Privacy in Education: A Guide for Parents and Adult-Age Students 1. Introduction 2. Tips for Parents and Adult-Age Students 3. Family Educational Rights and Privacy Act 3a. Education Records 3b. Access to Education Records 3c. Correcting Errors 3d. Uses of the Social Security Number 3e. Directory Information 3f. Violations of FERPA 4. Military Recruiters 5. Videotaping and Photography 6. Internet Publication of Information and/or Images 7. Surveys and Questionnaires 8. Surveillance Cameras 9. Issues Specific to Colleges and Universities 10. Resources 1. INTRODUCTION As soon as your child enters preschool, information is collected about him or her. The body of information grows throughout the child's academic career. School records contain highly sensitive information, even information about the family. The contents of student files are likely to have an impact on the overall educational experience of students. That is why it is wise for parents and adult-age students to be informed about laws and policies that govern student information. Privacy abuses can range from grades bandied about in hallways to the nonconsensual exposure of student information and photos on the Internet. In today’s climate of heightened security, it is more important than ever for parents and adult-age students to be vigilant about who has access to education records. Federal law, the Family Educational Rights and Privacy Act, protects student records to some extent. FERPA is one of the oldest privacy laws on the books, implemented in 1974. Most states have enacted similar laws. FERPA applies to schools that receive federal funds through a program of the U.S. Department of Education. Most schools fall into this category. Recent federal laws such as the USA Patriot Act and the No Child Left Behind Act of 2001 have somewhat changed the privacy landscape. Rapid advances in technology have stretched privacy laws to the limit. The Internet, now in use in nearly all U.S. schools, opens the door for instantaneous and widespread dissemination of student information. Recent incidents of school violence have prompted school administrators and parents to debate the issue of privacy versus security. Events such as the Columbine shootings in 1999 have resulted in increased security measures in our schools. Metal detectors and surveillance cameras are now a fact of life in many schools. This guide discusses privacy-related laws in education and covers emerging issues in security and informational privacy. The issues covered here pertain to students in the K-12 grades as well as college-level records. Additional issues specific to post-secondary education are discussed in Part 9. This fact sheet does not cover drug testing. You can find resources for additional information about education privacy at the end of this guide, Part 10. 2. TIPS FOR PARENTS AND ADULT-AGE STUDENTS If you read nothing else in this guide, be aware of all the ways you can actively monitor and limit the uses of student information. Learn how to safeguard the confidentiality of these records to the extent possible under the law. 1. Read everything that is sent home with your child from school or sent in the mail. Pay attention to the fine print. Look for terms such as “personally identifiable information,” “directory information," and "opt-out." It is easy, especially at the start of a new school year, to feel overwhelmed with paperwork. Take the time to read documents regarding privacy information. They matter. 2. Always question why information about the student is being requested. If you are told that the request is mandated by law or policy, ask for a copy. 3. Find out how your school defines “directory information.” Request the opt-out form if you do not want directory information about your child to be released to third parties. This can include descriptive information such as name, address, telephone number, date of birth, major field of study, school activities, key dates, and more. Schools are required to give parents the right to opt-out of the release of directory information (discussed further in Part 3). The trend is for schools to expand directory information to include many more types of student data. 4. Ask for a copy of the school or district policy on surveys and third-party access to personal student information. And ask for a copy of survey questionnaires that are given to your child. The school may not give this, but it is worth the effort and signals to the school that you are concerned about this issue. 5. Teach your child to tell you about surveys and questionnaires. Ask how you can "opt-out" of a survey, test, or other process that makes you uncomfortable. You can contact the school and ask: * Who is conducting the study? * What is the purpose of the study? * Is any personally identifiable information required? * Who is compiling, reviewing, storing the data? * When is the data destroyed? * Can I refuse to have my child participate? What are the consequences, if any, if my child does not participate? * What are my rights under Federal and State law? 6. Ask for a copy of the school or district policy regarding requests to access the education record. Always make such requests in writing. Keep a copy for yourself. Send all correspondence certified “return receipt requested” so you can confirm that the school received your letter. 7. Ask for a copy of school or district policy regarding the videotaping and photographing of students. Similarly, ask about its policy regarding the publication of student information and photographs on school-sponsored Internet web sites. If the school has no policy, work with other parents to contact the board and request that such policies be adopted. 8. Keep in mind that your child may participate in programs that are not formally sponsored by the school, but may be associated with the school nonetheless. Find out if programs, such as sports and music activities, have web sites in which participating students are named and pictured. Although such programs are generally not covered by FERPA, you are wise to examine the organization’s privacy policy and take advantage of consent opportunities. If the organization has no privacy policy and does not obtain consent before posting information and pictures about your child, complain to the program administrators as well as to appropriate school officials. 9. Request the opt-out form if you do not want your child contacted by military recruiters. Schools are required to inform you of your right to opt-out of recruitment contacts. 10. Review your child's education record periodically. Once a year is recommended, twice is preferable, especially if you have special concerns. 11. Ask to see the access log for the education records of your child at least twice a year, more often if you have special concerns. These logs show who has accessed the records. 12. If your child experiences a breach in confidentiality of student records or another kind of privacy abuse, document it carefully in writing. In addition to talking to teachers, staff, and/or administrators about the matter, write a letter to the appropriate administrator and, if necessary, the board. File a complaint with the U.S. Department of Education if it appears that the school has violated federal law (discussed below in Part 3). 13. If a privacy-invasive situation that your child has experienced is widespread or systemic, organize with other parents. Go to the board and work with the school to change the policy . 3. FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT (FERPA) What are the major federal laws that govern the privacy of education records? * Family Educational Rights and Privacy Act (FERPA) 20 USC 1232g (1974) * Protection of Pupil's Rights Amendments (PPRA) 20 USC 1232h (1978) * No Child Left Behind Act of 2001, Pub. L. 107-110, 115 STAT. 1425 (January 2002) * USA Patriot Act, P.L. 107-56 (October 26, 2001) * Privacy Act of 1974, 5 USC Part I, Ch. 5, Subch. 11, Sec. 552 FERPA is the best known and most influential of the laws governing student privacy. It has recently undergone some changes since the enactment of the No Child Left Behind Act and the USA Patriot Act, discussed below. What are the most important things to know about FERPA? FERPA gives parents and adult-age students some rights to the privacy of the student education record. Under FERPA, adult-age students are those who have reached the age of 18 or who attend post-secondary school, even though not yet 18 years of age. For example, a 17-year-old who is enrolled in college would be considered “adult-age.” The law provides: * The right of parents and adult-age students to inspect and receive a copy of student records. * The right to deny access to others, specifically those outside the school system, with some exceptions. * A process to correct errors, including a hearing. * The right to opt-out of military recruitment. * The right to opt-out of the disclosure of a student’s directory information. * A complaint process, handled by the Family Compliance Office of the U.S. Department of Education. FERPA has some significant shortcomings: * It does not give individuals the right to sue the school. Only the U.S. Department of Education can sanction schools that have violated FERPA. * It puts the burden on students and parents to respond to opt-out opportunities, such as disclosure of directory information. What institutions must comply with the requirements of FERPA? FERPA applies to all schools that receive funds from the U.S. Department of Education. In short, all public elementary and secondary schools are subject to FERPA. In addition, FERPA applies to colleges and universities, whether public or private, whose students receive financial assistance from the federal government. Private educational institutions that receive no federal funds under any applicable program are exempt. These are few and far between. The Family Compliance Office oversees FERPA. For more information about this law and the mission of this Office, visit the U.S. Department of Education’s web site at www.ed.gov/policy/gen/guid/fpco/index.html. 3a. EDUCATION RECORDS What exactly are education records? Under FERPA, education records consist of “anything directly related to a student” that is maintained by an educational agency or institution. These records include much more than test scores or class standing. They can include health information, description of physical appearance, family economic circumstances, criminal history, ethnic background, political and religious affiliations, and psychological test results. The information can be a fact such as birth date or a Social Security number. And it can include teachers' opinions of your child. This is not an exhaustive list. What are not considered education records? FERPA is very specific in listing what items are not included in the definition of education records. These include: * Records of teachers and administrators that are kept in their sole possession and not revealed to any other individuals except a substitute teacher. These are “teacher’s notes.” * Records of a law enforcement unit of the educational institution, such as the campus security office. * Medical and/or psychological records of a student who is at least 18 years of age or who is attending a post-secondary institution when such records are maintained by health care professionals and are used solely in a professional or paraprofessional capacity for treatment purposes. The adult-age student may offer those records to another physician or professional of his or her choice. * Personnel records of those individuals employed by the educational institution. Are records of home-schooled students covered? Through a quirk of the law, the records of home-schooled students are not protected by FERPA. Currently, report cards and other records of home-schooled children are considered public information if they have been shared with public school districts. Since many states require this sharing of information, such records have not been provided privacy protection under FERPA. Some members of Congress have introduced legislation to amend FERPA to include home-schooled students. (To find bills on this topic, visit the Congressional web site Thomas and do a “word/phrase” search on the term “home school.” http://thomas.loc.gov) 3b. ACCESS TO EDUCATION RECORDS Do parents have a right to see their children’s education records? Yes. Parents or adult-age students may review their records including medical or psychiatric evaluations. A parent may request and must be provided with a list of the kinds of information being stored and who to contact to retrieve them for review. Keep in mind that records are often kept in more than one school office. Be sure to ask school officials where records are filed and who to contact to retrieve them for review. The right of access provided under FERPA does not prevent a school from withholding transcripts or other official recognition of completed work until all tuition, fees, and other charges are paid to the school. Many states have laws which allow schools to set up procedural guidelines, including the fulfillment of all financial obligations, before records are released. FERPA does not prevent states from establishing individual procedures for how records are released. The right to review does not include the records of a school where one sought admission but was not accepted. Informal notes kept by teachers, as long as that information is made available only to substitute teachers or other school administrators, are also not included. Many school districts are beginning to offer parents online access to the student's educational information, such as grades, homework assignments, and progress reports. If you are concerned about the security of online records, be sure to discuss this with school personnel. Ask how records are protected from illegitimate access. For example, are records encrypted? Does the school employ audit trails to monitor access? All too often, online security is deficient. Insist that school officials give you specific information about the strategies they employ to keep records secure and accessible only to those with a legitimate right of access Who may have access to these records without parental/eligible student consent? The law is clear on who may access education records without parental consent. But note the word may. A parent could request, for example, that records not be released to another school, and it would then be up to the school to deny or approve the request. Even though a request may fall under one of the exceptions to parental consent, the school could still refuse to release education records to that individual. Those who can access education records include the following: * Parents themselves, students 18 or older, or students who attend a school past high school no matter what their age. In other words, a 17-year old who attends college would have the same access as students age 18 and older. * School officials who have been determined to have legitimate need to view the records. These would include teachers and administrators within the same school. * Officials of other schools or school systems to which the student is being transferred. In this case, however, the student’s parents must be notified of the transfer and receive a copy if they wish. * Financial aid purposes. This includes government agencies as well as private banks involved in the financial aid process. * Organizations conducting studies for educational institutions to develop or evaluate tests, student aid programs, or to improve education. Personally identifiable information must not be disclosed to anyone other than representatives of the organization, and such information must be destroyed when no longer needed. * In cases of emergency, appropriate persons may gain access if the information is needed to protect the health or safety of the student or others. Government officials who can access student records without parental consent include these: * The Comptroller General of the United States and the Secretary of the Department of Education. The Comptroller General has certain statutory authority to conduct audits. To date there have been no such audits of education records, but this provision is included in case such a review is necessary. State educational authorities may also have access for purposes of gathering data to audit and evaluate federally-supported education programs. * Representatives of the Attorney General for law enforcement purposes. Personally identifiable information is supposed to be destroyed once no longer required. * State and local officials may access the records if the state enacted a statute before November 19, 1974, that specifically granted this access for juvenile justice system purposes. If the state statute was enacted after November 19,1974, the access must still relate to juvenile justice system needs, but officials must also certify in writing to the school that they will not disclose the information to any third party except as state law allows, without the written consent of the parent. * In response to a grand jury subpoena, the educational institution may release records. But it may not reveal to anyone the existence or contents of the subpoena or what information was furnished. * In response to any other subpoena issued for a law enforcement purpose, the educational institution may release records. Again, the existence or contents of the subpoena may not be disclosed to anyone and any information furnished must remain confidential. Can these individuals or agencies then share the information with third parties? No. Parents must give written consent before information is divulged to another party. Should information be shared inappropriately, the party who was granted access may be barred from accessing education records for at least five years. How can I find out who has requested access to my child’s education records? Each educational agency must maintain a record, typically called an access log. It lists all individuals who requested or were given access to a student’s records. The log must also include the legitimate interest each person had to justify access. The log itself is subject to certain safeguards. Only parents and school officials responsible for custody of school records may view the log. Can a school or university withhold a transcript until all fees are paid in full? Yes. The right of access provided under FERPA does not prevent a school from withholding transcripts or other official recognition of completed work until all tuition, fees, and other charges are paid to the school. Many states have laws that allow schools to set up procedural guidelines, including the fulfillment of all financial obligations, before records are released. FERPA does not prevent states from establishing individual procedures for how records are released. How long is information stored by the school and in what form is it kept? FERPA does not require that institutions maintain records for a specified period of time unless there is an outstanding request by a parent or adult-age student to inspect the records. But educational institutions must use reasonable methods to ensure that information is protected. This includes protecting the integrity of e-mail files and Internet web sites, including inhouse Intranet systems.. FERPA does not mandate the specific method of achieving this goal. Districts are likely to have their own retention policies. 3c. CORRECTING ERRORS IN THE EDUCATION RECORD What if a parent or adult-age student believes an item in the school record is incorrect? The parent can request in writing that the school amend any information they believe is inaccurate. If the school does not do so within a reasonable period of time, the parent has the right to a hearing. The request should be made in writing to the proper administrative official, for instance the principal. The hearing must be held within a “reasonable time” after the request is made. FERPA gives parents an opportunity to argue the need for correction. A decision must be given to the parents and the school district in writing within a "reasonable time." 3d. USES OF THE SOCIAL SECURITY NUMBER Is my child’s Social Security number (SSN) part of the education record? Your child’s Social Security number is considered part of the education record, falling under the protection of FERPA. In a 1992 case brought by students against Rutgers University, the court confirmed that the SSN is an education record. It ruled that Rutgers must not list students’ SSNs on class rosters. (Krebs v. Rutgers, 797 F. Supp. 1246 (D.N.J. 1992)) Another federal law, the Privacy Act of 1974, also places limitations on uses of the SSN. It states that a government agency cannot “deny to any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his social security account number." It also requires agencies to provide a SSN disclosure notice, stating whether or not disclosure is mandatory or voluntary and what uses will be made of the SSN. (Section 7 of the Privacy Act, 5 U.S.C. § 552a note) The logical conclusion is that certain uses of the Social Security number by publicly funded schools would violate both FERPA and the Privacy Act -- such as identification cards, grade listings, or computer access. Unfortunately, many schools do not interpret the law this way. If you do not want your child's SSN used for identification purposes, you should request that your school allow you to use an alternate number. If you meet with resistance, cite the law and be persistent. For more information on using Social Security numbers in educational institutions, read: * Our Fact Sheet 10, www.privacyrights.org/fs/fs10-ssn.htm. * University of North Carolina analysis regarding limitations on the use of SSNs at www.uncg.edu/cha/UNIVERSITY_COUNSEL/FAQ/SSN.html. * U.S Department of Justice’s information on the Privacy Act, www.usdoj.gov/04foia/1974ssnu.htm. A new law in California limits the display and disclosure of SSNs, including as student identifiers. The law went into effect for new students enrolling in private schools starting July 1, 2002. Public K-12 schools must comply for new students beginning January 1, 2004. Higher education institutions have additional time to comply with the law, from 2005 to 2007 depending on the type of institution (University of California, California State University, Community College system). (See California Civil Code 1798.85, and Senate Bill 25 (2003, Bowen), at www.leginfo.ca.gov.) 3e. DIRECTORY INFORMATION What is “directory information” and how is it different from education records? Educational institutions may disclose certain categories of information about a student without parental consent or the consent of the adult-age student. Schools must notify parents and eligible students of the information that may be released and must allow a reasonable amount of time for the parent or adult-age student to request that the information not be disclosed. Under FERPA, directory information can include: * Student’s name * Address * Telephone listing * Date and place of birth * Major field of study * Participation in officially recognized activities and sports * Weight and height of members of athletic teams * Dates of attendance * Degrees and awards received * Name of the most recent previous educational agency or institution attended by the student. Each educational institution is responsible for giving parents and adult-age students notice of the categories that are considered directory information at that institution. Parents and adult-age students may refuse permission to the school to release this information if they inform the school in writing, in other words, if they “opt-out.” The law does not define for schools what they must designate as directory information, and the list is growing. Because directory information can be given to third parties unless parents have opted out, you will want to monitor what your school proposes to add to the list. Be sure to raise objections with the school board if you disagree with the school’s expansion of categories considered to be directory information. 3f. VIOLATIONS OF FERPA What recourse is available should I feel my rights or the rights of my child have been violated under FERPA? A recent Supreme Court decision ruled that individuals do not have the right to sue under FERPA. In other words, there is no private right of action. (John Doe v. Gonzaga University, 143 Wash. 2d 687, 24 P. 3d 390) http://supct.law.cornell.edu/supct/html/01-679.ZS.html The only option available to parents under FERPA is to file a complaint with the Family Policy Compliance Office of the U.S. Department of Education. They are responsible for investigating, processing, reviewing, and adjudicating violations and complaints. Unfortunately, hearings are only conducted in regional offices. All other functions are performed from the Washington, D.C. office. See the Resources at the end of this fact sheet for contact information. We recommend that before filing a complaint with the Compliance Office you exhaust your options for redress at the local level. This may mean contacting your school principal or district office in writing. It may also mean attending a board of education meeting to have your issue heard. Keep in mind that the FERPA office will follow many of these same steps. They will begin their investigation, in most cases, with a letter of notification to school officials. It may save time and minimize distress to contact your school officials directly. The process of achieving a positive outcome from the school district may be shortened by approaching officials first. Once the FERPA Office becomes involved, the school district may not be willing to discuss the issue with you directly. Sometimes the direct, personal approach is all that is needed to resolve the complaint. What happens if an educational institution is found to be in violation of FERPA? That institution may be cut off from federal funding. This would be an extreme case and has not yet been implemented in FERPA’s 30-year history. More likely, the FERPA office would require the school district to document and implement a policy and procedure to ensure that similar violations do not occur in the future. 4. MILITARY RECRUITERS The No Child Left Behind law (NCLB), signed into law in 2002, requires schools to provide military recruiters with access to secondary school students’ names, addresses, and telephone listings. FERPA also allows access, but the No Child Left Behind law gives it teeth. Schools must comply or risk losing federal funds. NCLB amends the Elementary and Secondary Education Act (ESEA), the principal federal law affecting education from kindergarten through high school (K-12). Although NCLB deals primarily with issues such as learning standards and testing, it also includes two little-known provisions regarding privacy – military recruitment, which we discuss here, and surveys, covered below. The Department of Education web site on NCLB is www.nclb.org. Can I prevent military recruiters from obtaining information about my child? Yes. Your school must notify parents and secondary school students of the option of withholding that information from military recruiters. Look for this "opt-out" opportunity in notices typically sent by the school at the beginning of the year. Private secondary schools that maintain a religious objection to military service do not have to provide student information to recruiters. There has been controversy regarding the provision since its inception. The boundaries and effects of this law have yet to be tested. To read a variety of viewpoints on the NCLB's military recruitment provision, use a search engine and search on the words "military recruitment no child left behind." (Do not include quotation marks in the search.) The military supplements the contact lists it receives from schools with its own program. So even if your child has chosen to be removed from the lists shared with recruiters by the school, the military obtains contact information about 11th- and 12th-graders from driver's license applications, the Selective Service System and commercial vendors. To opt-out, send a letter with the student's full name, street address, city, state, ZIP code, telephone number and date of birth to: Joint Advertising Market Research and Studies Attention: Opt Out" 4040 N. Fairfax Drive, Suite 200 Arlington, VA 22203-1613 For more information on opting out, and for sample opt-out letters in English and Spanish, visit the New York ACLU's web site, http://milrec.nyclu.org/2a.html. Also visit the Leave My Child Alone website at www.leavemychildalone.org. 5. VIDEOTAPING AND PHOTOGRAPHING Can my child be videotaped or photographed at school without my permission? FERPA does not have a provision regarding videotaping of students. However, once a videotape or photo is created and kept by the school, it becomes part of the student's education record and is protected under FERPA. In addition, depending on who is conducting the taping or photography and for what purpose, other protections may be granted under the Protection of Human Subject federal “common rule,” discussed further in Part 7 on surveys below. (45 CFR.Part 46) Each school or district should have a policy regarding videotaping and photographing that includes a consent provision. The policy should contain provisions regarding videotaping and photographing students who participate in non-school activities that take place on or in their facilities. Ask for a copy of the policy. If the school has none, contact the administration and board in writing and suggest that they develop such a policy. 6. INTERNET PUBLICATION OF INFORMATION AND/OR IMAGES Can images or information on my child be posted on the school’s web site without consent? It depends. Publication on the Internet is considered a "disclosure" of information from the education record and must comply with FERPA. Information in the aggregate can be posted if students are not identified. However, directory information may be posted (released) without parental consent and in compliance with FERPA. That is why it is important to request, in writing, that the school not release directory information about the student. School-supported clubs and organizations must comply with FERPA regulations. However, for activities like little league or soccer clubs, photographs are often taken and even posted on web sites that are not associated with the school. This is not governed by FERPA. We recommend that you inquire about the web site privacy policy of all clubs in which your child participates. Insist that they obtain your permission before posting anything about your child on the Internet. 7. SURVEYS AND QUESTIONNAIRES My child is often given questionnaires or surveys in school. How can I protect my child from inappropriate questioning or improper use of private information? The Protection of Pupil Rights Amendment (PPRA) and the No Child Left Behind Act of 2001 govern surveys in publicly funded schools. The rules are designed to control the use, dissemination, and protection of the data. (20 USC §1232h; 34 CFR Part 98) The PPRA requires that parents provide written consent before students are given a survey conducted by the U.S. Department of Education and supported by federal funds. The law governs surveys, analyses, and evaluations that include questions on these topics: * Political affiliations * Mental and psychological problems that are potentially embarrassing * Sex behavior and attitudes * Illegal, anti-social, self-incriminating, and demeaning behavior * Critical appraisals of family members * Legally recognized privileged relationships, such as those of lawyers, physicians, and priests * Religious practices, affiliations or beliefs * Income other than that required by law to determine eligibility for financial assistance. For additional information about PPRA, visit the U.S. Department of Education web site at www.ed.gov/policy/gen/guid/fpco/ppra/index.html. How has the No Child Left Behind Act of 2001 changed my rights under FERPA? The No Child Left Behind Act was signed into law by President Bush in January of 2002. The Act requires school districts to meet new educational standards to continue receiving federal aid. In addition, school districts are required to develop policies and procedures to protect the personal information of children from marketing groups and testing companies. (www.nclb.org) The law applies to companies that provide school districts with information technology systems or Internet service as well as the more traditional written surveys. School districts must provide annual notices to parents about any plans for commercial surveys. Parents must be given an opportunity to review the survey and can veto their child’s participation. In addition, the Act prohibits the development of a nationwide database containing personally identifiable information on individuals who participate in surveys or other data-gathering processes. With the passage of the No Child Left Behind Act, schools and organizations that administer the surveys must also make instructional material available for inspection by parents if that material will be used in connection with an Education Department-funded survey, analysis, or evaluation. When a survey is funded by an organization other than the U.S. Department of Education, new policies must be adopted to protect student privacy. Parents may inspect a survey created by a third party before it is administered. Arrangements must be made to protect student privacy when surveys are conducted that contain questions on topics covered in the PPRA (listed above). The school must adopt policies on the administration of physical examinations and health screenings as well as the collection of personal information for marketing. Parents also have the right to inspect any instructional material used as part of the curriculum. The educational institution must notify parents of these policies at least once a year. Ask for a copy of the school or district policy on when and how parents are notified of surveys and screenings in which students participate. Learn how to take advantage of the opt-out options available to you. The law requires schools to offer parents the opportunity to opt-out of the following: * Activities involving the collection, disclosure, or use of personal information collected from students for marketing purposes. * The administration of any non-Department of Education funded survey that contains one of the eight items listed above in the section on the PPRA. * Any non-emergency, invasive physical examination or health screening that is required as a condition of attendance or is not necessary to protect the immediate health and safety of the student or other students. Be aware, however, that certain surveys are exempt from this provision. Surveys or other techniques that are used to develop educational items, book clubs, and the like do not face the same restrictions as other surveys for commercial purposes because of their perceived benefit to the educational process. If your child is asked to participate in an ongoing study, additional privacy protection is granted under the federal “common rule entitled” Protection of Human Subject. (45 CFR Part 46) This provision is called a federal common rule because seventeen federal agencies subscribe to it, and so it is "common" to those agencies. 8. SURVEILLANCE CAMERAS Can my child’s school place surveillance cameras throughout the halls and classrooms? Yes. Since the Columbine school shootings in 1999, many schools have installed surveillance cameras in an effort to keep schools safe. Cameras may be placed in areas except those where individuals would have a "reasonable expectation of privacy," such as restrooms. Many schools are now installing cameras in the classrooms as well as hallways and common areas. There are many unanswered questions about the effectiveness and long-term impacts of video surveillance. Do cameras deter crime, or do they just move it to other areas? Does pervasive surveillance have harmful impacts on students and teachers? While some praise the cameras, others criticize video surveillance for promoting an atmosphere of mistrust and suspicion. We are not aware of conclusive statistics that prove whether or not cameras are effective in curtailing violence and other criminal behavior. If cameras are installed, we recommend that the school adopt a privacy and security policy that covers the rights and responsibilities of students, teachers, and other school personnel. The policy should include the purposes of video surveillance, who will have access to the stored tapes or files, how long the tapes will be stored, destruction of tapes and/or digital files, and to what uses the tapes will be put. Students and teachers should be advised if tapes will be used to judge performance. Ask for a copy of the school or district policy on the use of surveillance cameras. If the school has no such policy, or if you feel its policy does not properly spell out the school’s practices regarding purpose, access, storage, retention, destruction, and related matters, raise your concerns in writing with the administrators and the board. 9. ISSUES SPECIFIC TO COLLEGES AND UNIVERSITIES FERPA applies to any post-secondary institutions that receive funds from the U.S. Department of Education. Are college disciplinary proceedings protected by FERPA? There is a distinction between disciplinary actions for violations of rules and violent offenses. Violations of school policies become part of the education record and are protected under FERPA. The Student Right to Know and Campus Security Act of 1990 created exceptions for violent crimes and sexual assault. A victim of a crime of violence or a sex offense may be informed of the final results of any disciplinary proceeding against the accused. If the accused is found to have committed the acts, the public may be informed of the result as well. This law states final results of any disciplinary proceeding can only include the name of the student, the violation committed, and any sanction imposed by the institution on that student. The name of the victim or any witnesses can only be included with their written consent. Can a student request copies of letters of recommendation sent to a college? Students may request and receive copies of letters of recommendation dated after January 1, 1975, unless they sign a waiver relinquishing that right of access. Even after signing a waiver, a student may request the names of the persons furnishing recommendations. If a letter is used for any purpose other than as a recommendation, any waivers become invalid and the student may receive copies. A school may not require that a student sign a waiver in order to be accepted at the school or to receive financial aid or any other services from the school. Can adult-age students review their medical or psychiatric records stored by the school? Under FERPA, medical and/or psychological records of an adult-age student or a student who attends a post-secondary institution that receives public funds, are not considered education records. This is only the case, however, if those records are maintained by health care professionals and are used only for treatment purposes. A student may request that the health care professional release records to another health care provider at any time. Many schools are now choosing to include these records as part of a student's education record, thus allowing the student access at any time. The HIPAA Privacy Rule, implemented in April 2003, does not override this provision. For more information on this medical privacy rule, read our guide, “HIPAA Basics: Medical Privacy in the Electronic Age,” www.privacyrights.org/fs/fs8a-hipaa.htm. Can adult-age students review financial records of their parents placed in their educational files? No. Financial records of parents are not released to adult-age students attending post-secondary institutions. (31 USC 1232g(a)(1)(C)(i)) What are the impacts of the terrorist attacks of 9-11 on foreign students? The USA Patriot Act was passed into law just weeks after the terrorist attacks of September 11, 2001. The Act expands the powers of agencies like the FBI and the CIA. Those expanded powers include tracking communications on the Internet, telephone, and computer wiretapping, and easier access to personal information such as medical, financial, and education records. (P.L. 107-56 October 26, 2001) How has the USA Patriot Act altered how colleges and universities collect and disseminate information regarding their international students? The Student and Exchange Visitor Information System (SEVIS) is a foreign student tracking database mandated by the USA Patriot Act. The database is to be used to track and monitor international students, numbering over 500,000 by some estimates. The information collected and shared with the Bureau of Immigration and Customs Enforcement includes the amount and sources of funding, arrests, disciplinary action, off campus employment, changes in address, and enrollment data. Schools are electronically notified when a student has entered the United States. If that student does not register within thirty days of that date, the college must notify the Bureau of Immigration and Customs Enforcement. A college or university not utilizing the SEVIS database may not accept foreign students. As of February 15, 2003, all universities and colleges that are hosts to international students must use SEVIS to report certain biographical information to the federal authorities. This information is recorded for persons holding F-1 and J-1 visa status. As of August 1, 2003, all international students, except those holding diplomatic passports, must be recorded. Spouses and children of international students must also be entered into the database. For additional information on SEVIS, visit the web site of the Bureau of Immigration and Customs Enforcement, www.bice.immigration.gov/graphics. The Bureau was formerly the Immigration and Naturalization Service (INS). It is now a part of the Department of Homeland Security. 10. RESOURCES Filing Complaints under FERPA * U.S. Department of Education Family Compliance Office Family Policy Compliance Office U.S. Department of Education 400 Maryland Avenue, SW Washington, D.C. 20202-4605 Telephone: (202) 260-3887 E-mail: ferpa@ed.gov Web: http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html For advice on how to file an effective complaint, read the Department of Education’s web page on “FERPA General Guidance for Parents,” http://www.ed.gov/policy/gen/guid/fpco/ferpa/parents.html Other U.S. Department of Education Web Sites * Protection of Human Subjects Information www.ed.gov/offices/OCFO/humansub/overview.html * Protection of Pupil Rights Amendment www.ed.gov/policy/gen/guid/fpco/ppra/index.html * No Child Left Behind Act Telephone: (888) 814-NCLB TTY: (800) 437-0833 E-mail: nochildleftbehind@ed.gov Web: www.nclb.gov Additional Resources for Parents * American Civil Liberties Union Web page on student rights, including drug testing www.aclu.org/StudentsRights/StudentsRightsMain.cfm * Drug Policy Alliance “Safety First: Parents, Teens and Drugs” www.drugpolicy.org and www.safety1st.org * Electronic Privacy Information Center Student privacy page, www.epic.org/privacy/student * ERIC web site directory of education departments in the 50 states www.ericeece.org/statlink.html * Federal laws, web site of Cornell Law School www.law.cornell.edu * Home School Legal Defense Association P.O. Box 3000 Purcellville, VA 20134-9000 Telephone: (540) 338-5600 E-mail: info@hslda.org Web: www.hslda.org Digging Deeper: Related Reports on Privacy and Education * Issues in Education Data Confidentiality and Access and Compilation of Statutes, Laws, and Regulations Related to the Confidentiality of Education Data. A Report by the National Forum on Educational Statistics. 1994. US Government Printing Office, ISBN 0-16-045075-6. http://nces.ed.gov/pubs97/p97527/lk_2stud.asp * Privacy and the Handling of Student Information in the Electronic Networked Environments of Colleges and Universities. Published by CAUSE, the Association for Managing and Using Information Resources in Higher Education. 1997. Task force members: Susan Ferencz, Laurence Alvarez, Glair Goldsmith, Kathleen Kimball, Robert Morley, Trang Pham, Robert Ellis Smith, Steven Worona, and Virginia Rezmierski. www.nchems.org/Publications/privacyandhandling.htm * AACRAO 2001 FERPA Guide. Published by AACRAO, American Association of Collegiate Registrars and Admissions Officers. Authors Richard Rainsberger, Eliott Baker, Dennis Hicks, Brad Myers, Jim Noe, and Faith Weese. 2001. www.aacrao.org/compliance/ferpa * Guidelines for Postsecondary Institutions for Implementation of the Family Educational Rights and Privacy Act of 1974 as Amended. 1995. Prepared by Committee for AACRAO. AACRAO office (202) 293-9161. * Identifying Where Technology Logging and Monitoring for Increased Security End and Violations of Personal Privacy and Student Records Begin. By Virginia Rezmierski and Nathaniel St. Clair, II. 2001, AACRAO. The authors found that logging records that show the electronic transactions of students could be considered as education records. Available at www.aacrao.org/publications.html and www.educause.edu/policy/policy.html. This guide has been developed with funding from the Judith and Alfred A. Rosenberg Family Foundation. It was researched and written by Cathy McCarthy, Esq., on contract with the PRC.