A FERPA Fact double header: Do privacy laws really make it illegal to warn the campus about rapes?

A college in Minnesota and a high school in Georgia are both facing uncomfortable questions about why they delayed notifying the public about reported sexual assaults on campus. Their responses: FERPA made me do it.

In Minnesota, Gustavus Adolphus College sent a campus-wide email alerting the public to a sexual assault – nearly two weeks after the accused perpetrator had already been arrested and criminally charged. The university said that, regardless of the criminal charges, the Family Educational Rights and Privacy Act forbade disclosing information about what was, at the time, a still-ongoing disciplinary proceeding.

And in Georgia, administrators at Athens-area Cedar Shoals High School decided that, even though they’d seen security video of a student being sexually assaulted by multiple assailants in a campus stairwell, they’d wait a month to let the community know – only after news of the accused students’ arrests hit the local media.

Sources: Flagpole Magazine, “How Could the Scandal at Cedar Shoals Happen?” (2/14/2016) and Mankato Free Enterprise, “Gustavus administration alerts campus to sexual assault weeks later” (2/25/2016)

Former Executive Director Frank LoMonte: You have to ask yourself about the risk/reward-assessment skills of the people making judgment calls in schools these days.

If you warn the campus prematurely in a way that (let’s indulge this fiction for a moment) puts you in violation of FERPA, you get a warning letter from the Department of Education telling you not to make a habit of doing that.

If you warn the campus belatedly, you put other people in danger of getting raped. Oh, also you violate a different federal law that, unlike FERPA, actually carries penalties.

Doesn’t seem like it should be a hard choice, right?

It’s like seeing an oncoming car in your lane and having trouble deciding whether avoiding the head-on collision is worth wearing out your brakes. It’s like hesitating to start CPR on a dying guy because you’re worried the compressions might wrinkle his shirt. 

In the first place, it’s completely possible – indeed, commonplace – to release the what/where/when of a crime without releasing the “who,” and only the “who” implicates FERPA at all. “Dear parents, it may interest you to learn that we just turned three students over to the police on suspicion of committing a rape inside the building, and oh BTW they’re all still attending to the school just on the off chance that’s something you’d care about” is a perfectly FERPA-compliant notice that jeopardizes no confidences.  

Even the U.S. Department of Education, which isn’t exactly noted for recognizing sensibly limited boundaries to FERPA, has told schools and colleges repeatedly that they can lawfully release students’ otherwise-confidential information when necessary to protect public safety.

If administrators at Gustavus were right that FERPA precludes issuing the federally required “timely warning” of campus safety hazards if there’s a disciplinary case under investigation, “timely warnings” would become “eventual warnings.” (Or campus disciplinary boards would need all-night drive-thru windows like Taco Bell.) So yeah, that’s definitely not true.

Gustavus could have told the campus as soon as it learned that a student reported being raped on campus, and so could Cedar Shoals – especially since in both instances the cases became police matters. FERPA protects only information gleaned from education records, and if the institutions could have given the public meaningful information by relying on police records, then FERPA presented no impediment. 

We rate this: Not protected by FERPA at all