FERPA's Collision With Social Media

Social Media

Suppose the only thing that stands between one of your teachers and winter break is proctoring a final exam. That, and a high school student whose disability entitles him to extra time. The student uses three additional hours after the school day ends to complete the exam.

Annoyed at staying late, the teacher airs her grievances on Facebook. “Thanks a lot, kid, for finally coming to finish your effin final more than THREE HOURS after school let out.” The teacher mentions the boy’s name and says he “has some effing disorder — one of those ‘we don’t know what his disorder is and we don’t want him to be labeled, so we are not going to find out, but we want academic accommodations anyway’ disorders.”

The teacher’s post spreads like wildfire. Parents of several students complain. As superintendent, you decide to fire the teacher. Then the U.S. Department of Education contacts the district, concerned about compliance with the Family Educational Rights and Privacy Act. Do you have a FERPA problem? The short answer: Yes.

Protecting Privacy

FERPA is the federal law that protects the privacy of education records of any student in a district that receives federal financial assistance. Although FERPA sometimes conjures images of a “Wonder Years”-era permanent record kept in a central-office filing cabinet, the U.S. Department of Education has defined education records much more broadly, which presents compliance challenges in the smartphone era.

FERPA defines education record as “any information recorded in any way that is maintained by or on behalf of an institution” and “directly related to a student.” That broad definition covers information district employees might receive from any number of sources: staff e-mail, student information systems, gradebooks, extracurricular participation records, etc. District employees also might create education records when a teacher uses a smartphone to photograph or video-record while teaching a class. Although there is an exception for records kept in the sole possession of the maker, as a memory aid, that exception is inapplicable the instant the record is shared with anyone other than a temporary substitute for its creator.

FERPA prohibits nonconsensual disclosure of records or personally identifiable information from education records with few exceptions. Notably, most FERPA-protected information that flows among district personnel receives a “school official” exception, allowing districts to share protected information with employees who need it to do their jobs. Districts must use “reasonable methods to ensure that school officials obtain access to only those education records in which they have legitimate educational interest.” When a district does not use physical or technological access controls, it must ensure “its administrative policy for controlling access to education records is effective.”

Mitigating Risks

When staff post FERPA-protected information to social media, a FERPA violation has likely occurred, regardless of whether the educator’s account is public or private (assuming the private setting includes at least one person who is not a school official).

Two factors, however, mitigate the risk. First, if the district can prove the information is de-identified, no violation has been committed. Second, no private right of action exists under FERPA, which reduces the risk of civil suits. The U.S. Department of Education enforces FERPA, and it could withhold or terminate federal financial assistance.

From a forward-looking, compliance-oriented perspective, the safe assumption is that FERPA prohibits disclosure of student information that staff create or acquire in the course of their employment. As part of a district’s administrative policy to prohibit nonconsensual disclosure to third parties, school districts might consider adopting districtwide social media or FERPA policies that prohibit staff from posting any such information. Overly restrictive social media policies can present complex issues under the First Amendment and other federal and state laws. Protecting student information under FERPA is unlikely to be one of them.