIDUALLY) IDENTIFIED.

11

“PERSONALLY IDENTIFIABLE”

"PERSONALLY IDENTIFIABLE" MEANS DATA OR INFORMATION WHICH INCLUDES: (1) THE NAME OF THE STUDENT, THE STUDENT'S PARENT,

OR OTHER FAMILY MEMBERS

(2) THE STUDENT'S CAMPUS OR HOME ADDRESS;

(3) A PERSONAL IDENTIFIER (SUCH AS A SOCIAL SECURITY NUMBER OR STUDENT NUMBER)

(4) A LIST OF PERSONAL CHARACTERISTICS OR OTHER INFORMATION WHICH WOULD MAKE THE STUDENT'S IDENTITY EASILY TRACEABLE

12

Grades Posted on Bulletin Board outside of Instructor’s Office

Instructor Summary-Fall 1999-December 15, 1999GradeBook-Unregistered Copy MKT 227 Fall 99

A = 90.0 B = 80.0 C = 70.0 D = 60.0

RgAvg% 100.00

ExtCr % 5.6 Grade

2949 93.8 2.1 A4532 84.5 4.2 B5599 83.1 0.7 B1197 71 0.7 B7463 72.6 0.7 C6115 66.2 5.6 C7692 66.9 4.2 C2342 68.1 1.4 D1543 62.9 0.7 D6748 61.8 0.7 D

13

14

WHAT AN EDUCATION RECORD IS NOT!! “SOLE POSSESSION” NOTES

LAW ENFORCEMENT UNIT RECORDS

RECORDS MAINTAINED EXCLUSIVELY FOR INDIVIDUALS IN THE THEIR CAPACITY AS EMPLOYEES RECORDS OF INDIVIDUALS WHO ARE EMPLOYED AS A RESULT OF

THEIR STATUS AS STUDENTS (WORK STUDY) ARE EDUCATION RECORDS.

DOCTOR-PATIENT PRIVILEGE RECORDS

ALUMNI RECORDS

15

WHAT IS AN EDUCATION RECORD? (SUMMARY)IF YOU HAVE A RECORD THAT IS:

•MAINTAINED BY YOUR INSTITUTION•PERSONALLY IDENTIFIABLE TO A STUDENT (DIRECTLY RELATED TO A STUDENT AND FROM WHICH A STUDENT CAN BE IDENTIFIED)

•NOT ONE OF THE EXCLUDED CATEGORIES OF RECORDS…

THEN, YOU HAVE AN EDUCATION RECORD AND

IT IS SUBJECT TO FERPA

16

REQUIREMENTS FOR COMPLIANCE

DIRECTORY INFORMATION

• INFORMATION NOT NORMALLY CONSIDERED A VIOLATION OF A PERSON’S PRIVACY

•STUDENTS MUST BE NOTIFIED OF THE ITEMS OF DIRECTORY INFORMATION.

•STUDENTS MUST BE GIVEN THE OPPORTUNITY TO REQUEST THAT DIRECTORY INFORMATION NOT BE RELEASED. THIS RIGHT OF NON-DISCLOSURE

APPLIES TO DIRECTORY INFORMATION ONLY.

17

WHAT CAN DIRECTORY INFORMATION INCLUDE?

STUDENT’S NAME ADDRESS TELEPHONE NUMBER DATE/PLACE OF BIRTH MAJOR FIELDS OF STUDY PARTICIPATION IN

OFFICIALLY RECOGNIZED ACTIVITIES AND SPORTS

HEIGHT/WEIGHT OF ATHLETIC TEAM MEMBERS

DATES OF ATTENDANCE DEGREES AND AWARDS

RECEIVED MOST RECENT EDUCATIONAL

INSTITUTION ATTENDED OTHER SIMILAR

INFORMATION AS DEFINED BY THE INSTITUTIONTHAT WOULD NOT NORMALLY BE CONSIDERED AN INVASION OF A STUDENT’S PRIVACY

DIRECTORY INFORMATION MAY INCLUDE THE FOLLOWING STUDENT INFORMATION:

18

WHAT CAN DIRECTORY INFORMATION INCLUDE?

CLASS SCHEDULECLASS SCHEDULE E-MAIL ADDRESS

CLASS ROSTERSCLASS ROSTERS PHOTOGRAPHS

DIRECTORY INFORMATION MAY INCLUDE THE FOLLOWING RECENT ADDITIONS TO STUDENT INFORMATION:

CLASS SCHEDULECLASS SCHEDULE AND CLASS CLASS ROSTERSROSTERS ARE CURRENTLY (2001) UNDER REVIEW AS TO WHETHER THEY WILL REMAIN DIRECTORY INFORMATION

19

WHAT CAN DIRECTORY INFORMATION INCLUDE?

RACE GENDER SOCIAL SECURITY

NUMBER

GRADES GPA COUNTRY OF CITIZENSHIP RELIGION

DIRECTORY INFORMATION CAN NEVER INCLUDE A STUDENT’S:

20

DIRECTORY INFORMATION COLLEGE XXX STYLE

XXX COLLEGE HAS DESIGNATED DIRECTORY INFORMATION, ACCORDING TO THE FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT OF 1974 TO BE THE STUDENT’S:

NAME LOCAL AND PERMANENT

ADDRESS/ TELEPHONE NUMBER

MAJOR FIELD OF STUDY PARTICIPATION IN OFFICIALLY

RECOGNIZED ACTIVITIES/SPORTS

WEIGHT AND HEIGHT OF MEMBERS OF ATHLETIC TEAMS

DATES OF ATTENDANCE DEGREES AND AWARDS

RECEIVED AND DATES MOST RECENT PREVIOUS

EDUCATIONAL INSTITUTION ATTENDED

ACADEMIC LEVELENROLLMENT STATUS

(FT/PT)

21

It is important to remember that “directory information” be defined as such.

If a data element isn’t defined as “directory information” it isn’t directory information and can only be released if the student’s written permission is obtained or the release can be justified under one of the exceptions to students’ written permission found in FERPA.

DIRECTORY INFORMATION

22

“School Officials”A “SCHOOL OFFICIAL” CAN BE A PERSON:

1) EMPLOYED BY THE COLLEGE IN AN ADMINISTRATIVE, SUPERVISORY, ACADEMIC, RESEARCH, OR SUPPORT STAFF POSITION (INCLUDING LAW ENFORCEMENT AND HEALTH STAFF PERSONNEL),

2) ELECTED TO THE BOARD OF TRUSTEES,

3) OR COMPANY EMPLOYED BY OR UNDER CONTRACT TO THE COLLEGE TO PERFORM A SPECIAL TASK SUCH AS THE ATTORNEY, AUDITOR, OR COLLECTION AGENCY,

4) OR STUDENT SERVING ON AN OFFICIAL COMMITTEE, SUCH AS A DISCIPLINARY OR GRIEVANCE COMMITTEE, OR ASSISTING ANOTHER SCHOOL OFFICIAL IN PERFORMING HIS OR HER TASKS.

23

“LEGITIMATE EDUCATIONAL INTEREST”

THE DEMONSTRATED NEED TO KNOW BY THOSE OFFICIALS OF AN

INSTITUTION WHO ACT IN THE STUDENT’S EDUCATIONAL INTEREST,

INCLUDING FACULTY, ADMINISTRATION, CLERICAL AND

PROFESSIONAL EMPLOYEES, AND OTHER PERSONS WHO MANAGE

STUDENT RECORD INFORMATION.

ALTHOUGH FERPA DOES NOT DEFINE “LEGITIMATE EDUCATIONAL

INTEREST,” IT STATES THAT INSTITUTIONS MUST SPECIFY THE

CRITERIA FOR DETERMINING IT.

24

REQUIREMENTS FOR COMPLIANCE

WHAT WE MUST DO...

PROVIDE ANNUAL NOTIFICATION TO STUDENTS OF THEIR FERPA RIGHTS

PROVIDE STUDENTS’ ACCESS TO THEIR EDUCATION RECORDS

25

PROCEDURES AND STRATEGIES FOR COMPLIANCEA. DISCLOSURE OF EDUCATION RECORD

INFORMATION

a. SPECIFY THE RECORDS TO BE RELEASED

b. STATE THE PURPOSE OF THE DISCLOSURE

c. IDENTIFY THE PARTY OR PARTIES TO WHOM DISCLOSURE MAY BE MADE

d. BE SIGNED AND DATED BY THE STUDENT.

1. INSTITUTIONS SHALL OBTAIN WRITTEN CONSENT FROM STUDENTS BEFORE DISCLOSING ANY PERSONALLY IDENTIFIABLE INFORMATION FROM THEIR EDUCATION RECORDS (WITH THE EXCEPTIONS AS NOTED IN SECTIONS 2 AND 3 BELOW). THE WRITTEN CONSENT MUST:

26

PROCEDURES AND STRATEGIES FOR COMPLIANCEA. DISCLOSURE OF EDUCATION RECORD

INFORMATION

a. STUDENTS WHO REQUEST THE INFORMATION FROM THEIR OWN RECORDS

2. INSTITUTIONS MUST DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

27

PROCEDURES AND STRATEGIES FOR COMPLIANCE

A. DISCLOSURE OF EDUCATION RECORD INFORMATION

a. AUTHORIZED REPRESENTATIVES OF THE FOLLOWING FOR AUDIT, EVALUATION, OR ENFORCEMENT OF FEDERAL AND STATE SUPPORTED PROGRAMS:

COMPTROLLER GENERAL OF THE UNITED STATES THE SECRETARY OF THE UNITED STATES DEPARTMENT OF EDUCATION U.S. ATTORNEY GENERAL (LAW ENFORCEMENT ONLY) STATE EDUCATIONAL AUTHORITIES

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

28

PROCEDURES AND STRATEGIES FOR COMPLIANCEA. DISCLOSURE OF EDUCATION RECORD

INFORMATION

b. PERSONNEL WITHIN THE INSTITUTION DETERMINED BY THE INSTITUTION TO HAVE A LEGITIMATE EDUCATIONAL INTEREST

c. OFFICIALS OF OTHER INSTITUTIONS IN WHICH THE STUDENT SEEKS TO ENROLL, ON CONDITION THAT THE ISSUING INSTITUTION MAKES A REASONABLE ATTEMPT TO INFORM THE STUDENT OF THE DISCLOSURE

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

29

PROCEDURES AND STRATEGIES FOR COMPLIANCE

A. DISCLOSURE OF EDUCATION RECORD INFORMATION

d. PERSONS OR ORGANIZATIONS PROVIDING TO THE STUDENT FINANCIAL AID, OR DETERMINING FINANCIAL AID DECISIONS

e. ORGANIZATIONS CONDUCTING STUDIES TO DEVELOP, VALIDATE, AND ADMINISTER PREDICTIVE TESTS, TO ADMINISTER STUDENT AID PROGRAMS, OR TO IMPROVE

INSTRUCTION

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

30

PROCEDURES AND STRATEGIES FOR COMPLIANCE

A. DISCLOSURE OF EDUCATION RECORD INFORMATION

f. ACCREDITING ORGANIZATIONS CARRYING OUT THEIR ACCREDITING FUNCTIONS

g. PARENTS OF A STUDENT WHO HAVE ESTABLISHED THAT STUDENT'S STATUS AS A DEPENDENT--IRS CODE OF 1986, SECTION 152

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

31

PROCEDURES AND STRATEGIES FOR COMPLIANCE

A. DISCLOSURE OF EDUCATION RECORD INFORMATION

h. PERSONS IN COMPLIANCE WITH A JUDICIAL ORDER OR A LAWFULLY ISSUED SUBPOENA, PROVIDED THAT THE INSTITUTION FIRST MAKE A REASONABLE ATTEMPT.TO NOTIFY THE STUDENT. EXCEPTION: IF THE SUBPOENA IS ISSUED FROM A FEDERAL GRAND JURY, OR FOR A LAW ENFORCEMENT PURPOSE, AND ORDERS THE INSTITUTION NOT TO NOTIFY THE STUDENT.

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

32

PROCEDURES AND STRATEGIES FOR COMPLIANCE

A. DISCLOSURE OF EDUCATION RECORD INFORMATION

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

i. A COURT IF THE STUDENT HAS INITIATED LEGAL ACTION AGAINST THE INSTITUTION OR THE INSTITUTION HAS INITIATED LEGAL ACTION AGAINST THE STUDENT

33

PROCEDURES AND STRATEGIES FOR COMPLIANCE

A. DISCLOSURE OF EDUCATION RECORD INFORMATION

j. PERSONS IN AN EMERGENCY, IF THE KNOWLEDGE OF INFORMATION, IN FACT, IS NECESSARY TO

PROTECT THE HEALTH OR SAFETY OF THE STUDENT OR OTHER PERSONS

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

34

PROCEDURES AND STRATEGIES FOR COMPLIANCEA. DISCLOSURE OF EDUCATION RECORD

INFORMATION

k. AN ALLEGED VICTIM OF ANY CRIME OF VIOLENCE OF THE RESULTS OF ANY INSTITUTIONAL DISCIPLINARY PROCEEDING AGAINST THE ALLEGED PERPETRATOR OF THAT CRIME WITH RESPECT TO THAT CRIME

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

35

PROCEDURES AND STRATEGIES FOR COMPLIANCEA. DISCLOSURE OF EDUCATION RECORD

INFORMATION

m. VETERANS ADMINISTRATION OFFICIALS IN RESPONSE TO REQUESTS RELATED TO VA PROGRAMS

n. REPRESENTATIVES OF THE IMMIGRATION AND NATURALIZATION SERVICE FOR PURPOSES OF THE COORDINATED INTERAGENCY PARTNERSHIP REGULATING INTERNATIONAL (CIPRIS)

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

36

PROCEDURES AND STRATEGIES FOR COMPLIANCEA. DISCLOSURE OF EDUCATION RECORD

INFORMATION

o. PARENTS OF A STUDENT UNDER THE AGE OF 21 REGARDING A VIOLATION OF ANY LAW, AT ANY LEVEL, OR INSTITUTIONAL POLICY OR RULE GOVERNING THE USE OF ALCOHOL OR A CONTROLLED SUBSTANCE

DOES NOT SUPERSEDE ANY STATE LAW THAT PROHIBITS DISCLOSURE OF THIS INFORMATION.

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

37

PROCEDURES AND STRATEGIES FOR COMPLIANCEA. DISCLOSURE OF EDUCATION RECORD

INFORMATION

p. THE PUBLIC REGARDING THE FINAL RESULTS OF AN INSTITUTIONAL DISCIPLINARY PROCEEDING AS LONG AS THE STUDENT HAS BEEN DETERMINED TO BE THE ALLEGED PERPETRATOR OF A CRIME OF VIOLENCE.OR NON-FORCIBLE SEX OFFENSE

3. INSTITUTIONS MAY DISCLOSE EDUCATION RECORDS WITHOUT WRITTEN CONSENT OF STUDENTS TO THE FOLLOWING:

38

What do the “final results”include?

Must include only: the name of the student, violation committed, and any sanction imposed by the institution against the student.

The institution may not disclose the name of any other student, including a victim or witness, without prior written consent of the other student.

39

What about Parents? When a student reaches the age of 18 or begins

attending a postsecondary institution regardless of age, FERPA rights transfer to the student.

Parents may obtain directory information only at the discretion of the institution.

Parents may obtain non-directory information (grades, gpa, etc.) only at the discretion of the institution AND after it has been determined that their child is legally their dependent.

Parents may also obtain non-directory information by obtaining a signed consent from their child.

40

PROCEDURES AND STRATEGIES FOR COMPLIANCE

B. RECORDS OF REQUESTS AND DISCLOSURES

1. ALL INSTITUTIONS ARE REQUIRED TO MAINTAIN RECORDS OF REQUESTS AND DISCLOSURES OF PERSONALLY IDENTIFIABLE INFORMATION

a. THESE RECORDS WILL INCLUDE THE NAMES AND ADDRESSES OF THE REQUESTOR AND HIS/HER INDICATED INTEREST IN THE RECORDS.

41

PROCEDURES AND STRATEGIES FOR COMPLIANCE

2. RECORDS OF REQUESTS AND DISCLOSURES DO NOT HAVE TO BE KEPT FOR:

a. REQUESTS FROM STUDENTS FOR THEIR OWN USE

b. DISCLOSURES IN RESPONSE TO WRITTEN REQUESTS FROM STUDENTS

c. REQUESTS MADE BY SCHOOL OFFICIALS

d. THOSE SPECIFIED AS DIRECTORY INFORMATION

e. WHAT'S LEFT?

42

PROCEDURES AND STRATEGIES FOR COMPLIANCE

B. RECORDS OF REQUESTS AND DISCLOSURES

3. THESE RECORDS OF REQUESTS AND DISCLOSURES ARE PART OF THE STUDENT'S EDUCATION RECORDS AND MUST BE RETAINED AS LONG AS THE EDUCATION RECORDS TO WHICH THEY REFER ARE MAINTAINED BY THE INSTITUTION.

43

KEY CONCEPTS

Required annual notification Written permission of student required to disclose The exceptions to written permission Student's right to access their records The "musts" and "mays" in FERPA Parents/parental disclosure Legitimate Educational Interest

44

KEY TERMS

Education Record Directory Information School Official Personally Identifiable Eligible Student

45

Institutional FERPA Web Sites

University of Connecticut, Office of the Registrarhttp://www.registrar.uconn.edu/ferpa.htmlNew York University, University Registrar (as part of faculty handbook)http://www.nyu.edu/registrar/13faculty.shtmlIllinois State Universityhttp://coe.ilstu.edu/portfolios/students/wjpearc/final%20project/ferpa1.htmGeorge Mason University, Office of the Registrarhttp://registrar.gmu.edu/faculty_services/http://registrar.gmu.edu/ferpafaqs.htmlUniversity of Nebraska at Omahahttp://www.ses.unomaha.edu/ppt/ferpa/

46

Institutional FERPA Web Sites

University of Nebraska at Kearney, FERPA Quiz/Tutorial For Faculty and Staffhttp://www.unk.edu/departments/registrar/home.htmlUniversity of Puget Sound, Office of the Registrarhttp://www.ups.edu/registrar/University System of Maryland, Student Information System Projecthttp://info.fmis.ums.edu/ferpaweb/

also www.aacrao.org (Resource Center)

47

Current Issues and FERPA

Faculty--->e-mail--->students Posting grades Distance Learning E-signatures/digital signatures PIN E-mail transcript requests Tracking/logging Annual notification via the web The Cyber Library Outsourcing

48

To Contact Me…

Richard A. Rainsberger, Ph.D.Director, Admissions and RecordsCentral Virginia Community College

434-832-7630

49

Current Issues and FERPA

Faculty--->e-mail--->students

See Attachment A..

50

Current Issues and FERPA

Posting grades

51

52

Current Issues and FERPA

Distance Learning

We do not change our policies simply because our educational delivery methods have changed.

53

Current Issues and FERPA

E-signatures/digital signatures

Electronic signature—”An electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.” §106 E-sign Act, 2000.

54

Current Issues and FERPA

E-signatures/digital signatures

Digital Signatures Tutorial http://www.abanet.org/scitech/ec/isc/dsg-tutorial.html

See Attachment C.

55

Current Issues and FERPA

PINIn lieu of written permission, a PIN can only be used by a student within a secure web-based system to authorize release of non-directory information to him/herself.

56

Current Issues and FERPA

E-mail transcript requests

Written permission is required. Therefore, faxed signatures are OK. A “typed” name is not.

57

Current Issues and FERPA

Tracking/logging

When do those bits and bytes become personally identifiable to a student and become subject to FERPA?

01001100001100110011110001010 010 010101 011011001

58

Current Issues and FERPA

Tracking/loggingRezmierski, Virginia and Nathaniel St. Clair, “Identifying Where Technology Logging and Monitoring for Increased Security End and Violations of Personal Privacy and Student Records Begin: A Report to the Digital Government Program of the National Science Foundation,” 2001.

59

Current Issues and FERPA

Annual notification via the web

Only if all students are required to have PCs and they have unrestricted access to the institution’s web page.

60

Current Issues and FERPA

The Cyber Library

See Attachment B.

61

Current Issues and FERPA

Outsourcing

62

Outsourcing An institution's hiring of an agent to

perform a process/task that the institution would normally perform itself on a continuing basis.

63

Subcontracting An arrangement between the college and

consultants for one-time projects.

64

By outsourcing, you are establishing an agency relationship:

Agent: An organization, company, or bureau that provides some service for another; a company having a franchise to represent another.

65

So What Does FERPA Say?

66

34 CFR 99 FERPA Regulations (Appendix 2 of AACRAO FERPA Guide)

§ 99.31 Under what conditions is priorconsent (of a student) not required to disclose information?

67

§ 99.31 Under what conditions is priorconsent not required to discloseinformation?

(a)An ... institution may disclose personally identifiable information from an education record of a student...if the disclosure meets one or more of the following conditions:

(1)The disclosure is to other school officials whom the …institution has determined to have legitimate educational interests.

68

§ 99.33 What limitations apply to the

redisclosure of information?

(a)(1) An ... institution may disclose personally identifiable information from an education record only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the student….

(e) If this Office (FPCO) determines that a third party improperly rediscloses personally identifiable information from education records ..., the ... institution may not allow that third party access to personally identifiable information from education records for at least five years.

69

§ 99.7 What must an educational … institution include in its annual notification?

(a)(3)(iii) If the ... institution has a policy of disclosing education records under §99.31(a)(1), a specification of criteria for determining who constitutes a school official and what constitutes a legitimate educational interest (must be included in the annual notification).

70

The Family Educational Rights and Privacy Act (FERPA) affords students certain rights with respect to their education records. They are….

(3) The right to consent to disclosures of personally identifiable information contained in the student's education records, except to the extent that FERPA authorizes disclosure without consent.

One exception which permits disclosure without consent is disclosure to school officials with legitimate educational interests. A school official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has a person or company with whom the University has contracted (such as an attorney, auditor, or collection agent);contracted (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks.

A school official has a legitimate educational interest if the official needs to review an education

record in order to fulfill his or her professional responsibility….

Available for download at www.ed.gov/offices/OM/fpco.html

Model Annual Notification of Rights under FERPA for Post Secondary Institutions

71

And what does LeRoy say?

“…nothing in FERPA prevents an educational institution from contracting with a person or entity outside the institution to perform services that the institution would otherwise provide for itself.”

(Letter from LeRoy Rooker to Daniel Boehmer, April 19,1993 found in McDonald, Steven J., The Family Educational Rights and Privacy Act: A Legal Compendium, NACUA, 1999, pp. 221-223.)

72

Key FERPA Terms for Outsourcing

School Officials Legitimate Educational Interest Annual FERPA Notification to Students