The Family Educational Rights and Privacy Act (FERPA) gives students certain rights with respect to their “Education Records.”
A student’s affirmative consent is generally required to disclose personally identifiable information (“PII”) contained in a student’s Education Records to a third person. (The procedure for providing affirmative consent to have particular information shared with certain individual(s) is set out below.) Not all student records are, however, included in the definition of “Education Records” protected by FERPA. See below for a list of student records that are not “Education Records.” For instance, certain law enforcement unit, employment, health care provider, and parent’s financial records are not “Education Records.”
In addition, FERPA permits, and sometimes requires, the disclosure of PII from students’ Education Records without a student’s consent if the disclosure meets certain conditions.
One such exception is “Directory Information” which is specific limited information contained in Education Records. See below for a list of Directory Information. The disclosure of this information is not generally considered harmful or an invasion of privacy under FERPA. Unless a student affirmatively requests that such information not be shared, it may be disclosed by the college to third parties with a legitimate interest in the information. (The procedure for affirmatively directing that Directory Information not be shared, unless another applicable FERPA exception applies, is set out below.)
Another exception to the affirmative consent requirement is disclosure to “School Officials” with a legitimate educational interest in the record. See below for a description of those included as “School Officials.” It should be noted that students may not block release of their names, identifiers or email addresses in classes in which the students are enrolled, and may not refuse to display student ID cards or badges.
Other exceptions include disclosure in connection with a health or safety emergency, and disclosure of de-identified records and information where the student is not personally identifiable. See below for additional categories of records that are exceptions to the affirmative consent requirement.
The FERPA rights of students are:
- The right to inspect and review your “Education Records.”
If you want to review your Education Records, you should submit a written request that identifies the specific Education Record(s) you wish to inspect to the Registrar’s Office. If the records are not maintained by the Registrar, the Registrar’s Office will advise you of the correct official to whom the request should be addressed.
Requests should be granted or denied in writing (which may be by email) within 45 days of receipt. If the request is granted, you will be notified of the time and place where the records may be inspected. If the request is denied or not responded to within 45 days, you may appeal to the college’s FERPA Appeals Officer. Your appeal should identify the particular record(s) you requested access to, the date you made the original request for access, the person you made the request to, and the reasons why you believe you have a right of access to the record(s). Additional information regarding the appeal procedures will be provided to you if your request is denied.
Keep in mind that certain records are not “Education Records” subject to this mandatory access under FERPA. See below for student records that are not considered Education Records.
- The right to request the amendment of your Education Records that you believe are inaccurate, misleading or otherwise violate your privacy rights under FERPA.
You may ask the college to amend a record that you believe is inaccurate, misleading or otherwise violates your privacy rights under FERPA. You should write to the college official responsible for the record, clearly identify the part of the record you want changed, and specify why you believe it is inaccurate, misleading or violates your privacy rights.
If the college decides not to amend the record as requested, the college will notify you of the decision and advise you of you right to a hearing before the college’s FERPA Appeals Officer. Additional information regarding the hearing procedures will be provided to you if your request to amend is denied.
- The right to consent or withdraw consent to disclosure of personally identifiable information (“PII”) contained in your Education Records to specific individuals, except to the extent that FERPA authorizes disclosure without consent.
If you want to consent the disclosure of certain PII contained in your Education Records to a designated person, you should submit a FERPA Release Form to the Registrar’s Office. If you want to withdraw that consent, you should execute the lower portion of the form withdrawing the earlier consent. If the Education Record you want to give someone else access to is not maintained by the Registrar’s Office, the form should be provided to the college official who maintains the information.
Again, keep in mind that not all student records are “Education Records” under FERPA, and that there are many circumstances where a student’s affirmative consent to disclosure is not required. See footnotes below.
- The right to appeal the alleged denial of FERPA rights to the college’s FERPA Appeals Officer (described above), and the right to appeal the decision of that Officer (or the Officer’s failure to issue a timely decision) to the:
General Counsel and Vice Chancellor for Legal Affairs
The City University of New York
205 East 42nd Street
New York, NY 10017
An appeal to the General Counsel and Vice Chancellor must be in writing and must be made within 30 days of the college FERPA Appeals Officer’s decision. It must include a copy of the determination of the college’s FERPA Appeals Officer, and the reasons why you disagree with the decision. You may also file with the General Counsel and Vice Chancellor if you do not get notice of a hearing after you file your college appeal concerning denial of a request to amendment, or if you do not receive a decision within 30 days of the hearing.
- The right to file a complaint with the U.S. Department of Education concerning alleged failures by the college to comply with the requirements of FERPA. The address of the office that administers FERPA is:
Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, D.C. 20202-5920
- The right to direct that “Directory Information” not be disclosed to third parties (unless another exception to FERPA applies).
“Directory Information” is specific limited information contained in Education Records. See below for a list of Directory Information. The disclosure of this information is not generally considered harmful or an invasion of privacy under FERPA. One of the primary purposes of Directory Information is to allow the college to include this type of information in certain school publications, such as on-line directories, yearbooks, Dean’s list and other recognition lists, commencement programs, and sports activity materials. Unlike PII which requires your affirmative consent to disclose (unless another exception applies), Directory Information may be disclosed by the college to parties having a legitimate interest in the information, unless you specifically request that it not be. (Of course, the information may still be disclosed if a FERPA exception applies.)
By filing a Non-Disclosure of Directory Information Form with the Registrar’s Office, you may direct that, unless another FERPA exception applies, your “Directory Information” may not be released to third parties. See below for a list of Directory Information. Your direction not to disclose Directory Information to third parties will remain in effect unless and until you withdraw it which you may do at any time. The same form is used to withdraw your request.
- The right to inspect and review the college’s record of disclosures.
Except for disclosures to School Officials, disclosures related to some judicial orders or lawfully issued subpoenas, disclosures of Directory Information, and disclosures to the student, FERPA regulations require the college to record the disclosure. Eligible students have a right to inspect and review the record of disclosures.
Defined Terms
Student records that are not considered Education Records protected under FERPA
A student has no right to review, and the college need not permit inspection of the following types of records:
- confidential letters and confidential statements of recommendations
- financial records of the student’s parent(s)
- records that are in the sole possession of the maker
- records maintained on behalf of a college by its law enforcement unit, employment records of a college employee who is also a student
- records made by a health care provider
- records which pertain to a student but were generated after the student is no longer in attendance, grades on peer graded papers before they are recorded by a teacher
- any other record that is privileged or otherwise inaccessible to the student pursuant to law or regulation
“Directory Information” consists of:
- name
- attendance dates (semesters and sessions, not daily records)
- photograph
- 8-digit student ID number (but only if the ID number cannot be used to gain access to education records without one or more factors that authenticate the user’s identity)
- enrollment status (full or part-time, undergraduate or graduate, etc.)
- level of education (credits completed), degree enrolled for and major field of study
- participation in official recognized activities and sports (teams)
- height and weight (for members of athletic teams only)
- degrees, honors, and awards received
- Address, email address, and telephone number also constitute Directory Information, but disclosure of this information may only be released to employees of the University and its constituent colleges for the purpose of conducting legitimate University business. These three categories of Directory Information may not be shared with individuals and organizations outside the University (unless some other exception to FERPA applies).
“School Official” includes:
- a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff)
- a person or company with whom the college or University has contracted as its agent to provide a service instead of using University employees or officials and a contractor, consultant, volunteer or other party to whom a college or the University has outsourced services or functions that would be otherwise performed by employees
- a person serving on the Board of Trustees
- a student serving on an official committee, such as a disciplinary committee
- an individual assisting another school official in performing his or her tasks
- the State Comptroller and his or her agents and representatives for the purpose of conducting audits
Disclosure without Student Consent
Other circumstances under which, and people to whom, disclosure may be made without student consent include the following:
- To certain parties in an emergency if the information is necessary to protect the health or safety of the student or other individuals
- To an official or employee of another educational institution in connection with the student’s enrollment or transfer
- To designated government authorities including the U.S. Comptroller General, Attorney General, and Secretary of Education and certain State and Local educational authorities
- In connection with an audit or evaluation of Federal- or State-supported education programs, or the enforcement of or compliance with Federal legal requirements that relate to those programs
- In connection with financial aid or which the student has applied or which the student has received, if the information is necessary to determine eligibility for the aid, the amount of the aid, the conditions of the aid, or to enforce the terms and conditions of the aid
- To comply with a judicial order or lawfully issued subpoena
- To an organization conducting studies for, or on behalf of, the school, in order to: (a) develop, validate, or administer predictive tests; (b) administer student aid programs; or (c) improve instruction
- To accrediting organizations to carry out their accrediting functions
- To the general public, the final results of a disciplinary proceeding, if the college determines the student is an alleged perpetrator of a crime of violence or non-forcible sex offense, and has committed a violation of the college’s policies with respect to these allegations
- To the student’s parent(s) or legal guardian(s) if the student is a dependent for IRS tax purposes
- To parent(s) or legal guardian(s) of a student under age 21 regarding the student’s violation of any law or college rule governing the use or possession of alcohol or a controlled substance if the college determines the student committed a disciplinary violation
- In litigation and administrative proceedings involving the student and CUNY, or with respect to complaints by the student to a government entity, accrediting or licensing organization
- If the disclosure concerns sex offenders or others required to register pursuant to law
- To certain government agencies entitled to specific PII about foreign students with F or J visas
- To a child welfare agency legally responsible for the care and protection of a student who is in a foster care placement
- Disclosure of de-identified records and information is permitted if the college has reasonably determined that the student is not personally identifiable, taking into account other reasonably available information
- Disclosure of certain specific information (and information otherwise made available to other employers as “Directory Information”) is required to US military recruiters
