When a deadly or life-threatening crime takes place at an educational institution, the public justifiably asks: Did the school do enough to maintain safety? At such times, “we can’t say anything because of student privacy” is a profoundly incorrect answer—legally, morally, and practically.
The Family Educational Rights and Privacy Act (FERPA) was enacted in 1974 to protect students against law enforcement snooping into secret files their schools might be keeping without their knowledge. Over the years, aggressive lawyering by school and college attorneys has distorted the statute to encompass much more—but not nearly as much as school administrators insist.
Journalists and concerned parents have been unable to obtain many documents from the Broward County school system that might help the public understand whether school authorities responded to the Parkland, Fla., mass shooter’s capacity for violence with adequate urgency. Instead, they have met the “FERPA wall of secrecy” in asking about the background of Nikolas Cruz.
Government records, including those maintained by public schools, are normally presumed to be open for public inspection, even when the records contain sensitive or embarrassing information. But schools have widely come to misunderstand FERPA as preventing them from providing the public even with an anonymized factual description of serious disciplinary incidents or safety problems that involve students.
As a result, parents and community members regularly hear that “something bad happened” at a school but that they can’t be told what it is or whether anyone was punished. This makes it impossible for the public to hold schools and colleges accountable for how they use their governmental authority.
When a North Carolina high school student went public last year with allegations that another student swung a noose at him and pulled a knife, the superintendent cited FERPA and told the public little more than that “the matter was immediately investigated by school officials and appropriately handled.” After a 13-year-old Georgia student suffered a severe leg injury requiring amputation after an altercation with a district-contracted employee in 2016, the school claimed FERPA forbade them from releasing a surveillance video of the incident.
In these situations and hundreds more like them, schools invoke “student privacy” not because it makes students safer, but because it insulates school officials from having their disciplinary decisions second-guessed.
It’s eminently possible for schools to interpret FERPA in a common-sense manner that avoids absurd results."
This is a gross misuse of FERPA. The U.S. Department of Education, which interprets and enforces FERPA (and has never penalized any institution as a violator since it was enacted) has said repeatedly that the statute is a narrow one, protecting only the confidentiality of students’ education records. In an interpretation reiterated in several legal opinion letters, the department wrote to one school district in 2006 that “FERPA applies to the disclosure of tangible records and of information derived from tangible records. FERPA does not protect the confidentiality of information in general, and, therefore, does not apply to the disclosure of information derived from a source other than education records, even if education records exist which contain that information.”
In other words, as long as a school is not being asked to release the contents of a school-maintained record, federal law presents no prohibition to the disclosure of information that comes from other sources. And it certainly presents no prohibition to the disclosure of information that could only be identifiable by somebody with firsthand knowledge of the situation. For instance, FERPA would not prevent schools from sharing a statement that, “Two students were suspended for making a bomb threat on Twitter,” which does not identify the disciplined students by name.
When journalists ask for records about a case like Nikolas Cruz’s, their purpose is to assess how government officials did their jobs. Right now, it is up for serious debate whether school authorities responded properly to a potential threat at Marjory Stoneman Douglas High School—but without access to the school’s records, the debate is an uninformed one.
The initial wave of news stories reported that Cruz was expelled from Stoneman Douglas, but the Miami Herald later reported that no such expulsion took place. When an event of overriding public interest occurs, it serves no legitimate purpose for school officials to withhold accurate information, allowing speculation and rumor to proliferate. There is certainly no precedent for any school to be sanctioned as a FERPA violator for giving out such information (as, for instance, the University of Oklahoma did in announcing the expulsion of two students caught singing a racist song in 2015).
Time and again, educational institutions have put secrecy ahead of safety, insisting that FERPA prevents them from warning the public of dangerous students.
Fortunately, judges are seeing through the distortion of FERPA.
In 2011, an Arizona judge ordered Pima Community College to release internal emails in which employees discussed their concerns about a former student who went on to murder six people in Tucson and gravely wound Rep. Gabrielle Giffords. The judge turned aside the college’s insistence that FERPA precluded disclosure of such emails.
More recently, a federal judge sanctioned Northern Kentucky University lawyers who frivolously claimed that FERPA prohibited coaches from testifying about how they responded to sexual-assault accusations against members of the school basketball team.
As these rulings reflect, it’s eminently possible for schools to interpret FERPA in a common-sense manner that avoids absurd results.
In the Cruz case, it’s nonsensical to say that a person who has admitted shooting 17 people to death has any legally recognizable privacy interest. FERPA or no, police and prosecutors will have ample access to all of the education records they care to see—no court will deny law officials access to those records once a student is in custody and facing trial. And Cruz has no reputation left to protect. Not one person’s opinion of him will be lowered by finding out his disciplinary history, so even if FERPA could be interpreted to preclude disclosing his records, that interpretation makes no practical sense.
Federal regulations provide that, even if a FERPA violation is found, the U.S. Department of Education cannot take away a dime of federal money without first issuing a written warning and placing the school on a federal corrective plan. Only if the school refuses to accept the plan can the department then initiate financial penalties. That has never happened. FERPA is a toothless tiger—not an excuse for educational institutions to withhold essential information that’s necessary for students and their parents to feel safe.
Whether school officials are doing enough to maintain safety is manifestly the public’s concern. Schools know, or certainly should know, that they can say more than they’re saying.
It’s time for Congress to clarify the statute’s definition of “education records” to conform with common sense.
