FERPA Update

FERPA Update

February 13-14, 2012National Forum on Education StatisticsSan Diego, California

Kathleen M. StylesChief Privacy OfficerU.S. Department of Education

2

Presentation Overview

A long and winding road: What we’ve been up to Overview of changes to FERPA regulations Case studies: “Real world” hypotheticals Priorities for 2012 Your feedback

3

When Last We Talked ….

The situation at the July, 2011 STATS Conference:

Me: Almost brand new FERPA regulation changes: Gestating ED Data Release Working Group: Learning to walk PTAC: Hitting their stride

4

Breaches by Educational Institutions

All varieties: hacking, loss of portable device, unintentional, insider breach, etc.

Year Number of Breaches

Number of Records

2005 64 1,886,8412006 103 2,019,1192007 107 791,9382008 103 1,107,0012009 71 1,062,2752010 73 1,575,698

2011 57 394,008

Source: Privacy Rights Clearinghouse

5

What We’ve Been Up To

I’m proud that we … Published amended FERPA regulations on 12/1/2012 Issued a lot of guidance and best practices documents Resumed FERPA training Increased the coordination between PTAC and FPCO Started a 2-way line of communication

I am challenged with … Persistent, tough data release issues The mountain of work yet to do

6

Best Practices and Guidance Resources Guidance on Reasonable Methods and Written Agreements Data Stewardship: Managing Personally Identifiable Information in Electr

onic Student Education Records Basic Concepts and Definitions for Privacy and Confidentiality in Student

Education Records Responding to IT Security Audits: Improving Data Security Practices Data Security: Top Threats to Data Protection Data Security Checklist Data Governance and Stewardship Data Governance Checklist Data Security and Management Training: Best Practice Considerations

…and more on the way…

7

“You know how sometimes FERPA

can tie your brain in a knot trying to think

through it all?” 

Our Favorite FERPA Quote

Received in an email to PTAC

8

FERPA Regulatory Changes

274 Comments received Final FERPA regulatory changes

– December 2, 2011 Federal Register– Effective January 3, 2012

The new regulations serve to:– Strengthen enforcement– Help ensure student privacy– Improve program effectiveness

9

FERPA Regulatory Changes – Studies Exception

State educational authorities acting on behalf of their constituent schools

Requirement for written agreements

But remember! Studies ≠ ResearchThere is no “Research Exception” under FERPA

10

FERPA Regulatory Changes — Studies Exception

Not clear that a

redisclosure by

FERPA-permitted

entity (e.g., SEA)

would be “on

behalf of” an

educational

agency

State educational

authorities can

redisclose data on

behalf of their

constituent

schools

OLD

INTERPRETATION

NEW

INTERPRETATION

11

New Definitions for Audits and Evaluations

Authorized Representative– Any entity or individual designated by a State or local educational authority

or an agency headed by an official… to conduct—with respect to Federal- or State-supported education programs—any audit or evaluation, or any compliance or enforcement activity in connection with Federal legal requirements that relate to these programs (FERPA regulations, § 99.3).

Education Program– Any program principally engaged in the provision of education, including, but

not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, and any program that is administered by an educational agency or institution (FERPA regulations § 99.3).

12

FERPA Regulatory Changes – Audit and Evaluation

Requirement to use “reasonable methods” Written agreements mandatory “Guidance on Reasonable Methods and Written

Agreements”

13

FERPA Regulatory Changes – Directory Information

ID badges Limited directory information

14

FERPA Regulatory Changes - Enforcement

Enforcement now allowed against entities without students

Five year ban extended to audit and evaluation exception

15

FERPA Regulatory Changes — Enforcement

No clear

authority to

bring

enforcemen

t actions

against

entities that

have no

students

OLD

INTERPRETATION

NEW

INTERPRETATION

16

Case Study 1: High School Feedback Report

SFSF requirement: publish data on student success in college

Assume functional K-12 SLDS Assume Higher Education Governing Board with public

postsecondary information Accomplish using audit/evaluation exception and

written agreement Use reasonable methods and select best practices

17

Case Study 2: Head Start Program

Local community action organization operates an HHS-funded Head Start program

The Head Start program wants to evaluate how well it is preparing children for school in K-3

Assume functional K-12 SLDS As a federally funded “education program” the Head

Start program uses the audit/evaluation exception Written agreement/Reasonable methods/Best practices And don’t forget the recordation requirement

18

Case Study 4: Technical Assistance

High school health clinics run by city health department Research organization wants to conduct both a health

and an educational assessment LEA is concerned about FERPA and contacts PTAC PTAC conducts site visit, consults with FPCO, and

makes best practices recommendations New agreements executed, following guidance FPCO concludes that the LEA is in compliance

19

Priorities for 2012

Expansion of PTAC to LEAs More guidance and best practices:

Formal ED guidancePTAC best practices guidanceCase studiesFAQs, etc.

Inter-agency collaboration Publishing data while protecting PII Privacy and transparency

20

Prioritizing Guidance

We can’t do it all! Priorities for 2012 include: Template or checklist for written agreements Email and electronic transmission of PII Video – which ones are “education records?” Joint guidance with USDA on FRPL data Breach response checklist Best practices for transparency Distinctions between de-identified and aggregate data

21

Longer Term Projects:

Student government records – are they “education records?”

Guidance on responding to subpoenas and court orders Updating 1997 publication on FERPA in the juvenile

justice system External researcher access I’d like your input too

22

2012 — PTAC Initiatives

Expansion to LEAs Coordination with FPCO Helping organizations come into compliance

– Statistical and data security experts– Site visits and regional meetings– Best practices guidance documents and training

materials– Compliance vs. transparency

23

Inter-Agency Collaboration

Agriculture: Free and reduced price lunch data Federal Trade Commission: Child ID theft Health and Human Services: Early childhood programs

and foster children Department of Justice:

Patriot Act amendments to FERPA Updating 1997 juvenile justice guidance Responding to subpoenas and court orders

24

Publishing Data While Protecting PII

Utility vs. privacy in data tables Disclosure avoidance in an information-rich world Technical Brief 3 and strong public interest A need for more uniformity and rigor Data Release Working Group

25

Beware!

Expect a 2012 update of:“Children’s Educational Records and Privacy: A Study of Elementary and Secondary School State Reporting Systems,” Fordham Center on Law and Information Policy, 2009.

Transparency is key Don’t forget about your contracts PTAC will be reaching out to help you

26

Key Messages to Take Home

Parents should be able to find basic information on your website about what you are doing with their children’s

data and how you are protecting it.

Be proud! If you’re learning important things from student data, publish those results.

27

If you’re staying for the MIS Conference ….

Wednesday, 10:15 a.m. (Nautilus 1):“PTAC and FPCO: Moving Forward Under the New FERPA Regulations”

Thursday, 10:00 a.m. (Nautilus 5): “Protection of Personally Identifiable

Information Through Disclosure Avoidance Techniques”

28

Contact Information

Kathleen M. StylesChief Privacy OfficerU.S. Department of EducationKathleen.styles@ed.gov(202) 453-5587

29

Questions and Comments

Your feedback helps us prioritize our work better. What questions, comments, or concerns do you want to discuss?