Cybersecurity & Data Privacy Law Blog

As we’ve discussed in previous posts, the federal government and states are introducing bills that touch data and personal information. Lawmakers across the country are proposing legislation that touch on areas beyond employment law. While we focus primarily on employee privacy here, it is helpful to remember that students have privacy rights as well. Sometimes it is useful to explore privacy in a different arena, to reiterate the principles that prudent employers should adhere to in their own industry.

Even more, students are more in tune with their data and their privacy than ever before. When these students enter the workforce, they will be better equipped to understand their rights relating to their employee files and data on company equipment.

This blog is a high-level overview of student privacy. The law that governs student privacy, is called FERPA. This stands for the Family Educational Rights and Privacy Act. This statute covers institutions (elementary schools, secondary schools, postsecondary schools) that receive federal funding. This is the law that gives students the control over the disclosure and access to their Education Records.

What is an Education Record?

Education Records are all records that are directly related to the student and maintained by the school or by a party on behalf of the school. This includes records relating to financial aid and disciplinary records.

NOTE: There are exceptions to this definition, namely, (1) campus police records, (2) employment records (when the student is not employed by the university), (3) treatment/health records, (4) applicant records, (5) alumni records, and (6) grades on peer-graded papers.

Directory Information

FERPA provides universities with some wiggle room, and it comes in the form of “Directory Information.” The statute allows institutions to create their own definition of “Directory Information.” This is information that would not generally be considered an invasion of privacy or harmful if disclosed. However, there is a built-in protection for students- although it is not that strong. The law requires the University to provide students with an opportunity to either (1) opt-out or (2) block the release of the information.

Opt-Out vs. Opt-In.

Real Quick: "Opt-out” is a fairly easy way for entities to get the access to the data. It would be more student-friendly to have an “opt-in” measure instead of “opt-out.”

• Opt-In requires an affirmative action by the user to indicate the choice they agree to the release of the information to third parties.
• Opt-Out means that the individual’s lack of action indicates their choice to release information to third parties.

As you can imagine, most individuals (students or otherwise) click through these “opt-in” and “opt-out” choices without thinking or acting, leaving them without the protection of opting out.

What About High School Students?

Remember, that FERPA applies to schools that receive federal funding. So, it does not apply to private high schools. For students in public school, the parents hold the rights under FERPA, while the student is under the age of 18. When the student turns 18, then the rights transfer from the parents to the student. With that being said, students may execute a written consent form granting their parents permission to view the educational records. We’ll discuss valid consent a bit further down…

What About Students in College?

Every single student in college holds their own rights under FERPA, regardless of age. However, students can execute a written consent to allow their parents to view their educational records.

VALID CONSENT. Under FERPA, a valid consent is one that is signed, written and dated. It also identifies (1) the record to be disclosed, (2) the purpose of the disclosure and (3) to whom the disclosure is being made.

What Rights to Students Do Have Under FERPA?

• Access. This statute provides students the right to access and review the Educational Records. Once an entity receives a request, the institution has 45 days to respond to this request.
• Correction. Students can request corrections to their educational records.
• Enforcement. Students and their families can file complaints with the Department of Education to enforce their rights under FERPA.

Limits to Student’s Rights Under FERPA.

Students do not have unlimited access to all records. For instance, students do NOT have the right to: (1) inspect financial records of parents, (2) review confidential letters of recommendation, (3) access treatment records, (4) access records that are attorney-client privilege.

*This blog is part of an ongoing series on privacy. Flaster Greenberg has a great team of privacy and cybersecurity attorneys ready to assist you and your company’s needs.