Dear FERPA Professors,
We are getting hit with numerous Freedom of Information Act (FOIA) requests for student directory information for political campaigning purposes.
In the many discussions I’ve had, I’m shocked at how my own interpretations of FERPA have seemingly been wrong. Does this mean my fellow registrars may also be interpreting wrong? If so, I am reaching out for some guidance!
- Does FERPA truly allow a college to define its own directory information list that is more limiting than what is defined in FERPA? For example, can we determine that our own directory list is ONLY student name, enrollment dates, and awarded degrees?
- FERPA states that an institution may disclose directory information if it has given public notice. Does "may" mean we have the option to refuse a request for directory information, because the wording is not "will" or "should" or "is required?"
- Are institutions allowed to require students to opt in to allow their directory information to be released upon request?
Regards,
Q. Westion
Dear Q. Westion,
Following up on our recent conversation, see my comments following each of your questions below. You can find the cited FERPA regulations on pages 166, 161, and 159 of the 2012 AACRAO FERPA Guide.
Q1: Does FERPA truly allow a college to define its own directory information list that is more limiting than what is defined in FERPA? For example, can we determine that our own directory list is ONLY student name, enrollment dates, and awarded degrees?
A1: Institutions are permitted to limit what items are included in its directory information notice. Having only the items listed above would be the decision of the institution. The directory information notice required by § 99.37 of the FERPA regulations would need to include these items and they would be the only items that could be disclosed by the institution in response to any subsequent request for directory information.
Q2: FERPA states that an institution may disclose directory information if it has given public notice. Does "may" mean we have the option to refuse a request for directory information because the wording is not "will," "should," or "is required?"
A2: Any disclosure of directory information by an institution is not required by FERPA, but rather, institutions are permitted to disclose the information. However, depending on State law interpretation, institutions may be required to disclose their properly designated directory information in response to a State open records request. Any State-required disclosures of properly designated directory information would not be in conflict with FERPA because FERPA permits such disclosures without consent.
Q3: Are institutions allowed to require students to opt in to allow their directory information to be released upon request?
A3: The § 99.31(a)(11) directory information exception to the § 99.30 signed consent requirements of FERPA permits, but does not require, institutions to disclose properly designated directory information items on students so long as the conditions of § 99.37 are met. These conditions include notification to the students of the designated directory information items and the opportunity to opt out of having such information disclosed. Nothing in the FERPA regulations, however, would prohibit an institution from requiring the students to opt in to such directory information disclosures.