As the school year begins it is important to remind, and perhaps inform for the first time, employees and school districts of their responsibilities under the Family Educational Rights and Privacy Act (FERPA). This becomes even more important as many employees use social media to post pictures and other information about their students.
I. The District must annually inform parents and eligible students of their rights under FERPA.
FERPA requires the District to “effectively inform” parents or eligible students of their rights under FERPA. See 20 U.S.C. 1232g(e). In this regard, the District must “annually” notify parents or eligible students of the following rights (34 C.F.R. 99.7(a)):
i. To inspect and review the student=s education records;
ii. To seek amendment of the student=s education records that the parent or eligible student believes to be inaccurate, misleading, or otherwise in violation of the student=s privacy rights;
iii. To consent to the disclosure of personally identifiable information contained in the student=s education records, except to the extent disclosure may occur without consent; and
iv. To file a complaint with the U.S. Department of Education regarding the District’s alleged failure to comply with FERPA.
The District’s annual notification must also include the following:
i. The procedure by which the parent or eligible student can exercise his/her right to inspect and review the student=s education records;
ii. The procedure for requesting an amendment of the student=s education records; and
iii. The criteria for determining which District employees are permitted to inspect student education records, and what constitutes a legitimate educational interest to permit inspection by the District’s employees.
The annual notice can be provided “by any means that are reasonably likely to inform” the parents or eligible students. 34 C.F.R. 99.7(b). But what those “means” are is not made clear by FERPA. The notification can arguably be achieved by publishing it in any of the following: “in a schedule of classes; in a student handbook; in a calendar of school events; on the school’s website (though this should not be the exclusive means of notification); in the student newspaper; and/or posted in a central location at the school or various locations throughout the school.” See https://www2.ed.gov/policy/gen/guid/fpco/ferpa/students.html.
The best way to comply is to issue an annual Notification of Rights Under FERPA to parents or eligible students at the beginning of each school year. The District should contact its legal counsel if it does not currently have or issue one.
II. To legally disclose directory information, the District must give “public notice” to parents and eligible students.
Directory information is an exception to FERPA’s general prohibition against disclosure of personally identifiable information from education records without the parents’ or eligible student’s written consent. Directory information is generally not considered harmful or an invasion of privacy if disclosed, and includes the following: the student’s name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended by the student. 20 U.S.C. 1232g(a)(5)(A).
To legally disclose directory information, the District must first give “public notice to parents of students in attendance and eligible students in attendance” about all the following (see 34 C.F.R. 99.37(a)):
(a) The types of personally identifiable information the District has designated as directory information;
(b) A parent’s or eligible student’s right to refuse to let the District designate any or all of those types of information about the student as directory information; and
(c) The period of time within which a parent or eligible student must notify the District in writing that he or she does not want any or all of those types of information about the student designated as directory information.
FERPA does not provide further guidance about what constitutes “public notice” or how often such “public notice” must be made. Typically, “public notice” is provided with the annual notification of rights under FERPA. Thus, the District should send a Directory Information Notice at the beginning of each school year together with the Notification of Rights Under FERPA. The District should contact its legal counsel if it does not have a Directory Information Notice.
III. The District can limit what it designates as directory information. It can also limit the scope of disclosure of directory information to specific parties, for specific purposes, or both.
Through its Directory Information Notice, the District can limit what it designates as directory information. Designating some items as directory information permits the District to lawfully publish directory information in yearbooks, recognition lists, graduation programs, sports activity sheets, on its website, etc. At the same time, it limits disclosure of directory information that can be used for unwanted purposes, such as recruitment of students by other schools. Care should be taken to ensure that the District is not disclosing information which it has not designated as directory information.
Moreover, through its Directory Information Notice, the District can limit the scope of disclosure of directory information to specific parties, for specific purposes, or both. But if the District provides such limitations, it must limit its directory information disclosures to those specified in the public notice. 34 C.F.R. 99.37. If the District wishes to do any of the above, it should contact its legal counsel.
IV. The District should consider creating a social media policy.
Given that many employees use social media to post pictures and other information about their students, the District should consider creating a social media policy (if it does not already have one). This is important for several reasons. For example, depending on the content of the post, and whether a student opted out of directory information, a post about a student may violate his or her FERPA rights. Moreover, if the post documents the organization, functions, policies, decisions, procedures, operations, or other activities of the District, it may be considered a public record. Likewise, a post might contain real-time information about the location of a current or future student activity, which is not otherwise open to the general public. Such posts create security concerns for the District and parents alike. Given the increase in use of social media to post about students, it is recommended the District consider drafting a social media policy. The District should contact its legal counsel if it does not currently have one.