Privacy & FERPA

The Family Educational Rights and Privacy Act (“FERPA”), is an act of Congress designed to protect the right of students to both know what is in their school files and to restrict access to certain types of information in those files. The rights under FERPA transfer from the parents to the student, once the student turns 18 years old or enters a postsecondary institution at any age.

FERPA assigns to students the rights to:

• be notified of their rights under FERPA
• inspect and review their records
• seek amendment of their records
• request not to have any personally identifiable information disclosed, nor have their records inspected without their written permission except where exclusions permitted by the Act apply (such request must be received within 30 days of enrolment)
• file a complaint with the US Department of Education.

The information in student files is divided into the categories of directory and non-directory information.

Directory information is information that FERPA allows a school to release to eligible parties without the express consent of the student. Students have the right to restrict the release of directory information.

Directory information is defined by FERPA as “…information contained in an education record of a student which would not generally be considered harmful or an invasion of privacy if disclosed” (FERPA Regulations, 34CFR, Part 99.3). E.g. student’s name, hometown (city, state), email address, campus, school, activities, degrees and awards, dates of attendance, major field of study.

Non-directory information is information for which disclosure requires the student’s written permission. With the exception of directory information, all student records are considered to be confidential and may not be released, e.g. student ID number, social security number, race, gender, nationality, date of birth, GPA, grades, hours completed, student schedules, photo identification, etc.

A written consent from a student should specify:

• the information that may be disclosed (e.g., admission status, grades)
• the purpose of the disclosure
• the identity of the party or class of parties to whom the disclosure may be made (e.g. parents)
• the time period or event in which consent applies
• the date and signature of the student.

The registrar should be contacted in case of uncertainties.

In some circumstances, according to the FERPA Act and subsequent amendments, WU can and will give out non-directory information, for example:

• official subpoenas or other requests from appropriate government sources
• parents and legal guardians may receive non-directory information if the student is a legal dependent, as determined by their federal income tax return for the most recent tax year
• parents and legal guardians, whether or not the student is a dependent, may be contacted concerning instances of under-age drinking
• school officials with legitimate educational interest
• other schools to which a student is transferring
• appropriate parties in connection with financial aid to a student
• organizations conducting certain studies for or on behalf of the school
• accrediting organizations
• appropriate officials in cases of health and safety emergencies.

WU students’ privacy:

1. WU collects only personal information that is necessary for its activities and uses it only for that purpose unless the individual gives permission otherwise.
2. WU does not pass it on to third parties without the individual's consent.
3. Students have access to their personal records kept by WU. They should contact their cohort coordinator to initiate access and an appointment may be necessary. The records remain the property of WU.
4. WU seeks to keep any personal information accurate, complete and up-to-date. On request, WU will give an individual access to read, and if necessary to correct, personal information held about them. If there is a difference of opinion regarding correctness, the student is entitled to have their own version filed along with the WU record.
5. WU seeks to protect personal information from misuse and loss and from unauthorized access, modification or disclosure. It is destroyed or deleted when no longer needed.
6. WU does not require individuals to adopt, use or disclose identifiers assigned by government agencies except as required or permitted by law.
7. Members of the public can interact anonymously with WU whenever it is lawful and practicable to do so.
8. WU does not transfer personal information to any recipient across national boundaries unless the information will be appropriately protected by law or contract in its destination, or as permitted by law.
9. WU only collects sensitive personal information (such as about health, etc.) from students with their consent.

Employee responsibilities under FERPA:

1. to protect the confidentiality of student education records in their possession
2. employee access to student information is restricted to completion of their responsibilities as a WU employee only
3. to not release lists or files with student information to any third party outside WU
4. student education records (other than directory or public information) are considered confidential and may not be released without written consent of the student
5. student information stored in electronic format must be secure and available only to those entitled to access that information
6. employee are not permitted to access and store confidential information in unsecure locations (e.g., flash drives, public or home computers, etc.)
7. if in doubt about a request for student information, contact the registrar.

Communicating with third parties about students

1. The best practice is to not be the provider of information. The student has the right to reveal his or her non-directory information such as grades, attendance, and so forth. Encourage interested parties to speak directly with the student.
2. Always presume that you should not release non-directory information unless you see in writing that the individual requesting the information has the right to receive it.
3. Non-directory information is never released without the student's written authorization. These items include, but are not limited to:
• student schedule and course enrollment
• GPA
• academic standing
• grades earned
• physical address.
4. Do not use non-directory information in a letter of reference or other correspondence that mentions the individual.
5. Parents and legal guardians may receive non-directory information only by providing proof that the student is a legal dependent, such as a certified copy of a federal income tax return for the most recent tax year. Friends, spouses, siblings and others may not receive non-directory information regardless of need without the specific and written authorization of the student.
6. All requests for non-directory information must be made in writing. Please request the president’s permission.
7. All release of student information must be documented and communicated to the president.
8. All requests for student information should be documented even if the information is not provided.
9. Subpoenas should be referred to the president for processing.
10. WU does not verify individual qualifications or transcripts issued to students. WU may post on its website a record of graduations as public knowledge.

Communicating with students

1. Student grades may not be posted by name or in any readily identifiable manner.
2. U.S. Social Security numbers or ID numbers may not be used in posting grades.
3. Graded student work may not be left or returned to the student in any manner that would give another individual opportunity to see the work. However, having students offer input concerning another student’s work is part of the iterative process and is not viewed as an infringement upon the student’s right to privacy.
4. The student’s right to privacy is violated when another individual has access to a grade that a faculty member has assigned.
5. Do not leave student work in any public place for them to pick up (e.g., outside a faculty member’s office, unattended classroom).
6. Do not provide one student’s non-directory information to another student.
7. While email addresses are listed as directory information, it is often best to obscure the email addresses of emails that go to multiple students. This is accomplished by placing the email addresses in the BCC address category.

___________
Privacy Rights of Students
STATUTE 20, UNITED STATES CODE, 123g and regulations adopted pursuant thereto.
The code provides for an institution to establish a category of student information termed “directory information.” All information, such as health and medical records, disciplinary records, records of personal counseling, required student and family financial income information records, transcripts or student permanent academic records, student placement records and other personally identifiable information shall be open for inspection only to the student and such members of the professional staff of the college as have responsibility for working with the student. Such information will not be released to second parties without consent of the student.
Except as required for use by the president in the discharge of his official responsibilities as prescribed by laws, regulations of the state board, and board policies, the designated custodian of such records may release information from these records to others only upon authorization in writing from the student or upon a subpoena by a court of competent jurisdiction.