Part IV: How Do Third Parties Get Student Records?

Posted by Claire E. Parsons

FERPA does not outright prohibit educational agencies from disclosing student educational records containing personally identifiable information to third parties, but it does significantly restrict its disclosure.  If the sought after educational records contain personally identifiable information, the records can only be released with consent or if an exception applies.  In such cases, parties seeking records have two options: (1) obtain the written consent of the student or parent; or (2) fit within an applicable exception.  Consent is the most obvious means of obtaining student educational records and requires little explanation, but it is often not a viable option.  If consent cannot be obtained, FERPA allows schools to disclose student records to third parties when certain exceptions apply.  Though these exceptions are numerous, they are each quite narrow.  They fall into four broad categories: (1) educational and research exceptions; (2) law enforcement or judicial exceptions; and (3) emergencies.  See 34 CFR 99.31.

The educational exceptions allow schools to disclose student educational records to other supervising agencies, such as the state Department of Education.  34 CFR 99.31(a)(3).  It also allows school staff to share student educational records with each other so long as there is a legitimate educational reason for doing so.  34 CFR 99.31(a)(1).  Generally, this means that school staff can share student information if they need it to complete an administrative, supervisory, or instructional educational tasks or if they are attempting to provide a service or benefit with respect to the student’s education.  Along the same lines, student educational records can be released without consent to other schools where the student is seeking to enroll or to agencies charged with administering financial aid applications.  34 CFR 99.31(a)(2) & (4).  Similarly, FERPA also allows schools to disclose student educational records without consent for accreditation purposes or to organizations conducting official studies.  34 CFR 99.31(a)(6) & (7).  In short, disclosure of student records under FERPA is permitted to allow schools and educational agencies to educate students and perform their day to day activities.  

The other broad category of exceptions is that student records can be disclosed under FERPA without parental consent if they are requested by a law enforcement agency or if they are released pursuant to a judicial order or subpoena.  FERPA regulations explicitly allow for the release of educational records to “state and local juvenile justice systems or their officials[.]” 34 C.F.R. 99.31(a)(5); 34 CFR 99.38.  There is little regulatory guidance about the meaning of this term, and the only required conditions for the release of records to juvenile justice officials is that they must certify in writing that they will not release the records to any third parties.  34 CFR 99.38(b).

FERPA also permit educational records to be released in compliance with “a judicial order or lawfully issued subpoena.”  34 CFR 99.31(a)(9).  Usually, the subpoena or order will define the information and records that must be produced.  However, unless the subpoena states otherwise, prior to the disclosure of the records, schools are required under FERPA to make a reasonable attempt to notify the affected student or parents of the subpoena or order to given them an opportunity to take protective action, such as objecting to the request or moving to quash the subpoena.  34 CFR 99.31(a)(9).  The FPCO has not given much guidance as to what constitutes a reasonable attempt by schools to notify parents or students of the subpoena, see Letter of Finding to Youngstown University, (FPCO 2/16/99); but has made it clear that the failure to make any attempt at notification is a violation of FERPA.  Letter to Lapeer Community Schools (FPCO 9/15/2000).  For this reason, third parties seeking educational records via a subpoena should factor in additional time for the notification of the affected students and parents before they actually receive the requested records.  If parents or students object to the release of the records, it does not necessarily mean that the school must refuse to produce them.  In most jurisdictions, there is no recognized evidentiary privilege for educational records, so the court or agency from which the subpoena or order emanated will have to decide if the records must be released.  See, e.g., Edmonds v. Detroit Pub. Sch. Sys., 2012 U.S. Dist. LEXIS 164503 (E.D. Mich. Nov. 19, 2012) (ordering release of educational records because they were relevant to claims asserted in litigation).

Finally, FERPA allows schools to disclose student records to “appropriate persons” without parental consent in the case of a health or safety emergency.  34 CFR 99.36.  For obvious reasons, this exception is left relatively undefined.  It does not specify to whom educational records may be released and it does not provide examples of the circumstances which constitute “emergencies.”  The regulations do make clear, however, that the release of student records without consent is permitted if it is necessary to protect the safety of the student or other individuals which might be averted by the release of the records.  Id.  This does not allow the release of records merely if there is a generalized concern for the “public health,” but only if there is an “articulable and significant” threat, such as the threat of significant bodily harm, to the student or to others.  34 CFR 99.36(c); see also 73 Fed. Reg. 74.838 (2008).

In sum, FERPA allows schools to release student educational records without consent, but only insofar as the release is necessary to achieve specific purposes.  All of the exceptions to the release of records are narrowly drawn in order to ensure that the privacy of students is maintained.