ED Reminds Schools to Review FERPA Policies and Notices During COVID-19

The U.S. Department of Education’s Student Privacy Policy Office (SPPO) recently reminded school districts and schools that receive funds from the Department to review and, if necessary, revise policies, procedures, and notifications to parents about the “school officials” and “directory information” exceptions to the Family Educational Rights and Privacy Act (FERPA) in light of changes to the use of technology during remote learning. The SPPO also recommended that educational institutions work with their attorneys and information security specialists to vet all prospective technology applications and tools for FERPA compliance before implementing them for remote learning.

As the SPPO recognized, two exceptions to FERPA—the exception for releasing information to “school officials” with “a legitimate educational interest” and the exception for “directory information”—are particularly important to schools now during the coronavirus disease 2019 (COVID-19) public health crisis. Both of these exceptions allow schools to release certain student identifying information to vendors of video and other technology applications and tools without parental consent. Schools are required to provide an annual notification of rights to parents, including when and to whom the school releases student record information to “school officials” for “a legitimate educational interest.” FERPA also requires schools to have a directory information policy that indicates when the school will share “directory information” with third parties without parental consent.

While these polices, procedures, and notifications may typically be quite general and are often not top of mind for school leaders, because of the uptick in the use of online applications and tools during remote learning schools should heed the SPPO’s call and review and revise relevant documents. The SPPO also used this opportunity to once again remind schools of the importance of vetting all new technology that might require sharing student information before implementing it for use. We addressed this issue in a prior alert, which contains essential information for school leaders wishing to follow the SPPO’s recommendations.

For more information on complying with FERPA and other legal requirements implicated in remote learning, contact the authors of this alert or any other Franczek Attorney