FERPA BasicsRevised 10-5-17

Important Principles• Governed by privacy laws and policies• Personally identifiable• Treated with confidentiality

All Student Data

• Public or Directory information • Considered “sensitive”

Some Student Data

• Students can release or restrict, and access• Others access with or without student consent

Access and Control

The Key Questions

1• What is a student record?

2• What can be disclosed from a student

record?

3• What is really confidential at UC San

Diego?

First Question• What is a Student Record?

o any record that is directly related to a student and maintained by the University

• What is covered by FERPA and UC Policy?o Education Record

• What may be covered by other policies/laws?o Non Education Record

• Academic Records• Housing Records• Disciplinary Records• Financial Aid Records• Other records related to a student

Includes

• Electronic/computer media• Video file• Audio file• Printed document• Handwriting

In any recorded form

– not observations

Education Records

• Records kept by the creator of the record, usually as a memory aid, and are not accessible or revealed to another individual

• Campus Police records• Applicant records of individuals that do not enroll or register at

the University• Alumni records created after the individual is no longer a

student

Includes these

• Employment records *• Treatment or health records **

• * not related to their student status• ** can only be disclosed for treatment purposes or else

pursuant to a FERPA exception

And these

Not an Education Record Records not considered “Education Records” may be protected by other

privacy laws/policies.

Second Question

• What can be disclosed and to whom?o Directory/Public information data

• Anyone except as restrictedo Confidential personally identifiable information

• Anyone with student’s explicit consent• Others as permitted by exceptions

o Sensitive personally identifiable information • Should not be shared, except as permitted!• Sensitive data is highly restricted

Disclosure of Records without Consent

Disclosure of information from education records is generally permittedwhen:

• The information is directory information and has not been restricted bythe student

• The disclosure is directly to the student• The disclosure is to school officials with legitimate educational interest

Other exceptions for disclosure apply (more to come…)

Directory/Public Information DataUnless specifically restricted by the student, UCSD considers the following to be public information and can be released without student permission:• Student name• Campus/local telephone number• Permanent home telephone number• Date of birth• College and major• Dates of attendance• Degrees and honors received• Officially recognized activities (not currently maintained on ISIS)• E-mail addresses

How information can be disclosed?• Student consent to Disclosure

o Student Consent to Disclose form

• Disclosure of records without consento Exceptions that allow Disclosureo Re-Disclosure of Information

• Legitimate educational interest• Regulatory exceptions

Student Consent to DisclosureThe student may provide consent for disclosure to any third party.• For the consent to be valid, the student must sign and date a written

consent that identifies:o To whom the disclosures are to be madeo records to be disclosed,o purpose of disclosure, ando term of consent

• Consents do not need to be originals, i.e. they may be faxed• Electronic consent is permitted as long as the institution can authenticate

the requestor.

In TritonLink, the student user id and password is adequate authentication.

Student Consent to Disclosure Formhttps://students.ucsd.edu/_files/registrar/FERPA_WrittenConsentForm.pdf

Legitimate Educational InterestAn employee or agent of the institution has a “legitimate educationalinterest” if the record is necessary and relevant to the accomplishment ofofficial University responsibilities and duties.

A “legitimate educational interest” does not have to be educational oracademic. It can be related to any appropriate University function, and caninclude disclosure to campus police (in role as safety officers) or judicialaffairs.

Exceptions that Allow DisclosureDisclosure to third parties, without student consent, is permitted under thefollowing circumstances:

• A school official has a legitimate educational interest in the record; if therecord is necessary and relevant to accomplish an official Universityresponsibility

• To determine financial aid eligibility, amount, and/or conditions of the aid• To comply with a judicial order or subpoena; the University must

generally make a reasonable effort to notify the student in advance ofdisclosure

• If it is a health or safety emergency, the University can releaseinformation to any person whose knowledge of the information isnecessary to protect the health or safety of the student or otherindividuals

Re-Disclosure of InformationWhen information has been disclosed to a third party, the recipient of theinformation must be informed that the information they receive cannot befurther disclosed, unless there is written consent from the student whom therecord concerns.

Re-disclosure Notice Language

“The enclosed information is being released to you in accordance with the provisions of theFederal Family Educational Rights and Privacy Act of 1974 (FERPA). In providing this information,it is the responsibility of the University of California, San Diego to inform you that suchinformation is being transferred on the condition that you will not permit any other party to haveaccess to such information without the consent of the Student, except that the information maybe used by your organization’s officers, employees and agents, but only for the purposes forwhich the Disclosure was made to you.”

Third Question• What is really confidential at UC San Diego?

o Everything that’s not public/directoryEverything!o Some data are MORE confidential than others;

• Sensitive Personally Identifiable data…

Sensitive Personally Identifiable Data

UCSD considers some personally identifiable data as sensitive. Sensitive personally identifiable information includes:• Ethnicity• Social Security Number• Taxpayer Identification Number• Most financial information, tax returns, and other information such as Credit Card

numbers• Citizenship status*• Gender identity** Under consideration

Sensitive data is more highly restricted due to its revealing nature and our obligation to protect individual identity. Traditionally, sensitive data is not made available in general access to data.

Steps for Accessing Personally Identifiable Sensitive Data

• All requests for data, including sensitive data, are to be vetted through normal channels of DSA (Departmental Security Administrator) and Data Steward.

• Requests for sensitive data must be justified as required for federal, state, or university reporting requirements, or for research and study of group trends. No requests for access for the purpose of identifying individuals will be granted.*

• Data reporting units may produce reports for requestors after it is determined that:o they are eligible to have access to the datao they are unable to obtain it within their own resourceso if executive expediency is indicated

*under review

Data PoliciesData Policies• FERPA• PPM 160-2

Here are some campus and university resource links:

• http://blink.ucsd.edu/technology/security/personal/

• http://adminrecords.ucsd.edu/PPM/docs/160-2.pdf (Ref: III.J, and IX)

• http://policy.ucop.edu/doc/2710533/PACAOS-130 (Ref: 130.241)

Takeaways

All Student Data is personally identifiable

All access to student data is controlled

Sensitive data is highly restrictive