AIM Analytics Panel

November 2016

Maya R. Kobersy

Associate General Counsel

University of Michigan

FERPA OverviewApplies to all schools, colleges, and universities that receive funding from U.S. Department of Education (ED)Grants K-12 parents/college and university students key rights:

Right of annual notification of university’s FERPA policiesRight of access to own education recordsRight to seek amendment of education recordsRight, generally, to control release of personally identifiable information from education recordsRight to file complaint with Family Policy Compliance Office for alleged violations

Selected DefinitionsEducation record

Record that 1) contains personally identifiable information (PII) about a student and 2) is maintained by the educational institutionDoes not include the following:

Personal knowledge or observationsSole possession notesLaw enforcement recordsTreatment recordsEmployment records – unless the employment is because of the student’s status as a studentPost-graduation records not related to past attendance as studentGrades on peer-graded coursework before collected and recorded

Selected DefinitionsPersonally identifiable information (PII)

Name and address of student or family membersPersonal identifiers

Social Security NumbersStudent ID numbersBiometric records

Indirect identifiersDate of birthPlace of birthMother's maiden name

Information that, alone or in combination, could allow someone without personal knowledge to identify the student with reasonable certaintyInformation requested by someone whom the institution reasonably believes knows the identity of the student to whom the education record relates

Directory Information Exception

Institutions must provide annual notice of information designated as “directory information” under FERPACan disclose without student consent as long as both of the following are true:

Institution has notified its students of the information it has designated as “directory information”Institution has given students the opportunity to opt out of disclosure

CompletelyRe: particular purposesRe: particular parties

Directory Information Exception

Can designate as “directory information” information such as the following:

Student’s name, address, telephone number, and email addressStudent’s photographStudent’s date and place of birthStudent’s grade level, enrollment status, field of study, degrees, and dates of attendanceStudent’s participation in officially recognized activities and sportsStudent’s weight and height, if a member of an athletic teamsStudent’s honors and awards Student’s most recently attended educational agency or institutionOther information not likely to be viewed as harmful or an invasion of privacy if disclosed

Cannot include the following:Student’s Social Security NumberStudent’s student identification number, unless is not sufficient, on its own, to grant access student’s education records

Study ExceptionCan disclose PII without student consent as long as all of the following conditions are met:

Organization is conducting study for or on behalf of the disclosing institutionStudy has appropriate purpose

Developing, validating, or administering predictive testsAdministering student aid programsImproving instruction

Study is conducted in manner that does not permit personal identification by others not involved with studyPII is destroyed when no longer needed for study’s purposesOrganization and institution have entered into appropriate written agreement (see next slide)

Disclosing institution not required to initiate the study or agree with or endorse its conclusions or results

Study ExceptionWritten agreement between disclosing institution and organization conducting study must include the following terms:

Specification of purpose, scope, and duration of the study and the information to be disclosedRequirement that organization use PII only to meet the authorized purpose of the studyRequirement that organization conduct the study in a manner that does not permit personal identification by anyone other than organization’s representativesRequirement for destruction of all PII when no longer needed for the study and specification of the time period for destruction

If organization violates these requirements, cannot receive PII from disclosing institution for at least 5 years

De-Identified Records Exception

Can disclose without student consent after removal of all PIIDisclosing institution must first make reasonable determination that a student’s identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information

Can release de-identified student-level data for education research by attaching a code to each record that permits matching information received from the same source

Cannot disclose how code generated or assignedCode must be used only for this purpose and must not enable ascertaining of PII Code cannot be based on SSN or any other PII

FERPA – Implications for Researchers

Work with schools to obtain necessary permissions to access data or to survey studentsIf seeking access to UM data, work with appropriate data stewards before/in conjunction with IRB process

See, for example, SPG 601.12Where only data access is needed, consider alternative approaches that could help with consent issues – but remember that school is not required to release data!

School could de-identify data before releaseSchool could authorize researcher to undertake study on its behalf (if meets required purpose, etc.)