New federal rules released Thursday purport to give schools and colleges greater discretion to limit access to student directories to select users for select purposes.
However, it isn’t clear how much practical effect — if any — the rules will have in public schools and colleges, where student directories generally are already obtainable through state open-records laws.
The U.S. Department of Education (“DOE”) came out Thursday with its latest reinterpretation of the Family Educational Rights and Privacy Act (“FERPA”), the federal privacy law that often bedevils journalists attempting to get records from educational institutions.
FERPA, also known as the Buckley Amendment, gives parents access to their children’s education records (or gives access to the students themselves, once they turn 18), and requires schools to enforce policies restricting outside parties’ access to confidential student records.
The change getting the most attention would clarify that auditors and academic researchers can get access to student data — even with students’ personally identifying information included — as long as they use it only for auditing and research purposes, refrain from disclosing it to others, and destroy anything individually identifying when they are through using it.
But the change of greatest potential interest to news organizations is a change affecting access to student directories.
Right now, if a school designates certain basic student data (name, address, etc.) as “directory information,” then that information may be publicly released to anyone, regardless of student or parental consent. Journalists often use these directories, especially at colleges, to track down sources on deadline.
The new regulation allows — but does not require — schools to make the disclosure of directory information more selective, limiting access to certain users and/or for certain authorized purposes:
In its public notice to parents and eligible students in attendance at the agency or institution … an educational agency or institution may specify that disclosure of directory information will be limited to specific parties, for specific purposes, or both. When an educational agency or institution specifies that disclosure of directory information will be limited to specific parties, for specific purposes, or both, the educational agency or institution must limit its directory information disclosures to those specified in its public notice.
In other words, once the school publicly announces something like, “Directory information will be released only to charitable or other non-commercial users,” then — as the DOE characterizes it — the school may not disclose to anyone else.
When the rules were released in draft form earlier this year, news organizations including the Student Press Law Center filed comments expressing concern that the invitation to selectively restrict access to student directories could become a tool of retribution to punish disfavored media outlets for unwelcome news stories.
In its final rules, the Department acknowledged the concerns but did not revise the rules in response. Instead, the agency gave schools some non-binding guidance: “We encourage school officials to act responsibly in developing a limited directory information policy and to keep in mind routine disclosures that schools need to make in the normal course of business, including providing properly designated directory information to the media about various student activities and extracurricular pursuits of students.”
The DOE acknowledges, but does not resolve, the tension between its rule and state open-records statutes. Under most, if not all, state sunshine laws, a compilation of students’ names and addresses would be a public record accessible to anyone on request.
While a school might be able to deny an open-records request if federal law absolutely forbids the release — for instance, if the requester asked for a student’s medical charts — it is a different matter to say that a school can refuse an open-records request because of its own voluntarily adopted privacy policy.
If the two come into conflict — if a news organization files a freedom-of-information request for a student directory and is refused access on the grounds of a school’s voluntarily adopted limitation on access — it seems unlikely that the self-imposed limitation could trump the statutory requirement to disclose.