PII in Student Education Records: Rights, Sharing, and Complaints

Personally identifiable information in student education records covers far more than a name or Social Security number under the Family Educational Rights and Privacy Act (FERPA). The regulations at 34 CFR Part 99 protect direct identifiers, indirect identifiers, biometric data, and any combination of details that would let someone in the school community figure out which student a record belongs to. These rules apply to every school and college that receives federal education funding, which covers nearly all public K–12 districts and most postsecondary institutions.¹ The rights belong to parents until the student turns 18 or enrolls in college, at which point they transfer entirely to the student.²

What Counts as PII

The regulation at 34 CFR § 99.3 lists the categories of information treated as personally identifiable. The list is explicitly non-exhaustive. A school cannot assume something is safe to release just because the regulation does not name it.

Direct identifiers include the student’s name, the names of the student’s parents or other family members, and the student’s home address. Personal identifiers include Social Security numbers and student ID numbers. Biometric records are also protected: any measurable biological or behavioral trait used for automated recognition, such as fingerprints, retina and iris patterns, voiceprints, DNA sequences, facial characteristics, and handwriting.³ As schools bring in fingerprint-based lunch payments and facial recognition for building access, biometric data has become a real and growing piece of the education record.

Indirect identifiers get less attention but matter just as much. Date of birth, place of birth, and mother’s maiden name all count. Any one of them can narrow a search to a single student quickly, especially in a small community.³

The Reasonable Person Standard

The rule then goes further. Any information that, alone or combined with other available data, would allow a reasonable person in the school community to identify a specific student with reasonable certainty is protected too. This is the test that catches supposedly anonymous data. A spreadsheet without names, but with grade level, gender, ethnicity, and a specific academic award, might point to exactly one student in a small school. The question is not whether the school meant the data to identify anyone; it’s whether someone familiar with the community could work it out.

A final catch-all covers information requested by someone the school reasonably believes already knows which student the record concerns. Even trivial details become protected if handing them over would confirm what the requester already suspects.³

Which Records Are Covered

PII only gets FERPA protection when it sits inside an education record. An education record is any record directly related to a student that the school or someone acting for the school maintains.⁴ That definition is wide on purpose. It captures transcripts, disciplinary files, financial aid records, special education documentation, and emails about a student stored in school systems.

Several categories fall outside the definition and outside FERPA:

A teacher’s sole-possession notes used as a personal memory aid and shared with no one except a temporary substitute.
Records created and kept by a school’s law enforcement unit for law enforcement purposes, so long as they stay within that unit.⁵
Employment records about a school employee that relate only to their job, unless the person is employed because they are a student.
Treatment records made by a physician or psychologist for a student 18 or older or attending a postsecondary institution, if shared only with treatment providers.
Records created after someone stops attending that do not relate to their time as a student.
Grades on peer-graded papers before the teacher collects and records them.

The line matters. If campus police keep an incident report in their own files for law enforcement purposes, FERPA does not restrict it. If that same report ends up in a disciplinary file the dean maintains, it becomes an education record and full FERPA protection attaches.³

Directory Information and Opting Out

Not all PII gets the same level of protection. Schools can designate certain items as “directory information” and release them without consent. Typical designations include name, address, telephone number, email address, date and place of birth, major field of study, participation in officially recognized activities and sports, dates of attendance, photographs, and degrees or honors received.⁶

Before releasing any of it, the school has to give public notice listing what it has designated and how long families have to opt out. A written opt-out submitted during that window blocks disclosure of that student’s directory information to outside parties without prior written consent.⁶ If you have never seen the notice, it may be buried in a student handbook or back-to-school packet. Ask the registrar or records office for a copy, because opting out only works if you do it in the window and in writing.

Your Rights Over the Record

Parents and eligible students can inspect and review the student’s education records. After a request, the school must provide access within a reasonable time and no later than 45 days.⁷ If distance makes an in-person review impractical, the school must send copies or make other arrangements. Copy fees are allowed if reasonable, but the school cannot charge to search for or retrieve records, and it cannot set fees so high that they effectively block review.⁸ Records cannot be destroyed while a review request is pending.

Requesting an Amendment

If you believe something in the record is inaccurate, misleading, or violates the student’s privacy rights, you can ask the school to amend it. The school decides whether to comply and must tell you either way. If it refuses, it must inform you of your right to a formal hearing.⁹

One limit: the amendment process is for factual accuracy and privacy problems. It is not a way to challenge a grade because you disagree with how the work was evaluated.

If the hearing goes against you, you still have the right to file a written statement of disagreement. That statement stays with the disputed portion of the record for as long as the record exists, and the school must include it every time it discloses the contested information.¹⁰

When Schools Can Share Without Your Consent

FERPA is not an absolute lock. The regulations list more than a dozen situations in which a school may share PII without a signed release. The ones parents and students run into most often are these.

School officials with a legitimate educational interest. Teachers, administrators, and contractors can access records internally. A contractor or consultant qualifies as a “school official” only if the person performs a function the school would otherwise handle with employees, works under the school’s direct control regarding record use, and is bound by the same redisclosure limits as employees.¹¹ This is how ed-tech vendors access student data, and it is where a lot of real privacy risk lives.

Transfers to another school. When a student enrolls or tries to enroll elsewhere, the original school can send records without consent if the school’s annual FERPA notice told families it routinely does this.¹¹

Health or safety emergencies. In a real emergency, a school can release PII to anyone whose knowledge is necessary to protect the health or safety of the student or others. The school has to determine that an articulable and significant threat exists, looking at the totality of the circumstances. If the school had a rational basis for that call at the time, the Department of Education will not second-guess it later.¹²

Judicial orders and subpoenas. Schools must comply with a judicial order or lawful subpoena. Before releasing records, the school generally has to make a reasonable effort to notify the parent or eligible student so they can seek a protective order. Notification is not required when a court has ordered secrecy, as with certain grand jury subpoenas, law enforcement subpoenas with nondisclosure orders, or specific orders related to terrorism investigations obtained by the Attorney General.¹¹

Financial aid, audits, and research. Records tied to a student’s aid application can be shared to determine eligibility, set amounts, or enforce conditions. Disclosures to the Comptroller General, the Attorney General, the Secretary of Education, and state and local education authorities for audit, evaluation, or enforcement are permitted. Outside organizations conducting studies for the school can receive records but must destroy the data at the end of the project.¹¹

Parents of dependent college students. After FERPA rights transfer to the student, parents normally need the student’s consent to see records. The exception: a postsecondary institution may share records with the parents of a student who qualifies as a dependent for federal tax purposes, without the student’s consent.¹⁰ Schools are allowed to do this but not required to, so policies differ.

De-identified data. Schools can share data with anyone, for any purpose, if PII has been properly removed. That means more than stripping names and ID numbers. There must be no reasonable basis to believe the remaining information could identify anyone, accounting for cumulative risk from prior releases and public directory information.¹³

Redisclosure Limits and the Access Log

When a school gives PII to a third party, it has to tell that party the information cannot be shared further without consent from the parent or eligible student.¹⁴ That prohibition is what keeps student data from cascading through a chain of recipients who had no connection to the original purpose.

The school also has to keep a log of every request for and every disclosure of PII from each student’s file. The log stays with the record for as long as the record exists. It must show who asked for or received the information and the legitimate interest behind the request.¹⁵ Parents and eligible students can review that log. It is an audit trail showing who has seen the record and why, and it is one of the most underused rights in the whole statute. Ask for it.

How to File a FERPA Complaint

FERPA does not let you sue a school in court for a privacy violation. The Supreme Court held in Gonzaga University v. Doe that the statute creates no individually enforceable rights under federal civil rights law.¹⁶ The federal enforcement route is an administrative complaint to the Student Privacy Policy Office (SPPO) at the U.S. Department of Education.

A complaint must be in writing, filed within 180 days of the alleged violation or within 180 days of when you knew or reasonably should have known about it. It has to contain specific factual allegations that give reasonable cause to believe FERPA was violated, and it must come from the parent or from the student if rights have transferred.¹⁷ Trying to resolve the issue with the school first is encouraged but not required.

Completed forms go to FERPA.Complaints@ed.gov or by mail to the Student Privacy Policy Office, 400 Maryland Ave, SW, Washington, DC 20202-8520. SPPO may share complaint details with the school during its investigation to verify facts. If the school is found out of compliance, the Department works toward voluntary compliance first. Termination of federal funding is the ultimate lever, available only after the Department determines voluntary compliance cannot be achieved.⁴ In practice, the threat is usually enough to bring a school into line without ever getting there.

1
Protecting Student Privacy. To Which Educational Agencies or Institutions Does FERPA Apply?
2
Protecting Student Privacy. Eligible Student
3
eCFR. 34 CFR 99.3 – What Definitions Apply to These Regulations?
4
Office of the Law Revision Counsel. 20 USC 1232g – Family Educational Rights and Privacy
5
eCFR. 34 CFR 99.8 – What Provisions Apply to Records of a Law Enforcement Unit?
6
U.S. Department of Education. Directory Information
7
eCFR. 34 CFR 99.10 – What Rights Exist for a Parent or Eligible Student to Inspect and Review Education Records?
8
eCFR. 34 CFR 99.11 – May an Educational Agency or Institution Charge a Fee for Copies of Education Records?
9
Protecting Student Privacy. Family Educational Rights and Privacy Act (FERPA)
10
U.S. Department of Education. A Parent Guide to the Family Educational Rights and Privacy Act (FERPA)
11
eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required to Disclose Information?
12
eCFR. 34 CFR 99.36 – What Conditions Apply to Disclosure of Information in Health and Safety Emergencies?
13
Student Privacy Policy Office. Data De-identification: An Overview of Basic Terms
14
eCFR. 34 CFR 99.33 – What Limitations Apply to the Redisclosure of Information?
15
eCFR. 34 CFR 99.32 – What Recordkeeping Requirements Exist Concerning Requests and Disclosures?
16
Justia Law. Gonzaga Univ. v. Doe, 536 U.S. 273 (2002)
17
U.S. Department of Education. File a Complaint