Office of the CUNY General Counsel February 2009
GUIDELINES FOR THE IMPLEMENTATION OF THE STUDENT RECORDS ACCESS POLICY AND THE FEDERAL FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT (FERPA)
The Student Records Access Policy of the Board of Trustees of The City University of New York (CUNY) provides that the University and its colleges shall be in full compliance with the Federal Family Educational Rights and Privacy Act (FERPA) and its implementing regulations. These Guidelines contain the following four sections: (I) requirements of FERPA, (II) components of directory information which may be released without prior consent, (III) annual notification of students’ rights concerning educational records and directory information; (IV) rights of appeal to the Office of the General Counsel and Vice Chancellor for Legal Affairs.
Student Consent Required. A student’s written consent is required to disclose personally identifiable information contained in education records, with the exception of directory information (Section II) and the other exceptions noted in these Guidelines (Section I(E)). The student’s written consent must: (1) specify the records that may be disclosed; (2) state the purpose of the disclosure; and (3) identify the party or class of parties to whom the disclosure may be made. The FERPA Release Form attached as Attachment A hereto complies with these requirements.
Five forms are necessary for the College’s compliance with FERPA, as follows:
A. FERPA Release Form (form to be signed by students giving permission for third parties to access their education records).
B. College Denial of Appeal for Access to Records (with notice of right to appeal to the Office of the General Counsel and Vice Chancellor for Legal Affairs).
C. FERPA Appeal to the General Counsel and Vice Chancellor for Legal Affairs.
D. Directory Information Non-Disclosure Form (informing students of the categories of directory information and giving them the right to object to the disclosure of all or any of the categories).
E. Notification Under FERPA of Student Rights Concerning Education Records and Directory Information (students are required to be notified of their rights annually). Office of the General Counsel February 2009
I. REQUIREMENTS OF FERPA.
1. Student. With respect to education records, a student is a current or former student at a college, including a student in on-line course or program. An applicant is not a student until he/she attends a college.
2. Education records. Any data or information recorded in any way, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche, which directly relates to a student and is maintained by a college or the Central Office, constitutes an education record. Information about a student that is maintained by an educational institution on a computer data base is part of a student’s education record and thus protected by FERPA. Access to such information should be limited to those individuals who are college officials with a legitimate educational interest in the information.
3. Personally identifiable information. Information that makes an education record “personally identifiable” to a particular student includes: a. the student’s name; b. the name of the student’s parent or other family member; c. the address of the student or other family member; d. a personal identifier, such as the student’s social security number or student number or biometric record1; e. a list of personal characteristics that would make the student’s identity easily traceable; f. other information that, alone or in combination, is linked or linkable to a specific student, and which would allow a reasonable person to identify the student; or g. information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.
4. College Official. A college official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff), a person or company with whom the University has contracted as its agent to provide a service instead of using University employees or officials, a person serving on the Board of Trustees, or a student serving on an official committee, such as a disciplinary committee, or assisting another college official in performing his or her tasks. In addition, a college official includes a contractor, consultant, volunteer or other party (collectively “contractor”) to whom a college or the University has outsourced institutional services, so long the contractor has a legitimate educational interest in the records, is under the direct control of 1 A biometric record means a record of one or more measurable biological or behavioral characteristics (such as fingerprints) that can be used for automated recognition of an individual. 2 Office of the General Counsel February 2009 the college, and is performing services that would otherwise be performed by employees.
5. Legitimate Educational Interest. A college official has a legitimate educational interest in obtaining access to a particular record if access is reasonably necessary in order to fulfill his or her professional responsibilities for the University.
6. FERPA Appeals Officer. Official or employee designated by the College President to hear student appeals from denials of access to records, requests to correct records, or other rights under FERPA, generally the Legal Affairs Designee.
B. PROCEDURES TO REVIEW AND INSPECT RECORDS.
FERPA requires that a student’s education records be provided within 45 days of the college’s receipt of a request for access. (Note that a student is not entitled to the records listed in Section C.) A student should submit to the appropriate official a written request that identifies the records the student wishes to inspect. Although a request may be oral, the college should require requests to be in writing, especially if the request cannot be immediately fulfilled to the satisfaction of the student. A college official may be present when the student inspects and reviews his/her education records.
A request should be granted or denied in writing within 15 days or, if longer is required, a reasonable time from receipt of the request. If the request for access is denied or not responded to within 45 days of receipt, the student may appeal to the College FERPA Appeals Officer. The appeal must be in writing and should identify the particular records to which access was requested, the date of the original request for access, the person to whom the request was made, and the reasons why the student believes he/she has a right of access to the record. A decision on the appeal shall be rendered by the FERPA Appeals Officer no later than 30 days after the receipt of the appeal.
A denial of an appeal for access must be in writing and contain the reasons for the denial and a statement that the student has a further right of appeal to the General Counsel and Vice Chancellor for Legal Affairs within 30 days of the date of the denial. (A suggested form for a college’s denial of an appeal is annexed hereto as Attachment B.) The student may thereafter send an appeal to the Office of the General Counsel and Vice Chancellor for Legal Affairs of The City University of New York at 535 East 80th Street, New York, New York, 10075, a form for which is annexed hereto as Attachment C.
C. RECORDS NOT MANDATORILY ACCESSIBLE.
A student has no right to, and a college need not permit, inspection and review of the following types of records:
1. confidential letters and confidential statements of recommendations placed in the 3 Office of the General Counsel February 2009 education records before 1975, or after January 1, 1975, if the student has waived his or her right to inspect and review those letters and statements, and those letters and statements are related to the student’s: (a) admission to an educational institution, (b) application for employment, or (c) receipt of an honor or honorary recognition; and the waiver is not required as a condition of admission to or receipt of another service or benefit from the college;
2. financial records of his or her parents, and any information those records contain;
3. records pertaining to the student of instructional or administrative staff which are in the sole possession of the maker, are used as a personal memory aid and are not accessible or revealed to another person except a temporary substitute;
4. records pertaining to the student, which are maintained on behalf of a college by its law enforcement unit (i.e. Public Safety Department or equivalent), or by a contract guard service, provided that such records are: (a) created and maintained by the law enforcement unit; and (b) created for a law enforcement purpose. Law enforcement records are not education records and their disclosure is governed by the State Freedom of Information Law (FOIL) and federal law on campus security. However, law enforcement records that have been sent to other offices within the college or University are education records subject to FERPA;
5. employment records of a college employee who may be a student provided that: (a) such records are normally maintained by the college; (b) such records relate exclusively to the individual’s employment; (c) such records are used only for employment purposes; and (d) such employment is not the result of student status;
6. records pertaining to the student which are made by a physician, psychiatrist, psychologist, or other recognized professional/paraprofessional acting or assisting in his or her professional or paraprofessional capacity, which: (a) are created, maintained, or used only in connection with the provision of treatment of the student, and (b) are not disclosed to anyone other than the individuals providing the treatment;
7. records which pertain to a student generated after he/she is no longer in attendance and that are not directly related to his/her attendance as a student;
8. grades on peer-graded papers before they are recorded by a teacher.; and
9. any other record, which, pursuant to any other law or regulation, is privileged, or which is otherwise inaccessible to the student.
D. PROCEDURES FOR AMENDING OR CORRECTING RECORDS.
Under FERPA, if a student believes that his/her education records contain information that is inaccurate, misleading, or in violation of the student’s rights of privacy, he or she may ask 4 Office of the General Counsel February 2009 the college to amend the record. The college shall decide whether to amend within a reasonable time after receiving the request. If the college denies the student’s request, it shall inform the student of its decision and of the student’s right to appeal to the college’s FERPA Appeals Officer to challenge the content of the student’s education records on the grounds that the information contained in the education record is inaccurate, misleading, or in violation of the privacy rights of the student. A student may not contest the assignment of a grade through this procedure, but may contest whether the assigned grade was recorded accurately. The college’s FERPA Appeals Officer shall hold a hearing within a reasonable time after receipt of the appeal; reasonable notice of the date, time and place of the hearing shall be given to the student. The student shall be given a full and fair opportunity to present relevant evidence. He/she may be assisted or represented by one or more individuals of his/her choice. The decision must be based solely on the evidence presented at the hearing.
The college’s FERPA Appeals Officer shall within a reasonable time after the hearing issue a decision in writing and include a summary of the evidence and the reasons for the decision.
If as a result of the hearing, the FERPA Appeals Officer decides that the information is inaccurate, misleading or otherwise in violation of the student’s privacy rights, the college shall: (a) amend the record accordingly; and (b) inform the student of the amendment in writing. If, on the other hand, the college decides that the information is correct and not in violation of the student’s privacy rights, it shall inform the student of his/her right to place a statement in the record commenting on the contested information or stating why he or she disagrees with the decision of the college. If a statement is placed in the education records of the student, the college shall maintain the statement with the contested part of the record for as long as the record is maintained and disclose the statement whenever it discloses the portion of the record to which the statement relates.
E. DISCLOSURE OF EDUCATION RECORDS WITHOUT PRIOR CONSENT.
A college may disclose personally identifiable information from an education record of a student without prior consent under the following circumstances:
1. A college may disclose personally identifiable information from an education record to appropriate parties (including the student’s parents) in an emergency if the information is necessary to protect the health or safety of the student or other individuals. This exception applies where a college, taking into account the totality of the circumstances, is able to articulate a significant threat to the health or safety of a student or other individual and discloses information to any person whose knowledge of the information is necessary to protect the health or safety of the student or other individuals. The Office of the General Counsel and Vice Chancellor for Legal Affairs should be consulted, if possible, prior to the release of information under this emergency provision.
2. The disclosure is to a college official, as defined in Section I(A)(4) above who 5 Office of the General Counsel February 2009 has a legitimate educational interest in the record.
3. The disclosure is to an official or employee of another college, or other institution of postsecondary education, where the student seeks or intends to enroll or where the student is already enrolled so long as the disclosure is for purposes related to the student’s enrollment or transfer, provided that the college also gives the student written notice of such disclosure, and upon request, a copy of the record that was disclosed.
4. The disclosure is to authorized representatives of the Comptroller General of the United States; the Secretary of Education of the United States; the Attorney General of the United States; or State and local educational authorities, where access to the education records is in connection with an audit or evaluation of Federal or State supported education programs or for the enforcement of or compliance with Federal legal requirements which relate to those programs.
5. The disclosure is in connection with financial aid for which the student has applied or which the student has received, if the information is necessary for purposes such as the determination of eligibility, and the amount thereof, and enforcement of the terms and conditions of the aid.
6. The disclosure is to comply with a judicial order or court-ordered subpoena. In such instances, the college must notify the student by mail of the subpoena five days in advance of compliance, except a shorter period may be authorized by the General Counsel and Vice Chancellor for Legal Affairs, unless the disclosure is in compliance with a subpoena issued for law enforcement purpose where the court has ordered that the existence or the contents of the subpoena or the information furnished in response not be disclosed. The Office of the General Counsel and Vice Chancellor for Legal Affairs should be contacted if a law enforcement agency such as a District Attorney, United States Attorney, or Grand Jury issues a subpoena for a student’s records and directs or requests that the student not be informed.
7. The disclosure is to an organization conducting a study for or on behalf of the college, pursuant to a written agreement, to (A) develop, validate, or administer predictive tests, (B) administer student aid programs, or (C) improve instruction, so long as the study does not permit personal identification of parents and students by those other than representatives of the organization with legitimate educational interests, and so long as the information is destroyed or returned to the educational institution after the study is over.
8. The disclosure is to accrediting organizations to carry out their accrediting functions.
9. The disclosure is of the final results of a disciplinary proceeding against a student whom the college has determined violated an institutional rule or policy in connection with 6 Office of the General Counsel February 2009 alleged acts that would, if proven, also constitute a crime of violence or non-forcible sex offense. The final results which may be released are the disciplined student’s name, the violation committed, and the sanction imposed. The violation committed includes the rules violated and the essential findings of fact supporting the determination. This only applies to disciplinary proceedings in which the final results were reached after October 6, 1998. The information released may not include the name of any other student, such as a victim or witness, absent the consent of that student.
10. The college may disclose the final results of a disciplinary proceeding to the victim of an alleged perpetrator of a crime of violence or non-forcible sex offense, even if the institution concluded that no violation was committed.
11. A college may disclose records to a parent if the student is a dependent of the parent as defined in the Internal Revenue Code (Section 152). A copy of the parent’s latest tax return may be requested as documentation.
12. If a college determines that a student under the age of 21 has committed a disciplinary violation with respect to the use or possession of alcohol or a controlled substance, the parent or legal guardian may be informed. The determination may be made other than through a disciplinary proceeding. The student must be under 21 at the time of the disclosure.
13. A student’s records may be used in litigation brought by the student against CUNY, or litigation commenced by CUNY against the student. Information may also be provided to a third party when the student has made a complaint to a government or similar agency having the power to take official action against the institution. 13. The disclosure concerns sex offenders and other individuals required to register under Section 170101 of the Violent Crime Control and Law Enforcement Act of 1994 (Wetterling Act), 42 U.S.C . 14071, and the information was provided to the college under that statute and applicable federal guidelines.
F. RECORD KEEPING REQUIREMENTS.
The Registrar’s office of each college shall maintain a record of each request for and disclosure of a student education record, other than directory information. For each disclosure, the record must include the parties who have requested and received personally identifiable information from the education records and the basis for obtaining the information, including, in the case of a health or safety emergency, the “articulable and significant threat” to health and safety of a student or other individuals.
G. REDISCLOSURE OF INFORMATION.
A college may disclose personally identifiable information from the education records of a student only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the student or the college’s authorization. Personally identifiable information which is disclosed to an institution, agency or organization, however, may be used by its officers, employees and agents, but only for the purposes for which the disclosure was made. The party to whom the disclosure is made shall be informed in writing of this requirement.
II. DIRECTORY INFORMATION.
A college may disclose directory information to persons with a legitimate interest in such information. Directory information consists of a student’s name, attendance dates (not daily records), address, telephone number, date and place of birth, photograph, e-mail address, full or part-time status, enrollment status (undergraduate, graduate, etc.), level of education (credits) completed, major field of study, degree enrolled for, participation in officially recognized activities and sports (teams), the height and weight of members of athletic teams, previous school attended, and degrees, honors and awards received. Dates of attendance are the years or dates (semesters, sessions) the student has been enrolled, not daily records of attendance. Directory information does not include a student’s social security number, identification number, race, ethnicity or gender.
Each college must inform its students about directory information and allow them to request that the college not disclose such information. A student may request that any part of, or all, directory information not be released without prior written consent by completing a form to be made available on the college’s web site as well as in the registrar’s office of each college during regular business hours. A copy of a Directory Information Non-Disclosure Form is annexed (Attachment D).
III. NOTIFICATION OF RIGHTS.
Each college shall inform its current students of their rights under FERPA at least annually, by publishing a notice in the college’s catalogs and posting it in the Registrar’s office. If the college catalog is not published every year, the notice should also be in a publication distributed to all students at least once a year. This notice should also be placed on the college’s web site. Colleges must include in the notification: (1) a statement of the procedures for inspection and review and amendment of education records, (2) the procedure for requesting amendment of records, the criteria for determining who is a college official, and what is a legitimate educational interest, (3) rights of appeal, and (4) directory information and how to request non-disclosure. A Notification Under FERPA of Student Rights Concerning Education Records and Directory Information is annexed to this memorandum (Attachment E). 8 Office of the General Counsel February 2009 9
IV. RIGHTS OF APPEAL FROM COLLEGE DECISION.
Student appeals of alleged failures by any college to comply with the requirements of FERPA may be made to the college FERPA Appeals Officer, and then the General Counsel and Vice Chancellor for Legal Affairs within 30 days of the decision of the college’s FERPA Appeals Officer. Decisions of the General Counsel and Vice Chancellor for Legal Affairs shall be submitted to the Board Committee on Student Affairs and Special Programs for its approval, and the student may submit a response. Annexed hereto is a form for appeals to the Office of the General Counsel and Vice Chancellor for Legal Affairs (Attachment C), which must be in writing, and include a copy of the determination of the college’s FERPA Appeals Officer and the reasons why the student disagrees with the determination. If the college FERPA Appeals Officer does not issue a decision within 30 days of an appeal or the holding of a hearing thereon, whichever is later, the student may then also file with the Office of the General Counsel and Vice Chancellor for Legal Affairs.
The Vice Chancellor for Legal Affairs shall render a decision no later than 30 days after the receipt of the appeal. This appeal shall be made prior to a student exercising his/her statutory right of appeal to the Family Policy Compliance Office of the U.S. Department of Education, 400 Maryland Avenue SW, Washington, D.C., 20202-5920.