Most parents are aware that their students have some privacy rights that schools must take appropriate action to protect. However, many parents are not aware of what establishes those privacy rights and, perhaps more important to parents, what can be done to protect them.

The Family Educational Rights and Privacy Act (FERPA) was adopted in 1974 as a Congressional response to the abuse of student records nationwide. FERPA serves two main functions: 1) guarantee access to students records for both students and parents; 2) limit third-party access to student records.

When processing a records request, a school must determine whether the materials requested qualify as education record materials. An “education record” includes records, files, documents and other materials, which: (1) contain information related to a student; and (2) are maintained by an educational institution. This includes things like a student’s academic work, test scores, psychological records, and family background. An education record does not include things like personal notes of a teacher or counselor, personnel records or law enforcement records.

So what happens when a student’s school releases part of their education record to a third party in violation of FERPA? One of the most common questions we receive is how parents can sue their child’s school for violating FERPA. Unfortunately, they cannot. FERPA creates no private right of action in the event of a school violation, meaning individuals cannot sue for a violation in court. Instead, in the event of a FERPA violation, a parent or student may file a Complaint with the Student Privacy Policy Office (SPPO) of the Department of Education alleging a violation.

A Complaint must be filed within six months of the violation, or within six months of when parents first knew or should have known of the violation. In this process, timeliness is key. Following a complaint, the SPPO will determine whether the school violated FERPA, and whether the school has a practice or policy of violating FERPA.

If the SPPO finds that a school has a practice or policy of violating FERPA, SPPO will then provide steps that the school must take to comply and provide a reasonable period to comply. If a school still does not comply, SPPO may withhold further payments made under any federal program and either issue a cease-and-desist letter or terminate federal funding.

Although there is no private cause of action guaranteed under FERPA it is still important that parents make their voices heard through the SPPO Complaint process. When facing the restriction or elimination of federal funding, schools will typically clean up their act with regard to maintaining FERPA-protected information. If you believe your child’s private, FERPA-protected information has been wrongfully distributed by their school, we encourage you to file a complaint with the SPPO and make your voice heard.

For more information about FERPA, check out the Special Education Legal Clinic’s FERPA video: SELC Understanding FERPA. Further SELC Workshops on other topics are also available.

Megan Mitchell is an education attorney in Michigan at Abdnour Weiker, LLP