Dear FERPA Professors,
Our institution is looking into adding email addresses to be part of our directory information that can be released. The question is this:
Are we in violation if we release the university email address without prior notification to the student to opt out of getting the email released since the email address was not initially part of our directory information and if the information is being requested by a third party for alumni, former, and current students? What is our notification responsibility to stay in compliance?
Regards,
Addie Mail
Dear Addie Mail,
FERPA defines "directory information" as information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. (See § 99.3 "Directory Information").
FERPA permits the disclosure of directory information on students so long as the conditions of § 99.37 of the regulations are met. This would include notifying students in attendance of the items designated and permitting them the ability to opt out of having any or all of the directory information items disclosed. (See § 99.37(a)). Including an institutional email address is permitted, but only if the notice to the students has included it as a directory information item. Otherwise, the institution would need to obtain consent from any student whose email address is being disclosed prior to any such disclosure.
Alternatively, the institution could create a new "directory information" notification for students and include "email address" as one of the designated items.
I hope this is helpful in answering your questions. You can find the above-cited FERPA regulations on pages 153 and 166 of the 2012 AACRAO FERPA Guide.