Federal Privacy Guidelines

Federal Privacy Guidelines

Overview

The Family Educational Rights and Privacy Act (FERPA) is a federal law designed to protect the privacy of education records; to establish the right of students to inspect and review their education records; and to provide guidelines for the correction of inaccurate and misleading data through informal and formal hearings. What this means is that, in general, no one may release information from the student record to a third party, including parents, without written permission from the student.
FERPA was established by the federal government in 1974 and applies to all institutions receiving federal funding. It applies to both K-12 and post-secondary institutions, but students have different rights in K-12 than when in college.

See types, locations and custodians of educational records.

For Students

FERPA provides students with specific rights:

  1. Students have the right to inspect and review the education records the University maintains on them.
  2. Students have a right to request corrections to education records that they believe are inaccurate, misleading, or in violation of their privacy rights. The procedure for the correction of records can be obtained by contacting the Registrar.
  3. Students have the right to consent to disclosure of personally identifiable information. If you would like for your parents to have access to your billing information, use the Consent to Release Information form.
  4. Students have a right to know what an institution has designated as public/directory information and the right to limit the release. Use the Non-Disclosure of Directory Information form to suppress your personal information.
  5. Students have a right to know school officials may access their records and the criteria for determining that a student has a legitimate need to know the information.
  6. Students can file a complaint with the Family Policy Compliance Office in the U.S. Department of Education if they believe information has been disclosed without their consent or withheld from review. This complaint must be in writing, be within 180 days of the alleged offense and contain the specifics of the incident. The address for submitting complaints is:

Family Policy Compliance Office
U.S. Department of Education
130 Coffey Hall
400 Maryland Ave. S.W.
Washington, D.C. 20202-5920

Correction of Education Records

Students have the right to ask to have record corrected if they believe that the records are inaccurate, misleading or in violation of their privacy rights. The procedure for correcting education records is as following.

  1. A student must request in writing of the appropriate custodian to amend a record. In so doing, the student should identify the part of the record she or he wants changed and specify why it is believed to be inaccurate, misleading or in violation of her or his privacy or other rights.
  2. The University may comply with the request or it may decide not to comply. If it decides not to comply, the University will notify the student of the decision at her or his last known address of record and advise the student of the right to a hearing to challenge the information believed to be inaccurate, misleading or in violation of the student’s rights.
  3. A written request for a hearing must be submitted to the appropriate records custodian. The University will arrange for a hearing on the matter and will notify the student, reasonably in advance of the hearing, of the date, place and time that the hearing will be held.
  4. The hearing will be conducted by a hearing officer who has no direct interest in the outcome of the matter to be decided; however, the hearing officer may be an official of the institution. The student shall be afforded a full and fair opportunity to present evidence relevant to the issues raised in the original request to amend the student’s education records. The student may be assisted by one or more individuals, including an attorney.
  5. The hearing officer will prepare a written decision based solely on the evidence presented at the hearing. The decision will include a summary of the evidence presented and the reasons for the decision. A copy of the written decision will be provided to the student at her or his last known address of record within a reasonable time after the hearing, usually 10 business days unless circumstances require a longer period for a decision to be prepared.
  6. If the hearing officer decides that the challenged information is not inaccurate, misleading or in violation of the student’s right of privacy, she or he will notify the student of the right to place in the education record a statement commenting on the challenged information and/or a statement setting forth reasons for disagreeing with the decision.
  7. The statement will be maintained as part of the student’s education records as long as the contested portion is maintained. If the University discloses the contested portion of the record, it must also disclose the student’s statement.
  8. If the University decides that the information is inaccurate, misleading or in violation of the student’s right of privacy, it will amend the record and notify the student, in writing at her or his last known address of record, that the education record has been amended.

For Parents

The same laws that give parents and students access to and control over a child’s educational records during elementary and high school transfer ownership of the records to the student at the college level.

According to FERPA (Family Educational Rights and Privacy Act, also known as the Buckley Amendment), college students are considered responsible adults and are allowed to determine who will receive information about them. Under this law, parents who want to receive a copy of their student’s academic or financial records can do so if their student signs a release form. FERPA, along with the State of Minnesota Data Privacy Act, forms the backdrop for the university policy on student records.

For Faculty and Staff

In general, the information the University collects and maintains about students is either directory or non-directory information. Directory information is defined as information that would not generally be considered harmful or an invasion of the student's privacy if disclosed.

St. Catherine University has designated the following items of information as directory information: student's name, address, telephone number, e-mail address, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance (semester and year), full- or part-time status, degrees and awards received, Latin honors received, most recent previous school attended and photograph.

Unless restricted by the written request of a student, the University may release directory information without the prior consent of a student. Directory information required for classroom participation may not be withheld from faculty and students connected with the particular course.

Information that is not directory information is non-directory information and, unless excepted by FERPA, requires the prior written consent of the student for release. Prior written consent is required for disclosures to all non-University entities, including parents. Information may be shared among education officials within the University when a legitimate educational interest exists for the disclosure of specific information. A legitimate educational interest exists when a school official demonstrates a need to know specific information to accomplish instructional, advisory, administrative, research, supervisorial, or other administrative responsibilities assigned by the University. School officials may include employees, faculty, staff, designated representatives of the University, members of the Board of Trustees, students serving on official committees, students assisting another school official in performing her or his tasks, and contractors, consultants, volunteers, and other outside service providers used by an institution to perform institutional services and functions that it would otherwise perform itself.

Faculty can avoid most violations of student privacy by strictly adhering to the following points:

  1. Students should never be given a copy of a class list, grade sheet, or any document that contains references to other students, even when that document is provided in a sealed envelope.
  2. Grades and other documents should never be posted or made publicly available in a manner that identifies individual students.
  3. Student papers, exams or business-related documents should not be left unsupervised or in common areas for distribution or pick-up.
  4. Parents or guardians who request information about their students should be referred to the Dean of Student Affairs or the Registrar.
  5. Do not even release directory information about a student if the following message is displayed in Self-Service Banner when you access the student’s record: Confidential Information for (name of student).

Definitions

Student
Any person who attends or has attended St. Catherine University.

Education record
According to FERPA, education records are records (in handwriting, print, tapes, film, computer, or other media) that are maintained by St. Catherine University, or an agent of the University, and that are directly related to a student and from which students can be personally (individually) identified. However, FERPA makes the following exceptions to its definition of education records.

  1. Personal records that are the kept in the sole possession of the maker and are not accessible or disclosed to any other person, except a temporary substitute for the maker of the record
  2. Records created and maintained for law enforcement purposes
  3. Employment records, unless employment is contingent on student status
  4. Records created and maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional, if the records are used only for the treatment of a student and made available only to those persons providing the treatment
  5. Alumni records, which are created and maintained about a student after he or she is no longer in attendance at the University and which are not related to the individual’s attendance as a student

Personally identifiable information (PII)
Personally identifiable information includes but is not limited to:

  1. Name of the student, student's parent(s) or other family member(s)
  2. Address of the student or student's family
  3. A personal identifier, such as the student's social security number, student ID or biometric record
  4. Other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name
  5. Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.
Possible Federal and State Data Collection and Use

As of January 3, 2012, the U.S. Department of Education's FERPA regulations expand the circumstances under which your education records and personally identifiable information (PII) contained in such records — including your Social Security Number, grades, or other private information — may be accessed without your consent. First, the U.S. Comptroller General, the U.S. Attorney General, the U.S. Secretary of Education, or state and local education authorities ("Federal and State Authorities") may allow access to your records and PII without your consent to any third party designated by a Federal or State Authority to evaluate a federal- or state-supported education program. The evaluation may relate to any program that is "principally engaged in the provision of education," such as early childhood education and job training, as well as any program that is administered by an education agency or institution. Second, Federal and State Authorities may allow access to your education records and PII without your consent to researchers performing certain types of studies, in certain cases even when we object to or do not request such research. Federal and State Authorities must obtain certain use-restriction and data security promises from the entities that they authorize to receive your PII, but the Authorities need not maintain direct control over such entities. In addition, in connection with Statewide Longitudinal Data Systems, State Authorities may collect, compile, permanently retain, and share without your consent PII from your education records, and they may track your participation in education and other programs by linking such PII to other personal information about you that they obtain from other Federal or State data sources, including workforce development, unemployment insurance, child welfare, juvenile justice, military service, and migrant student records systems

Visit the official FERPA website »