Student Education Records are Protected Under FERPA and Ohio Law
The release of student records by schools is governed by both state and federal statutes. At the federal level, all school districts receiving federal funds are subject to the Family Educational Rights and Privacy Act of 1974 (“FERPA”). FERPA regulates the use and access to student education records, provides procedures for correcting faulty information, and assures parent and student access. At the state level, the Ohio Student Records Privacy Act, R.C. § 3319.321, similarly restricts the release of student records.
Parent and Student Access to Education Records
As a starting point, FERPA requires that parents have access to their child’s education records, and conditions federal funding on making these records accessible for students and their parents. FERPA states in part that, "no funds shall be made available under any applicable program to any. . . institution which has a policy of denying, or which effectively prevents, the parents of students. . . the right to inspect and review the education records of their children." 20 U.S.C.A. § 1232g.
Education records include “those records, files, documents, and other materials which (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution.” FERPA requires schools to establish procedures related to granting parental requests for records within a reasonable time, but in no case more than 45 days after the request by the parent.
Third Party Access to "Directory Information" (a.k.a. Yearbook Information)
In contrast to “education records” which should always be made available for students and parents, Ohio authorizes schools to release “directory information” to certain third-parties. See R.C. § 3319.321. Directory information is what might typically be contained in a school yearbook, and is more generic than other information included in education records. Under Ohio law, “directory information” includes a student’s:
name
address
telephone listing
birth date
place of birth
major field of study
participation in officially recognized activities and sports
weight and height of members of athletic teams
dates of attendance
date of graduation, and
awards received.
It is important to reiterate that R.C. § 3319.321 authorizes the release of these categories of directory information to unrelated third-parties. However, schools that make directory information available must follow certain procedures. First, FERPA requires that schools making directory information available provide public notice of the categories of information that it has designated as directory information. Next, FERPA requires that schools give parents and students a chance to opt-out of the disclosures. In regards to the notice and opt-out requirement, FERPA states as follows:
"Any educational agency or institution making public directory information shall give public notice of the categories of information which it has designated as such information. . . and shall allow a reasonable period of time after such notice has been given for a parent to inform the institution or agency that any or all of the information designated should not be released without the parent's prior consent. If a student eighteen years of age or older or a student’s parent, guardian, or custodian has informed the board that any or all such [directory] information should not be released without such person’s prior written consent, the board shall not release that information without such person's prior written consent." 20 U.S.C.A. § 1232g.
Under Ohio law, schools may never release directory information for use in a profit-making plan or activity. R.C. § 3319.321(A). For this reason, schools in Ohio also have a right to ask the party requesting the directory information for the intended use of the information.
Access to Personally Identifiable [Student] Information Only With Parental Consent
Both Ohio law and federal law prohibit the disclosure of a student's personally identifiable information (including most of the education record) without the written consent of the parent, or of the student, if the student is over the age of 18. There are certain limited exceptions to the disclosure of personally identifiable information without parental or student consent, which are enumerated in the state and federal statutes.
“Personally identifiable information” is defined by 34 C.F.R. § 99.3 as "data or information that includes the name of a student, the student’s parents, or other family members; the address of the student; a personal identifier such as a social security number or student number; indirect identities such as date of birth, place of birth or a biometric record; a list of personal characteristics or other information which would make the student's identity easily traceable; or information requested by a person whom the school reasonably believes he knows the identity of the student to whom the record relates."
Parents have a right of access to their child's education records under federal and state law. School districts must always consider all aspects of these laws when releasing directory information or other protected student records to parents or third parties.