Family Educational Rights and Privacy Act (FERPA) ResourcesThe MACRAO Registrars Practices Committee regularly reviews the requirements of the federal Family Educational Rights and Privacy Act (FERPA) and makes recommendations for best practices to MACRAO members. These guidelines are based on the work of the American Association of Collegiate Registrars and Admissions Officers (AACRAO) and are endorsed by the committee. AACRAO's website includes additional information on the subject and is highly recommended. The following information is not intended to be legal advice; please refer to your institution's legal counsel for specific advice regarding FERPA requirements and implementation. What is FERPA?The Family Educational Rights and Privacy Act of 1974, was established to protect the rights of students and to ensure the privacy and accuracy of education records. The Act applies to all educational institutions that are recipients of federal funding. Who is protected under FERPA?FERPA protects the education records of students who are currently enrolled or formerly enrolled regardless of their age or status with regard to parental dependency. The education records of students who have applied to but have not attended an institution are not subject to FERPA guidelines, nor are deceased students. What are "educational records?"Any record which contains information that is personally identifiable to a student and is maintained by the institution or by a party acting for the institution. Education records include any records in whatever medium (e.g. handwriting, print, tapes, film, microfilm, microfiche, any form of electronic data storage including emails) that are in the possession of any school official. This includes transcripts or other records obtained from a school in which a student was previously enrolled. What is not considered to be an educational record?
Do students have the right to inspect and review their education records?Students have the right to see everything in their “education record,” except:
FERPA does not prescribe what records are created or how long they are to be kept; however, institutions cannot destroy a record if there is a request to inspect and review. What is “personally identifiable” information?“Personally identifiable” includes more than just a student’s name; it includes a “personal identifier” such as a social security number. FERPA provides the following guidelines to determine what is personally identifiable.
What constitutes “legitimate educational interest?”The demonstrated “need to know” by those officials of an institution who act in the student’s educational interest, including faculty, administration, clerical and professional employees, and other persons who manage student record information including student employees or agents. What is directory information?Data elements that are generally not considered harmful or an invasion of privacy if publicly available. Every student must be given the opportunity to have directory information suppressed from public release. Institutions may disclose what it has defined as directory information on a student without violating FERPA. Common examples include: name, address, email address, telephone number, date and place of birth, photograph, academic programs of study, enrollment status, dates of attendance, class or level, participation in officially recognized activities and sports, weight and height of members of athletic teams, degrees, honors, and awards received, and the most recent educational agency or institution attended. Directory information cannot include: race, gender, SSN (or part of a SSN), grades, GPA, country of citizenship, or religion. A student ID number can be considered directory information only if it cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity, such as a personal identification number (PIN), password, or other factor known or possessed only by the authorized user. MACRAO recommends institutions discuss their definitions of directory information with their legal counsel. When do you need consent to disclose non-directory information from an education record (including transcripts)?A student must provide written consent before an institution may disclose personally identifiable information from their education records (except as otherwise allowed under FERPA). Such written consent must:
When must an institution disclose information without a student’s written consent?When the disclosure is to:
When may an institution disclose information without a student’s consent?When the disclosure is (one or more of the following):
What is required for annual notification?Institutions must provide annual notification to students of their rights to:
Institutions must also notify students annually of the following:
Additional InformationIf you still have questions, please contact: Family Policy Compliance Office Additional information regarding FERPA regulations and history can also be found at the following link:
Updated 10/15/2021. |