In the wake of a record number of school shootings in 2018, school districts are looking to improve threat assessment measures and enhance school safety. The ability to share information is a critical tool to further these efforts but can be difficult to do in an environment where the Family Educational Rights and Privacy Act (FERPA) applies. Under FERPA, unless an exception applies, the disclosure of personally identifiable information (PII) from students’ education records is generally prohibited without parents’ or eligible students’ consent.
On February 5, 2019, the U.S. Department of Education, through its Privacy Technical Assistance Center, released a new guidance document entitled “School Resource Officers, School Law Enforcement Units, and The Family Educational Rights and Privacy Act.” The guidance was drafted “to address questions about how FERPA applies to schools’ and districts’ disclosure of PII from student education records to school security units, outside law enforcement entities, School Resource Officers (SROs), and other schools.”
Among other things, the guidance discusses disclosures to law enforcement personnel and threat assessment teams under FERPA’s “school official” and “health and safety” exceptions. It also discusses when school personnel can disclose information of which they have “personal knowledge” but is not captured in an education record. Highlights of the guidance are as follows:
School law enforcement unit officials and threat assessment team members may be considered school officials.
FERPA permits disclosure of education records without parental or student consent to school officials who have legitimate educational interests in the records. In every school district’s notice of FERPA rights to parents and students, a school district must include the criteria it uses to determine who constitutes a “school official” and what constitutes a “legitimate educational interest.”
According to the guidance, both school law enforcement unit officials and threat assessment team members may be considered school officials if they meet the criteria specified in the district’s annual FERPA notification for being a “school official” with “legitimate educational interest” in the education records. Provided the annual FERPA notification states the same, law enforcement unit officials may use information from education records for the legitimate purpose of promoting school safety and the security of students. In addition, depending on how a FERPA notification has been drafted, threat assessment team members may lawfully review education records to identify, evaluate and address threats or potential threats to school security.
Persons who are not full-time school employees may be “school officials.”
Oftentimes, law enforcement unit officials and threat assessment team members are not full-time school employees. The guidance confirms even non-school employees in these roles may qualify as school officials if they meet all of the following conditions:
- Otherwise, meet the criteria specified in the school or district’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records;
- Perform an institutional service or function for which the school or district would otherwise use an employee;
- Are under the “direct control” of the school or district with respect to the use and maintenance of the education records; and
- Are subject to FERPA’s use and redisclosure requirements in 34 CFR § 99.33(a) (providing that information derived from education records may only be used for the legitimate educational purpose for which the disclosure was made).
Though not a statutory requirement, the guidance advises school districts should require law enforcement unit officials and threat assessment team members who are not school employees to sign a memorandum of understanding (MOU) or acknowledgment recognizing they meet the above four criteria. The document should also clearly state such individuals may not share information from education records with anyone outside of the school district, including others who work for their primary employer.
Information shared under the school-official exception may not be used for other purposes or redisclosed without appropriate consent unless another FERPA exception applies.
Importantly, PII from education records shared under the “school official” exception may only be used for the purpose for which the disclosure was made, e.g., to promote school safety and the physical security of students. It may not be redisclosed for another purpose or to persons outside of the school district. For example, an off-duty police officer may not redisclose, without appropriate consent, PII from education records to other employees of his or her police department who are not acting as school officials. In order to redisclose PII, an additional exception to FERPA’s general written consent requirement, such as the health and safety exception, must apply.
Information from education records may be disclosed without parental or student consent to someone who is not a school official when related to an imminent or present emergency.
Under FERPA’s health or safety emergency exception, a school may disclose information from education records to “appropriate parties” when necessary to protect the safety of students or other individuals. The guidance defines appropriate parties as only those individuals who need to know the information to protect the safety of others. It goes on to state the disclosure may only occur during the period of, and in relation to, a “significant and articulable” emergency. Examples of a significant and articulable emergency include impending natural disasters, terrorist attacks, campus threats or the outbreak of epidemic disease.
In some cases, FERPA does not prohibit school personnel from disclosing their independent personal knowledge.
The guidance reiterated that FERPA does not secure information which school personnel have independent personal knowledge of or was obtained through observation. FERPA does, however, protect information which school personnel obtained while making an official determination maintained in an education record.
Next Steps
Schools that wish to share PII from student education records with threat assessment teams and school law enforcement personnel should do the following:
- Review and update their annual FERPA notifications to parents and eligible students to ensure law enforcement personnel and threat assessment team members are considered “school officials” with “legitimate educational interests” in the education records. “Providing safety and security” for a school or district is a legitimate educational interest.
- Consider entering into memorandums of understandings (MOUs) with law enforcement officials and threat assessment team members who are off-duty police officers, school resource officers, and other non-full-time personnel. These MOUs should establish data use restrictions and data protection requirements.
- Schools that do not use physical or technological access controls to control access to education records should review and update their administrative policies for controlling access to education records to ensure they are effective and compliant with FERPA’s legitimate educational interest requirement.