The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g) is a federal law that protects the privacy of student education records. The law and its regulations (34 CFR Part 99) apply to all schools that receive funds under an applicable program of the U.S. Department of Education (ED).
FERPA regulates the disclosure of personally identifiable information from youth education records in all public elementary and secondary schools, school districts, intermediate education agencies, state education agencies, and any public or private agency or institution that uses funds from ED. The purpose of FERPA is to protect all student and parent information maintained in an Education Record.
This guidance specifies the policies and procedures related to research access to education records covered by FERPA.
Record means “any information recorded in any way, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche.”
Education Records means records that contain information directly related to a student and that are maintained by an educational agency or institution or by a party acting for the agency or institution.
Eligible student means a student who has reached 18 years of age or is attending an institution of postsecondary education.
Disclosure means to permit access to or the release, transfer, or other communication of Personally Identifiable Information contained in Education Records to any party, by any means, including oral, written, or electronic means.
Personally Identifiable Information is the student’s (or family member’s) name, address, personal identifier, and personal characteristics or other information that would make the student’s identity easily traceable.
Directory Information means information contained in an Education Record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. It includes, but is not limited to, the student’s name, address, telephone listing, electronic mail address, photograph, date and place of birth, major field of study, dates of attendance, grade level, enrollment status (e.g., undergraduate or graduate; full-time or part-time), participation in officially recognized activities and sports, weight and height of members of athletic teams, degrees, honors and awards received, and the most recent educational agency or institution attended.
Access to Education Records for Research Purposes
Investigators are responsible for meeting FERPA and human subject protection regulations (IRB requirements) and University policy when accessing Education Records.
FERPA stipulates that an educational institution has the authority to determine what information may be accessed from an Education Record. If an institution denies an investigator access to information in an Education Record, the IRB cannot overrule the decision. Here, at University of California, Davis, the Office of the University Registrar requires review of the research prior to accessing Education Records.
Obtaining Consent to Access Records for Research Purposes
FERPA and IRB requirements are usually met if a parent (or “Eligible Student”, as defined in § 99.3) signs a consent form to participate in a research study and authorizes release of his/her child’s Education Records for research purposes.
FERPA regulations specify that a parent or Eligible Student must provide a signed and dated written consent in accordance with the requirements of § 99.30 before Personally Identifiable Information from Education Records is disclosed, unless the disclosure falls within one of the exceptions set forth in § 99.31.
The consent provision in FERPA requires a specification of:
- the records that may be disclosed;
- the purpose of the disclosure; and
- the identity of the party or class of parties to whom the records may be disclosed.
FERPA gives parents certain rights with respect to their children’s Education Records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are referred to as “Eligible Students.”
If a prospective student is not an Eligible Student under FERPA then the student’s parents must provide signed consent for Disclosure of Personally Identifiable Information from the student’s Education Records.
Access to Records for Research Purposes without Obtaining Consent
Disclosure of Directory Information
The Investigator should contact each institution from which he/she proposes to access student records and follow that institution’s FERPA policy and procedures when accessing directory information.
FERPA allows schools to designate and disclose, without consent, certain items of information as “directory information”, such as a student’s name, address, telephone number, date and place of birth, honors and awards, and dates of attendance.
Each educational institution designates what information is considered directory information. FERPA requires that students be given the opportunity to file a request to prevent disclosure of directory information, commonly known as “opting out”. An institution will not release any information on a student, even directory information, if a student has “opted out”.
Studies to develop, validate, or administer predictive tests; administer student aid programs; or improve instruction
FERPA allows educational agency or institution to disclose personally identifiable information from an Education Record of a student without consent if the disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions to:
- Develop, validate, or administer predictive
- Administer student aid
- Improve instruction [34 CFR 99.31]
A school district or postsecondary institution that uses this exception is required to enter into a written agreement with the organization or researcher conducting the research that specifies:
- The determination of the
- The purpose, scope, and duration of the
- The information to be
- That information from education records may only be used to meet the purposes of the study stated in the written agreement and must contain the current requirements in 34 CFR 31(a)(6) on re-disclosure and destruction of information.
- That the study will be conducted in a manner that does not permit personal identification of parents and students by anyone other than representatives of the organization with legitimate
- That the organization is required to destroy or return all personally identifiable information when no longer needed for the purposes of the
- The time period during which the organization must either destroy or return the
Removal of all Personally Identifiable Information
Education records may be released without consent under FERPA if all personally identifiable information has been removed including:
- Student’s name and other direct personal identifiers, such as the student’s social security number or student
- Indirect identifiers, such as the name of the student’s parent or other family members; the student’s or family’s address, and personal characteristics or other information that would make the student’s identity easily traceable; date and place of birth and mother’s maiden
- Biometric records, including one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual, including fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and
- Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable
Disclosure of Information from UCD Student Records for Research
The following terms, relevant to FERPA, are defined in UCD Policy 320-21 “Privacy and Disclosure of Information from Student Records.”
The Disclosure of information from Student Records is governed by the Federal Family Educational Rights and Privacy Act (FERPA). It is the purpose of UCD Policy 220 to provide reasonable interpretations of those laws and to protect the Student’s right of privacy as guaranteed by the Constitution of the State of California. When the law is silent, UCD shall be guided by two principles: (l) privacy of an individual is of great weight; and (2) the information in a student’s files should be disclosed to the student on request.
For the purposes of implementing the provisions of FERPA, the University of California system is viewed as ten separate institutions, rather than as a single entity. Personally Identifiable Information contained in UCD Student Records may not be disclosed to other University of California campuses without the written consent of the student, unless the Disclosure is consistent with the provisions of Section IV.E. of UCD Policy 320-21.
Disclosure of UCD Directory Information
Upon review and approval, the UCD Office of the University Registrar may provide student data to researchers affiliated with UCD for the purpose of data analysis or transmission of a mass email to students (e.g., to recruit participants).
UCD researchers who wish to obtain student data are responsible for compliance with:
UCD FERPA Review Responsibilities
For purposes of human subjects protection, UCD IRBs assess FERPA requirements when reviewing research protocols that involve access to student Education Records. When research protocols propose to access Education Records without parental/student consent, the IRB:
- considers whether the records access meets the criteria for a waiver of informed consent at 45 CFR 116 (see Checklist: Waiver of Written Documentation of Consent (HRP-411)), and if so,
- notifies researchers of their responsibilities to obtain exception(s) to parental/student consent at each educational institution from which Education Records access is
The UCD Office of the University Registrar makes determinations subject to FERPA regarding requests to access UCD student Education Records without parental/student consent.