Blog: Higher Ed Beat

How to Navigate Privacy Laws When Reporting

“How many people are here in some part because you’ve made a request for a record and gotten the FERPA answer?” asked Frank LoMonte, an expert in the federal privacy law, to a roomful of education reporters at a recent conference.

Nearly all in attendance raised their hands.

“That’s why my phone rings 2,000 times a year,” said LoMonte during the Education Writers Association’s 2017 National Seminar in Washington, D.C.

LoMonte was joined by Amelia Vance, an expert in consumer-privacy law, for an EWA panel to address a common frustration reporters face when requesting information from a university or school system. They file requests through the Freedom of Information Act, looking for documents with hard numbers, and are met with, at best, a document full of blacked-out redactions, or a variation on this response: “We can’t release that due to FERPA rights.”

The Federal Education Rights and Privacy Act was established in 1974 in response to concerns that sometimes racist or damaging information was being put into records sent out to anyone the school thought was okay, said Vance, who acts as the policy counsel for the Future of Privacy Forum, a Washington-based research and advocacy group.

Students are granted numerous rights under the federal law, such as annual notification of their educational institution’s FERPA policy, access to their own records, confidentiality of their private information, and notification when third parties request access to their records. They are also allowed to request a correction of their records and file a complaint if they believe something doesn’t belong in them.

On the flipside, FERPA protections do not apply in certain instances, including information published in student directories (e.g. whether a student participates in campus organizations like fraternities or sororities), records of law enforcement agencies, the outcome of disciplinary cases, and lawsuit settlements, even when a student is involved. Also, if the student is deceased and at least 18 years old, their records are no longer protected by FERPA.

Blocked by a FERPA Claim: Now What?

LoMonte, the former director of the Student Press Law Center, said that while most school districts or colleges that refuse to provide information will claim fear of pushback under FERPA, he is aware of no examples of schools or universities facing sanctions — the loss of some federal aid — for violating FERPA requirements. Such cases would have to prove a policy or practice of repeated violations, an active effort on the school’s part to intentionally disclose private information. Pointing this out to the FERPA officer at your local university might help pressure them to divulge the requested information.

LoMonte, who now heads the Brechner Center for Freedom of Information at the University of Florida, pointed to an important detail in what is covered by FERPA. While an individual student’s disciplinary record cannot be made available, reporters are legally in the right to interview observers of incidents, such as teachers, who are allowed to disclose what they saw, even if that information could appear on a record somewhere.

FERPA, LoMonte said, is a very narrow statute, as the law specifically states the only thing it covers is documents centrally maintained as education records. The maintenance aspect is important, LoMonte notes, because it means something that’s just sitting on a teacher’s desk or an email sitting in somebody’s inbox or a quiz paper passed from one to another students is not covered by FERPA.

“The universe of things that have been miscategorized as confidential education records is limited only by the vast imagination of school and college attorneys,” LoMonte said.

Vance suggested that if a reporter is hitting a FERPA wall, to find other examples of analogous information that has been released by other schools, and then contacting the U.S. Department of Education’s Privacy Technical Assistance Center, which can help put pressure on the school.

Flurry of State Privacy Laws Passed

Another important consideration, Vance said, is that states often have more sway in privacy law, since there’s been a flurry of state laws passed since 2013 — by her count, 108 new measures in 40 states.

“So almost every state has a brand new privacy law, and many of them significantly change the landscape and what the requirements are and what third parties can access,” Vance said.

The trick for reporters is to keep up with privacy laws in their states, and push back as best they can, citing analogous cases from other states. Some helpful resources are the SPLC’s FERPA facts tumblr, which rates cases of reporters being blocked from information by administrators citing FERPA, and the FERPA Sherpa page at the Future of Privacy Forum, which breaks down state privacy laws and higher education data resources.