FERPA Compliance

FERPA protects the privacy interests of students in their education records. It generally prohibits the disclosure of a student's personally identifiable information from education records without the consent of the parent or eligible student. An eligible student is one who reaches the age of 18 years old and/or attends a post-secondary educational institution, in which case the rights of the parent transfer to the student.

Under StudentTracker for High Schools, districts disclose personally identifiable information about their high school students to the National Student Clearinghouse. They do so in compliance with FERPA, as there are several circumstances under which the general prohibition against nonconsensual release of information does not apply. This document will discuss them.

The StudentTracker for High Schools program for high school districts currently comprises two distinct services:

1. StudentTracker - Districts transmit the names, dates of birth and graduation dates of their former students to the Clearinghouse. The Clearinghouse compares the data to its post-secondary student record database from over 3,000 colleges and universities. It transmits to districts summary reports and detailed records of the college enrollment of their high school alumni, identifying colleges where they enrolled, attendance dates, degrees earned, etc.
   
   
2. DiplomaVerify - Districts transmit the names of their high school graduates, high schools from which they graduated, identification numbers (e.g., Social Security numbers or other student IDs), birth dates, and graduation dates to the Clearinghouse. Employers and their agents contact the Clearinghouse to perform pre-employment verifications of the diplomas claimed by job applicants. They provide names of job seekers, names of high schools, Social Security numbers, birth dates, and dates of graduation. Provided that the employer has the written consent of the job applicant for release of education records, the Clearinghouse confirms the diplomas.

The U.S. Department of Education's Family Policy Compliance Office (FPCO) has the responsibility to enforce FERPA and interpret its applicability. FPCO has issued legal opinions concerning the FERPA compliance of StudentTracker and diploma verification activities.

FERPA Compliance of the StudentTracker Service

On August 2, 1999, FPCO issued the Clearinghouse a letter stating, "…the StudentTracker program complies with the requirements of FERPA regarding the release or disclosure of personally identifiable information from education records on a nonconsensual basis." The letter can be viewed and downloaded from FPCO's Web site. 

The crux of FPCO's opinion is that high schools may release data to the Clearinghouse without obtaining written consent, when the information released is "directory information." Directory information is defined as information about students that is generally not considered harmful or an invasion of privacy if disclosed, such as:

"The student's name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received and the most recent education agency or institution attended by the student. 20 U.S.C. §1232g(a)(5)(A).

The data elements that high schools release to the Clearinghouse under the StudentTracker service (i.e. student names, dates of birth, graduation dates) are all within the permissible directory information parameters. Schools must designate the kinds of information they want to include in their definition of directory information, and they must publicly notify parents and students about their definition and their right to block the release of such information without their consent. By following these practices, high schools can utilize StudentTracker in a FERPA compliant manner.

FERPA Compliance of the DiplomaVerify Service

FPCO has written an opinion that the disclosure of personally identifiable information, including SSNs, may be made on a nonconsensual basis to third-party service providers, such as the National Student Clearinghouse (NSC), in connection with agreements to supply diploma verification activities. FPCO's opinion letter can be viewed and downloaded from FPCO's Web site.

The letter states:

"... NSC maintains education records on behalf of certain schools that have contracted with NSC to provide enrollment and degree verification services for such schools. This Office has previously advised schools that they may use outside entities, such as NSC, to provide verification services consistent with the requirements of 34 CFR §99.31(a) and §99.7(a)(3)(iii). FERPA contains an exemption to the prior written consent requirement that permits an educational agency or institution to disclose personally identifiable information from education records to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests. 34 CFR § 99.31(a)(1). Thus, an organization such as NSC, by virtue of a contractual relationship with an educational agency or institution, may be considered a school official with legitimate educational interests under 34 CFR §99.31(a)(1) subject to the provisions of 34 CFR §99.7(a)(3)(iii).

... It is our understanding that a requester who uses NSC's Degree Verify service has prior, written consent from the student permitting access to information in education records maintained by NSC on behalf of a school. In other words, this prior written consent would permit NSC to match the student's SSN in its database with the SSN submitted by the requester for identification purposes incident to a search of its database for purposes of providing degree or enrollment verification information."

High school districts may participate in the DiplomaVerify service on a FERPA compliant basis. They may disclose to the Clearinghouse personally identifiable information, including social security numbers, on a nonconsensual basis, as the Clearinghouse is designated as a "school official" and there are "legitimate educational interests" in outsourcing diploma verification activity for the benefit of its graduates and the efficiency of its own administrative process.