The Family Educational Rights and Privacy Act is a federal statute about which most students know very little, despite dealing with it on a regular basis. The law prohibits the disclosure of certain "personally identifiable information" pertaining to academic records without the written consent of a parent or student older than 18 years of age.
Students generally encounter the law when granting certain individuals or entities consent to access their academic records. Moreover, individual schools are required to remind students and parents annually of the rights FERPA grants them. The Department of Education, however, is threatening to undermine this principle of consent by pressing ahead with several proposed changes to the law despite making little effort to inform students.
The department's proposal would make it possible for state agencies to gain access to students' personally identifiable information without their knowledge. The ostensible rationale behind this revision is to ease restrictions on states seeking to compile information for the purpose of conducting audits and evaluations into their educational systems. Federal officials hope that by making such reviews easier to undertake, the quality and consistency of public education will be improved.
Additionally, they have pointed out that state agencies only will have access to what is known as "directory information," which is defined in current federal regulations as "information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed." Included within that categorization are a student's name, address, telephone listing, email address, photograph and major. Another proposed alteration to the law would add a student's ID number to the list.
Some of this information is publicly available already, and it is unlikely disclosure would lead to serious embarrassment or safety concerns for most students. The problem with the department's proposal, though, is that it has not been advertised to the students it will affect. The public comment window that runs until May 23 at least offers a period of delay before the proposal takes effect, but it is not sufficient for ensuring students are fully informed. Instead, the department must reach out to students and convey the potential implications of the changes before they are implemented.
This is particularly important given the gray areas that exist within the proposal's language. For example, state agencies are not the only entities that would receive access to directory information. Rather, that privilege would extend to any group deemed an "authorized representative" by the state. The current proposal establishes no strict standard for determining who would qualify as an authorized representative beyond requiring that state officials "use reasonable methods to ensure that any entity designated as its authorized representative remains compliant with FERPA."
Therefore, this leaves open the possibility state authorities could take advantage of the law to disclose personal student information to groups with their own political, religious or commercial agendas. Assoc. University Registrar Jonathan Helm said in an email that he "would hope that reasonable justification would be provided for records requests." But students should recall the disdain for such "reasonable justification" that has been shown by Virginia Attorney General and University alumnus Ken Cuccinelli in his pursuit of University records related to a professor's climate change research.
Ultimately, the proposed revisions could prove to be beneficial for the purposes of accountability and efficiency in state monitoring of educational programs. Yet these potential gains do not justify disregard for the right to consent that the FERPA law is meant to uphold. Before moving ahead, the department should engage students about the subject of privacy and clarify the uncertain nature of several of its proposed revisions.