New Guidance on the Family Educational Rights and Policy Act (FERPA)

The Family Educational Rights and Policy Act (FERPA), amended effective January 3, 2012, includes new definitions for two previously undefined terms. “Authorized representative” and “education program” are now more broadly interpreted to implement FERPA in a way that protects the confidentiality of education records while allowing improved access to data. This will facilitate the evaluation of education programs and, according to the Secretary of Education, ensure that “limited resources are invested effectively.”

The regulation states that “educational agencies and institutions are permitted to nonconsensually disclose Personally Identifiable Information (PII) to ‘authorized representatives’ of State and local authorities, the Secretary, the Attorney General of the United States, and the Comptroller General of the United States, as may be necessary in connection with the audit, evaluation, or the enforcement of Federal legal requirements related to Federal or State supported education programs.”

New guidance from the Department of Education rescinds the earlier, restrictive interpretation of authorized representatives. The amended regulation defines authorized representative as “any entity or individual designated by a State or local educational authority or an agency headed by an official listed in Section 99.31(a)(3) who is involved in Federal- or State-supported education programs.” This is interpreted to mean that state and local education authorities are now allowed to share data with other government agencies or individuals that are not under their direct control, as long as they are involved in federal- or state-supported education programs. Thus, a researcher conducting an evaluation of an educational program at the request of a state or local authority is an authorized representative. It is important to note that the regulations do not list new reasons an individual or an entity may be designated as an authorized representative. As before, the designation may be made only for the purpose of conducting an audit, evaluation, or enforcement or compliance activity.

The amended regulation also expands the definition of “education program” to encompass “any program that is principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, and any program that is administered by an educational agency or institution.” The purpose of the broader interpretation is to include programs such as bullying prevention, cyber-security education, and substance abuse and violence prevention, when they are administered by an educational agency or institution. The department’s definition of “education program” is intended to facilitate the disclosure of PII from education records, as necessary, to evaluate a broad category of programs.

The amendment clarifies that “FERPA-permitted entities are not prevented from redisclosing PII from education records to conduct studies for, or on behalf of, educational agencies and institutions.”