Legal Issues: Spotlight Online
A FERPA Primer
The NACE Legal Department developed the following article to respond to inquiries from career services practitioners and employers about placement/credential files and reference letters. The article summarizes the key points of the Family Education Rights and Privacy Act (FERPA).
FERPA requires federally funded academic institutions to obtain student consent before disclosing personally identifiable information in students’ education records to third parties. Disclosure pertains to the hand delivery, mail, fax, or electronic transmission of information, including access to career services’ data bases of student resumes. A third party is any individual or organization other than the student or his/her parents. However, within the school, student information can be disclosed without student permission to those with a “legitimate educational interest.”
An education record is any information maintained by a school about a student. The information or data may be recorded in any medium, such as a computer data base; “personally identifiable information” includes transcripts, GPA, grades, social security number, or any other information that would make the student easily identifiable. (Note: Directory information, such as a student’s name, street and e-mail address, telephone number, date of birth, field of study, enrollment status, dates of attendance, and degree and awards received, may be released without student authorization.)
FERPA gives students the right to inspect their files before giving consent to disclose information. In many cases, students will have seen the contents of their files. Even if students have waived the right to access their files, the school must provide a list of the file’s contents upon student request. If the student file has changed in any way, e.g., a letter of recommendation has been altered or replaced, career services should notify the student of the changes before disclosing the file’s contents to a potential employer or graduate school.
FERPA does not specify what a placement/credential file should include or what information should be divulged in a reference letter. Nor does the law define the term “confidential” or specify the rights of, or guarantee any legal protection to, the writer of a reference letter. Faculty should understand that even a confidential letter could be disclosed to a student during the course of a legal proceeding. Moreover, unless a student consents to the disclosure of that “confidential letter,” it may never be seen by anyone.
Just as information released directly from a student’s credential file or other educational record is prohibited by FERPA, third-party redisclosure of information is prohibited. Schools should notify third parties who receive student files of this restriction. The school is responsible for any improper disclosures made by outside organizations. Organizations receiving such information may use it only for the purpose for which disclosure was granted. If disclosure is to a contract recruiter, employment agency, or resume referral data base, student consent should state that the disclosure is for the purpose of further disclosure(s) to potential employers. If a third-party improperly rediscloses student records, the Department of Education (DOE) will prohibit that party from obtaining student records for a period of at least five years.
Finally, FERPA does not specify a time period for retaining credential/placement files or reference letters. The law merely provides that an education record may not be destroyed if there is an outstanding student request to inspect the file. The school has the discretion to develop a record retention policy and communicate that policy to its students. The policy should include a deadline by which students/alumni must respond if they do not wish to have their files destroyed. Once the deadline has passed, and there has been no request for retention, the records may be destroyed.
The following tips can help ensure compliance with FERPA:
- Advise students annually of their rights under FERPA.
- Obtain signed, written consent from a student before a school official, administrator, career services staff member, or faculty member releases (orally or in writing) personally identifiable information to an employer, third-party recruiter, or resume referral data base.
- Remind faculty members that, under the law, they may not communicate information about students, such as recommendations, academic transcripts, and any other academic information, without first receiving student consent.
- Notify employers, employment agencies/contract recruiters, resume data bases, or other entities that student records are subject to FERPA, cannot be redisclosed without student consent, and that improper redisclosure will result in denial of access to those records for five years.
- Determine, clearly define, and communicate to students what information will be considered directory information. Students must be given a reasonable deadline to notify the school if they want to restrict access to this type of information.
- Plan to obtain a new consent if any student information is changed, such as revisions to a letter of recommendation, prior to fulfilling an information request.
- Note that FERPA does not address the issue of placing amended letters of recommendation into students’ files. Each educational institution is responsible for establishing and consistently enforcing its own policy on this issue.
- Advise students on the implications of waiving their right to inspect their files or letters of recommendation.
E-mail questions about FERPA to the DOE. Both FERPA regulations and the DOE’s Family Policy Compliance Office can be found online.
Spotlight, June 15, 2001 (Volume 23, Issue 21)
