FERPA
By Gareth HoyleLast updated How we research
FERPA is the Family Educational Rights and Privacy Act, which bars schools receiving federal education funds from disclosing student records without consent, with exceptions.
FERPA is the Family Educational Rights and Privacy Act, 20 USC 1232g, which protects the privacy of student education records. It applies to schools and education agencies that receive funds under US Department of Education programs, and it generally requires written consent before personally identifiable information from education records is disclosed.
What exceptions does FERPA allow?
34 CFR 99.31 lists exceptions. Vendors can receive records as school officials if they perform an outsourced function under the school's direct control and follow redisclosure limits. Organizations conducting studies for a school can receive records under a written agreement, and must destroy the information when it is no longer needed.
Can de-identified student data be licensed?
Section 99.31(b)(1) allows release without consent "after the removal of all personally identifiable information", provided a reasonable determination is made that a student's identity is not personally identifiable, taking into account other reasonably available information. Edtech companies holding records as school officials usually cannot relicense them, because their school contracts and the redisclosure rules limit them. See our publishers and education page.
In the UK and EU, student records are personal data under GDPR, and data about children needs particular care.