Under FERPA, a school may not generally disclose personally identifiable information from an eligible student´s education records to a third party unless the eligible student has provided written consent. However, there are a number of exceptions to FERPA´s prohibition against non-consensual disclosure of personally identifiable information from education records. Under these exceptions, schools are permitted to disclose personally identifiable information from education records without consent, though they are not required to do so. Following is general information regarding some of these exceptions.
One of the exceptions to the prior written consent requirement in FERPA allows "school officials," including teachers, within a school to obtain access to personally identifiable information contained in education records provided the school has determined that they have "legitimate educational interest" in the information. Although the term "school official" is not defined in the statute or regulations, this Office generally interprets the term to include parties such as: professors; instructors; administrators; health staff; counselors; attorneys; clerical staff; trustees; members of committees and disciplinary boards; and a contractor, volunteer or other party to whom the school has outsourced institutional services or functions.
A school must inform eligible students of how it defines the terms "school official" and "legitimate educational interest" in its annual notification of FERPA rights. A school official generally has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility. Additional information about the annual notification of rights is found below in this guidance document.
Another exception permits a school to disclose personally identifiable information from an eligible student´s education records, without consent, to another school in which the student seeks or intends to enroll. The sending school may make the disclosure if it has included in its annual notification of rights a statement that it forwards education records in such circumstances. Otherwise, the sending school must make a reasonable attempt to notify the student in advance of making the disclosure, unless the student has initiated the disclosure. The school must also provide an eligible student with a copy of the records that were released if requested by the student.
FERPA also permits a school to disclose personally identifiable information from education records without consent when the disclosure is in connection with financial aid for which the student has applied or which the student has received, if the information is necessary for such purposes as to: determine the eligibility for the aid; determine the amount of the aid; determine the conditions for the aid; and/or enforce the terms and conditions of the aid. With respect to this exception, the term "financial aid" means payment of funds provided to an individual (or payment in kind of tangible or intangible property to the individual) that is conditioned on the individual´s attendance at a school.
Another exception permits a school to disclose personally identifiable information from education records without consent when the disclosure is to the parents of a "dependent student" as that term is defined in Section 152 of the Internal Revenue Code. Generally, if either parent has claimed the student as a dependent on the parent´s most recent year´s income tax statement, the school may non-consensually disclose the eligible student´s education records to both parents under this exception.
Postsecondary institutions may also disclose personally identifiable information from education records, without consent, to appropriate parties, including parents of an eligible student, in connection with a health or safety emergency. Under this provision, colleges and universities may notify parents when there is a health or safety emergency involving their son or daughter, even if the parents do not claim the student as a dependent.
FERPA also permits a school to disclose personally identifiable information from education records without consent when the disclosure is to the parents of a student at a postsecondary institution regarding the student´s violation of any Federal, State, or local law, or of any rule or policy of the institution, governing the use or possession of alcohol or a controlled substance. The school may non-consensually disclose information under this exception if the school determines that the student has committed a disciplinary violation with respect to that use or possession and the student is under 21 years of age at the time of the disclosure to the parent.
Another exception permits a school to non-consensually disclose personally identifiable information from a student´s education records when such information hasbeen appropriately designated as directory information. "Directory information" is defined as information contained in the education records of a student that would not generally be considered harmful or an invasion of privacy if disclosed. Directory information could include information such as the student´s name, address, e-mail address, telephone listing, photograph, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, the most recent previous educational agency or institution attended, grade level or year (such as freshman or junior), and enrollment status (undergraduate or graduate; full-time or part-time).
A school may disclose directory information without consent if it has given public notice of the types of information it has designated as directory information, the eligible student´s right to restrict the disclosure of such information, and the period of time within which an eligible student has to notify the school that he or she does not want any or all of those types of information designated as directory information. Also, FERPA does not require a school to notify eligible students individually of the types of information it has designated as directory information. Rather, the school may provide this notice by any means likely to inform eligible students of the types of information it has designated as directory information.
There are several other exceptions to FERPA´s prohibition against non-consensual disclosure of personally identifiable information from education records, some ofwhich are briefly mentioned below. Under certain conditions (specified in the FERPA regulations), a school may non-consensually disclose personally identifiable information from education records: