Privacy rules could stunt access

Proposed changes to the regulations governing the Family Educational Rights and Privacy Act could result in denying access to information that would be crucial to keep schools accountable, some First Amendment advocates say.The U.S. Department of Education’s Family Policy Compliance Office currently is reviewing 121 comments made about the changes and expects to finalize the proposal sometime in December, said Jim Bradshaw, a spokesman for the Department of Education. Once finalized, the changes are expected to take effect in January 2009.Comments from several organizations, including the Student Press Law Center, expressed concern that some language in the proposal might be overly broad and would allow schools to deny access to records that would otherwise be open under the statute.FERPA forbids schools and colleges that receive federal funding from releasing individual students’ educational records to the public, with a few exceptions for information that has personal identifying information redacted or that does not pertain to a specific student.The Department of Education is in charge of administering and enforcing FERPA, and periodically issues clarifying regulations that implement the statute.Confusion on former studentsU.S. Secretary of Education Margaret Spellings proposed a change to the definition of educational records clarifying that records created or received after a student leaves school — and that are not directly related to the student’s attendance — would be excluded from FERPA protections. The Department of Education wrote in the Federal Register that there has been some confusion among schools about the provision excluding alumni records from the definition of educational records.”Some schools mistakenly interpreted this provision to mean that any record created or received after a student is no longer enrolled is not an education record under FERPA,” the department wrote.The department provided an example of what would be considered private under the proposed changes to the regulation: a settlement agreement about events that happened when a student was enrolled.But a settlement agreement is precisely the kind of document that might be newsworthy, the SPLC wrote in its comments. A settlement could involve sexual harassment by an instructor, an injury due to the school’s negligence or any other instance where disclosure would be necessary to hold the institution accountable, the SPLC wrote.”By using a settlement agreement’ as an example of a confidential record, the Department sends a very dangerous message to schools — a message that invariably will multiply the already alarming number of wrongful FERPA-based denials,” wrote Frank LoMonte, SPLC executive director, in comments to the department.But some privacy advocates argue that the rule does not go far enough in protecting confidentiality. By declaring that FERPA does not cover records received after a student’s enrollment unless the document directly relates to the student’s attendance, the department is creating a new exception that is “not found in the statute, is without authority and is potentially damaging,” wrote the Center for Law and Education (CLE), a non-profit organization that provides legal assistance in low-income communities.The Center argued in its comments that a school could continue to collect information about its former students, including negative information such as allegations of criminal activity, and that information would not be treated as a confidential educational record under the proposal.An education record is an education record whether the person it involves is in attendance at the time or not, said Kathleen Boundy, CLE co-director.Boundy asked that the Family Policy Compliance Office consider students who have dropped out, been expelled or who intend to re-enroll. Data the school collects on a student between attendance periods could be considered unprotected information under the proposed rule, she said.”Although the definition of student properly includes former students, this exemption from the definition of education record’ undermines the former student’s ability to exercise his rights under the statute,” Boundy wrote in an e-mail to the SPLC.Reading minds?While FERPA requires schools to withhold records that contain educational information about named individuals, proposed changes could effectively expand FERPA by denying information that is “linked or linkable” to a specific student, even if the information does not name or identify any student. The proposal also says schools should refuse information to a requestor if the institution believes the requestor has “direct, personal knowledge of the identity of the student to whom the educational record directly relates.”Some fear this language adds a subjective standard that entrusts too much discretion to school officials to make judgment calls on releasing or withholding documents.”The Department’s proposal would require school employees to read the minds’ of people requesting public documents, with the illogical result that the very same piece of paper will be an open record to one requestor and a confidential educational record to the next requestor, based on the subjective judgment of a school employee,” LoMonte said in a written statement.Betsy Hammond, an education reporter for The Oregonian, wrote comments on behalf of the Education Writers Association saying that the proposal runs the risk of closing the doors to performance data because disclosing information by students’ grade levels or ethnicities could reveal information that is “linked or linkable” to a particular student.Hammond also said that both education reporters and parents might have trouble accessing records because they are likely to know students at the school and have the ability to connect them to the records at hand.For instance, parents of an eighth-grade student might be ineligible to receive statistics on dropout rates because they are likely to have direct knowledge of many of their children’s classmates.”These unintended consequences of proposed changes in language regarding personally identifiable information’ mean the definition must be further refined to protect the public [interest] in being able to scrutinize the performance of public schools,” Hammond wrote.Clifford A. Ramirez, who worked in the Registrar’s Office at the University of California at Los Angeles, said that the regulations are not meant to impede or obstruct the evaluation of academic programs or the ability of citizens to hold schools accountable.Ramirez said the school can release redacted information — such as statistics on dropout rates — but the institution may also deny access if there is suspicion of a “targeted” request.”The institution must make a responsible judgment based upon privacy considerations, but also in regard to the safety of its students, parents and other members of the educational community,” Ramirez said in an e-mail to the SPLC.Many people from both sides of the open-records debate contend that as long as a document does not contain personally identifiable information or that particular information has been redacted, the record should be made available regardless of any other information the requestor may have.The statute defines personally identifiable information as a student’s name, social security number, student number, Internet identifiers, family members’ names and personal characteristics that would make the student’s identity easily traceable. Proposed changes to the Education Department regulations would add biometric identifiers — such as fingerprints — and other indirect identifiers such as the place and date of birth or mother’s maiden name.The CLE also suggests that further clarification of the “linked or linkable” standard is necessary, saying there is no need to question the motives of those who request records if the standards for personally identifiable information remain restricted to those authorized by the statute.Boundy said this change in the regulation is intended as further protection for students, which her organization advocates, but the standard is confusing.”This proposed language appears to create an unenforceable standard, transferring to the holder of the records responsibility for making a subjective determination of what is in the mind of the inquirer at the time of the request,” the CLE wrote.Balancing rightsCongress made changes to the FERPA statute via the USA PATRIOT ACT of 2001 and the Campus Sex Crimes Prevention Act. The Patriot Act changes allow schools to release information to the Attorney General — without consent or knowledge of the student — in connection with the investigation or prosecution of terrorism crimes. The Campus Sex Crimes Prevention Act makes an exception to FERPA allowing schools to release information about registered sex offenders who enroll at the institution. The school is instructed to make information about that student available to the campus community, campus law enforcement and local law enforcement agencies.Although these statutory changes went into effect seven years ago, the Family Policy Compliance Office said the agency is not required to make changes to the regulations every time an amendment is made, but that the agency enforces the statutory changes and provides written guidance until the regulations are amended to catch up with the statute.”Writing regulations is quite time-consuming and the more changes you have to make, the longer it takes to get everything through and to publication in the Federal Register,” Bradshaw said on behalf of the office. “Typically, we wait until we have several changes that need to be made before undertaking the regulatory process.”The amendments to department regulations, proposed in March, are meant to implement those changes made to FERPA by Congress. The proposed changes also make clarifications that arose from two Supreme Court decisions and “amendments that have been identified as a result of the [Department of Education’s] experience in administering FERPA,” according to the notice of proposed rulemaking.Changes also were made in response to the shootings at Virginia Tech. Those changes would allow campus officials to share more information about students’ mental health.The final regulations are expected to be published in December and — unless otherwise noted — will take effect 30 days after publication in the Federal Register. A discussion of the comments received that were relevant to the proposal will be published with the final regulations, Bradshaw said.”It is laudable that open records advocates continue to argue for vehicles to ensure the integrity of our public institutions,” said Ramirez, the former UCLA official. “Not to be forgotten in that dialogue, however, is consideration for the privacy of the citizens themselves. In other words, our Constitutional rights do not end at the First Amendment.”