The Federal Family Educational Rights and Privacy Act of 1974, known as "FERPA," (20 U.S.C. § 1232g; 34 C.F.R. Part 99) governs access to student education records maintained by educational institutions, including those of the University of Wisconsin System. FERPA's purpose is to protect the privacy of students’ education records and to ensure that students have access to their own records. Under FERPA, the presumption is that a student's records are private and not available to the public without the consent of the student. UW System employees responding to requests for student information must be aware of the unique, protected status of such information. Employees must not provide requested information unless the student consents to the release, or the information falls within a specific FERPA provision permitting release without consent. Thus, FERPA analysis is the converse of the usual approach under the Wisconsin Public Records Law which presumes records to be open.

To Whom Does FERPA Apply?

FERPA applies to “eligible students.”  An eligible student is any individual who has been or is “in attendance” at an institution of post-secondary education at any time and about whom the institution maintains records.  “In attendance” can include correspondence courses and on-line courses.  The age of the student is irrelevant under FERPA.

What Records are Covered by FERPA?

FERPA protects from disclosure "education records," broadly defined to include all records directly related to a student and maintained by an educational institution or someone acting on its behalf (e.g., contractors). Records can be in any format, including email messages, other computer records, videos, etc.

However, the definition excludes, among other records:

  • campus law enforcement records (if certain criteria are met);
  • certain notes made by employees for their own personal use;
  • certain employment records;
  • certain medical treatment records; and
  • alumni records containing information obtained after a student's graduation.

NOTE:  “Education records” does not include information obtained through personal observation.

Who Has Access to Education Records?

Generally, there are four categories of individuals who can obtain access to education records in the manner defined under FERPA:

  1. Students
  2. Parents of Students
  3. School Officials
  4. Others

How is Access Obtained?

  • Students.  Students may have access to their own education records with few exceptions, including parental financial information, confidential letters of recommendation, and portions of their own education records containing information about other students.

  • Parents.  Parents generally have no automatic right of access to the education records of their children.  However, access can be obtained in the following ways:

    • With the consent of their child (see below);
    • If the child is identified as a dependant on the parents’ tax return;
    • If there is a health and safety emergency involving their child;
    • If their child has been found responsible for a drug or alcohol violation through the campus disciplinary proceedings.

  • School Officials.  School officials who have a legitimate educational need to access students’ records may do so.

  • Others.  Members of the public, employees of certain agencies, court officials and others may access education records when the following circumstances apply:

    • The student has given consent (see below);
    • The information has been designated directory information (see below);
    • A health or safety emergency is involved;
    • If the individual is a victim of certain types of violent offenses, s/he may obtain certain information;
    • The recipient is an employee of an institution to which the student is seeking or has transferred;
    • The final results of a disciplinary proceeding involving a crime of violence or non-forcible sex offense, under certain circumstances;
    • Organizations conducting studies on behalf of the institution (if certain criteria are met);
    • To comply with a subpoena or court order;
    • For audit and evaluation by certain state and local officials.

NOTE: FERPA permits, but does not require, these disclosures. When disclosure is contemplated under these provisions of FERPA, it may be appropriate to consult with counsel to apply the balancing and notification requirements of the Wisconsin Public Records Law.

What Does it Mean for a Student to Consent?

A student's valid consent means an informed, written consent which:

  • specifies the record(s) to be disclosed;
  • states the reason for disclosing the records; and
  • identifies the person(s) to whom disclosure may be made.

What is “Directory Information”?

“Directory information” is personally-identifiable student information which the U.S. Department of Education has concluded is permissible for institutions to release without a student’s consent. Such information may include the students’:

  • Name
  • Address
  • Telephone number
  • Date and place of birth
  • Major field of study
  • Dates of attendance
  • Grade level
  • Enrollment status
  • Participation in activities and sports
  • Weight and height of athletes
  • Degrees, honors, awards
  • Most recent education institution(s) attended
  • Photograph

Note:  Directory information may never include social security number.

What Must an Institution Do Under FERPA?

Annual Notice. Annually, the institution must advise students of:

  • Right to inspect and review their own records;
  • Right to seek amendment of their records;
  • Right to consent to disclosure;
  • Right to file a complaint with the Department of Education;
  • Right to opt out of directory information (provide a definition of directory information);
  • Definition of school officials and legitimate educational interest;
  • Records transfer policy.

Record of Disclosures. As part of the education record of each student, each institution must maintain a record of disclosures which contains the following information:

  • The names of all individuals, agencies, or organizations that have requested, or obtained, access to the student's records and the legitimate educational interest of those accessing the information; and
  • Any disclosures that are made under the health and safety emergency exception, the circumstances surrounding that decision to disclose and to whom disclosures were made.

However, there is no need to record:

  • access by the institution's own employees;
  • release of "directory information"; or
  • release of information with a student's written consent.

Authentication of Requestors. Institutions must use “reasonable methods” to identify and authenticate the identity of those who access records. Such methods may include requesting a combination of some of the following: the requestor’s photo identification; all or part of the student’s ID number; the student’s date of birth; the student’s PIN; a password; a personal security question.

What Other Information is Important to Know Under FERPA?

FERPA Complaints. Students may file a complaint with the U.S. Department of Education. Generally speaking, however, students may not file a lawsuit against the institution for a violation of FERPA.

Penalties for Violation of FERPA. Penalties for uncorrected violations may include a cutoff of federal funding to the institution.

Military Access to Education Records. The Solomon Amendment (10 U.S.C. § 982; 32 C.F.R. 216, 65 F.R. 2056) is not a part of FERPA, but it allows military organizations access to information ordinarily restricted under FERPA for the purpose of military recruiting. Specifically, the Solomon Amendment permits Department of Defense entities to physically access institutional facilities to recruit students, and to obtain students' names, addresses, phone numbers, age, class, and degree program once every term. Institutions are exempt from these requirements if they do not collect this information, or if they do not normally provide this information to prospective employers. The Solomon Amendment only applies to enrolled students over age 17.

Institutions that violate the Solomon Amendment risk loss of funding from several federal agencies, including the Departments of Defense, Education, Health and Human Services, and Labor. If a component of the institution violates the Solomon Amendment, larger system funding may be affected.