Student data privacy developments: FERPA obligations, edtech vendor contracts, state student privacy statutes and school data breach response.
Student education records carry federal protection under FERPA, layered with a growing set of state student-privacy statutes and edtech vendor rules. This hub covers school and university obligations, vendor contracting, and the incidents that keep testing both.
Directory information is the one category of student record a school may release without consent, and the trade is a public notice plus a window to opt out. The PPRA is a separate statute covering surveys, physical examinations and the collection of student information for marketing, with its own annual notice and its own opt-out.
Read more →FERPA's default is written parental consent before a school discloses personally identifiable information from education records. The school official exception displaces that default for outsourced vendors, but only where four conditions in 34 CFR 99.31(a)(1) and 99.33 are all met — including a direct control requirement the Department added in 2008 to reach IT and web services.
Read more →FERPA is a spending condition rather than a privacy statute in the ordinary sense, and almost everything distinctive about it follows from that. It binds schools that take Department of Education funds, is enforced by withholding them rather than by lawsuits, and its central exception is broad enough to carry an industry of software vendors.
Read more →