Family Education Rights and Privacy Act (FERPA)

The Family Education Rights and Privacy Act of 1974 is a federal law that was implemented to protect the school records and personal information of students. It applies to students who are enrolled in a school that receives funds from the U.S. Department of Education.

FERPA defines the rights to the access and use of education records. Parents, and later children upon their turning 18, are granted the right to see the school's records on the student, the right to request that a school make a correction to a record to data that they believe to be inaccurate or misleading, and the right, through a written request, to release information from the student's record, except for certain circumstances such as school transfers, judicial orders and other situations defined by the law.

The law also gives schools the right to disclose student's personal information, such as a name, address and telephone number, without consent, in a directory, provided that parents and students are told and given adequate time to request the information be withheld.

Cyber threats, as well as human error, can put the privacy of student records at risk. Confidential data can be revealed if it is sent unencrypted through email or if hackers break into a schools network. School staff members could be careless in the handling of information and inadvertently allow it to be seen by others.

To uphold the privacy measures that are protected by this law, schools must take steps to protect student information. These steps include securing digital information with the use of firewalls and wireless access protection, setting up and following authentication and authorization policies and procedures for access to data, and protecting digital data through encryption. Furthermore, the school must set and follow procedures to conceal data in hardcopy format. To ensure data is protected, schools must inform and train staff on the importance of handling student information with care and in compliance with FERPA requirements.