Disclosure Without Your Consent: The FERPA Exceptions
The general rule at 34 C.F.R. § 99.30 is that an institution must obtain signed and dated written consent before disclosing personally identifiable information from a student’s education records.
Section 99.31 then lists the exceptions, and they are extensive enough that the exceptions do most of the work. These are the ones that matter in practice.
School officials with a legitimate educational interest
The most-used exception, and the loosest. An institution may disclose to school officials it has determined have a legitimate educational interest. The institution defines both terms in its annual notification — and many define “school official” to include contractors, consultants, volunteers and outside counsel performing an institutional service.
Two constraints are worth knowing. The institution must state its criteria in the annual notification under § 99.7, and it must use reasonable methods to ensure officials obtain access only to records in which they have a legitimate educational interest.
So the question to ask when you learn a professor or administrator saw something is not “is that allowed” in the abstract. It is: what interest did that person have in this record, and what does your published policy say?
Directory information
Under § 99.37, an institution may designate certain information as directory information and disclose it without consent — typically name, address, telephone, email, dates of attendance, enrollment status, major, degrees and awards, participation in activities, and photographs.
The critical point: you can opt out. The institution must give public notice of the categories it designates and allow a reasonable period to refuse designation. Most students never read that notice and never opt out.
An opt-out has consequences worth weighing — it can mean a school will not confirm your enrollment to an employer, or list you in a graduation program. But if you have a safety concern, or you do not want your enrollment status confirmed to third parties, it is the mechanism.
Health or safety emergency
Under § 99.36, an institution may disclose to appropriate parties, including parents, if knowledge of the information is necessary to protect the health or safety of the student or other individuals in connection with an emergency.
The Department has stated it will not substitute its judgment for the institution’s if there is a rational basis for the determination, which makes this exception broad in practice. It requires an articulable and significant threat and is limited to the period of the emergency — it is not a standing authorization.
Subpoenas and court orders
Under § 99.31(a)(9), an institution may disclose in response to a lawful subpoena or judicial order, and must generally make a reasonable effort to notify you in advance so that you may seek protective action. There are exceptions to the notification requirement, including certain grand jury and law enforcement subpoenas where the issuing court has ordered non-disclosure.
If you learn a subpoena has been served on your institution for your records, the notification window is the moment to act, and it is short.
The other exceptions in brief
- Other schools to which you seek or intend to enroll.
- Financial aid, in connection with aid you have applied for or received.
- Accrediting organizations carrying out accrediting functions.
- Studies conducted for or on behalf of the institution, subject to conditions.
- Parents of a dependent student for tax purposes — see parents and FERPA in college.
- Victims of crimes of violence or non-forcible sex offenses, who may receive the final results of a disciplinary proceeding.
- Final results of a disciplinary proceeding where a student is found responsible for a crime of violence or non-forcible sex offense — see disciplinary records.
The disclosure log
Under § 99.32, institutions must maintain a record of each request for access to and each disclosure of personally identifiable information from your education records, including who received it and their legitimate interest — and that log is available to you.
Requesting it is the most direct way to find out who has actually seen your file. Very few students ask for it, and it costs nothing to ask.
Common questions
My professor discussed my file with another professor. Was that lawful?
Possibly, under the school officials exception, if that person had a legitimate educational interest. Ask what interest was identified.
Can the school tell my employer I was disciplined?
Disciplinary records are education records. Absent consent or an applicable exception, no — but directory information and separately-authorized disclosures complicate the picture.
Can I stop a specific disclosure?
Where consent is required, yes, by not consenting. Where an exception applies, generally no, though a subpoena is a different situation because of the notice provision.
Get in touch if a records question has become a real problem — a hold you cannot resolve, a disclosure that should not have happened, or a record that is wrong and staying wrong.
General information about federal education privacy law. It is not legal advice, it does not create an attorney-client relationship, and it cannot account for your institution’s own policies or the law of your state, several of which impose obligations beyond FERPA.