U.S. Proposes New Rules on Student Privacy

The federal law designed to protect the privacy of students' educational records has been under scrutiny and stress from a variety of angles in recent years, most recently from those concerned (in the wake of last year's shootings at Virginia Tech) about whether the Family Educational Rights and Privacy Act gives college officials sufficient latitude to report their fears about mentally ill students.

Responding to the issues raised by Virginia Tech, by laws like the Patriot Act, and by several recent court decisions, the U.S. Education Department today proposed new regulations to govern the educational privacy law known as FERPA, which restricts disclosures by educational institutions from a student’s records.

As is typical when federal agencies propose new rules to update existing laws or programs, the department’s guidelines for FERPA, which appear in today’s Federal Register, appear to contain nothing in the way of stunning surprises or radical departures from the important law as it has been understood by campus officials. But the regulations proposed by the Education Department suggest several important updates, changes and clarifications to the law since the regulations were last significantly updated, in 2000.

Perhaps foremost among them, as the anniversary of the April 16 shootings at Virginia Tech approaches, is an attempt to give educational administrators more latitude in sharing information about a student (without getting that student’s prior approval) when they believe the health and safety of that student or others may be in jeopardy. A federal report in the wake of Virginia Tech found consistent “confusion and differing interpretations” about when it was appropriate for college instructors or administrators to provide information about students they suspected might pose harm to themselves or others, and what kind of liability the campus officials might face if they were later found to have violated FERPA by revealing that information.

Although legal experts (on Inside Higher Ed and elsewhere) and Education Department officials have argued that the law already provides significant flexibility and protections for such disclosures, the department’s new proposed regulations aim to “provide a new standard” for when campus officials can release information under the “health and safety” exception.

Under the proposed change, the department explains in its publication today, “the Secretary requires that, considering the totality of the circumstances, there must be an articulable and significant threat [emphasis added] to the health or safety of a student or other individuals, and that the disclosure be to any person whose knowledge of the information is necessary to protect against the threat.

“On the other hand,” the proposed regulation continues, “the Secretary has determined that greater flexibility and deference should be afforded to administrators so they can bring appropriate resources to bear on a circumstance that threatens the health or safety of individuals. To provide for appropriate flexibility and deference, the Secretary has determined that if, based on the information available at the time of the determination, there is a rational basis [emphasis added] for the determination, the Department will not substitute its judgment for that of the educational agency or institution in evaluating the circumstances and making its determination.”

In other words, the department aims to clarify the legal standard a campus official must meet in deciding to release information (assuring that there is an “articulable and significant threat” to the health and safety of individuals), but also offering assurance that college officials will be less likely to be second guessed later for having released the information as long as they can show they had a “rational basis” for their original decision.

Steven McDonald, general counsel at the Rhode Island School of Design, who closely monitors developments related to the educational privacy law, said the department had signaled to colleges in guidance as early as 2004 that it would not second guess decisions they made to release information related to students' health and safety. But the current language in the FERPA regulations "clearly was frightening" to many campus officials," because it "made it sound like you had to be absolutely sure before you relied on that exception. The proposed new language, McDonald said, makes it crystal clear that "you're not going to get in trouble for a good faith decision made in the heat of the moment before all facts are known."

"This is a very positive and important statement that provides a significant safety net for college administrators who have been inappropriately concerned about a narrow interpretation of emergency conditions" under the law, said Sheldon E. Steinbach, a lawyer with the Washington firm of Dow Lohnes. "These regulations hopefully will be heeded by administrators at all levels so as to understand that at the end of the day, the welfare of the student and the student body and the community is what is paramount, and not restricting access to vital information out of a fear of potential penalty that does not exist.”

Following are some other changes that the proposed rules would make:

• To conform FERPA with the requirements of the USA Patriot Act, the proposed rules would make clear that educational institutions must disclose education records to the attorney general in response to an ex parte court order as part of an investigation or prosecution related to potential terrorism.
• To conform FERPA with the requirements of the Campus Sex Crimes Prevention Act, enacted in 2000, the new regulations would permit campus officials to release information they received from a state community notification program about a student registered as a sex offender.
• The proposed rules would extend to contractors, consultants and others who work with a college or school the exception that allows educational institutions to disclose personally identifiable information about a student to school officials who have "legitimate educational interests in the information."
• The rules would allow a school or college to share information about a student without his or her consent with officials at another institution in which the student has already enrolled.
• The department, citing concerns that "some institutions are under the mistaken impression that FERPA prevents them from providing parents with any information about a college student," aims to clarify in the proposed regulations that current laws and rules allow colleges to make information available to parents of financially dependent students without their consent, and to any student (even if not he or she is not financially dependent on the parents) under several exceptions to the law.
• Reflecting changing technology, the rules would clarify that students who study online or otherwise are not physically present in the classroom are covered by FERPA. (Existing regulations extend the law to students studying via correspondence, but do not address those who are taught by electronic means.)
• The regulations would clarify that educational institutions can provide personally identifiable information to state auditors without prior consent without violating FERPA.
• The new rules would provide "objective standards" about when colleges and schools can release education records and other information without the consent of students when they have removed all "personally identifiable information." The regulations, as proposed, would seem to allow for the release of significantly more information that has been redacted, as long as it is not seen as targeted to identify an individual student or does not, in combination with other information that might be requested, allow for students to be identified by name.
• The proposed regulations would bar a college or school from requiring a victim of an alleged sexual offense to agree not to disclose information he or she receives from the institution about the alleged perpetrator as part of a campus disciplinary proceeding. "Some postsecondary institutions have required the accuser to execute a non-disclosure agreement before they disclose the outcome of a disciplinary proceeding for an alleged sexual offense as required under the [Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act]," the department says in its guidance published today. "The proposed regulations would clarify that postsecondary institutions may not require the accuser to execute a non-disclosure agreement or otherwise interfere with the redisclosure or other use of information disclosed as required under the Clery Act."
• The rules make clear that, as suggested by a 2002 Supreme Court decision in a case involving Gonzaga University, the department has the authority to investigate possible violations of FERPA even if a complaint by a parent has been withdrawn or no complaint has ever been filed. "[T]he department needs to establish in its regulations that the Office may investigate allegations of non-compliance provided by a school official or some other party who is not a parent or eligiblestudent because sometimes parents and students are not aware of an ongoing FERPA problem that needs to be addressed."

"This is a pretty significant update of FERPA regulations," said Barmak Nassirian, associate executive director of the American Association of Collegiate Registrars and Admissions Officers. "I'm impressed. It's very thoughtful."

The department invites comments on the proposed rules by May 8, and offers instructions on how to submit them in the publication in today's Federal Register .