Dear FERPA Professor,
There’s a situation on our campus that I would like your guidance on.
Our IT group is working on setting up an Intranet for our campus. Basically all institutional employees and students would have access to it. They want to make all “directory information,” which includes institutionally issued e-mail accounts, available or searchable inside the intranet. My response based on my interpretation of FERPA is that although our institutionally issued e-mail account is considered directory information, any student who has requested a FERPA protection (restriction on directory information) would have to be excluded from that searchable database.
Our IT department and myself are in disagreement about this point. The argument being made by IT is as follows; “our understanding of FERPA is that it only deals with release of information to “third parties.” My impression would be that the student is the first party, our institution and its agents (faculty, staff, and students) is the second party, and external entities is the third party.”
Based on my knowledge, only those with a legitimate educational reason to know would be able to get access to what normally would be considered directory information if a student has requested that it be protected; however I want to make sure that I’m not missing anything and would like your professional response.
Sincerely,
Tim Charoo
____________________________________________
Dear Tim,
Good catch. Your IT folks are off by a "third party." The only student who would be a "first party" would be the student who opted out of directory information release. Disclosure to any other student(s) would not be permitted under FERPA's directory information exception to signed consent, and thus, the University could not disclose information (including name or email address) on those students who opted out of directory information in any searchable intranet listing of students.
I hope this is helpful and let me know if you have more questions.
Sincerely,
The FERPA Professor
Register now for the FERPA Professor's Registrar 101 & FERPA two-day workshop, July 8-9 in New Orleans. After the workshop, stay and join AACRAO's 2017 Technology and Transfer Conference. Find more information about the Reg 101 workshop here.
Please check out our Ask the FERPA Professor archives for more insight from the professor.
Want the Professor to come to your campus? Visit our FERPA compliance training page.
Send your questions for the FERPA Professor to connect@aacrao.org.