Student Privacy Rights and Wrongs on the Web

School Administrator, Sept, 2001 by Joy Surratt Baskin, Jim Surratt

These days, it seems the sky is the limit when it comes to school technology. You can buy computers that fit in your pocket and monitors that cover entire walls. The letters CD-ROM, CPU and HTML are more than alphabet soup. Schools everywhere are gaining access to the broadest broadband you can imagine.

But with all that power at your fingertips, sometimes you'll need to stop, take a deep breath and call your lawyer--especially if you're posting student information on the Internet.

Many schools and districts would like to put student information online to promote community relations and facilitate internal communications. A district may want to use its Web site to showcase its successes with the community. Schools may create an intranet or internal network to maximize communications among students and staff. When these forms of communication are used to post personally identifiable student information, student privacy rights are involved.

Personally identifiable student information is protected by the Family Educational Rights and Privacy Act and by state privacy laws. FERPA prevents school districts from releasing students' education records without written parental consent, except in limited circumstances. An "education record" is any information directly related to a student that is maintained by a school district or someone acting for the school district.

Students' education records can be released in only two circumstances. First, a school district may release student information that has been designated "directory information," so long as the school district has given the notice described below. Second, student information can be released in accordance with a parent's written consent.

Student Data

Directory information means anything contained in an education record that would not generally be considered harmful or an invasion of privacy if disclosed. The FERPA regulations list the following examples of directory information: a student's name, address, telephone listing, electronic mail address, photograph, date and place of birth, major field of study, dates of attendance, grade level, enrollment status, participation in officially recognized activities and sports, weight and height of athletes, degrees, honors and awards received and most recent educational institution attended. FERPA's regulations and comments state that school districts may add items to this list.

Student information that has been designated as directory information can be disclosed only if the school district has given public notice of (1) the types of information included in its definition of directory information; (2) parents' right to restrict the disclosure of such information; and (3) the time within which a parent must notify the district in writing that he or she does not want all or part of the information designated directory information.

Public notice is all that is required. It can be done through a newsletter, a local newspaper or the student handbook. In practice, however, many school districts send parents individual notice of these rights.

Parental Consent

To post personally identifiable student information that is not directory information, schools must obtain parental consent. FERPA requires parental consent to be written and specific. The consent must specify the records to be released, the reason for such release and to whom the records are to be released.

School districts may be tempted to simplify this process by asking for broad parental consent once each school year. A blanket parental consent form may not comply with FERPA, however, meaning schools should obtain separate permission prior to each Web posting.

These privacy protections apply to any release, online or otherwise, of personally identifiable student information. With these rules in mind, schools may consider posting specific categories of student information on the Web.

Student Work

Student work is protected by FERPA if it is personally identifiable. Obviously, student work is personally identifiable if it is labeled with the student's name. But even without a name, student work can be considered identifiable if it contains sufficient information about the student to enable someone to identify the author or artist. If student work is personally identifiable, the district should seek parental consent before posting the work.

For every rule, there is an exception. In some circumstances, student work may qualify as directory information because it is an honor or award. For example, the Department of Education Family Policy Compliance Office, which is the federal office charged with overseeing FERPA compliance, has considered a complaint alleging that a school violated FERPA when it sent a letter inviting a student to participate in an arts program to other recipients as well.

The compliance office believed the invitation could be considered an award. If the school district gave public notice that awards would be directory information, and the student's parent did not object, the invitation could be released without prior parental consent. Including honors and awards in the list of directory information will allow school districts to publicize much of their good news, such as releasing the names of students in the Top 10 percent of the graduating class or the names of the district's National Merit Finalists.