Protecting student privacy, or hiding key details from the public? How schools use or misuse a 50-year-old law you might not know about

CNN

10-05-2025

Student lifeFacebookTweetLink
Follow
A young boy suffered a serious head injury on the playground, but his family can't get surveillance video to learn what happened. The school said releasing that footage would violate student privacy.
A governor ordered schools to notify parents if there's a fentanyl overdose at their child's school. But schools resisted the order, citing an often misunderstood law.
Across the country, K-12 schools and universities have denied information to the public – even to parents of injured students – citing student privacy or FERPA, the Family Educational Rights and Privacy Act.
But many schools have misinterpreted the federal law, said CNN Senior Counsel Frank LoMonte, who previously served as executive director of the Student Press Law Center in Washington, DC. He is also a former director of the Brechner Center for Freedom of Information at the University of Florida.
'There's no question that FERPA was a well-intentioned law that has gone completely off the rails and is now really more of a detriment to the quality of education than an asset,' he said.
The law prevents schools from publicizing specific, sensitive student records. But it doesn't have any consequences for schools that refuse to give information that should be available to the public.
We asked LoMonte how some schools use FERPA as an excuse to withhold too much information – potentially impacting public safety – and what can be done to fix the problem. (This conversation has been edited for clarity and length.)
LoMonte: Congress passed it in 1974 as a very narrow privacy statute inspired by a specific concern. Back in the 1970s, a lot of K-12 schools were starting to hire psychologists and therapists on their staffs, and they were bringing in students and administering behavioral tests that then went into the students' permanent files in the principal's office.
Congress intended the law to be used to protect students in unusual, extreme outlier situations when schools violate or refuse to adopt a confidentiality policy.
Congress was concerned that a student might get profiled as being a dangerous or unstable person without their parents knowing and in a way that might blow back on them later in life. So, Congress passed a law that has both 'rights' and 'privacy' in the name.
The 'rights' part says that if a school keeps an education record about a particular student, then the parent or the adult-age student has a right to inspect that record, to correct mistakes in that record, to demand a hearing if the school refuses to correct the record.
The Supreme Court has been very clear that FERPA privacy is narrow, and it applies to only a small subset of the records that schools and colleges keep – certainly not to every email or text message or snippet of video in which a student is identifiable.
In a 2009 case, the Supreme Court said FERPA is only about the records that are permanently stored in the principal's office or the dean's office and a file that corresponds to a student's name.
One thing that the Department of Education has said over and over again is that FERPA is a records statute, not an information statute. In other words, all it protects is the documents. It doesn't protect the information.
If a journalist or a parent were to ask an educator about a student, the educator is completely free under FERPA to share personal experiences and observations. The only way you can trigger the federal law is by reading someone the contents of the file in the principal's office.
Any school or college that takes federal money has to maintain a policy of keeping student education records confidential. If a school does not maintain a confidentiality policy, then the Department of Education can completely disqualify them from receiving any federal money. Essentially, it's the financial death penalty. But it's not a one-strike-and-you're-dead law. There are all kinds of warnings.
In over 50 years, the Department of Education has never once taken a dime away from any educational institution.
There have been many cases where schools have refused to explain to families anything about the circumstances of a violent or threatening incident, because they claim that even discussing the circumstances would violate student privacy.
When someone brings a gun to school, parents want to know: What were the circumstances of finding this gun? What type of penalty did the student get? And all of that is shrouded … even though there is compelling interest in knowing whether discipline is being fairly and adequately imposed.
I think there are two parallel problems going on. First of all, people have received bad training, and they are legitimately confused and misinformed. So it's safest to just give no answer at all.
Also, I'm certain there is intentional misapplication of the law. Because just like any other government agencies, schools and colleges are very concerned about their reputations. And they reflexively resist oversight and transparency.
The reality today is that if you are a parent and your child comes home with a bloody nose from a beating on the school bus, you are entitled to zero information from a school (misinterpreting FERPA). You cannot get a copy of the surveillance video that shows the beating on the school bus. You cannot find out who attacked your child. You cannot even find out what discipline the attackers did or did not receive, even without their names attached.
For example, a family in Arkansas rushed their child to the doctor after he suffered a serious head injury on the school playground. The doctor's office asked if they knew how the injury occurred, and the family attorney asked the school for surveillance video.
The video would have helped the doctors diagnose and treat the injury. But the school insisted that because other children were visible in the video, it was a confidential FERPA record. That's the kind of insanity that can result.
Unfortunately, the only way to make an educational institution turn over information is by suing for public records. That's incredibly costly and time-consuming. And it doesn't work at a purely private institution because those institutions aren't covered by FOIA (Freedom of Information Act) laws.
And as soon as a case goes to court, the educational institution will immediately argue that they are forbidden by federal privacy law from answering the question. And judges should skeptically examine those claims and see through them. But unfortunately, that's rare. Judges tend to be highly deferential to the privacy claims raised by these educational institutions.
Imagine that any school lawyer comes to court and says, 'Judge, if we honor this request for records, the US Department of Education will take away all our money and close us down.' No judge wants that blood on their hands, right? I think that is where the undue degree of deference comes from.
No. What the law says is if you violate FERPA, you get a nasty letter from the Department of Education saying, 'please assure us that you obey a policy of confidentiality.' That is the only thing that happens to you. Only if you refuse to write the letter to the department can you be penalized any further. And that's never happened.
So the boogeyman of financial shutdown is greatly exaggerated and would certainly never be imposed in the event of granting a single request for public records.
There are certainly cases where giving out confidential information about a small number of identifiers will trace back to those students. No question. If we suspend the starting five players on the basketball team for steroids, everybody can figure out who those five starters are. It is easy to match the names with the penalty. But just the fact that a small number of people are involved doesn't necessarily make the statistic matchable to individuals.
The more important point is FERPA is about protecting the reputation of people against being damaged by information in school records that might be inaccurate or unfair.
Under normal principles of privacy law, information ceases to be private once it is widely known by the public. So if it is widely known that Billy brought a gun to school and was arrested and jailed, then nothing about Billy bringing that gun to school is private anymore. But the way that schools and judges have interpreted (FERPA) … schools will still look you straight in the eye and say, 'We cannot tell you anything about what Billy did or what punishment he got.'
In the law of privacy, there is always a sliding scale of privacy depending on the age of the person involved and how compelling the public's need is for information. I think you could still argue that even with a juvenile suspect, if the crime is very serious, and if the school ignored a lot of warning signs that put the student body in danger, the public has a compelling need to know that.
If somebody received a slap on the wrist for past threats or weapons incidents, then there are valid questions about how school authorities did their jobs. That is not information about the child.
The public is much more interested in whether the administrators at that school can be trusted to keep the school safe.
This is another defect with the law. Congress did not include any (consequence) for over-concealing information. It's a door that only swings one way. You could be penalized for under-protecting privacy, but you cannot be penalized for overprotecting privacy.
So a person who is denied access to records cannot file a FERPA complaint and obtain federal recourse, except for the parent. That is the only person who can file a complaint. A journalist or a concerned member of the community cannot.
But the hypocrisy of schools is that when a journalist or a community member needs public records, FERPA is interpreted to encompass anything and everything. When a journalist shows up and needs surveillance videos, all of a sudden, they magically transform into confidential FERPA records.
But when a parent shows up or a student shows up and asks to see their own records, all of a sudden, the definition of a FERPA record shrinks. And the law definitely does not provide two different definitions. The law says you have to call one strike zone. But schools and colleges are not prepared to live by that definition.
Nobody wants to be known as a college where lots of crime happens or lots of hazing happens. So it's in their own reputational self-interest to interpret as much information as possible as being confidential under federal law.
And if you tell the public, 'My hands are tied by federal law. I would love to help you and cooperate, but Congress forbids me from doing so,' that is a get-out-of-accountability-free card.
There are a small handful of primarily religious schools that refuse, on principle, to take any federal money at all. But outside of that very small handful, even otherwise private schools regularly take federal money, like Pell Grants. At the college level, it's very common to accept Pell Grants or to accept federal research grants, even if your institution is otherwise private and not government-funded.
Special education is a program that receives quite a bit of federal subsidies, as well as school lunches. Those are two major sources of federal money flowing to schools – even ones that otherwise consider themselves to be private.
It's very common today to ask a college how many of its students received a notice from the federal government that their immigration status was being changed, and for the college to refuse to give out the number – not the names, just the number.
Numerous universities have said that they regard the number of people who have been notified that they're subject to deportation as being a piece of confidential information. There is this perception that numbers are confidential records, and there's no support for that.
Whether colleges are doing an adequate job of disciplining people who commit serious crimes on their campus is a matter of compelling, overriding public interest. If you are accused of being a rapist anywhere other than on a college campus, a public record is created – starting with arrest, through prosecution, through appeal. All those things create a records trail – except on a college campus.
Many colleges interpret privacy law as forbidding them from saying anything about the outcomes of those cases – even if they conclude that somebody engaged in a violent crime. Hazing is an example. If you beat someone with a paddle in a private apartment complex, you are going to jail. Your police record is going to be open for public inspection. But if you beat someone with a paddle on a college campus, there is every chance that the public will never know about it. And that seems like it's a two-tiered system of justice.
Certainly there are more compelling privacy arguments when you're dealing with very young children. Depending on the age of the child, it really might make sense to disclose a narrower range of information when the person with the weapon is 10 years old. In the eyes of the law, that person is a juvenile, incapable of forming criminal intent.
But even with the 10-year-old, the public is certainly entitled to know whether discipline was given out in an adequate and fair way.
One of the many concerns about the secrecy of discipline is that discipline can be administered in a discriminatory manner when it is secretive.
While there's no compelling interest in having the names of children who get suspended from school, there is certainly a compelling interest in knowing their demographics. We need to know whether discipline is handed out fairly or with favoritism. And the lack of transparency around discipline makes it very hard to evaluate the effectiveness of that system.
They absolutely can answer that. And they should answer that, because there is a public interest in knowing whether school health and safety protocols are adequate.
It is hard to ever make an argument that grades or medical tests or psychological tests need to be disclosed. But once something rises to the level of potentially criminal conduct – and conduct that affects the safety of other people – then at the very least, the public is entitled to know the circumstances, if not the names.
You're raising two great questions. The first is the public is absolutely entitled to know numbers and statistics. Did the school have one child collapse from heat exhaustion, or 10 children? If one child collapsed, that's not indicative of a systemic problem. If 10 children collapse, that is a red flag that the coaches may be disregarding safety, and that goes to the performance of the employees, not to the students.
But many schools will refuse to give out that number, erroneously claiming student privacy. So that's a great example of times when we suffer through privacy for privacy's sake … even though none of the purposes of FERPA are being achieved.
If you're getting information from the school, what the Supreme Court has said is that FERPA applies only to the content of education records. That is all that it applies to.
So if you ask the coach if Johnny is doing OK after collapsing on the field, the only way the coach can violate FERPA is by reading Johnny's FERPA records to you. If the coach knows from personal observation what happened to Johnny, he can tell you that without triggering FERPA at all.
No, because the coach is not a provider of health services. HIPAA only applies to people who provide medical services or to insurers.
Take the financial death penalty off the table. If the penalty for violating FERPA was a sensibly proportionate penalty, then it would not be the boogeyman that it is today.
And the door should swing both ways. If a journalist or a concerned citizen gets a frivolous FERPA argument (from a school), then that journalist or that citizen should be able to file a complaint with the Department of Education and get redress.
In all 50 states, education is one of the top three government expenditures. Whether schools and colleges are using their authority properly is a matter of public concern because they are huge, powerful, well-funded government agencies.
The problems that occur inside schools and colleges do not stay there. If a kid is a violent kid, and the kid is being let off with multiple warnings and minimal disciplinary consequences after giving every indication of being violent and dangerous, that violence and that danger may not stay inside of the building. So it's in everybody's interest to know whether schools and colleges are doing their jobs properly.