FERPA Fact

Oregon high school left out of "top schools" list because students scored too high on tests

Thu, 09 May 2013 14:41:37 -0400

Oregon high school left out of "top schools" list because students scored too high on tests:

Last month, when U.S. News and World Report released its list of best high schools in the country, students, parents and administrators at Lakeridge High School in Oregon were surprised to learn they didn’t make the cut. For the past three years, they’ve been ranked a “silver medal school” from the publication. Students’ test scores were even higher than a rival high school that was ranked.

It turns out the school was excluded because of how the Oregon Department of Education records students’ test scores. When more than 95 percent of students at a school pass state math and reading tests, the state doesn’t record specific scores because doing so might identify students who didn’t pass. This is a policy put in place to avoid violating the Family Educational Rights and Privacy Act.

Source: The Oregonian, Lakeridge High goes unranked in national top schools list because test scores were too high. (May 3, 2013)

SPLC Executive Director Frank LoMonte: I don’t even.

Can I stop there?

You know that part in Hannibal where the guy eats his own brains? That’s this. This is FERPA eating FERPA. “We’re keeping test scores secret, because if it got out that 98 percent of the people who took the test passed … then … that wouldn’t be secret anymore. And that would be bad … because, secrets … need to be secret.”

I would invite you to follow the logic, but let’s face it, we’re beyond that.

Suppose it gets out that 99 percent of all kids in Oregon passed the exam. FERPA applies only to the disclosure of information about identified individuals. How does the percentage lead to the identity of any individual? Jackson Pollock on acid couldn’t connect these dots.

Let’s say it turns out that only two kids in all of Oregon failed the high school proficiency test. Even if you know that you are one of them, so you know there’s only one other kid out there — how does the number lead you to the individual? (Unless the other guy has already told you, in which case the statistic isn’t giving away anything confidential.) If you are some algorithmic prodigy capable of extrapolating from a statistic into the name of the other person — well then, you wouldn’t have failed the Oregon high school proficiency exam, would you?

No court has ever held that the release of a statistic is a violation of FERPA. The only person (inside the Oregon Department of Education or outside of it) who would be able to figure out the identity of an individual test-taker from a statewide data set is someone who already has access to those names anyway.

A state that overthinks FERPA this badly doesn’t deserve to be on anybody’s “best anything” list.

Florida A&M says it can't discuss a student trustee's removal because of FERPA

Mon, 15 Apr 2013 13:03:40 -0400

Florida A&M says it can't discuss a student trustee's removal because of FERPA:

Florida A&M University’s student government president recently was removed from the college’s board of trustees. But no one will say why. Officials told the student newspaper, The Famuan, that the matter is confidential under FERPA, the Family Educational Rights and Privacy Act.

The Famuan published a strongly worded column criticizing the university’s decision to withhold information about the trustee’s removal.

“However, people need to realize that by putting yourself into the position of a public figure and joining the BOT, you are subject to scrutiny, and your actions have to be made publicly,” Managing Editor Jorge Rodriquez-Jimenez wrote. “For the university to try to protect a public figure by screaming FERPA makes me question what other lines they are willing to blur to save face.”

Source: The Famuan, Stop hiding behind FERPA, (March 22, 2013)

SPLC Executive Director Frank LoMonte:

So, here’s the thing. In January, the editor of the FAMU student newspaper vanished — and the university wouldn’t say why. Then in March, the student representative on FAMU’s board of trustees disappeared — and again, FAMU wouldn’t explain why.

There’s only one logical explanation.

Killer sinkholes.

Florida’s full of these suckers, they’re fast, they strike without warning — and they’re hungry.

So… on the remote possibility that the campus is NOT full of killer sinkholes — that, instead, FAMU’s student body president was disqualified from the board for academic or disciplinary reasons — is there any reason FAMU can’t say so?

Well, for starters, a Tallahassee TV news station reported March 21 that the former trustee, Marissa West, “resigned” from student government. A resignation from elected office is not a piece of confidential education information, so FAMU clearly can (but apparently won’t) confirm that much.

And FAMU probably can say quite a bit more. By way of reminder, FERPA protects the confidentiality of records — not of facts. If FAMU’s information about the former elected official comes from a source other than education records (for instance, from city police reports), then that information is not FERPA-protected.

As even universities themselves admit (when admitting it serves their self-interest), FERPA does not apply to one-off disclosures — it penalizes schools that have a “policy” of releasing confidential records. What “policy” might conceivably exist here? “Every single time we fire the student member of the Board of Trustees, we tell people why” isn’t (let’s hope!) a routine practice.

The fact that we’re even arguing about this at all illustrates how hopelessly dysfunctional FERPA is. When you run for the highest-profile office on your campus, and agree to sit on the university’s governing board, you implicitly waive a degree of privacy as it relates to your job performance and your fitness to serve.

But because the FERPA statute doesn’t provide for a “waiver by conduct,” it’s literally possible that you could get your grade-point average tattooed on your forehead (by the way, don’t) and yet file a FERPA complaint if the college discloses it.

Bottom line: FAMU legally can (and ethically should) say something about why its students no longer are represented by the elected trustee of their choice. And unless disclosing the basis for the departure necessarily requires giving away a piece of confidential information gleaned from education records, then the college legally can (and ethically should) give the public a full explanation.

Just to be safe, Florida needs to get cracking on plugging those killer sinkholes. Starting with the information sinkhole that is Florida A&M University.

Duke student government president says names of students found responsible for sexual assault is protected by FERPA

Tue, 09 Apr 2013 17:19:00 -0400

Duke student government president says names of students found responsible for sexual assault is protected by FERPA:

Last week, a candidate for Duke University’s student government dropped from the race after flyers were hung around campus that said he had been suspended from campus for a semester for sexually assaulting another student, The Duke Chronicle reports.

The candidate has denied the accusations, but the incident has prompted students on campus to ask whether student government has any means of learning whether candidates or elected students have been found responsible for sexual assaults or other disciplinary action.

The school’s incoming student body president, Stefani Jones, told the paper that student government would have no way of learning about a candidate’s disciplinary history.

“Even if we wanted to create a policy about [those found responsible for sexual assault or harassment], it would be impossible,” Jones told the paper, citing FERPA. “We would never know which students were in violation of that policy…. If it existed, it could never be enforced.”

Source: The Duke Chronicle, Duke student government cannot access candidates’ history (April 8, 2013)

SPLC Attorney Advocate Adam Goldstein: Obviously, we need to talk about this topic in the abstract—since I’m not a prosecutor looking to make my reputation, I don’t want there to be any confusion about the fact that I’m talking about hypotheticals.

But it turns my stomach to hear people assert that FERPA would be an obstacle to learning whether someone has been suspended for rape. Partially because that’s incorrect; FERPA does not prevent an institution from disclosing the final result of a disciplinary proceeding where someone has been found responsible for a rule infraction that is also a crime of violence. See 20 U.S.C. Sec. 1232g(b)(6)(B).

Mostly, however, this upsets me because it suggests there’s some kind of academic right of privacy in rape. There isn’t. At all. Ever.

There are four valid answers Duke could give the student government if it requested copies of the outcome of a disciplinary proceeding against a candidate:

“Here’s a copy of the final outcome.” This would apply if the person was found to have committed a crime of violence.
“I can’t give you those records because of FERPA.” This would apply if the person was not found responsible, or they were found responsible of a non-violent offense (for example, if they were found to have tresspassed).
“There are no such records.” Meaning there never was a disciplinary proceeding.
“We aren’t going to tell you because Duke is a private institution and we don’t have to.” If Duke feels an overwhelming urge to protect the rapists in its school, I suppose it’s legal to do this. It’s a pathetic, shameful answer, but it’s legal.

Nobody has a right of privacy in being a perpetrator of sexual assault. That’s an asinine position. That’s like saying you should have a right of privacy in robbing banks, or a right of privacy in treason. The entire point of criminalizing conduct is that we want to find those people and remove them from the streets.

I know that people are going to tell you that, in the name of campus safety, it’s important that we work hard to keep secret the names of rapists on campus. I suggest you find those people and ask them what the hell are they thinking.

After FERPA Fact rating, Saddleback College reverses position on records relating to shooter

Fri, 15 Mar 2013 14:29:00 -0400

After FERPA Fact rating, Saddleback College reverses position on records relating to shooter:

Here’s a first: After earning FERPA Fact’s “Not protected by FERPA” rating, one California college has reversed its position.

Last week, we gave a Triple Duncan rating to Saddleback College’s use of FERPA. The school cited the Family Educational Rights and Privacy Act (before citing the Health Insurance Portability and Accountability Act) when denying student journalists at the Lariat access to public records about a former student who went on a shooting spree that killed three in February.

This week, the college has reversed its position. In an email sent Thursday, the school’s spokeswoman told Lariat editor Angie Pineda that after consulting with the school’s lawyers, the school would be releasing records relating to Ali Syed.

“The opinion of legal counsel is that based on the U.S. Department of Education’s interpretation of the Family Educational Rights and Privacy Act (FERPA), it is within the discretion of the district to decide whether to release the documents in this highly unusual circumstance,” McCue wrote. “The college and district take student privacy rights and laws protecting those rights seriously. Given that it is within our discretion to release the documents in this circumstance, the college and district have made the decision to honor the Lariat’s request.”

Pineda said she and her staff never expected administrators to provide the records. ”We were all stunned,” she said. Read the documents here.

California school says records relating to shooter are protected by FERPA, HIPAA

Wed, 06 Mar 2013 19:01:42 -0500

California school says records relating to shooter are protected by FERPA, HIPAA:

Last month, 20-year-old Ali Syed went on a shooting spree killing three before killing himself. Student journalists at Saddleback College’s Lariat quickly learned that Syed had attended the school and began seeking more information about his attendance, Editor-in-Chief Angie L. Pineda said.

The Lariat reporters talked with a professor who taught Syed but has had difficulty getting any more information about him from school administrators. At first, school administrators said their request — for records relating to whether Syed was in the school’s programs for disabled students or those with special needs — could not be released because the records are private under FERPA, Pineda said. When she followed up, a school spokeswoman told her that HIPAA, the Health Insurance Portability and Accountability Act, protected the records from release. Pineda said the staff seeks the records because they are crucial to their reporting about what prompted Syed’s shooting and whether there were warning signs before.

Source: interview with Angie L. Pineda, Lariat editor-in-chief (March 6, 2013)

SPLC Attorney Advocate Adam Goldstein: We’ve heard this song and dance before from Ohio State employees, who cited FERPA and HIPAA as a basis for refusing to disclose disciplinary outcomes after sexual assault reports. Somehow, Saddleback College has managed to come up with something even dumber, here.

As the Department of Education has pointed out, FERPA does not protect the records of dead students. Syed killed himself. I’d have thought that was enough for Saddleback employees to piece it together themselves, but apparently, they’re still struggling. I’d explain it to them in smaller words but I don’t understand what part they don’t understand.

And as we’ve discussed in that Ohio State post, HIPAA only applies to organizations that are primarily in the business of providing health care. It doesn’t apply to law enforcement, it doesn’t apply to fire departments, and it doesn’t apply to university life offices. A person with basic literacy skills who is permitted to operate her own shoelaces and buttons would be able to figure this out from any summary of HIPAA anywhere, so to cite this is both a complete abdication of the basic obligation to meaningfully respond to public records requests, and evidence of someone possessing the intellectual curiosity of a cream cheese danish.

(I apologize, that was a completely uncalled for thing to say about danishes, which are proud and noble pastries, rich with history, that have never once improperly withheld a record.)

Now, far be it from me to cast aspersions on Saddleback’s motivations, here, but I have a hard time taking them at their word that they are refusing to disclose information related to this person’s education due to an overwhelming concern with the completely imaginary privacy rights of a dead murderer. Do you think it might be possible—I mean, could it be the case—that Saddleback just doesn’t want anyone to know what services this person was or was not offered?

Let’s not forget that this same path was walked by Pima Community College in Arizona, when they cited FERPA as a basis for withholding e-mails related to their former student, Jared Loughner, who murdered six people in Tucson in January 2011. Out of their overwhelming desire to protected Loughner (and not at all out of, say, a desire to avoid anyone finding out what they knew and when they knew it), Pima Community College refused to disclose Loughner’s records, citing FERPA.

Pima lost the case, and when they finally did hand over the records (which showed that, while Pima struggled to figure out what to do, it was trying very hard to do the right thing), they also ended up handing over $25,000 in attorney’s fees.

The only real difference between Saddleback’s situation and Pima’s situation is that Loughner is still alive. Take a minute to process that.

A little less than two years after a court says FERPA doesn’t protect e-mails about the mental state of a campus shooter who is alive, Saddleback is citing FERPA (and the even more laughable HIPAA) as a basis for refusing to confirm the enrollment details of a campus shooter who is dead, and thus categorically exempt from FERPA.

It may be necessary to find local counsel to get a judge to order them to comply with the law. And then probably it’ll be necessary to hire some cartoonists or puppeteers to translate the judge’s order into something even a Saddleback administrator would understand.

In the meantime I’m just going to cross my fingers and hope that there has to be somebody at the college smart enough to realize how stupid this looks. Is there somebody there who is in charge of the pointy-scissors and watching the paste to make sure the other administrators don’t eat it? Can you forward this to him, please?

Southern Connecticut State University uses FERPA to withold information about suspended baseball coach’s allegations

Tue, 05 Feb 2013 14:59:00 -0500

Southern Connecticut State University uses FERPA to withold information about suspended baseball coach’s allegations:

Friday, Southern Connecticut State University released a statement announcing that it had placed its head baseball coach, Tim Shea, on immediate administrative leave due to allegations of NCAA violations. In the schools press release, the university says it cannot comment further because they cannot release any more information about Shea’s administrative leave because of FERPA.

Source: The Hartford Courant, Southern Connecticut baseball coach Tim Shea placed on administrative leave pending investigation of NCAA violations. (Feb 1, 2013)

SPLC Attorney Advocate Adam Goldstein: While it’s entirely possible that some of the NCAA violations in question touch on student behavior, that’s not why the institution can’t “provide further comment.” For most violations, disclosing the nature of the violation with identities redacted won’t disclose anything about students in the program.

SCSU basically looks like it’s fudging the details in its statement. The statement amounts to saying, “we won’t tell you anything, and that’s because of internal rules and FERPA.” So it’s not even quite saying that FERPA is the reason they won’t comment further. It’s a misuse of FERPA in that they’re using federal law to give a veneer of respectability to what is essentially a press release saying, “go to hell, we’re not answering your questions because we don’t have to.”

That said, is there any FERPA-protected information in play here? Possibly. It really depends on the violations. But that’s not why they won’t “comment further.” They could go farther than they did without going anywhere near FERPA’s rules.

In essence, SCSU’s invoking FERPA to explain why they won’t disclose the nature of the violation is like a store owner invoking shoplifting law to explain why they won’t let anyone into the store. Yes, it’s possible someone would shoplift if they got in the store, but the line being drawn is so far away from the law being cited that it’s clearly not the real motivation for the action.

Because they fudged the details by invoking internal policy and FERPA in the same breath, they’re more guilty of intellectual dishonesty than FERPA wrongdoing.

We rate this:

Indiana school superintendent says FERPA prohibits disclosure of disciplinary outcomes

Sat, 05 Jan 2013 14:22:01 -0500

Indiana school superintendent says FERPA prohibits disclosure of disciplinary outcomes:

Warrick County School Superintendent Brad Schneider says he can’t discuss the results of the Indiana school district’s investigation into a threat made on Facebook by a high school student because FERPA prohibits doing so. Schneider brought up the threat, made at the beginning of the school year, when discussing another alleged threat made by a student on Facebook, this time following the shooting at Sandy Hook Elementary School. The results of the recent investigation aren’t clear, either.

Source: Warrick Publishing, BHS, police respond to Facebook threat. (Jan. 2, 2013)

SPLC Executive Director Frank LoMonte: In the real world — that is, the world that you and I and everyone we know lives in — “privacy” refers to “things that are private.”

That is not the world inhabited by the legal geniuses at the Department of Education — which is the only reason that the answer to this FERPA scenario is not 100 percent obvious.

Let’s pay a brief visit to the real world. There, a principal’s statement that “we suspended a boy for 10 days for making a threat” would never in anyone’s wildest imagination be considered a release of confidential information, (a) because the statement tells us nothing about the kid, and (b) you give up the right to be indignant about your privacy anyway when you threaten violence against people, especially when you do it on Facebook.

Judges, for the most part, occupy the real world. Thus, judges in Montana applied FERPA correctly and ruled that a newspaper could be told what disciplinary penalties were imposed on two students who shot at classmates with pellet guns, once the students’ names were withheld.

If we stop there, then it’s nonsensical for the Warrick County school district to refuse to tell the public what was threatened and what penalty was imposed. Not just nonsensical, but affirmatively counterproductive to good education. With just Superintendent Schneider’s statement, there’s no way for the public to independently verify whether the school district used sound judgment — or grossly overreacted.

Now let’s step through the funhouse mirror into “DOE Wonderland,” where when they use a word, it means just what they choose it to mean — neither more nor less.

As of 2009, the Department changed its interpretation of FERPA to say that, if anyone within the school community might be able to match up the anonymous piece of information with a known student, then even the release of de-identified records can still violate FERPA.

It’s probably true that some people within the school know that Johnny Jones is the kid who made the Facebook threat. But those people also already know that he was kicked out of school for 10 days.

So a statement by the superintendent reassuring the public as to how threats are punished — reassurance to which the entire school community is kind of entitled — gives away nothing that Johnny’s friends didn’t already know.

That is the fatal fallacy of the Department’s 2009 FERPA reinterpretation — that releasing information already known to an entire class (or even known to the entire school) can be an invasion of privacy.

But being realistic, there is absolutely zero chance that the DOE would impose the “financial death penalty” on a school district because its superintendent, in a good-faith effort to inform the community, let the public know the nature of a threat and the severity of the penalty imposed. The department has never seen fit to sanction anybody for a FERPA violation — ever. It certainly would not start here.

While there is no indication of an ulterior motive in Warrick County, interpreting FERPA in this nonsensical way clearly invites mischief. A school district that grossly misuses its disciplinary authority — in ways that the public should know about — can conceal its wrongdoing behind “student privacy.” Unless the student and his family incur the embarrassment of “outing” themselves, citizens will never learn about, and put a stop to, disciplinary overkill.

It is utterly impossible to believe that Congress intended for FERPA to be used to keep the public in the dark about whether a threat of violence was or was not serious, and whether the school responded appropriately. Unless you work at the Department of Education, where they sometimes believe as many as six impossible things before breakfast.

We rate this:

Connecticut university releases elementary school shooter's grades

Mon, 31 Dec 2012 11:05:00 -0500

Connecticut university releases elementary school shooter's grades:

Among the details being shared now about the man behind the Dec. 14 shootings at Sandy Hook Elementary School are records about his attendance at Western Connecticut State University. A spokesman for the school district told the Associated Press that the shooter earned a 3.26 grad point average while taking classes as a teenager. He earned an A in a computer class, A- in American history and a B in macroeconomics, according to the AP’s report.

Source: The Associated Press, School gunman went to Conn. univ. when he was 16. (Dec. 17, 2012)

SPLC Executive Director Frank LoMonte: Washington’s about to drive over a cliff. You can’t go anywhere without a bulletproof vest anymore. And we’re out of Twinkies. Let’s face it, America: 2012 sucked.

So let’s end it on a modestly positive note, by giving props to a college that put aside FERPA mythology and correctly honored a request for public records — without triggering the Mayan apocalypse.

Normally, federal law makes students’ grades confidential, and that confidentiality survives graduation. But when a (present or former) student dies, FERPA privacy dies too — the U.S. Department of Education’s chief FERPA enforcer said as much in a December 1994 advisory opinion to Maine’s Bates College.

Not a lot about federal privacy law is consistent with common sense, but this is one time the two actually align. Courts have said for decades that the common-law right of privacy does not survive the individual’s death. It would defy logic to say that a writer was free after your death to publicize your drinking habits, your extramarital affairs and your embarrassing venereal diseases — but not that C-minus you got in Trigonometry.

Eagle-eyed readers may note that Newtown shooter Adam Lanza attended college starting at age 16, and may wonder whether that changes the rules. It doesn’t — but if you noticed that, then you’re probably a terror at “Where’s Waldo.”

When the student is a minor, the right of FERPA confidentiality belongs to the parent, not the student — except if little Doogie goes to college early. The FERPA statute, 20 U.S.C. Sec. 1232g(d), provides that the right to consent to the release of confidential records belongs to the student and not the parent “whenever a student has attained eighteen years of age, or is attending an institution of postsecondary education” (emphasis added).

So the answer remains — the right to object to the release belongs to the college student, and with his death, the right to object dies as well. Western Connecticut State acted consistently both with FERPA and with common sense in fulfilling the AP’s request.

It’s pretty pathetic when you have to pop a champagne cork to celebrate a college not acting irrationally and not violating the open-records act — but consistent with 2012 as the year of lowered expectations, we’ll take it.

With wishes for a more transparent 2013,

We rate this:

University of Colorado cites FERPA in withholding more than 2,000 documents related to Aurora theater shooter

Tue, 18 Dec 2012 09:23:08 -0500

University of Colorado cites FERPA in withholding more than 2,000 documents related to Aurora theater shooter:

Thousands of documents, including many emails, concerning Aurora theater shooter James Holmes were released earlier this month by the University of Colorado, a month after a judge ruled some records could be released if they were public under Colorado law. The university said it redacted about 2,000 of the documents about Holmes because of FERPA and medical privacy reasons.

Source: Associated Press, James Holmes emails reveal brief romance, few friends (Dec. 6, 2012).

SPLC Executive Director Frank LoMonte: It’s depressing to have to say this — and doubly so, given the events of Dec. 14 at Newtown, Conn. — but we’ve been down this road before.

In 2011, The Arizona Republic tried to get public records from Pima Community College about its former student, Jared Loughner, after Loughner was arrested for the shopping-center shooting spree that killed a federal judge and left congresswoman Gabrielle Giffords gravely wounded.

Pima College, predictably, said everything it had on Loughner was confidential under FERPA.

A state-court judge didn’t see it that way.

Superior Court Judge Stephen C. Villarreal explained that FERPA covers only records that a college “maintains” about its students. An email from one professor to another, commenting that a particular student might be dangerous, is not a record “maintained” by the school. It doesn’t appear in the student’s permanent file, and it is subject to being deleted by the recipient at any time.

Judge Villarreal’s common-sense application of FERPA is consistent with the way the Department of Education has explained the statute’s purpose: If a record is a FERPA record, then (a) it must be produced when the student shows up and demands to inspect his FERPA records and (b) the student has the right to challenge the accuracy of the record, to insert corrective material into the record, and to have a hearing if the college declines to make the correction.

None of those descriptions applies — heck, none of them even makes sense — when talking about employee emails.

Now, fast-forward to Aurora, Colorado.

In its initial records production, the University of Colorado appears to have disclosed mostly documents created after the July 20 movie-theater shooting, such as correspondence about responding to journalists’ inquiries. As media reports have characterized the records, very few pertain to Holmes’ actual attendance at the university.

Undoubtedly, some of what the university has in its “James Holmes” file — his college application, grades, records of minor disciplinary incidents and the like — are “education records.”

But two thousand pages’ worth?

Let’s see, the University of Colorado has 30,000 students at any given time. If the “James Holmes file” is typical, then Colorado has 60 million pages of FERPA “education records” — just on its current students.

Sixty million pages is how much the Library of Congress adds to its collections every year. Sixty mission pages is the size of the entire collection in the Ronald Reagan Presidential Library.

In other words, nah. Colorado doesn’t have 2,000 pages of FERPA records about James Holmes. It has 2,000 pages of something — but relatively few of those pages are “education records.”

Judge Villarreal had it right in the Arizona Republic case. If documents aren’t centrally “maintained,” they aren’t covered by FERPA.

Postscript: To the extent that Colorado insists some of the documents are covered by “health care privacy,” that exception — like FERPA — is much narrower than schools commonly claim.

If Holmes was consulting a health-care professional such as a university psychiatrist, then records of his treatment legitimately are protected by the federal Health Insurance Portability and Accountability Act (“HIPAA”). But the opinions of non-medical laypeople about Holmes’ mental state are not HIPAA records — nor, see above, are they legitimately within the scope of FERPA.

We rate this:

Oklahoma State University says it was prohibited from contacting police about allegations of multiple sexual assaults because of FERPA

Tue, 11 Dec 2012 17:30:23 -0500

Oklahoma State University says it was prohibited from contacting police about allegations of multiple sexual assaults because of FERPA:

Last month, the student reporters at Oklahoma State’s The Daily O’Collegian received an anonymous letter that said a former member of one of the school’s fraternities had committed nearly a dozen sexual assaults against new fraternity members. The O’Colly contacted the local police department, who hadn’t heard of the assaults. Shortly after, Stillwater police contacted school administrators, who confirmed the university knew about “‘several occurrences” similar to those described in the anonymous letter but had declined to contact police about the incident. Gary Shutt, Oklahoma State’s director of communications, said in a statement Monday that “due to federal laws (FERPA), OSU was not allowed to contact police.”

Stillwater police Capt. Randy Dickerson said he has been told by Oklahoma State’s student conduct office that it can’t disclose any additional information to police, including the results of a disciplinary hearing, because of FERPA. In interviews with The O’Colly, Shutt said the university conducted a “level three student conduct committee hearing,” which is used when suspension or expulsion from the university is possible. The student conduct committee made its decision Nov. 30, Shutt told the paper. As of Monday Dec. 10, the student was still enrolled, according to the registrar’s office.

Source: The Daily O’Collegian, UPDATE: Stillwater police speak to alleged victims in sexual assault investigation (Dec. 7, 2012), OSU did not tell police of sexual assault allegations (Dec. 10, 2012) and Student accused of sexual assault still enrolled at OSU (Dec. 10, 2012)

SPLC Executive Director Frank LoMonte: Let’s play a game. I’m going to give you two paths to choose from. Each path carries a risk.

If you decide to go down Path Number One, the worst thing that can happen is that unsuspecting college students will get raped by a sexual predator.

If you choose Path Number Two, the worst thing that can happen is that you’ll get a harsh letter from the U.S. Department of Education.

If you decided that the less dangerous choice was Path Number One, congratulations. You just passed the administrator certification exam for Oklahoma State University.

When the grotesquely flawed and misused FERPA statute is repealed by Congress and replaced with a clearer one — and make no mistake, that day is now very near — this will be the case that changed everything. The day that FERPA Jumped the Shark.

Nobody — not one person — outside of the administrative offices of Oklahoma State University thinks that what has happened in Stillwater is a defensible exercise of judgment. Giving OSU the benefit of every doubt, the college knew at a minimum that credible accusations existed that a serial sex offender had preyed on at least five student acquaintances (and police are now saying the number may go much higher).

Did they transmit a warning to the campus community? No.

Did they promptly remove the student from campus to separate him from other potential victims? No.

Did they notify the police? No.

What they did — all they did — was send the case to the same disciplinary board that punishes you for having too many overdue library books.

Because, they say, of FERPA.

Had a tipster not notified the alert student journalists at The O’Colly — who, unlike OSU administrators, recognize serial rape as kind of a big deal — a string of sex offenses that may exceed a dozen would have gone un-prosecuted.

There are times when emergencies entitle you to violate the law. If you’re rushing a gunshot victim to the emergency room, it’s excusable to speed. If you’re on fire, it’s excusable to grab your neighbor’s jacket to put it out.

And if you’re pretty convinced that there’s a serial sex offender on your campus, it’s excusable to let the police know. That’s what the U.S. Department of Education — which enforces FERPA — told schools last June in a memo that was specifically intended to keep FERPA from becoming an obstacle to telling the police about ongoing dangers to student safety:

[I]f a school official can explain why, based on all the information then available, the official reasonably believes, for instance, that a student poses a significant threat, such as a threat of substantial bodily harm to any person, including the student, the school official may disclose personally identifiable information from education records without consent to any person whose knowledge of the information will assist in protecting a person from threat.

An exhaustive list of all the ways in which Oklahoma State is wrong would be, well, exhausting. Let’s just hit the high points:

The Department of Education’s FERPA rules explicitly say that asking the police to investigate crimes doesn’t violate student privacy: “Nothing in the Act prohibits an educational agency or institution from contacting its law enforcement unit, orally or in writing, for the purpose of asking that unit to investigate a possible violation of, or to enforce, any local, State, or Federal law.” That’s game/set/match right there. Oklahoma State is down to two choices: (a) stupid or (b) lying. That’s no way to go through life.
Leaving aside the existence of a directly-on-point FERPA exemption, it’s entirely possible to notify the police of a security risk without giving away the identities of the victims — and FERPA prohibits only the release of identifying information, not generic information.
It’s also entirely possible that the police had information that would have been directly relevant to the disciplinary decision. While this turns out not to be the case, suppose the police had already begun their own investigation based on complaints from seven different victims? (It’s not exactly a leap of the imagination that rape victims might, you know, go to the police.) Wouldn’t that have been informative in deciding the accused student’s level of dangerousness?
A federal disclosure law, the Clery Act, requires colleges to issue a “timely” warning to the campus community whenever it appears that criminal behavior “represents a threat” to students or employees. See 34 C.F.R. Sec. 688.46(e). Once an OSU disciplinary board concluded that it was probable that the accused student had a pattern of predatory behavior — and knew he was still on the campus — it’s difficult to excuse the failure to alert the public. As a federal appeals court said in a 2007 interpretation of the Clery Act:

[T]he need to assure safety and security for campus communities counsels that doubts should be resolved in favor of notification.

Hmm, it’s weird, you ever have that feeling that you’ve seen the movie already? A suspected sexual predator loose on a college campus? Administrators who could’ve called the police but decided not to? Boy, this one’s going to be bothering me all day, I can’t shake the feeling we’ve heard this somewhere before.

We rate this:

Missouri athletic director says he cannot comment on police report detailing alleged rape by star player because of FERPA

Sat, 08 Dec 2012 16:34:00 -0500

Missouri athletic director says he cannot comment on police report detailing alleged rape by star player because of FERPA:

Late last month, The Kansas City Star learned that a Missouri basketball star’s October suspension came shortly after he was accused of rape for a second time. Police investigated the allegations again Michael Dixon Jr. and he was not charged in either incident. Previously, athletic department officials said Dixon’s suspension was for violating unidentified team rules. Since the two rape allegations have become public, Missouri coach Frank Haith and Athletic Director Mike Alden have said they cannot comment on them because of FERPA. Alden again cited the federal student privacy law when asked whether he had seen the police record from the first rape accusation in January 2010.

Source: The Kansas City Star, Haith says Dixon’s suspension was for academics, then changed. (Nov. 30, 2012)

SPLC Executive Director Frank LoMonte: You want to bet that, when members of the U.S. Senate were sitting around deliberating over passing a law to make “education records” confidential, one of them turned to the other and said, “Of course, by ‘education records,’ we mean ‘records of whether you raped somebody.’”

Yeah, me neither.

FERPA privacy undoubtedly does restrict colleges from revealing confidential disciplinary records pertaining to particular students, including student-athletes. But FERPA was designed in a simpler time (1974), when “disciplinary record” meant sneaking a joint in the stairwell of the dorm. Not sexual assault.

Because campus disciplinary boards increasingly are being asked to handle what society considers — everywhere but on a college campus — to be felonies, it’s debatable whether 1970s-era privacy standards are a proper fit. But until Congress acts, secrecy is the law.

Missouri probably cannot reveal the basis for disciplinary action against a particular student-athlete, or the student’s reasons for transferring schools. That much, legitimately, is covered by FERPA. (Unless, that is, a disciplinary tribunal actually found that the student committed a violent or sexual offense, which doesn’t appear to be the case here. The FERPA statute — 20 U.S.C. Sec. 1232g(b)(6)(B) — expressly says colleges can disclose such disciplinary findings.)

Police reports, however, aren’t FERPA records. When a coach or athletic director is asked “are you aware there is a police report accusing one of your players of sexual assault,” answering that question in no way violates federal law. FERPA restricts only the release of information that is gleaned from confidential “education records.”

A police report is a matter of public record. Coaches can and do comment about information appearing in police reports — for instance, if an athlete is injured in a car wreck. (Here’s an example from May in which Michigan State put out a press release describing the circumstances of a car crash in which two football players were hurt. No indication that the “FERPA cops” have closed down MSU as a result — we just checked, and their website’s still working.)

An athletic director not only can say “yes, I know there was a criminal complaint filed against one of my players,” he should say it. The public is entitled to reassurance that those running major athletic departments are being kept informed and are making reasonable efforts to stay informed. A contrary response — “Son of a gun, that’s the first I’ve heard of that!” — would indicate a lack of inquisitiveness and engagement that might best be described as “Spanier-esque.”

Acknowledging awareness of a police report in no way compromises any of the player’s confidences. Nor is that awareness the result of reviewing any confidential education records.

We rate this:

Ohio State officials respond to Triple Duncan FERPA Fact rating

Wed, 05 Dec 2012 08:40:00 -0500

Ohio State officials respond to Triple Duncan FERPA Fact rating:

Recently, we wrote about Ohio State’s use of FERPA (and HIPAA) to deny access to records about three rapes in one dorm this semester. After we gave it a Triple Duncan rating, The Lantern asked administrators about it. Unfortunately, they’re standing by their original excuse.

School says it can't disclose disciplinary action taken after sexual assaults because of FERPA

Tue, 27 Nov 2012 14:17:21 -0500

School says it can't disclose disciplinary action taken after sexual assaults because of FERPA:

After Ohio State police reported three sexual assaults in one dorm this semester, The Lantern talked with police and student life officials about the assaults. Both offices declined to say whether disciplinary action had been taken by the school, citing FERPA and HIPAA, the Health Insurance Portability and Accountability Act.

Source: The Lantern, 3 sex crimes reported in Park-Stradley this semester (Nov. 26, 2012).

SPLC Attorney Advocate Adam Goldstein: When you have law enforcement and student life citing HIPAA as a reason to withhold information, you’re off to a bad start. HIPAA only applies to organizations primarily in the business of providing health care and certain types of billing companies they work with. In other words, HIPAA never applies to anything law enforcement or student life ever does, ever, at all. The fact that Ohio State officials would cite HIPAA here shows that not only don’t they intend to comply with open records law, they don’t even respect The Lantern enough to come up with a coherent lie to hide behind.

It’s not that surprising, then, that their FERPA explanation is completely bogus, too. The Lantern’s request wasn’t even for a record, let alone a record that would make a student identifiable. At worst, it was a request for information that might suggest the existence of unspecified records about unidentified individuals who may or may not even be students.

And while this isn’t directly about FERPA, I can’t let Chief Denton or University Life spokesman Isaacs off the hook for some of the absolutely bone-chilling things they do manage to say about the situation in Park-Stradley Hall.

Denton is quoted as saying that the victim and suspect in the Nov. 21 case were “casually acquainted,” but that the crimes didn’t appear to pose an ongoing threat to the campus community. Chief, what are you trying to say when you say that the victim and suspect were “casually acquainted?” That there’s no ongoing threat because the suspect was only acquainted with one other person? That acquaintance rapes, which may make up as many as 80-85 percent of all rapes, are somehow less of a threat?

Look, chief, I don’t know how many rapes it takes for you to start getting nervous, but for me, it’s one. One rape is when I start worrying about the risks posed to the campus community. At about the third rape, saying there’s no ongoing threat sounds like madness.

It doesn’t matter that the crimes are unrelated. The entire theory behind the Clery act was that, if Jeanne Clery had been warned about the thefts on campus, she’d have taken precautionary measures that could have stopped her rape and murder. Again, it doesn’t matter that you think the three rapes are isolated. If you warn students about a pattern of rape, even if the perpetrators change, students take precautionary measures. That’s the whole concept of the Clery Act. And you’re doing it wrong.

Speaking of precautionary measures, Isaacs is quoted as saying, among other things, that “we have extensive offerings in self-protection.” Are you kidding me? Are you even serious? So Ohio State doesn’t think it’s important to warn students that there have been a series of rapes in the building, but hey, if it upsets them when they find out, they can take krav maga? That’s Ohio State’s plan to reduce sexual assault on campus? This is the best idea you’ve had so far?

Since the Buckeyes can’t go to a bowl this year anyway, can we deploy the defensive linemen to Park-Stradley? Hey, say what you will about that idea, but it’s better than, “if you find out about the rapes and they make you nervous, study Kung Fu.”

We rate this:

School says incident report detailing sexual assault is protected by FERPA

Wed, 21 Nov 2012 14:22:30 -0500

School says incident report detailing sexual assault is protected by FERPA:

The College of Charleston has denied requests for police incident reports related to allegations of sexual assault involving a female varsity softball player. The victim has accused the school of hiding the assault because the four suspects involved are baseball players for the school. Attorneys for the school have said that releasing the incident report and other records related to any internal discipline of the suspects would violate FERPA.

In addition, one attorney for the school said that releasing the records or even confirming whether the suspects are varsity athletes could prompt a school shooting. “There are also safety concerns,” school attorney Thomas Trimboli told The Post and Courier. “You’ve seen stories about the shootings. Do you want to take that chance?”

Source: The Post and Courier, College cites privacy, fear of violence in withholding information (Nov. 18, 2012).

SPLC Executive Director Frank LoMonte: Wow, they totally went there. Write about our athletes being accused of rape, you snoopy journalists, and it’ll be all your fault when they go ballistic.

This is, in its own incredibly stupid and offensive way, a really ingenious response to requests for public records, since it can work in really just about any situation: “You want to see what Vice President Smithers has been charging on his university credit card? Good Lord, man, do you realize how tightly wound Smithers is? The man’s a smoldering volcano of violence — if his wife found out he paid $9.95 to watch ‘Jack and Jill’ on pay-per-view, he might blow us all to kingdom come!”

(Having admitted that they’ve allowed three men whom they suspect of harboring murderous tendencies to continue attending the school, it will be entertaining to see how the College of Charleston’s legal geniuses backpedal if one of the men — perhaps after a particularly frustrating 0-for-5 day at the plate — actually does go off and hurt someone.)

So, leaving aside the facts that (1) there is no “homicidal maniac” exemption in the South Carolina Freedom of Information Act and (2) there is no recorded history of anyone ever machine-gunning a campus in response to an embarrassing newspaper story, is this a valid use of the federal FERPA privacy law?

Not even close.

As we’ve (sigh) said before and (sigh) apparently need to say again, Congress amended FERPA in 1992 to make it unmistakably clear that records created for law enforcement purposes cannot be withheld on the grounds of “student privacy.” A campus police writeup of a student’s rape complaint assuredly falls within this category.

Police incident reports are textbook public records. The College of Charleston’s refusal to honor a request for those records — especially after, as The Post and Courier reports, the criminal investigation is over — smacks of bad faith.

We rate this:

School district says names of parents who sent emails, signed petitions are protected by FERPA

Mon, 19 Nov 2012 16:19:00 -0500

School district says names of parents who sent emails, signed petitions are protected by FERPA:

Earlier this year, a book about a family with two lesbian parents was taken off the library shelves and placed behind the counter at an elementary school in Utah. Students were allowed to check out the book with a permission slip from their parents. The American Civil Liberties Union has sued over the book’s placement. The Salt Lake Tribune asked to see the emails and petitions submitted by parents on both sides of the issue, which the school provided with the parents’ names redacted. The school district cited FERPA.

Source: The Salt Lake Tribune, Emails show range of emotions surrounding book controversy (Nov. 13, 2012).

SPLC Attorney Advocate Adam Goldstein: This is a tricky one. The names of parents are explicitly listed in the regulations as examples of personally identifiable information contained in education records. (See the definition of “personally identifiable information” in 34 C.F.R. Sec. 99.3.) But the same section has a definition of education records that say education records are those “directly related to a student” and “maintained by” the school. While the copy of the petition in the possession of the school is presumably something they maintain, query whether a petition signed by a student’s parent, with no other reference to the student, on an issue unrelated to the students’ education, is “directly related” to the student.

On the other hand, I haven’t seen the petition. It’s certainly within the realm of possibility that a petition could contain information that is directly related to a student. For example, if a group of parents wanted to protest discipline imposed on all the members of a club, the fact that a parent had signed the petition would have information directly related to the discipline of the student.

So whether the names on a parent-circulated petition are FERPA-protected is going to depend on what the petition says and if that discloses information about the student children of the undersigned parents. The people circulating these petitions ought to make them available to the media directly to avoid any FERPA issues.

We rate this:

School tells students to remember FERPA when speaking to the media, and also says Bangladeshi university is bound by FERPA

Fri, 26 Oct 2012 18:27:07 -0400

School tells students to remember FERPA when speaking to the media, and also says Bangladeshi university is bound by FERPA:

A former Southeast Missouri State University international student was arrested last week, charged with attempting to blow up the Federal Reserve Bank in New York with a car bomb. The university has released some information about the suspect, noting that he was enrolled for one semester and was majoring in cybersecurity. A spokesman for North South University in Dhaka, Bangladesh, which the suspect attending before moving to the United States, said he was a “terrible” student.

Anticipating media inquiries, Southeast Missouri State sent a letter to students, faculty and staff, instructing them to remember FERPA and its restrictions on releasing information about students if they talked with members of the press. When The Southeast Arrow, the school’s newspaper, interviewed President Kenneth Dobbins later that day, he declined to comment on the statement from North South University, citing FERPA. Dobbins also told the paper that the Bangladesh school shouldn’t have given the statement, again citing FERPA.

Source: The Southeast Arrow, President releases letter assuring campus is safe (Oct. 18, 2012) and The Southeast Arrow, Dobbins addresses campus safety, will meet with international students (Oct. 18, 2012).

SPLC Attorney Advocate Adam Goldstein: Is this really a thing that happened? Are university presidents struggling with this issue? Am I an animated map in a Schoolhouse Rock! short designed to teach basic geography? Maybe I should write this one in open letter format.

Dear President Dobbins:

I heard you thought FERPA might apply to North South University, an institution in Bangladesh. As you presumably know, the U.S. Department of Education makes rules for—curiously enough—the United States. I had this visual aid commissioned to help explain the rest of the problem with your analysis:

Shout out to Mrs. Brown’s fourth grade class for drawing the visual aid. (Just kidding. I didn’t ask a fourth grader to correct you. But I could have. I easily could have.)

Also, while your reminder to school employees about FERPA obligations was timely, sending the letter to students is a mistake, because non-employee students don’t have any obligations under FERPA and are free to talk about this student to anyone they like.

I hope this helps you understand FERPA and geography and maybe even give you a sense of wonder about this big ol’ world full of countries.

Yours,

Adam Goldstein
Attorney Advocate, SPLC
Part-Time Animated Map

We rate this:

School says names of student senate members are protected by FERPA

Fri, 26 Oct 2012 15:42:40 -0400

School says names of student senate members are protected by FERPA:

Source: C.J. Ciaramella, University of Oregon alumnus who is a reporter for the Washington Free Beacon, via Twitter.

SPLC Executive Director Frank LoMonte: Hang on a second, I’m on the phone with the FERPA Police. “Hello, FERPA Police? Yeah, I’d like to report a violation. The University of Oregon is letting a bunch of students email confidential FERPA records back and forth to each other. Right, they’re just emailing these FERPA records from one student senator to another student senator. No, they’re not redacting the emails, they’re letting these 20 student senators see everything. Oh good, you’ll send a squad car right over?”

You see the point, right? If an email from Senator Huey to Senator Dewey is a FERPA record, then the violation occurred when the email was shown to 18 other senators on the listserv — because (except for safety emergencies) FERPA doesn’t allow for confidential education records to be shared with anyone other than (a) a university employee with a business need to know or (b) a university contractor who has both a business need to know AND a signed confidentiality agreement. These students are neither.

But of course, an email from Senator Huey to Senator Dewey is not a FERPA record, because the Supreme Court told us so:

The word “maintain” suggests FERPA records will be kept in a filing cabinet in a records room at the school or on a permanent secure database, perhaps even after the student is no longer enrolled. Owasso Independent School District v. Doe, 534 U.S. 426 (2002).

If Senator Donald shows up at the Registrar’s office and asks to see his FERPA records, nobody tells him, “Wait right there while we do a search of all of the email listservs to see if you’ve ever written anything, or anyone’s ever written anything about you.” Because those aren’t “maintained” as a part of Donald’s university file. Because they aren’t FERPA records.

The only way a student can create a FERPA record is by sending a confidential communication to a university employee, e.g., appealing for the change of a grade. A note from one student senator to another student senator — and let’s just assume they’re talking about Senate business, not exchanging report cards, over the listserv — simply can’t be a secret education record.

If Oregon really wants to take the position that emails between student senators are FERPA records, then they better dial up Phil Knight and see if he can write them a check for the hundreds of millions of dollars that the U.S. Department of Education is going to fine them. Because I bet some of those senators have forwarded some of those quote-unquote “FERPA records” to their friends, or even read them out loud at Senate meetings.

You guys want to maybe reconsider that answer, OU?

We rate this:

School says police report about pellet gun shooting is protected by FERPA

Wed, 10 Oct 2012 19:33:00 -0400

School says police report about pellet gun shooting is protected by FERPA:

After learning of a fight at an apartment complex involving a pellet gun, The Butler Collegian asked the Butler University Police Department for a copy of the incident report. The police department declined to turn over the police report, citing FERPA. When questioned further, the police department said the incident report was not a law enforcement record because the case had been referred to Butler’s student affairs department.

Source: The Butler Collegian, Suspect name not released in incident (Sept. 19, 2012).

SPLC Executive Director Frank LoMonte: This one’s not even close.

When the police respond to the scene of a reported crime (in this case, an assault) and create a writeup, that’s a law enforcement record, not an “education record.”

Congress specifically amended FERPA in 1992 to exclude “records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement” from the definition of confidential FERPA records. See 20 U.S.C. Sec. 1232g(a)(4)(B).

We constantly hear the excuse that, even if police initially created the record for law enforcement purposes, it magically transforms into an education record if the decision is made to handle the crime as a disciplinary case and not a criminal case. Follow that logic, if you can.

What happens if the student who got shot by the pellet gun changes his mind and decides, two weeks later, that he wants to press criminal charges after all? Does the report then magically revert back to being a law enforcement record? Or what if the district attorney learns of the crime and decides campus discipline isn’t enough punishment and opens a criminal investigation — does the report then magically transform into a law enforcement record? You see how silly this could get.

What matters under FERPA is the purpose for which the record was created, not the manner in which it is later used. In this case, police with full state-delegated arrest authority responded to investigate a report of a violent crime. That’s a law enforcement activity, period.

The purpose of exempting law enforcement records from FERPA is to allow students to take precautions against crime to keep themselves safe. So it makes no sense to treat a burglary differently just because it is punished with a suspension rather than jail time. (“Oh, I heard a car got broken into last week, but that was just a disciplinary burglary, so I guess I’ll leave my MacBook right here on the passenger seat.”)

Police reports are never FERPA records, period.

(As a bonus, Butler police also claimed they’re exempt from the Indiana Access to Public Records Act because the university, being private, isn’t a state agency. But the Butler University Police Department is different. Its website boasts that Butler police officers “are appointed under the statutes of the State of Indiana with full police power and are available 24 hours a day throughout the year.” Those Indiana statutes give police officers at private colleges “[g]eneral police powers, including the power to arrest” and “[t]he same common law and statutory powers, privileges and immunities as sheriffs and constables.” When you ask for state authority to carry out a state function, you’d best be prepared to accept the disclosure responsibilities that go along with it.)

We rate this:

School says age and grade level of student who gave birth at school is protected by FERPA

Tue, 02 Oct 2012 19:55:00 -0400

School says age and grade level of student who gave birth at school is protected by FERPA:

A high school student gave birth in her Wilmington, N.C., school’s bathroom around dismissal time. The school system’s spokeswoman declined to release the student’s age or grade level, citing FERPA.

Source: The (Wilmington) Star-News, Baby born in Hoggard High bathroom (Oct. 2, 2012)

SPLC Attorney Advocate Adam Goldstein: This is a little bit of a gray area, actually. The district in question classifies the student’s name and date of birth as directory information, so ordinarily, FERPA wouldn’t shield that information. Here, however, the information is tied to a non-directory fact: that the student gave birth in a bathroom. To the extent that information was in a record, that would be protected by FERPA. But that information probably isn’t in a record (at least, I hope that students giving birth in the bathroom isn’t so common that the school maintains a form for it).

So the information being sought isn’t protected by FERPA because it’s directory information, and the information that would be protected by FERPA isn’t protected if it isn’t in a record. So while it looks very close to what FERPA would protect, it’s not quite there.

Of course, the really asinine part is that there are going to be lots of other places to get this information, like, say, birth records, or anybody who had gym class with the girl and noticed she was playing dodgeball with a curiously defensive stance. As far as FEPRA wrongdoing goes, this may be technically unprotected, but it’s close enough to the line that reasonable minds could differ.

We rate this:

N.Y. community college says student's arrest report is protected by FERPA

Tue, 02 Oct 2012 13:02:00 -0400

N.Y. community college says student's arrest report is protected by FERPA:

Last month, the student senate vice president at Hudson Valley Community College was arrested for threatening another student with a knife. Campus safety sent an alert to students, but withheld his name and have refused to give the incident report to reporters at The Hudsonian, the school’s student newspaper. Administrators said doing so would be a violation of FERPA.

Source: The Hudsonian, College refuses to reveal public records (Sept. 27, 2012)

SPLC Attorney Advocate Adam Goldstein: HVCC isn’t only wrong on FERPA, they’re withholding information that state law requires them to disclose. Here’s why.

FERPA doesn’t protect records in the possession of campus security or law enforcement. See 20 U.S.C. Sec. 1232g(a)(4)(b)(ii), excluding from FERPA’s protection “records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement[.]”
Even if FERPA protected law enforcement records (which it doesn’t), HVCC defines names as directory information, a class of data not subject to FERPA.
Furthermore, HVCC’s security officers are peace officers under NY Criminal Procedure Law. They’re using state authority to arrest people.
NY’s Public Officers Law defines an agency subject to state open records laws as “any state or municipal department, board, bureau, division, commission, committee, public authority, public corporation, council, office or other governmental entity performing a governmental or proprietary function for the state or any one or more municipalities thereof.”
HVCC is a SUNY school. So, you know, a state entity. With state-sworn officers performing the governmental function of policing.

So yeah, the security officer who asserted that this information is protected by FERPA managed to say the dumbest thing a public employee from New York has said since Alexander Hamilton said, “I’m just going to pop over to Weehawken and see if the Vice President is still having a temper tantrum.”

We rate this: