Filing a FERPA Complaint

FERPA is enforced administratively by the Student Privacy Policy Office at the U.S. Department of Education. Understanding what that office can and cannot do is the difference between a realistic strategy and a wasted year.

There is no private right of action

Start here, because everything else follows from it.

In Gonzaga University v. Doe, 536 U.S. 273 (2002), the Supreme Court held that FERPA’s nondisclosure provisions do not create personal rights enforceable under 42 U.S.C. § 1983. The statute directs the Secretary of Education to withhold federal funds from institutions with a policy or practice of permitting improper disclosure; it does not confer an individual entitlement of the kind that supports a private suit.

So: you cannot sue your university for a FERPA violation. What you can do is complain to the Department, and pursue whatever other causes of action the same facts may support — state privacy law, contract, defamation, or a civil rights claim where the disclosure was discriminatory or retaliatory. Those are separate theories with separate elements, and they are where the actual remedies live.

How to complain

A complaint goes to the Student Privacy Policy Office. Under 34 C.F.R. §§ 99.63–99.64 it must be submitted in a timely manner — generally within 180 days of the alleged violation or of the date the complainant knew or reasonably should have known of it. Extensions may be granted for good cause.

The complaint must contain specific allegations of fact giving reasonable cause to believe a violation occurred. Vague allegations are dismissed.

What makes a complaint work:

A specific record — what document or information was involved.
A specific disclosure or refusal — who did what, to whom, and when.
The provision at issue — failure to permit inspection within 45 days, disclosure without consent, refusal to amend without offering a hearing, failure to provide annual notification.
What you did first. Complaints are far stronger where you asked the institution to fix it and can show what happened.

What happens next

The Office notifies the institution and may investigate. Where it finds a violation, the typical outcome is a notice of the finding and a requirement that the institution come into compliance — changing a policy, providing training, granting the access that was refused.

The statutory sanction is withdrawal of federal funding, which has never been imposed. That fact tells you what the enforcement mechanism really is: institutional correction, not individual remedy.

What a complaint is actually good for

Being clear-eyed about this makes it more useful, not less.

Getting access you were refused. Where the violation is a failure to permit inspection or to offer an amendment hearing, a complaint often produces exactly the thing you wanted.
Changing a practice. Where an institution has a systemic problem — a policy of circulating diagnoses, a habit of disclosing to parents without a basis — this is the route that fixes it.
Building a record. A finding of violation is useful evidence in other proceedings, including internal ones.
It is free, and it does not require a lawyer.

What it is not good for: compensation, reversing a decision, or urgency. It is slow.

Use the internal route first

Institutions must provide annual notification under § 99.7 of the right to inspect and review, the right to seek amendment, the right to consent to disclosures, and the right to file a complaint. That notification names the office to approach.

Going there first is almost always right. It is faster, it frequently resolves the problem, and if it does not, the paper trail is what makes the federal complaint credible.

Where FERPA is the wrong tool

Several problems present as FERPA problems and are not:

A grade you believe is wrong. That is a grade appeal, not a records amendment.
A disciplinary finding you believe is unjust. That is an appeal.
A disclosure that was discriminatory or retaliatory. That may be a Section 504, Title VI or Title IX matter, with real remedies. See OCR’s retaliation guidance.
A hold blocking your transcript. That is usually a financial or administrative dispute.

Identifying which statute actually governs is most of the work, and getting it wrong costs the 180 days.

Get in touch if a records question has become a real problem — a hold you cannot resolve, a disclosure that should not have happened, or a record that is wrong and staying wrong.

General information about federal education privacy law. It is not legal advice, it does not create an attorney-client relationship, and it cannot account for your institution’s own policies or the law of your state, several of which impose obligations beyond FERPA.