The United States Department of Education (“Department”) has modified its investigatory practices to address and resolve complaints and violations of the Family Educational Rights and Privacy Act (“FERPA”), as stated in its guidance document titled “Improving the Effectiveness and Efficiency of FERPA Enforcement.” FERPA applies to all educational agencies (e.g., school districts) and institutions (i.e., public elementary and secondary schools and postsecondary institutions) that receive funds under any program administered by the Secretary of Education. The Secretary must take appropriate actions to enforce FERPA and to investigate violations.
Typically, under the FERPA regulations, the Department has “formally” investigated all timely FERPA complaints that it receives from parents and eligible students. However, final determinations often take months or even years to complete. In some instances, the investigation continues after the underlying issue has been resolved or the student no longer attends the educational agency or institution. The Department has recognized that investigations should entail a shorter period of time, and it shall make a case-by-case determination on the best mechanism to address a timely FERPA complaint.
Going forward, the Department will not formally investigate every FERPA complaint. Formal investigations will still occur in matters deemed to required them because of their significance. In lieu of a formal investigation, the Department will weigh the feasibility and propriety of acting as an intermediary or providing resolution assistance. In determining when to conduct a formal investigation, the Department will prioritize the highest risk complaints based upon “the severity of risk to student privacy, the number of students affected, [and] other relevant factors.” The Department will also continue to conduct self-initiated investigations in the absence of a filed complaint.
As an example of where the Department envisions acting as an intermediary, it cites complaints implicating a parent’s or eligible student’s right to access or amend the student’s education records, which are typically time-sensitive matters and frequently arise out of misunderstandings regarding FERPA’s requirements. Also, a large number of complaints involve isolated incidents of inadvertent or accidental disclosures of student education records or personal identifying information within the records. The appropriate response may entail assisting the educational agency or institution in improving its policies, practices and security controls to prevent future incidents. If a complaint cannot be resolved through resolution assistance, the Department will determine—on a case-by-case basis—whether additional action is required.
The Department’s guidance should come as welcome news to agencies and institutions subject to FERPA, as data management and privacy pose often vexing challenges particularly with electronic records. The Department seeks to undertake a more interactive and cooperative resolution of FERPA complaints, without subjecting the funding recipient in every instance to the potential stigma, costs and impacts of a prolonged formal investigation.