Every state has a public-records law requiring state and local government agencies – including public schools and colleges (though not private ones) – to disclose upon request the documents they maintain. These laws go by different names – “sunshine laws,” freedom-of-information acts, or open-records acts – but all of them work in basically the same way: government agencies must, within a reasonable time (or within a specified number of days) allow inspection and copying of any type of medium that records information. The requester need not provide any justification for wanting the information, and if access is denied, the burden is on the government agency to point to a justification in the law. Refusal to produce public records can result in fines, awards of attorney fees, and under some state laws, even jail time.
Courts generally give state open-records laws the broadest possible interpretation, and any exception to disclosure is applied as narrowly as possible. The benefit of the doubt is supposed to go to the party requesting access.
Even without FERPA, there are safeguards in place to deter the release and publication of non-newsworthy information about private individuals. Every state open-records act excludes certain categories of records from disclosure because legislators have decided there is no overriding public interest in the information. These exclusions commonly include medical information, confidential attorney-client communications, and “identity theft” information such as Social Security numbers. And almost every state open-records act incorporates a discretionary balancing test that enables an agency to refuse a request for records if disclosure would constitute an unwarranted invasion of individual privacy. Moreover, every state recognizes a legal claim for invasion of privacy if severely embarrassing and non-newsworthy personal information is published without consent.