Dear FERPA Professors,
We have, unfortunately, had reports of some thefts happening in our college cafe and snack shop recently. In response to these reports, our IT and Security Offices installed a camera in that area and have sent our Student Affairs Office videos of students who were caught stealing on camera.
With this information, our food service management has considered pressing charges against our students for petty theft if they don’t come pay for the things they’ve stolen once they are caught. Does FERPA protect the student names from being given to the food service? To be clear, these students will have been given multiple warnings and are already being fined less than they would be getting legally. Our Student Affairs Office would like to provide their names to our food service if legally able.
As a contracted service provider, I would interpret the definition to include our food service provider as a school official. But that does raise the question in my mind of whether they would then be bound not to release the name to local law enforcement. On the other hand, our college defines name and video as Directory Information, so could the college release just the names to our food service provider under the Directory Information umbrella?
Thanks,
Ben Caut Steeling
Dear Ben Caut Steeling,
Section 99.31(a)(1)(A) and (B) of FERPA permits the non-consensual disclosure of PII from education records to school officials whom the institution has determined have a legitimate educational interest or to a third party to whom the institution has outsourced institutional services or functions, under certain conditions. If food service management meets the criteria for a school official under this section, the Student Affairs Office may non-consensually disclose PII to food service management. If food service management is not considered a school official under this section, the Student Affairs Office most likely could not disclose any PII to food service without consent, unless another exception to consent applies.
As food service management is technically a school official, they would not be permitted to disclose any PII from education records to law enforcement unless the non-consensual disclosure meets one of FERPA’s exceptions to consent. As stealing from the cafe does not rise to the level of a health or safety emergency, the only other exception I see that could apply is if the institution initiates legal action against the students. Under this exception, the institution may disclose to the court, without a court order or subpoena, the education records of the students that are relevant for the institution to proceed with the legal action. Regarding your second question, as the food service provider is a “school official”, you may disclose whatever PII from education records to food services the institution determines would be of legitimate educational interest to food services, consistent with the institution’s definition of a school official and what is considered a legitimate educational interest. You state that your institution considers “name” and “video” as directory information. While name clearly is considered directory information, whether a video and its content would be considered directory information would depend. For example, in your situation, a video of a student stealing from the cafe would generally be considered an education record. The PII contained in that video would be the act of the student stealing, which would not be considered directory information as it would be considered harmful or an invasion of privacy, if disclosed.
I hope this is helpful in answering your questions.
Respectfully,
Want the Professor to come to your campus? Visit our FERPA compliance training page.
share