FERPA

20 U.S.C. § 1232g; 34 C.F.R. Part 99

Family Educational Rights and Privacy Act

In force since November 19, 1974

Who it applies to

  • Educational agencies and institutions receiving US Department of Education funding

Consumer rights

  • Access / know — grantedObtain the personal data held about you, and the categories, sources and purposes behind it.
  • Correction — grantedRequire inaccurate personal data to be fixed.
  • Deletion / erasure — not granted
  • Portability — not granted
  • Opt out of sale / sharing — not granted
  • Opt out of targeted advertising — not granted
  • Opt out of profiling — not granted
  • Limit sensitive data use — not granted
  • Human review of automated decisions — not granted
  • Non-discrimination — not granted
  • Appeal a refusal — not granted
  • Private right of action — not granted

Obligations

Consent model
Opt-in
Universal opt-out signal
Not required
Risk assessments
Not required
Data protection officer
Not required
Records of processing
Not required
Processor contract
Required
Right to cure
None — enforcement may follow immediately
Data broker registration
Not required
Minors
Rights belong to the parent until the student turns 18 or enrols in a post-secondary institution, at which point they transfer to the student.

Breach notification

To individuals
Not addressed by this Act
To the regulator
Not required by this law
What triggers it
Not addressed by this Act

Penalties

Headline
Withdrawal of federal funding
Private right of action
No — enforcement is by the regulator only
Notes
The only sanction is loss of funding, which has never been imposed. The Supreme Court held in Gonzaga University v. Doe (2002) that FERPA creates no private right of action.

Exemptions

Entities

  • Private schools that receive no applicable federal funding

Data

  • Directory information, where the institution has given notice and an opt-out

Sources