Student Records and Privacy – What Faculty and Staff Need to Know

Kris Kaplan
Assistant General Counsel
Minnesota State Colleges and Universities
Office of the Chancellor
Bemidji State University
January 2005
************************

It’s the Law

*The federal Family Educational Rights and Privacy Act (FERPA) and Minnesota Government Data Practices Act (MGDPA) govern how state universities handle data on individually identifiable students, i.e., "education data/records."

*All university employees are responsible to protect the privacy of education records in their possession.

*Willful violations may result in institutional liability or individual sanctions.

It’s the Right Thing to Do

*Respecting Student Privacy

*Demonstrates integrity

*Sensitivity to students as individuals and their rights

*Instills confidence

What is an Education Record?

*Broader than you may think:
--All information created, collected, maintained or disseminated by university on individually identifiable student(s)
--in any tangible form or media
--wherever located.

*Examples: enrollment records, (including internships, study abroad), grades, schedules, electronic document or e-mail, class list, financial aid information, application information, photos, notes taken during advising session, discipline, work study records and more . . .

What’s Not an Education Record?

*Several exceptions in law:
--Sole possession notes of instructor, so long as not shared with anyone other than a substitute instructor, and destroyed at end of term.
--Medical treatment records of university health care professionals so long as not shared with others not providing treatment.
--Solely personal information or observations not recorded or derived from education record.

Other laws may apply – and always: common sense(itivity).

Education Records are Presumed Private

*Private generally means:

--Access by student subject (10 days)
--Access by "school officials" who have "legitimate educational interest"
--Access by third parties if signed, written consent of student or other legal authority

Who?

*"School officials" include employees, agents of the university, student workers and others who need data to perform assigned university work, i.e., have a "legitimate educational interest."

*Third parties include: parents, union, media, spouses, potential employers, law enforcement, other schools, other students – and "others".

Directory Data is Public

*Directory Data is defined at BSU:
--Name; address; e-mail address; phone #
--Major and minor fields of study
--FT, PT status
--Student classification (sophomore, junior, etc.)
--Dates of attendance and graduation
--Participation in official activities, sports
--Degrees, awards, academic recognition and licenses received; associated names of parents

*Public data must be released upon request, but procedures are important.

Some Data is Always Private

*Directory information NEVER includes:
--SSN; Student ID Number
--Race, ethnicity, nationality, religion
--Gender
--GPA

*Remember default rule: if not public, is private.

Student Rights

*Access to education records on self (unless previously waived)

*To seek amendment of inaccurate, incomplete records

*To control disclosure, as permitted by law

*To file complaint with Department of Education

*All university students have same rights regardless of age.

Student Rights to Control Disclosure

*May suppress directory data (includes classroom).

*Prior notice of compliance with subpoena (usually).

*Most disclosures to third parties require signed release that specifies information to be released, to whom, and for what purpose.

*Waiver of rights must be voluntary.

Third Party Disclosure Without Student’s Consent

*Permitted examples:
--Court order
--Health, safety emergency (narrow exception)
--Other schools where student intends to enroll or is enrolled
--USCIS for certain international student information
--Military recruiters for certain information
--Other . . .

Faculty and Staff Responsibilities
*Access/use education records only for legitimate educational purpose; i.e., "need-to-know." Not curiosity.

*Do not release any information from education records (including class schedules) unless:
--Directory data, not suppressed
--Written consent of student
--Other legal authority, as determined by designated college personnel

"Tennessen Notice/Warning"

*When collecting private data, inform:
--Why collecting – how used;
--Who will have access;
--Whether legally required to provide;
--Consequences of providing or not.
--Goal is informed consent – need not be written, but easiest on forms. Don’t forget electronic collection.

*Tip: don’t ask for private data (especially SSNs) unless required.

*Know campus resources
--DPCO: David Carlson
--Directory data definition, how to check for suppression (see registrar)
--Refer public requests to Communications/Public Affairs
--Consult with and follow IT staff policies on privacy, security of electronic data.
http://www.ogc.mnscu.edu/

Privacy Practices

*Don’t:
--Use any portion of SSN or student ID to post grades or other information;
--Allow access to graded materials by students other than subject;
--Improperly disclose information derived from private education records (including oral disclosures);
--Allow public view of student data on computer screen;
--Allow family members to use college computer resources;
--Disclose class lists or schedules unless authorized;
--Download unauthorized software or circumvent other privacy or security measures for electronic resources.

*But DO know who to call for help – or refer.

Test Your FERPA IQ

How would you handle the following situations?

*Parent comes to business office to pay child’s tuition and wants to know the balance.

*Parent asks whether child has been in class since last week.

*Parent calls supervisor or student worker and wants to know why she isn’t at work.

*Media requests information about former student who just won local election.

*What if request is only for "personal opinions" – not grades?

*Newspaper requests graduation rate of Hispanic students from St. Paul.

*Police officers demand student’s class schedule to serve arrest warrant.

*For criminal investigation, law enforcement asks for list of students in Computer Language class.
--Would it matter if she provided a subpoena?
--What if the request came from campus security?

*Faculty passes around class list and asks students to provide e-mail address for class communication.
--Ok to share with other students?
--Ok for instructor to communicate with students by e-mail?

*Instructor gives Registrar’s Office list of students in her "Advanced Programming" course and asks for their grades in "Beginning Programming."

*Expanding computer company wants names and addresses of all female computer science majors for their affirmative action recruiting.

*Student requests copy of transcript of school from which he transferred last spring.

*Student requests review of admissions file, including letters of reference.

*Faculty advisor for Spanish Club ask Registrar for names of all students enrolled in Spanish I.
--Spanish majors?
--Hispanic students?

*HS counselor requests grades of PSEO students from his school.

*Parent requests grades of 17 year-old son attending as PSEO student.

*Staff reports seeing students fighting in hallway. He was interviewed for Conduct Code proceeding and wants to know outcome. What if complainant was student?

*May a department share class lists and point out troublesome students to each other?

*Faculty requests information from financial aid on students who have defaulted on loans?

*Faculty requests list from Registrar of students who are on academic probation?

*Credit card company asks for list of names of all business major students.
--List of all students enrolled in Accounting 202?
--List of all Computer Science majors with GPA of 3.7 or higher?

*Student calls over semester break to request grades. E-mail?

*Employer calls to request grades of employee who is student – employer is paying tuition.

*Student asks instructor for employment reference – FERPA issues?
--Would it matter if request is in writing?
--Naming faculty on application form?
--by phone? By FAX? By e-mail?
--Can you require waiver of ability to review?
--If your only knowledge about the student comes from extra-curricular activities, is FERPA a concern?

*Student asks for her mid-term exam so she can see what she needs to focus on for the final. Instructor refuses because she re-uses exam questions and doesn’t want copies in circulation. Correct?
--What if student wants copies of instructor’s notes re: classroom participation?

*Colleague asks you about performance of student last year in Calculus I – colleague says student is struggling in her Calculus II class. Luckily, you have saved your notes and provide them to your colleague, since you no longer need them. Student now demands to see them – you refuse.

*Instructor asks disability services for medical update on student who seems to be having more difficulty with speech.

*Instructor asks counseling services to verify student attended appointment last week (missing mid-term).

*Parent needs explanation of health service charge for insurance coverage.


*Football coach calls instructors to request mid-term grades of student athletes.

*Football coach holds press conference to announce disciplinary action against two well-known players and results of knee surgery on quarterback.

*You would like to begin to submit all your students’ essays to a plagiarism detection program – others in your department question whether this violates FERPA?

Responding to Requests for Private Data

"I’m sorry but that information is private under the law. If you would like further information about how to access student information, or to obtain a release form, please contact --."

Advanced Issue: If student not enrolled or has suppressed: "I have no information on that individual." Use same response to avoid inadvertent disclosure of student status.