Frequently Asked Questions about Student Privacy

The federal Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. § 1232g; 34 CFR Part 99, protects personally identifiable information contained in students’ education records from unauthorized disclosure. Personally identifiable information includes direct identifiers (such as student or other family member’s name) and indirect identifiers (such as student’s date of birth, place of birth, mother’s maiden name). See 34 CFR § 99.3 (definition of “personally identifiable information”).Disclosure may be made only with consent unless an exception to FERPA applies. The Massachusetts Student Record Regulations, 603 CMR 23.00, are consistent with FERPA and its federal regulations. Educators do need to be aware that FERPA applies to the disclosure of personally identifiable information during videoconferencing and use of other online platforms for distance learning.

Relatedly, the Children’s Online Privacy Act (“COPPA”), 5 U.S.C. §§ 1501-1506; 16 CFR Part 312, requires that web-based tools and application providers obtain parental consent in order for children under the age of 13 to use web-based tools and applications. COPPA is less of a concern for educators when using district-supplied platforms because the onus is on application providers and school districts to ensure consent is obtained.

Yes. FERPA contains an exception that, if certain criteria are met, school districts may disclose education records, or personally identifiable information contained in those records, to the providers of video conferencing software or other virtual learning software applications without consent. The onus is on the school district – not educators – to confirm whether this exception has been met for approved platforms or applications in order to conduct distance learning.

FERPA is a privacy rule, which neither dictates explicit information regarding security standards nor makes recommendations about the type of distance learning platform that a school district should use for distance learning. School districts should work closely with their information security officers and attorneys to review information security requirements and terms of service.

School districts have the authority to make decisions regarding whether distance learning lessons are recorded for students to access at a later time, but expectations should be clearly communicated and fairly enforced. Districts vary on whether recordings are required, and we recommend following all applicable district policies and administrator directives. We recommend that local associations negotiate over the scope of how such recordings may be used.

A live video of an entire classroom or group of students is not automatically subject to FERPA. However, video or audio recordings may be considered education records under FERPA if the recordings directly relate to a student. Some examples of videoconferencing or distance learning that may implicate FERPA include:

• a videoconference or recording of a distance learning lesson that depicts a student having a seizure (because the depicted health emergency becomes the focus of the video)
• a videoconference or recording of a faculty meeting or parent/teacher conference during which a specific student’s grades are discussed (discussion contains PII from the student’s education record)

A live or recorded video is not directly related to a student if the student’s image is incidental or captured only as part of the background.

Educators should not record students for non-educational purposes. Any educational- related recording of students should be done at the district’s direction and in accordance with district’s policy. Issues regarding parental consent for such recording should be raised with your local association to be discussed with the district.

Whether a parent or non-student may observe a distance learning lesson is a district decision and educators should follow local guidance about whether parents or other third parties may be present during a distance learning lesson.

Information about students that is based on what is generally happening during class is not necessarily subject to FERPA because it does not originate from the student’s education record. If an educator does not disclose personally identifiable information from student education records during the live or recorded distance learning lesson, FERPA would not bar a non-student from observing a distance learning lesson.
 
If an educator has concerns regarding potential disclosure of personally identifiable information from student education records during a distance learning lesson, the school district could obtain prior written or electronic parent consent for such potential disclosure to avoid a FERPA violation. Educators should raise concerns over potential FERPA violations or the impact of parents and non-students viewing distance lessons with their local associations during negotiations over distance learning.

As stated previously, if the educator is not disclosing personally identifiable information from the student’s education record to the other household member(s) or obtains consent for potential disclosure in writing or electronically from the student’s parent, the conference will not violate FERPA.

Information about students that is based on what is generally happening during class is not necessarily subject to FERPA because it does not originate from the student’s education record. If an educator does not disclose personally identifiable information from student education records during the live or recorded distance learning lesson, FERPA would not bar a non-student from observing a distance learning lesson.

Given how quickly educators have had to adapt to distance learning and the associated technology, the possibility of accidental data sharing with students or parents is significant. Before sharing any data, educators should confirm the following:

• you are sending what you intend to send (the correct document and/or content);
• you are sending to the person you intend to receive the information;
• >the intended recipient is authorized to receive the information; and
• you are using a secure and/or encrypted method of communication.

When in doubt, consult your supervisor or administrator.

If you have accidentally shared something you did not intend to share, or to an unintended recipient, promptly attempt to recall the message (if you can) or send a follow-up message asking the recipients to disregard and delete. In some cases, such as accidental sharing of information during a live videoconference, recall is not possible. Next, promptly notify your administrator of the mistake. Self-reporting may not shield the educator from disciplinary consequences, but such proactive behavior could reduce the likelihood or severity of disciplinary consequences.

The federal Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. § 1232g; 34 CFR Part 99, protects personally identifiable information contained in students’ education records from unauthorized disclosure. Personally identifiable information includes direct identifiers (such as student or other family member’s name) and indirect identifiers (such as student’s date of birth, place of birth, mother’s maiden name). See 34 CFR § 99.3 (definition of “personally identifiable information”).Disclosure may be made only with consent unless an exception to FERPA applies. The Massachusetts Student Record Regulations, 603 CMR 23.00, are consistent with FERPA and its federal regulations. Educators do need to be aware that FERPA applies to the disclosure of personally identifiable information during videoconferencing and use of other online platforms for distance learning.

Relatedly, the Children’s Online Privacy Act (“COPPA”), 5 U.S.C. §§ 1501-1506; 16 CFR Part 312, requires that web-based tools and application providers obtain parental consent in order for children under the age of 13 to use web-based tools and applications. COPPA is less of a concern for educators when using district-supplied platforms because the onus is on application providers and school districts to ensure consent is obtained.

Yes. FERPA contains an exception that, if certain criteria are met, school districts may disclose education records, or personally identifiable information contained in those records, to the providers of video conferencing software or other virtual learning software applications without consent. The onus is on the school district – not educators – to confirm whether this exception has been met for approved platforms or applications in order to conduct distance learning.

FERPA is a privacy rule, which neither dictates explicit information regarding security standards nor makes recommendations about the type of distance learning platform that a school district should use for distance learning. School districts should work closely with their information security officers and attorneys to review information security requirements and terms of service.

School districts have the authority to make decisions regarding whether distance learning lessons are recorded for students to access at a later time, but expectations should be clearly communicated and fairly enforced. Districts vary on whether recordings are required, and we recommend following all applicable district policies and administrator directives. We recommend that local associations negotiate over the scope of how such recordings may be used.

A live video of an entire classroom or group of students is not automatically subject to FERPA. However, video or audio recordings may be considered education records under FERPA if the recordings directly relate to a student. Some examples of videoconferencing or distance learning that may implicate FERPA include:

• a videoconference or recording of a distance learning lesson that depicts a student having a seizure (because the depicted health emergency becomes the focus of the video)
• a videoconference or recording of a faculty meeting or parent/teacher conference during which a specific student’s grades are discussed (discussion contains PII from the student’s education record)

A live or recorded video is not directly related to a student if the student’s image is incidental or captured only as part of the background.

Educators should not record students for non-educational purposes. Any educational- related recording of students should be done at the district’s direction and in accordance with district’s policy. Issues regarding parental consent for such recording should be raised with your local association to be discussed with the district.

Whether a parent or non-student may observe a distance learning lesson is a district decision and educators should follow local guidance about whether parents or other third parties may be present during a distance learning lesson.

Information about students that is based on what is generally happening during class is not necessarily subject to FERPA because it does not originate from the student’s education record. If an educator does not disclose personally identifiable information from student education records during the live or recorded distance learning lesson, FERPA would not bar a non-student from observing a distance learning lesson.
 
If an educator has concerns regarding potential disclosure of personally identifiable information from student education records during a distance learning lesson, the school district could obtain prior written or electronic parent consent for such potential disclosure to avoid a FERPA violation. Educators should raise concerns over potential FERPA violations or the impact of parents and non-students viewing distance lessons with their local associations during negotiations over distance learning.

As stated previously, if the educator is not disclosing personally identifiable information from the student’s education record to the other household member(s) or obtains consent for potential disclosure in writing or electronically from the student’s parent, the conference will not violate FERPA.

Information about students that is based on what is generally happening during class is not necessarily subject to FERPA because it does not originate from the student’s education record. If an educator does not disclose personally identifiable information from student education records during the live or recorded distance learning lesson, FERPA would not bar a non-student from observing a distance learning lesson.

Given how quickly educators have had to adapt to distance learning and the associated technology, the possibility of accidental data sharing with students or parents is significant. Before sharing any data, educators should confirm the following:

• you are sending what you intend to send (the correct document and/or content);
• you are sending to the person you intend to receive the information;
• >the intended recipient is authorized to receive the information; and
• you are using a secure and/or encrypted method of communication.

When in doubt, consult your supervisor or administrator.

If you have accidentally shared something you did not intend to share, or to an unintended recipient, promptly attempt to recall the message (if you can) or send a follow-up message asking the recipients to disregard and delete. In some cases, such as accidental sharing of information during a live videoconference, recall is not possible. Next, promptly notify your administrator of the mistake. Self-reporting may not shield the educator from disciplinary consequences, but such proactive behavior could reduce the likelihood or severity of disciplinary consequences.