Federal Student Privacy Rights: FERPA, PPRA and COPPA

Your Rights under FERPA

Your Rights under PPRA

Your Rights under COPPA

 

FERPA

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law passed in 1974 that bars the disclosure of personally identifiable data in student records to third parties without parental consent.  Yet FERPA has been considerably weakened in recent years to make it possible to enable schools and districts to share these data with others for a multitude of reasons, including allowing it to be disclosed to vendors, consultants and contractors for administrative, instructional or assessment purposes (known as the “school official/contractor” exception) and/or to organizations or individuals for vaguely-defined evaluation or audit purposes, without either notifying parents or gaining their consent (known as the “authorized representative” exception). In addition, yet a third loophole allows nonconsensual disclosures (and re-disclosure) of personally identifiable information (or PII) for “studies.” [For more information on how FERPA has been revised, see our fact sheet on FERPA.]

These school official and authorized representative exceptions were cited by states, including New York, in claiming they were legally allowed to share personal student information with the now-defunct database known as inBloom, without parental knowledge or consent.

What rights do parents still have under FERPA?

1. The right to inspect the information in their child’s education records, whether this data is held by the state, the local district or their child’s school.

2. The right to correct information in their child’s records if there are errors. If the school, district or state agency refuses to correct the record, the parent has the right to a formal hearing. After the hearing, if the school or agency still refuses to correct the record, the parent has the right to amend the record by placing a statement into the child’s record setting forth his or her view about the contested information.

3. The right to be informed as the school/district’s criteria in determining who constitutes a school official or other third party with a legitimate educational interest to whom the school/district intends to disclose personally identifiable information without parental consent.

4. The right to opt out of any “directory information” about their child being made public. Directory information generally includes a student’s name, address, email, telephone number, date and place of birth, honors and awards, and/or dates of attendance. Schools must tell parents about their right to refrain from having their children’s directory information shared with any third parties without prior consent. Please note that opting out of a school’s directory does not prevent schools or districts from using the exceptions mentioned above to disclose personal student data under the school official, authorized representative or research provisions of the new FERPA regulations. Nevertheless, we urge you to opt out in any case. (For information on how to opt out of “directory information” please see here.)

5. The right to opt out of having their child’s name, address and telephone from being provided to military recruiters.

6. The right to be informed of their FERPA rights each year by their school or district. The actual means of notification (letter, PTA bulletin, student handbook, or website) is left to the discretion of each school.

7. When students turn 18 or enroll in a postsecondary institution at any age, their rights under FERPA transfer from their parents to themselves.

For FAQs on FERPA, see here: http://www2.ed.gov/policy/gen/guid/fpco/faq.html  and http://www2.ed.gov/policy/gen/guid/fpco/hottopics/ht-10-09-02a.html

If you believe that your FERPA rights have been violated, you should first complain to your school, district Superintendent and/or school board. If they refuse to take appropriate action, you should file a complaint with the Family Policy Compliance Office of the US Department of Education.  More information about FERPA and instructions on how to how to file a complaint are here: http://www2.ed.gov/policy/gen/guid/fpco/ferpa/parents.html You should try to be as specific as possible.


PPRA

The Protection of Pupil Rights Amendment (PPRA) (20 U.S.C. § 1232h; 34 CFR Part 98) was enacted in 1978, and applies to student surveys, instructional materials or evaluations funded by the federal government that deal with highly sensitive issues.

What rights to parents have under the PPRA?

1. Parents have the right of written consent before their children are required to participate in any federally funded survey, analysis or evaluation dealing with information concerning:

  • Political affiliations;
  • Mental and psychological problems potentially embarrassing to the student and his/her family;
  • Religious affiliations and beliefs;
  • Sex behavior and attitudes;
  • Illegal, anti-social, self-incriminating and demeaning behavior;
  • Critical appraisals of individuals with whom respondents have close family relationships;
  • Legally recognized privileged relationships, such as those of lawyers, physicians, and ministers; or
  • Income (other than that required by law to determine eligibility for a program).

2. If the survey, analysis or evaluation that deals with issues listed above are not federally funded, written consent is not required but parents must be notified in advance of the survey and have the right to opt their children out of participating.

3. In either case, schools and/or their contractors must make these instructional materials or surveys available for inspection by parents ahead of time, to allow them to decide whether to consent or opt out.

The PPRA also grants parents the right to receive notice and an opportunity to opt their children out of:

4. Any non-emergency, invasive physical exam or screening administered by the school unnecessary to protect the immediate health and safety of a student, except for hearing, vision, or scoliosis screenings, or any physical exam or screening permitted or required under State law; and

5. Activities involving collection, disclosure, or use of personal information obtained from students for marketing or to sell or otherwise distribute the information to others.

If you believe your PPRA rights have been violated, you should take the actions listed above under FERPA.

For FAQs on PPRA, see here: http://www2.ed.gov/policy/gen/guid/fpco/index.html


COPPA

Congress enacted the Children’s Online Privacy Protection Act (COPPA) in 1998, which is regulated by the Federal Trade Commission, not the US Department of Education.

The primary goal of COPPA is to allow parents to have control over what information is collected online from their children under age 13.  The law applies to any operators of  websites,  online services including web-based testing, programs  or “apps” that collect, use, or disclose children’s personal information, whether at home or at school.  However, COPPA only applies to personal information collected online from children; it does not cover information collected from adults that may pertain to children.

The personal information can include the child’s name,email, phone number or other persistent unique identifier, and information about parents, friends and other persons. The law recognizes that the school can consent on behalf of the parent to create accounts and enter personal information into the online system– but only where the operator collects personal information for the use and benefit of the school, and for no other commercial purpose. Unfortunately, many schools fail to engage in proper due diligence in reviewing third-party privacy and data-security policies, and inadvertently authorize data collection and data-mining practices that parents find unacceptable.

What rights do parents have under COPPA when online programs are used in schools?

The FTC revised guidance on best practices in March 2015, shifting some parental rights to schools. If your under-13 child is participating in an online program from a service provider or commercial website collecting personal information, whether for instructional, testing, or other purposes, the school and/or vendor or service provider must provide your school with a clear and prominent privacy policy and use practices on its website or elsewhere, including the following:

  1. The name, address, telephone number, and email address of the vendors collecting or maintaining personal information through the site or service;
  2. A description of what personal information the operator is collecting, including whether the website or program enables children to make their personal information publicly available, how the operator uses such information, and the operator’s disclosure practices for such information; and
  3. That the school can review or have deleted the child’s personal information and refuse to permit its further collection or use, and provide the procedures for doing so.

Best practice on the part of the school would also be to require written consent from parents if their child under 13 is using such a program, especially if the program contains ads or any marketing material.

In any event, when an online operator receives consent from the school, the operator must, upon request, provide schools with the following:

  1.  A description of the types of personal student data collected;
  2. An opportunity to review a student’s information and/or have it deleted;
  3. The ability to prevent the online program from any further use or collection of a student’s personal information.

For FAQs on COPPA, see here: http://www.business.ftc.gov/documents/0493-Complying-with-COPPA-Frequently-Asked-Questions

You can also contact the FTC to ask questions or issue a complaint if the online operator refuses to provide you with these rights by emailing here: CoppaHotLine@ftc.gov


The above summaries of parental rights and opt out forms are aligned with our understanding of federal student privacy laws, which are complex and have changed over time.   Any questions, corrections or suggestions for improvement, please email us at info@studentprivacymatters.org  thanks!