FERPA
Family Educational Rights and Privacy Act
Student Records Privacy Policy and Notification of Rights under FERPA
Definitions
- Eligible Student: A student who has either reached the age of eighteen or who is enrolled in a postsecondary educational institution. Eligible students are granted rights under FERPA.
- Education Records: Under FERPA, education records are any documents, files, and/or other materials that contain information directly related to a student, are personally identifiable to that student, and are maintained by the university or a university agent. FERPA designates several types of records that are exceptions to this definition, including law enforcement records and medical and treatment records.
- Personally Identifiable Information (PII): Information that includes direct personal identifiers (such as a student’s social security number), indirect identifiers (such as a student’s date of birth or mother’s maiden name), and other information that alone or in combination that is linked or linkable to a specific student that would allow a reasonable person to identify the student. For more information about what is considered PII at William & Mary, please see Sensitive Data.
- Directory Information: Information that is generally not considered an invasion of privacy or harmful to a student if disclosed. Examples of directory information at William & Mary include a student’s name, hometown, and dates of attendance. The university may release a student’s directory information without written consent from the student unless the student prohibits release by completing a Request for Confidentiality form (pdf), however, William & Mary generally does not permit the release of such information. For a comprehensive list of items considered directory information at William & Mary, please see II., B., 13 of the Student Records Privacy Policy and Notification of Rights under FERPA and Directory Information and Privacy.
- School Official: At William & Mary, a school official is a person employed by the university in an administrative, supervisory, academic, research, or support staff position (including law enforcement unit personnel and health staff); a person serving on the board of visitors; or a student serving on an official committee, such as the Honor Council. A school official may also include a volunteer or contractor outside of the university who performs an institutional service or function for which the university would otherwise use its own employees and who is under the direct control of the university with respect to the use and maintenance of personally identifiable information from education records.
- Legitimate Educational Interest: A school official has a legitimate educational interest to review a student’s education record(s) without the student’s consent if the official needs to review an education record in order to fulfill their professional responsibilities for the university, pursuant to §99.31(a)(1) of FERPA.
I. Scope
This policy applies to all students in attendance at William & Mary, including the Batten School of Coastal and Marine Sciences (the university).
II. Policy
The university protects the privacy of student records in accordance with the Family Educational Rights and Privacy Act (FERPA) and the Virginia Health Records Privacy Act, and provides students with access to their own records in accordance with FERPA. For questions about FERPA, please [[ferpa, email the University Registrar's Office.]]
A. Student Records Rights
FERPA affords students certain rights with respect to their education records and defines situations in which the university may release information from student records with student consent. Education records, under FERPA, are documents, files, and other materials that contain information directly related to a student and are maintained by the university or a university agent. Student rights include:
1. The right to inspect and review the student's education records within 45 days after the day the university receives a request for access.
A student should submit to the University Registrar’s Office a written request that identifies the record(s) the student wishes to inspect. The school official will make arrangements for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the school official to whom the request was submitted, that official shall advise the student of the correct official to whom the request should be addressed.
Students who are citizens of Virginia also have rights to their records under the Virginia Freedom of Information Act. Information about the process for requesting records under the Act, and the university’s obligations, is provided in the university’s Freedom of Information Act Policy.
2. The right to request the amendment of an element of the student’s education records that the student believes is inaccurate, misleading, or otherwise in violation of the student’s privacy rights under FERPA.
A student who wishes to request an amendment should write the university official responsible for the record, clearly identify the part of the record the student wants changed, and specify why it should be changed.
If the university decides not to amend the record as requested, the student will be notified in writing of the decision and of the student’s right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing.
3. The right to provide written consent before the university discloses personally identifiable information (PII) from the student's education records, except to the extent that FERPA authorizes disclosure without consent.
The school discloses education records without a student's prior written consent under the FERPA exception for disclosure to school officials with legitimate educational interest.
Upon request, the university may also disclose education records without consent to officials of another school in which a student seeks or intends to enroll.
The types of disclosures permitted without student consent are described in Section B, below.
4. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the university to comply with the requirements of FERPA.
The name and address of the Office that administers FERPA is:
Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202
See also Section C, below, for a discussion of other university policies relating to student records.
B. Disclosures Permitted Without Student Consent
FERPA permits the disclosure of PII from students' education records, without consent of the student, if the disclosure meets certain conditions found in §99.31 of the FERPA regulations. Except for disclosures to school officials (item 1 below), disclosures related to some judicial orders or lawfully issued subpoenas (item 8 below), disclosures of directory information (item 13 below), and disclosures to the student, §99.32 of FERPA regulations requires the institution to record the disclosure. Eligible students have a right to inspect and review the record of disclosures.
William & Mary may disclose PII from a student's education records without obtaining prior written consent of the student under the following conditions:
1. To other school officials whom the school has determined to have legitimate educational interests.
A school official is a person employed by the university in an administrative, supervisory, academic, research, or support staff position (including law enforcement unit personnel and health staff); a person serving on the board of visitors; or a student serving on an official committee, such as the Honor Council. A school official also may include a volunteer or contractor outside of the university who performs an institutional service or function for which the university would otherwise use its own employees and who is under the direct control of the university with respect to the use and maintenance of personally identifiable information from education records, such as an attorney, auditor, or collection agent or a student volunteering to assist another school official in performing his or her tasks.
A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the university.(§99.31(a)(1)).
2. To officials of another school where the student seeks or intends to enroll, or where the student is already enrolled if the disclosure is for purposes related to the student's enrollment or transfer, subject to the requirements of §99.34. (§99.31(a)(2))
3. To authorized representatives of the U. S. Comptroller General, the U. S. Attorney General, the U.S. Secretary of Education, or State and local educational authorities, such as a State postsecondary authority that is responsible for supervising the university's State-supported education programs.
Disclosures under this provision may be made, subject to the requirements of §99.35, in connection with an audit or evaluation of Federal- or State-supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs. These entities may make further disclosures of PII to outside entities that are designated by them as their authorized representatives to conduct any audit, evaluation, or enforcement or compliance activity on their behalf. (§§99.31(a)(3) and 99.35)
4. In connection with financial aid for which the student has applied or which the student has received, if the information is necessary to determine eligibility for the aid, determine the amount of the aid, determine the conditions of the aid, or enforce the terms and conditions of the aid. (§99.31(a)(4))
5. To organizations conducting studies for, or on behalf of, the university, in order to: (a) develop, validate, or administer predictive tests; (b) administer student aid programs; or (c) improve instruction. (§99.31(a)(6))
6. To accrediting organizations to carry out their accrediting functions. ((§99.31(a)(7))
7. To parents of an eligible student if the student is a dependent for IRS tax purposes. (§99.31(a)(8)). Pursuant to Virginia law, the university will disclose such information, if certain conditions are satisfied, as described under Section C(2) below.
8. To comply with a judicial order or lawfully issued subpoena. (§99.31(a)(9))
9. To appropriate officials in connection with a health or safety emergency, subject to §99.36. Under this exception, William & Mary may disclose PII if the university determines that the person to whom the PII is to be disclosed needs the information to protect the student or other individual(s) from an articulable and significant threat to their health or safety (§99.31(a)(10))
10. To a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense, subject to the requirements of §99.39. The disclosure may include only the final results of the disciplinary proceeding with respect to that alleged crime or offense, regardless of the finding. (§99.31(a)(13))
11. To the general public, the final results of a disciplinary proceeding, subject to the requirements of §99.39, if the university determines the student is an alleged perpetrator of a crime of violence or non-forcible sex offense and the student has committed a violation of the university's rules or policies with respect to the allegation made against him or her. (§99.31(a)(14))
12. To parents of a student regarding the student's violation of any Federal, State, or local law, or of any rule or policy of the university, governing the use or possession of alcohol or a controlled substance if the university determines the student committed a disciplinary violation and the student is under the age of 21. (§99.31(a)(15))
13. Directory Information: In addition, FERPA permits the disclosure of information deemed by the university to be “Directory Information” without written consent. (§99.31(a)(11)) This information includes:
- Student name
- University email address
- Telephone numbers
- Current classification
- Hometown
- Previous schools attended and degrees awarded
- Dates of attendance
- Current enrollment status
- Degree(s) earned and dates awarded
- Major(s), Minor
- Scholarships, awards, honors and special recognition
- Height, weight, and birth date of members of athletic teams
- Photograph
Students may prohibit the public release of Directory Information by completing a Request for Confidentiality form (pdf). This request must be submitted in person to the Office of the University Registrar and will remain on file indefinitely until written notice is submitted by the student to remove it.
In accordance with Va. Code Section 23.1-405 (C), the university shall not disclose the address, telephone number, or email address of a student unless the student has consented in writing to such disclosure.
14. In addition, recent federal guidelines permit release of student information for the purpose of data collection and analysis.
i. First, the U.S. Comptroller General, the U.S. Attorney General, the U.S. Secretary of Education, or state and local education authorities (Federal and State Authorities) may allow access to your records and private information without your consent to any third party designated by a Federal or State Authority to evaluate a federal- or state-supported education program. The evaluation may relate to any program that is principally engaged in the provision of education, such as early childhood education and job training, as well as any program that is administered by an education agency or institution.
ii. Second, Federal and State Authorities may allow access to your education records and private information without your consent to researchers performing certain types of studies, such as Statewide Longitudinal Data Systems, in certain cases even when the university objects to or does not request such research.
15. The Solomon Amendment (10 U.S.C. § 983) is a federal law that requires institutions to provide directory-type information on students, at least 17 years of age who are registered for at least one credit, upon request from representatives of the Department of Defense for military recruiting purposes.
This information, referred to as "student recruiting information," includes: student name, addresses, telephone listings, age or year of birth, place of birth, level of education or degrees received, academic major, and the most recent previous educational institution in which the student was enrolled. A request for student recruiting information under Solomon must be honored unless the student has completed the Request for Confidentiality Form (pdf) and submitted the completed form to the Office of the University Registrar.
C. Additional University Policies and Practices Relating to Student Records.
1. Medical/Health Records. Medical information in student records generally is not subject to additional protections, except for records of the Student Health Center and the Counseling Center that are protected by the Virginia Health Records Privacy Act. The Act generally prohibits the disclosure of a student’s health information without the student’s consent, unless an exception applies. The Health Records Privacy Act does not have a provision that permits sharing of health records within the institution similar to the “school officials” FERPA exception, but it does allow disclosure of records (other than psychotherapy notes) by the Student Health Center and Counseling Center to the university’s Threat Assessment Team. The Act also contains numerous other exceptions, including disclosures in response to a subpoena satisfying specific statutory requirements.The Health Insurance Portability and Accountability Act of 1996 (HIPAA) does not apply to education records, even if these records contain medical information; HIPAA exempts education records from its privacy regulations, because these records are protected by FERPA.
2. Other Policies. For additional information regarding students’ rights related to the release of personally identifiable information, see the University Registrar’s website or the section entitled ‘Statement of Rights and Responsibilities’ in the Student Handbook. Additional university policies include the following:
i. Release of Academic, Student Conduct, and Financial Information to Parents: Students who wish their parents, guardians, and/or spouse to have access to academic, financial or student conduct information protected by FERPA may provide consent by completing the Personal Information tab in Banner Self-Service. Students have the right to revoke this consent at any time. Parents of dependent students have the right to information about their children; however, they must provide tax documents if there is no release already on file with the university.
ii. Student Assessment: William & Mary conducts periodic reviews of its curricular and co-curricular programs as part of the university's state-mandated responsibility to monitor student outcomes and assure the continuing quality of a William & Mary degree. Surveys, course portfolios (including examples of student writing), and other procedures are used to gather information about student achievement and experiences. Information collected as part of the assessment program will not be used to evaluate individual performance and will not be released in a form that is personally identifiable. Students who do not want their work to be used in institutional or program assessments must submit a letter indicating that preference to the Dean of Undergraduate Studies.
III. Authority and Implementation
This policy is approved by the Provost. The University Registrar is charged with implementation of this policy.
This policy was amended by the Provost effective June 18, 2018, to (1) comply with Virginia Code 23.1-405(C) on student records and Virginia Code Section 2.2-3705.4 on FOIA by removing address (permanent, local, and email) and telephone numbers and adding hometown from Section II.B.13, (2) make changes conforming to amendments to other policies and (3) make formatting improvements.
This policy was further amended in March 2020, in accordance with amendments to Virginia Code 23.1-405(C) and to facilitate collaborative instruction by adding university email and telephone numbers to Directory Information.
IV. Related Policies
Policy on Release of Records to Parents
Freedom of Information Act Policy
