Privacy and Data

In 1974, the passage of the Family Educational Rights and Privacy Act (FERPA) ushered in a new era for educational privacy rights through its application of fair information practices to educational records. The culture of privacy is so deep-rooted within the education community that there have been few violations of FERPA over the past four decades. AACRAO is deeply committed to the promotion of privacy policies that maintain the confidentiality of the highly sensitive data that students willingly entrust to educational institutions.

Correcting Certain Provisions Created by 2012 Regulations
In 2012, the Obama Administration, through the Department of Education, implemented regulatory amendments that dramatically expanded FERPA. The amendments greatly broadened the definition of who is given access to personally identifiable information (PII) from student records on a nonconsensual basis. AACRAO strongly believes that some of the 2012 regulatory actions require statutory action to ensure students’ private information will not be inappropriately disclosed to third parties.

The Term "Authorized Representative"

• The 2012 regulations inappropriately expanded the definition of "Authorized Representative" to anyone chosen by the designated official.
• AACRAO believes that the definition "Authorized Representative" should be restored to its previous definition of "individuals and entities under direct control of officials" as designated in the original statute.

The Term "Implied Authority"

• The 2012 regulations also overreached on the definition of "Implied Authority" to audit programs and have created much confusion, and lacks legal precedent.
• AACRAO believes that Congress should close this loophole for non-consensual disclosure of education records.

• The 2012 regulations vastly widened this definition to include programs not administered by educational authorities.
• AACRAO believes that the definition of "Education Programs" should revert back to the original definition of "programs administered by an educational agency or institution."

The Term "Non-Consensual Disclosure for Studies"

• The 2012 regulations expanded the meaning of non-consensual disclosure of personal information from education records to organization conducting "for, or on behalf of" educational agencies or institutions.
• AACRAO believes that Congress should restore the limitation on the purposes that the research exception may be invoked.

Data Systems
AACRAO is concerned about individual privacy protections under State Longitudinal Data Systems (SLDS). As a result of regulatory modifications to FERPA in 2009 and 2012, many SLDS fail to incorporate basic fair information practices in their policies and operating procedures.

• Recognizing the need for collecting better data on students and colleges, AACRAO supports the exploration of alternative methods for collecting and reporting student information.
• Any new approach must include meaningful privacy protection for students—such as notice and choice, right of review, correction and amendment, and the right to control re-disclosure of unit-level data records.
• AACRAO believes that reasonable regulatory or legislative modifications can be made to accommodate legitimate policy goals without surrendering the educational privacy rights of families and students.

FERPA and Electronic Records
FERPA provides students with the right to inspect and review their educational records, exercise significant control over the disclosure of information from those records, and correct or amend erroneous information in the records. It serves as the cornerstone to ensuring student privacy.

Electronic Records

• While AACRAO believes that the current law is media-neutral and focuses solely on the information contained in educational records, recent court decisions have created confusion on this issue.
• That is why AACRAO strongly supports the inclusion of language that will identify "Electronic Records" in the definition of "Educational Records."

Third Party Record Collection

• The creation of third party services that directly capture and maintain information that otherwise was maintained by institutions means that the inclusion of "Third Party Record Collection Agencies," through cloud storage for example, needs to be included in the list of entities that capture and maintain student data.

Reverse Transfer

• Reverse transfer is the transfer of credits from a four-year institution to any two-year institution from which a student transferred for the purpose of facilitating the awarding of a degree or certificate.
• Currently, there are clear processes and guidelines on how two-year institutions may share student information with four-year institutions. However, there are no processes or guidelines for sharing student information from four-year to two-year year institutions.
• AACRAO supports the creation of a new exemption that will allow the sharing of student information between institutions that will facilitate increased college completion rates.

Transcript Disciplinary Notations

• There has been considerable discussion on whether serious disciplinary notations (sexual assault, robbery, burglary, arson, etc.) should be placed on academic transcripts.
• AACRAO has been studying this issue for several years and in 2015 created the "Transcript Disciplinary Notations Work Group," which is comprised of Registrar and Admission Officers from ten higher education institutions.
• AACRAO will release a "White Paper" with recommendations from this working group in May 2017.