As colleges and universities know, higher education institutions have a duty to protect the confidentiality of student records, codified in the Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. § 1232g.  When such documents are requested in the course of litigation, FERPA dictates the processes and standards a school must apply in response.  The discussion that follows answers the following questions:

• When if ever must a school provide student information to a third party during litigation?

• May the student object to the release of their information, and if so, how?

• What notice must a school give a student before providing student information to a third party?In particular,
  • How much advance notice must the student receive?
  • What methods of notice are adequate?
  • What information must the notice contain?

FERPA does not bar the disclosure of student records during discovery.  Rather, it protects “education records” and the personally identifiable information (“PII”) they contain from disclosure to third parties without the student’s consent. “Education records” includes “those records, files, documents, and other materials which (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution.” This discussion focuses on such “education records,” but we note that what FERPA labels as “directory information,” such as a student’s name, address, years of attendance, date of birth, telephone listing, and athletic participation, is held to lower disclosure requirements discussed in more detail here.

As a general rule, an institution may not disclose any education records without the written consent of the student.  In the absence of written consent, the statute permits disclosure of protected information “furnished in compliance with judicial order, or pursuant to any lawfully issued subpoena, upon condition that parents and students are notified of all such subpoenas or orders in advance of compliance therewith by the educational institution or agency.”

1. What is a “lawfully issued subpoena”?

   While the term is not defined in FERPA, guidance letters issued to institutions have consistently stated that a lawfully issued subpoena is one that complies with the subpoena requirements under the relevant state law.

2. How can students object?

   FERPA does not dictate how a student can object to the subpoena. The most common practice for schools is to require that students object on their own written motion to the court, seeking to quash the subpoena. A university may opt to take a larger role in the objection process, but most choose not to take on this additional burden, which is not required under the statute.

3. What sort of notice must the school provide to students?

FERPA requires that universities “make a reasonable effort” to notify students so that they have an opportunity to object to the disclosure of their records, 34 C.F.R. § 99.31(a)(9)(ii), which includes providing students with both sufficient time and information to do so.

Timing of Notice

FERPA does not set a specific time period requirement for FERPA notices.  Rather, the notice must be reasonable.  When determining if the time period provided to the student was reasonable, the Department of Education (“the Department”) has referred to four factors: (1) How long the institution had to comply with the subpoena; (2) Whether this time period was reasonable in light of the institution’s FERPA obligations (if the time period was not reasonable, the institution should make efforts to extend the time of compliance, or quash the subpoena); (3) Whether the institution made a good faith effort to give notice in advance of its compliance with the subpoena; and (4) When and how notice was given and whether the student had a reasonable opportunity to move to quash the subpoena. Schools should thus endeavor to provide students with as much time as possible to receive and respond to the FERPA notices. 

Some schools include a standard notice period within their FERPA policies, which they make available to students and the public, to put students on notice of their FERPA process.  Doing so is not required by FERPA. FERPA regulations require that schools provide an annual notice of rights to students, but the annual notice is not required to provide an official FERPA policy or address the litigation disclosure or notice process. See 34 C.F.R. § 99.7(a). Schools should consider whether establishing and publicizing a strict notice period in a FERPA policy is prudent.  Neither FERPA nor the Department direct or even encourage schools to establish a standardized notice period.  Although doing so may illustrate the school’s good faith effort to put students on notice, it does not negate the burden on schools to provide individualized notice, as outlined below, nor does it necessarily satisfy the reasonableness requirement.  Establishing a standard notice period may therefore be unnecessarily restrictive, as seven or ten days may be reasonable in one instance, but not in another.  For schools with such publicized FERPA policies and notice periods, it may be wise to include language that makes clear that the time period stated is approximate, or will apply in most, but not necessarily all, cases.

Method of Notice

The method by which schools give notice to students is likewise flexible.  Crucially, students must be given notice individually. General notices in a campus newspaper or on Facebook, for example, would be insufficient. Otherwise, the institution may select its manner of notification. In a 1999 guidance, the Department encouraged various forms of notice, such as regular mail, telephone, and fax. This 1999 guidance logically extends to emails in 2021. With most institutions communicating regularly with students via school-sponsored emails, email is likely the easiest and most effective way to give notice. Likewise, many schools maintain email contact information for alumni.  Depending on the number of students involved, it may be prudent to provide notice through multiple methods—e.g. email and mail—to maximize the likelihood of receipt by the current or former student.  Doing so would be a strong illustration of the school’s good faith efforts to provide notice under FERPA.

Contents of Notice

Lastly, the notice must provide sufficient information to the student so that they understand what PII the subpoena is requesting and can seek a protective order. While there is no explicit statutory guidance on what information must be included, it is common practice to include the date by which students must respond to object to the subpoena, the PII the subpoena seeks to disclose, how to object to the subpoena, and the court and docket information number.  Schools also often attach the subpoena to the notification, though it is not required.  The letter should clearly indicate that no affirmative objection with the court before a set date will result in their records being disclosed pursuant to the court order. 

Conclusion

When colleges and universities become entangled in litigation, it is important for the schools to take actions to protect the confidentiality of educational records.  Schools must provide educational information to a third party during civil litigation when sought through a lawfully issued subpoena. Students may object to this information being disclosed by moving to quash the subpoena in court. Schools must use reasonable efforts to notify the student(s) involved that their records have been subpoenaed.  Specifically, the school must make good faith efforts to notify the student(s) individually, whether by mail, telephone, or email, and provide reasonable time and sufficient information such that the student may object if they so choose. Litigants may ultimately have a right to relevant records, but only after they request the records properly and students are informed adequately.