January 30, 2003
|Memorandum to:||Chief State School Officers
State Directors of Vocational-Technical Education
State Directors of Adult Education
State Directors of Community, Junior and Technical Colleges
|From:||William D. Hansen||/s/|
|Deputy Secretary of Education|
|Subject:||Additional Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) to Reporting under the Carl D. Perkins Vocational and Technical Education Act and the Adult Education and Family Literacy Act|
|Date:||January 30, 2003|
In response to inquiries from States and education groups, the Department issued formal guidance on the interplay of the Family Educational Rights and Privacy Act (FERPA) and the accountability requirements in the Carl D. Perkins Vocational and Technical Education Act (Perkins III) and the Adult Education and Family Literacy Act (AEFLA) on January 18, 2001. The guidance presented here, which will become effective April 30, 2003, will supersede the previous guidance and is intended to harmonize program evaluation requirements in Perkins III and AEFLA with FERPA, permitting the evaluation functions in the former statutes to be carried out while protecting the privacy of students as reflected in FERPA.
Specifically, the Department has reviewed the January 18, 2001, memorandum (2001 memorandum) in light of its concern for the privacy of students' records and compliance with FERPA. Based on that review, we believe that further, more specific guidance is needed to avoid application of the memorandum by the States in a manner that may interfere with FERPA protections. In addressing these matters, we have focused our attention on the possible use of the "authorized representatives" provision in FERPA as legal authority for conducting audits or evaluations to determine whether Federal program accountability requirements are being met.
The 2001 memorandum stated that:
|FERPA permits the disclosure of protected student information without the prior consent of students in certain, limited circumstances. (20 U.S.C. § 1232g(b); 34 CFR § 99.31.) One exception permits the disclosure of information derived from education records without prior consent to "authorized representatives of" the Comptroller General of the United States, the Secretary, the Attorney General or|
|"State or local educational authorities." The disclosure must be "in connection with the audit and evaluation of Federally-supported education programs, or in connection with the enforcement of the Federal legal requirements which relate to such programs."|
Based on this provision, the 2001 memorandum simply concluded that " a State educational authority may authorize the State UI [Unemployment Insurance] agency (or other agency that has access to State UI wage records) to be its representative for the purpose of evaluating whether local vocational and adult education programs have achieved the student employment goals established by the State under Perkins III or AEFLA."
We have reevaluated this conclusion in light of the full text of the statutory language of FERPA and congressional statements as to its meaning and purpose. Specifically, in authorizing disclosure to authorized representatives, § 1232g(b)(1)(C) limits such disclosures to "the conditions set forth in paragraph (3)," which pertinently provides:
|Provided, That except when collection of personally identifiable information is specifically authorized by Federal law, any data collected by such officials shall be protected in a manner which will not permit the personal identification of students and their parents by other than those officials|
(Emphasis added.) 20 USC § 1232g (b)(3). The multiple references to "officials" in paragraph (b)(3) reflect a Congressional concern that the authorized representatives of a State educational authority be under the direct control of that authority. This conclusion is supported by the Joint Statement presented by Senators Buckley and Pell while enacting important amendments to FERPA late in 1974. Specifically, in explaining the meaning and effect of what is now § 1232g(b)(1)(C), the Joint Statement provides:
|Section 438(b)(1) of existing law restricts transfer, without the consent of parents or students, of personally identifiable information concerning a student to auditors from the General Accounting Office and the Department of Health, Education, and Welfare|
120 Cong. Rec. at 39863 (December 13, 1974). Plainly, the sponsors of FERPA did not view the concept of "authorized representatives" in an expansive manner; rather, their vision was closely tied to employees and officials of, for example, the Comptroller General and the Secretary.
We conclude, therefore, that for the purposes of FERPA, an "authorized representative" of a State educational authority must be under the direct control of that authority, e.g., an employee or a contractor of the authority. Thus, the State educational authority could not, for example, designate a State department of labor to perform an audit or evaluation because the department of labor is not under the educational agency's direct control. However, the following guidance would permit State educational authorities to work with other State agencies to obtain information necessary to comply with Perkins III and AEFLA reporting requirements, while at the same time maintaining FERPA privacy protections.
Regarding the collection of data, a State educational authority that maintains the student records should conduct, oversee, or participate directly in the computer match to ensure that it is carried out consistent with FERPA requirements. Even if the computer match cannot be effected in a State educational authority's own facilities, the State educational authority is responsible for ensuring that any disclosure of education records of students to carry out an evaluation on its behalf complies with FERPA, and should maintain oversight and direction of the matching process. This is because FERPA requires that the information collected be protected in a manner that does not permit personal identification of individuals by anyone except the officials of the State educational authority, and must be destroyed when no longer needed for the purposes listed in 34 CFR § 99.35(a).
A State educational authority may obtain State unemployment insurance (UI) wage record data from the State UI agency and conduct the computer match through its employees or contractors under its direct control in order to determine the employment status of students. This approach meets the requirements of FERPA because the State educational authority has not disclosed personally identifiable information from education records to an outside entity. Alternatively, if the computer match is implemented at other facilities, such as at the State UI agency or a neutral location, an employee of the State educational authority, or a party under the direct control of the State educational authority, should conduct the computer match.
The Department anticipates that, in many cases, the State educational authority will carry out the responsibility of matching student data with UI records on behalf of all educational institutions participating in Perkins III and AEFLA. In some cases, however, individual community colleges and other schools may be given the responsibility for acquiring employment-related outcome data required by Perkins III and AEFLA, and providing those outcome data to the State educational authority administering the program. If the community college or other school chooses to use UI record matching to comply with the employment-related outcome data requirements, it will need to follow procedures similar to those applicable to the State educational authority to ensure that records are maintained under the direct control of the local educational authority. There are reasonable strategies for implementing this guidance, such as in cases where distance is prohibitive for a community college or other school to send staff to directly oversee the matching process. For example, a school may hire a contractor that is located in proximity to the UI agency to act as the school's representative in directly overseeing the match. Additional compliance guidance can be obtained from the Department's Family Policy Compliance Office, the office that administers FERPA. (Contact information for the office is provided at the end of this document.)
Additionally, educational agencies and institutions may disclose information from a student's education records, such as the student's social security number, if the student is an "eligible student" and has provided prior, written consent for the disclosure. (An "eligible student" is defined in FERPA as a student who is either 18 years of age or older or who is attending a postsecondary institution at any age. At the secondary level, consent must be obtained from the parent to disclose information, unless the student is 18 years old or older. In the latter case, the "eligible student" is the person from whom the agency or institution seeks consent.) Thus, a State educational authority-such as a community college commission-may disclose student social security numbers to a State UI agency (or other agency that has access to State UI wage records) for the purpose of determining employment status if the eligible students in question have provided consent for the disclosure by the State educational authority to the outside entity. This written consent must be signed and dated by the eligible student and must:
|(1) Specify the records that may be disclosed;
(2) State the purpose of the disclosure; and
(3) Identify the party or class of parties to whom the disclosure may be made.
See 34 CFR § 99.30(b). Requesting student consent for this disclosure, for example, may be made a regular part of the intake or admission process for vocational and adult education programs. The Department's Family Policy Compliance Office is available to assist with the development of consent forms.
FERPA also requires that educational agencies and institutions make a record of the disclosure of information from a student's education records-unless the disclosure was made with the consent of the parent or eligible student. This requirement is found in 34 CFR § 99.32. Therefore, if a postsecondary institution discloses information from a student's education record to a State educational authority specifically for program evaluation purposes under Perkins III or AEFLA, the institution is required to record in each student's education records the party or parties to whom the information was disclosed and the legitimate interest the party or parties had in obtaining the information.
The Department recognizes that parties have reasonably relied upon the guidance issued on January 18, 2001. Therefore, the Department has delayed the effective date of the guidance set forth in this memorandum until April 30, 2003. Parties may, therefore, continue to rely on the prior guidance until that date.
The Department's Family Policy Compliance Office is available to provide technical assistance to States in applying the guidance provided herein. The address and telephone number for the Family Policy Compliance Office are as follows:
Family Policy Compliance Office
Telephone number: (202) 260-3887