Dear FERPA Professor,
We recently received a message from an honors society and we were wondering a couple of things:
1. Is it actually FERPA-compliant to supply the records they are requesting, and;
2. Does AACRAO ‘certify’ vendors?
The message we received is below, with identifying information redacted. We would appreciate your clarification on this matter.
Thanks,
Curio Ess
Hello,
Our honors society is making an open records request in compliance with FERPA and in furtherance of an academic purpose to your institution. Our society is one of the nation’s largest, with chapters at more than 600 schools and FERPA-certified by AACRAO.
We request the following information for all students with a cumulative GPA of 3.3 or higher (if you are unable to pull directory data on this criteria, all students that currently fall in your honors category are requested):
-
First name
-
Last name
-
Email address
-
School address
-
Permanent address
Allow your students to join this preeminent honor society for access to content on leadership, scholarships and much more.
______________________________________________________________
Dear Curio,
AACRAO FERPA Consulting is available to provide an independent third-party review of a vendor’s product to evaluate its compliance with FERPA. This consists of a consultant going to a vendor to learn about the product or service offered, how it is used by the school, and what FERPA issues might need to be addressed. Once this process is complete, if the product appears to meet all requirements of FERPA, AACRAO would issue a letter to that effect.
This letter is not an endorsement, however. It rather states that the product or service, as detailed in the letter, appears to meet applicable FERPA requirements. With that said, if a vendor mentions this AACRAO FERPA product review, then institutions should know that AACRAO found no practices or policies to be non-compliant with FERPA.
In this particular case, if the requested information is designated as directory information at your institution and the students have not opted out of the disclosure of directory information, then you may release this information to the society. However, there is nothing in FERPA compelling you to do so.
I hope this is helpful in answering your question.
Sincerely,
The FERPA Professor