If you’ve ever requested documents from your school through open records law and been denied or had substantial information redacted, there’s a good chance you’ve dealt with The Family Education Rights and Privacy Act, or FERPA.
This privacy law is a common barrier for student journalists looking to dig deeper into what’s happening at their school. Reporters who request records relating to campus sexual assault, police investigations or disciplinary records often find themselves stonewalled by FERPA.
FERPA is often misused by schools — either intentionally, to conceal unflattering information, or unintentionally, because the law is vague and administrators want to play it safe by erring on the side of privacy. Most school administrators are not FERPA or public records experts.
So let’s talk about FERPA: what it is, how it causes trouble for journalists, and how some journalists have fought back against misuses of the law.
What is FERPA?
FERPA is a federal law that gives parents the right to protect, view and amend their child’s educational records. When a student turns 18 years old or begins postsecondary school, all rights under FERPA transfer to the student.
FERPA applies to both public and private schools that receive federal funding.
Passed into law in 1974, then-Senator James Buckley proposed FERPA as an amendment to a bill extending the Elementary and Secondary Education Act of 1965.
In the nearly 45 years since the bill’s passage, there’s been a continual debate over what the law actually protects.
Student Press Law Center Staff Attorney Sommer Ingram Dean said that FERPA, originally designed to safeguard a student’s education records from manipulation or disclosure, has been misinterpreted and abused in ways to stonewall journalists and others seeking public records.
“Over the years … the definition of education records has become something that’s more loosely defined and schools use it to prevent student journalists from reporting on any events that happen at the school that school officials don’t want to get out to the public,” Dean said. “So that could be anything from a fight happening on campus, fraternity hazing incidents, sexual assault reports, anything like that.”
Sen. Buckley himself told the Columbus Dispatch in 2010 that “[t]he law needs to be revamped. Institutions are putting their own meaning into the law.”
Misuse of FERPA can be particularly frustrating for student journalists, who rarely have the resources to wage a long legal battle for records.
Most student newsrooms are hard-pressed just to pay the labor and photocopying costs for documents in records requests.
So if their records request is denied, taking their school to court is simply not feasible for most student publications. Unfortunately, that may be the only way to get a school to give up the records denied because of FERPA.
Jane Wester, editor-in-chief of The Daily Tar Heel during the 2016-17 academic year, said she had to recruit three other local media outlets to join the fight to be able to afford taking the University of North Carolina at Chapel Hill to court over FERPA. That also meant sharing the story they originally hoped to do themselves.
Lasting nearly three years, the case has moved through the North Carolina Superior Court, the state Court of Appeals and the state Supreme Court. This is another unique struggle for student newsrooms: because student staff graduate and move on, schools know they can probably wait students out and try the same tricks year after year. Did UNC really expect three different editor-in-chiefs to continue this fight?
The Daily Tar Heel is located in a region with established media companies who all have an interest in covering UNC and have joined in the legal push to make the records public. For student newsrooms in remote areas or in regions without a strong local media presence, it can be tough to find someone to take on your school with you.
When FEPRA gets invoked
FERPA protects the privacy of a student’s educational records. But what counts as an “educational record”? Some records are obvious: GPA, transcripts and attendance are always protected by FERPA.
Southeast Missouri State University violated student privacy law on Oct. 4, 2019 by accidentally emailing a list of students’ grades, academic standing and other personally identifiable information to around 50 students, the student newspaper the Arrow reported.
Even though the school’s FERPA administrator found this to be a violation of the law, Dean said a one-time incident of disclosing student records would likely not result in losing federal funding.
Not one school or university has ever lost federal funding for violating FERPA.
But other cases are less clear: can schools conceal surveillance footage from a school bus? What about withholding records of a student convicted of a crime?
In Ohio, media outlets are suing the Bellbrook-Sugarcreek School District for education records on Connor Betts, the man who killed nine people and then himself on Aug. 4 in Dayton, Ohio.
The school district is claiming FERPA protects these records, although Ohio’s attorney general filed a brief in the lawsuit claiming FERPA protections expire after a student’s death.
Broward School District in Florida also invoked FERPA in the case of Nikolas Cruz, who killed 17 people in February 2018 at Marjory Stoneman Douglas High School in Parkland.
Multiple Florida news outlets requested records detailing Cruz’s school records, but were stonewalled by the school district, which spent over $200,000 on public relations consultants and an unspecified amount on lawyers to defend against releasing the records.
A judge ordered the records to be released, but the school redacted a hefty amount of details from them. But the South Florida Sun Sentinel simply pasted the records into another computer file and the redactions disappeared.
The Sun Sentinel found the school district knew of Cruz’s violent rhetoric and listed multiple instances of troubled behavior on his records.
The report by the state commission that investigated the Parkland shooting said Broward stretched its interpretation of FERPA too far. It also said the law “needs to be changed and information needs to flow much more freely under circumstances such as this.”
Schools have also used FERPA to block the release of surveillance footage from school buses. In two cases in Pennsylvania, adults had physical altercations with students on a school bus. The school districts argued the footage was considered an educational record and protected by FERPA. The court in each case ruled the assumption incorrect and ordered the schools to release them.
Fighting FERPA: Disciplinary results and the serious crimes exception
The FERPA battle between The Daily Tar Heel and UNC began in September 2016 when student reporters started asking questions about how a new sexual assault policy, which changed the adjudication process and expanded definitions of sexual assault, was being implemented on campus.
Wester said the accounts UNC published did not tell the whole story.
“They publish annual reports, but they just weren’t nearly specific enough to really get anything out of it,” she said. “So we were probing them for more and more details, just in terms of ‘are you penalizing anyone, how is the process going?’”
UNC is currently facing fines for their lack of transparency around campus crimes during this time. The U.S. Department of Education found the university violated the Clery Act, a law requiring institutions to disclose crime statistics and security policies, among other things. UNC was found noncompliant with Clery on eight accounts between 2009 and 2016, including “Lack of Administrative Capability,” “Failure to Follow Institutional Policy in a Case of an Alleged Sex Offense” and “Failure to Properly Compile and Disclose Crime Statistics.”
The newspaper asked the university to disclose the names of anyone found responsible for rape, sexual assault or any related acts of sexual misconduct, the outcome of the adjudication and the penalty imposed since the policy had changed.
The Daily Tar Heel submitted multiple records requests in early 2016, but the documents they received contained limited information, or the requests were denied, Wester said. In September 2016, the newspaper submitted a final request with a one month deadline and stated their intent to sue if UNC withheld the documents.
UNC did not meet the deadline, and in November 2016 The Daily Tar Heel, the Capital Broadcasting Company, the Charlotte Observer Publishing Company and The Durham Herald Company filed a lawsuit against the university.
Nearly three years later on Aug. 28, 2019, the case went before the North Carolina Supreme Court. The Court has still not reached a decision.
UNC’s defense in court centered around FERPA. It claimed that student misconduct records are education records. However, FERPA expressly exempts and does not prohibit disclosure of the final results of disciplinary proceedings against students who committed serious crimes, including sex crimes and crimes of violence.
SPLC Senior Legal Counsel Mike Hiestand said a recent amendment added to FERPA allows schools to release information, including a student’s name, about violent crimes committed by students if a campus court has found them responsible.
“It allows them to provide the name of the student that was found guilty and just the basics around what sort of penalties, what he was convicted of and what sort of penalties were associated with that campus court proceeding,” Hiestand said.
UNC also argued in court that releasing the names would reveal the names of the victims of sexual assault. Wester pushed back against this claim.
“If you read the request, all we’re asking for is the outcome of the adjudication, the penalty imposed and the person found responsible,” she said.
“Any journalist who’s ever covered a story related to sexual assault or domestic violence or anything like that has worried about victim privacy,” she added.
Just like with police reports, Wester said, a reporter decides “does this [information] contribute to the story or is it just needlessly graphic?” Any ethical journalist would publish with the victim’s privacy in mind, she said, because reckless reporting carries the risk of retraumatizing the victim.
Fighting FERPA: When your school takes you to court
The University of Kentucky in 2016 sued its own student newspaper, the Kentucky Kernel, over documents the university sought to protect under FERPA.
The Kernel requested documents related to an investigation into a former professor after being accused by two female students of sexual assault. The students reached out to the Kernel and asked the paper to look into how UK handled their cases.
Marjorie Kirk, the Kernel’s editor-in-chief during the 2016-17 academic year, told the SPLC in 2017 that UK cried FERPA after the paper filed the request.
“When we asked the university for the investigative report, [UK] denied it, citing attorney-client privilege,” she said. “They said that the investigative report was a student record even though it dealt with an employee disciplinary process. They said that student privacy [laws] would not allow any part of that record to be seen by the public, even though it contains information like the specific charges against a professor.”
Hiestand said if a student journalist wants to know the name of the professor being accused of a serious crime, there really is no argument for withholding it.
“I don’t think there is any claim that could be made that FERPA would protect the identity of the professor that’s being accused or the faculty member that’s being accused,” he said.
After all, FERPA protects student records, not teacher or school employee records.
UK also denied then-Kentucky Attorney General Andy Beshear the opportunity to review the requested records, which he has the statutory power to do under open records law.
Beshear ruled that UK had violated state open records law by denying the Kernel’s request and ordered the documents to be released. Beshear’s ruling would’ve also required UK to turn over any similar documents in the future.
“How open records law in Kentucky works is that if one party disagrees with the attorney general, they have to sue the party that came to the attorney general in the first place, and in this case that’s us, the student newspaper,” Kirk said.
Suing the KerneI was UK’s way of saying they wouldn’t turn over the records until a judge ordered them to do so. UK also threatened to personally sue Kirk, and later blamed the paper for being the reason sexual assault report numbers declined on campus.
The Kentucky Court of Appeals ruled in May 2019 that UK violated the state’s open records act by refusing to give the Kernel the records.
UK had argued, similar to UNC, that Title IX records are protected under FERPA. Six other Kentucky colleges, however, complied with the Kernel’s request for similar documents.
The requested documents were leaked to the Kernel by a confidential source in August 2016. The paper found that UK’s investigation into the professor spanned seven months, covered three years worth of allegations and found five total victims.
Kirk said a reason the paper continually looked into how UK handled sexual assault cases was because victims often reached out to the paper to look into what they thought were botched investigations by the university.
“Just the number of survivors who have come to me and said ‘thank you for pursuing these stories, I would love to share my story with you and I want to pursue real action against this person because I felt like the university either abused my trust in them, did not give me the justice that they had led me to believe I would get, or just butchered the investigative process,’” Kirk said.
The Kernel published an article in November 2016 by an anonymous UK student who was a sexual assault victim. The victim wrote that she had run into her rapist on campus on two occasions after being promised by the university that would never happen.
Similar to the anonymous author, Kirk said victims of sexual assault at UK often “felt like the rug was pulled out from under them” by the university.
Fighting FERPA: Challenging excessive redactions
In February 2018, reporters at The Daily Kansan filed an open records request for documents related to hazing investigations into University of Kansas fraternities in 2017 and early 2018.
The records the Kansan received only “include details about the process, chapter response and sanctions — but details about the reported behaviors that incited the investigations were redacted,” KU student journalists Lara Korte and Chandler Boese reported in May 2018.
Redacting an entire factual narrative of what happened, we didn’t think was required by FERPA
Nicole Asbury, the Kansan’s 2019-20 investigations editor, continued the story in April when she filed another records request from the time the Kansan last filed a request in early 2018 to the end of the 2018-19 academic year. She said she received more of the same — almost all the details of the investigations redacted.
Deciding that wasn’t good enough, the Kansan challenged the redactions this time.
“I actually sent an email to the open records custodian just detailing that I was challenging the exemptions,” Asbury said. “Because redacting an entire factual narrative of what happened we didn’t think was required by FERPA, or at least I didn’t think so.”
It’s required by FERPA to protect any identifiable information about a student (names, addresses, etc.) when releasing documents, but it’s an overreach to say FERPA requires a school to conceal information (like the origins of a hazing investigation) that wouldn’t identify individual students.
Asbury also dug into KU’s previous hazing reports and found that in the past, the university had been far more transparent in disclosing hazing investigation details.
“In 2010, KU had released nearly the full results of this investigation into the fraternity Phi Gamma Delta, known as FIJI,” she said. “Then, the university had only redacted the names of the fraternity members into that hazing investigation.”
Buried in the records, Asbury found a passage on why KU believes releasing these records helps inform future students about Greek organizations on campus. The Kansan found this contradictory, since what caused the investigations were never disclosed.
She said KU’s shifting definition of what FERPA covers was part of their motivation for challenging the redactions in the documents. Asbury said the paper is currently waiting on KU’s response to their appeal.
Fighting FERPA: Do your homework and know your rights
Sometimes a school will try to withhold public records for privacy reasons, without specifically citing FERPA. The reasoning may be different, but the steps for recourse are pretty similar: know your state’s open record laws and any privacy laws that may apply, do your homework and fight back. That’s exactly what Edward Sutelan, the 2018-19 editor-in-chief of the Lantern, Ohio State University’s student newspaper did.
It was just sort of known Ohio State wasn’t going to explain why
Sutelan filed a public records request in September 2018 seeking a series of public records for a number of football players over the last six years. Finally, after 18 weeks, OSU delivered the documents and Sutelan found a police report that intrigued him.
Except the name was redacted, as were the details on a number of the documents.
“This one in particular stood out to me,” he said. “It was a case of accused rape, and so I requested Ohio State to have an updated copy because it said that this was still under investigation, and when I received the updated copy, that took about a month later, the name was still redacted and the case had been reported as being closed for reason of the police not being able to get in contact with the alleged victim.”
Sutelan had a hunch the name behind the black ink was former Buckeye running back Brian Snead, who was dismissed from the team around the time this police report was filed.
“[OSU] never ended up giving an explanation for why this running back Brian Snead ended up leaving the university or why he was suspended,” he said. “It was just sort of known Ohio State wasn’t going to explain why.”
Sutelan asked Ohio State for an unredacted copy of the report he believed was Snead’s, but the school refused.
“Ohio State argued that the reason that the names were redacted was because it was an uncharged suspect and these were investigative documents,” he said. “My response back was that this was an initial police report and that according to Ohio sunshine laws, that it is illegal to redact the names of even uncharged suspects in an initial incident report.”
Sutelan took OSU to the Ohio Court of Claims after failing to receive an unredacted copy, and he was confident he could win; earlier he had asked local police for a similar report, and it was provided with zero redactions.
“I went to the Columbus Division of Police and requested a similar incident of an accused rape case where the suspect was uncharged, and all of that information was provided in there completely unredacted even though the suspect had not been charged with the crime and the case was closed,” he said.
On Aug. 9, the Lantern reported the court of claims found Ohio State violated public records law by withholding the names in the police reports. The special master investigating the case also found that OSU took too long to provide the initial records and believed this type of behavior was likely to be repeated again by the university.
And after receiving the unredacted records, Sutelan confirmed it was Snead who was named in the police report.
In October 2019, the Student Press Law Center awarded The Lantern with its 2018 Reveille Seven College Press Freedom Award. The award is co-sponsored by Louisiana State University’s Manship School of Mass Communication and the Associated Collegiate Press.
Advice from student journalists
Wester said it helps to find former student reporters and ask them how they navigated an experience close to yours. She says by having extensive knowledge of open records and privacy laws, it can sometimes catch your school off guard.
It’s completely in a journalist’s prerogative to challenge any redaction that they think is unfounded
“Whether it’s FERPA or a state public records law,” she said, “just know the law and keep pushing, and ask for them to show you the exact line or quote that they’re using when they deny you, and a lot of times they can’t do it.”
Asbury’s advice is to never be afraid to question your school.
“It’s completely in a journalist’s prerogative to challenge any redaction that they think is unfounded, and it’s completely within that journalist’s prerogative, even more so, to request that information in the first place,” she said. “The job that you’re doing is consistently within the public’s interest and you have to think of it in that realm.”
“I think a lot of people get hesitant or nervous particularly because we’re such young reporters to challenge those things,” she added. “[But] it’s your right to do so, and it’s also your responsibility as someone who delivers information to the public to do that.”
In the Kansan’s fight, reporters looked to what other schools were doing in similar situations. If another school in your state disclosed information comparable to what you’re seeking, you can use that as an argument in your favor.
“I think the most important thing beyond that is make sure that you’re reading their exemptions and understanding their positions on certain things,” Asbury said, “and also study up on how other universities have done it in the past to see what’s inconsistent with how those universities use FERPA to redact certain documents compared to yours.”
Sutelan also stressed the importance of being as knowledgeable about open records laws in your state as possible and looking for avenues to challenge denials. Ohio has a court of claims, which is a relatively inexpensive way to take your school to court. He said the complaint he filed cost $25.
I tell folks all the time that FERPA is just kind of a good law gone bad
Hiestand has been working with student journalists for over 30 years. He said because of the pervasive and ongoing problem of record denials based on FERPA, it’s long past the time for the privacy law to be changed.
“It’s time to clean this law up. I tell folks all the time that FERPA is just kind of a good law gone bad. It was passed for some really good reasons,” he said. “But it’s just that at some point — since 1974 — schools have for a variety of reasons taken advantage of some of the confusion in the law.”
SPLC reporter Joe Severino can be reached by email at jseverino@splc.org or by calling 202-974-6318. Follow him on Twitter at @jj_severino.
Want more stories like this? The Student Press Law Center is a legal and educational nonprofit defending the rights of student journalists. Sign up for our occasional News Roundup.