Dear FERPA Professor:
Hope all is well. We are upgrading our student system, which includes a new online module that will allow students to delegate authority to access their educational records. Would you mind offering an opinion on this scenario?
A student uses the self-service functionality and delegates access to their educational records to the parents.
Two semesters later the student submits a Directory Information Form instructing our office not to release his information.
The student has taken no further action with regards to delegated access for their parents.
Delegating access does not mean that his parents are given a login to the institutional network. The system provides a page that will allow student services office staff that ability to look up and authenticate who has been given access.
After 1, 2, & 3 above happen, a parent calls and request information about the student. The staff person will see that the student has submitted a HOLD on directory information and also see that the student delegated access to their parents. Is this only confusing or is it a potential issue where FERPA is concerned?
Thanks for your insight,
Confusedius
________________________________________________________
Dear Confusedius,
As you well know, there is absolutely nothing confusing about FERPA. Okay, maybe one or two things, so let’s look at your questions.
Your questions are comparing the signed consent requirements of §99.30 with the exceptions to signed consent found at §99.31. If the institutional log-in is based on a randomly assigned pin or password, then the students providing permission through the student portal could be considered an electronic signature by the institution. (See §99.30(d), which you can find on page 159 of the 2012 AACRAO FERPA Guide and also Appendix J starting on page 353.) The student opting out of the disclosure of "directory information," which is a §99.31 exception to signed consent, does not affect the signed consent so long as that consent has not been revoked by the student. Thus, the institution can continue to disclose the student's education records to the parents but would not confirm directory information on the student to any external inquiry, absent a signed consent from the student.
I hope this is helpful in answering your questions.
Sincerely,
The FERPA Professor
Register for the 2-day Registrar 101 & FERPA workshop in Phoenix, Oct. 30-31.
Learn about AACRAO's new FERPA Online Training Compliance Program.
Please check out our Ask the FERPA Professor archives for more insight from the professor.
Want the Professor to come to your campus? Visit our FERPA compliance training page.
Send your questions for the FERPA Professor to connect@aacrao.org.