Directory information under FERPA: what a school can share without asking

The federal regulation, 34 CFR 99.3, defines directory information as facts in a student's record that would not generally be considered harmful or an invasion of privacy if disclosed. Its list includes a student's name, address, telephone listing, email address, photograph, date and place of birth, grade level, dates of attendance, participation in officially recognized activities and sports, weight and height of athletes, and honors and awards.

Each school district chooses which of these it will treat as directory information. One district may publish only names and grade levels. Another may include home addresses and photos. That choice is written in the district's annual FERPA notice, which is usually inside the student handbook or the back-to-school packet.

Two things are never directory information: grades and discipline records. A school also cannot use a Social Security number or student ID number as a key to release records without written consent.

Under 34 CFR 99.37, a school may release directory information only after it gives public notice of three things: which items it has designated as directory information, the right of a parent or eligible student to refuse that designation for any or all of those items, and the period of time the family has to say no in writing. An 'eligible student' is a student who is 18 or in college; at that point the FERPA rights move from the parent to the student.

The deadline is the part that matters. If the form is not turned in by the date in the notice, the school may treat the information as public until a written opt-out arrives. An opt-out filed while a student is enrolled stays in force after the student leaves, unless the student cancels it.

One exception is written into the rule: a school can still require a student to wear or carry an ID badge showing directory-type information, such as a name and photo, even if the family opted out. And a separate federal law, 20 U.S.C. 7908, requires high schools that take federal funds to give military recruiters and colleges the name, address, and telephone listing of each student on request, unless a parent has submitted a written request that the school not release it without consent.

In Gonzaga University v. Doe (2002), the Court held that FERPA does not let a student sue a school for money over a records violation. The remedy is a complaint to the U.S. Department of Education, which can pull federal funding from a school that has a policy of breaking the law.