ferpa
FERPA clarification: record disclosure vs personal knowledge
<p>I am confused about what is and is not covered by ferpa regarding ‘personal knowledge/observations’. For example, could Professor A tell (orally or via email) Professor B at a different school (unprompted) that a student cheated on an exam which resulted in a conduct record? Even if Professor A was told secondhand?</p>

<p>While this incident is tied to educational records (exam and conduct record), technically Professor A ‘personally observed’ or has ‘personal knowledge’ the incident, correct? In which case telling Professor B unprompted is not protected by FERPA?</p>

<p>FERPA regulates what educational institutions (not instructors) can do: it is institutional policy that determines what employees can or cannot do. An institution can prohibit that which is allowed by the federal government, or can allow (at their peril) that which is forbidden. Institution A could have a different policy from that of B, since each institution has to construct its own policies (on the other hand, there is a tendency for institutions to copy each other's policies especially when they are attempting to state facts related to federal law, which does not vary from institution to institution). I have not surveyed university policies in the past decade, but there has been a trend towards uniform policies.</p>

<p>As for what the regulations on institutions say, a record is defined under <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=2aa3d1b7c535f77761142e614296382f&amp;mc=true&amp;node=se34.1.99_13&amp;rgn=div8" rel="nofollow noreferrer">34 CFR 99.3</a> as</p>

<blockquote>
  <p>any information recorded in any way, including, but not limited to,
  handwriting, print, computer media, video or audio tape, film,
  microfilm, and microfiche.</p>
</blockquote>

<p>Presumably there exists an actual record of a disciplinary hearing, even if A did not rely on that record. The problem with the regulation is that it speaks of abstract information, not the particular means of obtaining the information. That is, if Smith was sanctioned for cheating, that information is defined in terms of what fact it is about, and not the means of acquiring the information. The law says that if information is written down, the information is itself deemed to be "a record". One might argue that the original legislative intent was only to limit disclosure of knowledge derived from the fact of having been recorded, but that is not what the regulations say. I have not found a relevant court case that settles this issue.</p>

<p>Under the premise that the information is a record (and it is clearly personally identifiable information), "disclosure" means to</p>

<blockquote>
  <p>permit access to or the release, transfer, or other communication of
  personally identifiable information contained in education records by
  any means, including oral, written, or electronic means, to any party
  except the party identified as the party that provided or created the
  record.</p>
</blockquote>

<p>So a phone call telling B about the action is disclosure.</p>

<p>Under <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=2aa3d1b7c535f77761142e614296382f&amp;mc=true&amp;node=se34.1.99_131&amp;rgn=div8" rel="nofollow noreferrer">§99.31</a>, personally identifiable information from an education record can be disclosed without student consent "to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests", but there is no general provision for disclosure to other institutions. However, disclosure without consent <em>is</em> allowed, "subject to the requirements of §99.34, to officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student's enrollment or transfer" (which could be applicable). The regulation does not require B to ask – A can tell <em>sua sponte</em> – but it would have to be for the aforementioned enrollment / transfer reason. There is no definition of such reasons, and I can't think of any marginal case where it's not clear. (Employment is not enrollment; taking just one class <em>is</em> enrollment).</p>

<p>Assuming for the sake of discussion that A revealed the information to B for some other reason, perhaps to scuttle the student's submission to a conference, that could be a violation of FERPA regulations. The student could then sue the university and the Department of Education could punish the university – the university would presumably argue that the information is "not a record". If the student prevailed, the university might then sanction the instructor in some way, or it might determine that it needed to tune up the internal documentation about FERPA (i.e. explicitly say that "personal knowledge is included").</p>
