By Daniel Bryar, MNEA General Counsel
Something Better magazine, winter 2022
Often, we turn on the news and learn about a data breach somewhere in the world, and that inevitably causes individuals concern about the disclosure of our personal information. Such news may make you wonder about your obligations regarding disclosure of students’ personally identifiable education records.
School personnel are expected by federal law and board policies to guard against unauthorized disclosure of records containing personal information of students and their families. The Family Educational Rights and Privacy Act, often called FERPA, is the applicable federal law. FERPA broadly permits parental access to their student’s education records and an opportunity to correct such records’ inaccuracies. FERPA also requires prior parental consent to disclose educational records unless an exception applies.
Disclosure of personally identifiable education records containing “directory” information to the school community does not require parental consent, although parents must receive annual notice and an opportunity to object to such releases. Directory information is information that if disclosed would not be considered harmful or an invasion of the student’s privacy (for example: name, date of birth, enrollment status).
FERPA also allows disclosure, without parental consent, of student educational records to school officials possessing a legitimate educational interest in the record. FERPA does not define “legitimate educational interest,” nor does it state which personnel possess such interest. Board policy and procedures should answer these questions. School personnel often have such interest when performing tasks within or incident to their job description or contract.
FERPA does not permit parents or students to sue over an unauthorized disclosure of records, but they can submit complaints to the U.S. Department of Education. An unauthorized disclosure could result in the loss of federal education funds to a school district. To my knowledge, however, this penalty has never been levied. Nevertheless, under the threat of financial penalty and desire to protect students, districts and all school personnel must take privacy concerns seriously.
Although FERPA became law in 1974, prior to this year, the Missouri Supreme Court never issued an opinion on the subject. A recent court case, Tammy Ferry vs. The Board of Education of the Jefferson City Public School District, involved the termination of a tenured teacher and tested FERPA.
The teacher had a pending discrimination claim against the district and, in part based on her lawyer’s advice to support the lawsuit, copied the Google Drive assigned to her on the district’s domain to her personal Google account. The teacher intended to copy only specific work files and was in the process of copying thousands of district files. Some of the copied files contained confidential student information such as IEPs, physical therapy evaluations and physical therapy progress notes.
The school board terminated the teacher for failing to keep student records confidential in accordance with the law and for accessing records without having a legitimate educational interest. The teacher appealed the termination to a trial court, which reversed the board’s termination decision. The trial court stated the transferred files were never sent to a third party and did not constitute a disclosure under FERPA.
The Missouri Supreme Court, however, upheld the teacher’s termination. The court disregarded the fact that documents were not disclosed to a third party and highlighted that documents were transferred for the purpose of supporting the teacher’s personal lawsuit. Thus, the teacher’s viewing and transfer of the documents was unrelated to a legitimate educational interest and constituted a FERPA violation. Moreover, because the district could show it had conducted training on keeping student data secure, the policy violation could be deemed “willful,” which justified termination under the teacher tenure act.
The recent case clarifies that school personnel can be disciplined for effecting unauthorized disclosures of personally identifiable education records, and this disclosure can include transferring files to a personal Google account without a legitimate educational interest.
If you have questions about safeguarding student education records, consult your school board’s policies and procedures, local building representative, or UniServ director. Missouri NEA’s legal department conducts trainings on a host of topics relevant to MNEA members. Arrange legal trainings through your UniServ director.