By: Anne Groves

Secondary banner

What is “FERPA”?


The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records through the regulation of their disclosure.[1] FERPA gives parents and guardians certain rights over their student’s educational records.[2] Once the student turns 18, they become an “eligible student” under FERPA and these rights that once belonged to the parent are transferred to the eligible student.[3]


What types of information does FERPA protect?


FERPA generally prohibits educational institutions from disclosing personally identifiable information from education records without the written consent of the parent or eligible student.[4] FERPA includes the following in the definition of personally identifiable information: a student’s name; the name of the student’s parents or other family members; the address of the student or student’s family; personal identifiers such as a social security number, student number, or biometric record; other indirect identifiers such as birthday, place of birth, and mother’s maiden name; and other information that alone or in combination is linkable to a specific student would allow a reasonable person in the school community who does not have personal knowledge of the relevant circumstances to identify the student with reasonable certainty; or information requested by a person who the education agency or institution reasonably believes knows the identity of the student to whom the education record relates.[5]


Can my college or university ever disclose my personally identifiable information without my consent?

FERPA does allow certain disclosures without obtaining consent, including but not limited to disclosing the student’s information to other “school officials” with a “legitimate educational interest.”[6] The legitimate education interest exception is explained in 34 C.F.R. § 99.31 in part as follows: “An education agency or institution may disclose personally identifiable information from an education record of a student without . . . consent . . . if the disclosure meets one or more of the following conditions: The disclosure is to school officials, including teachers, within the agency or institution whom the agency or institution has determined to have a legitimate educational interest.”[7]


What types of information could my college or university disclose to non-school officials without needing my consent?

Under FERPA, schools can disclose information categorized as “Directory Information” to any party, and it doesn’t require the student’s consent.[8] The Directory Information exception outlined in FERPA provides that Directory Information can be disclosed to third parties without the consent of the eligible student as long as the following conditions are satisfied: (1) The institution gives public notice of the types of information it categorizes as “Directory Information”;[9] (2) The institution informs the eligible student of their right to restrict the disclosure of such information;[10] and (3) The institution provides the time frame in which the eligible student can notify the school that they wish to limit disclosure of this information.[11]

What further protections do I have if I attend college or university in Virginia?

The Virginia legislature has afforded Virginia students further protections than the baseline requirement that federal government provides through FERPA. Virginia law specifies that no school is permitted to disclose the address, telephone number or email address of a student pursuant to the Virginia Freedom of Information Act unless the parent or eligible student has affirmatively consented in writing to such disclosure.[12] This is unlike the baseline standard provided in the directory information standard in FERPA, which does not require affirmative consent by the eligible student or parent for the disclosure of address, telephone number, or email address.[13]


[1] See Family Educational Rights and Privacy Act (FERPA), U.S. Dept. of Ed. (last updated Mar. 1, 2018)

[2] See id.

[3] See id.

[4] See 34 C.F.R. § 99 et. seq.

[5] See id.

[6] See Family Educational Rights and Privacy Act (FERPA), supra note 1.

[7] 34 C.F.R. § 99.31.

[8] See 4 C.F.R. § 99.3 and 99.37.

[9] See id.

[10] See id.

[11] See id.

[12] See Va. Code Ann. § 22.1-287.1.

[13] See 4 C.F.R. § 99.3 and 99.37.


image source: