![](media/image1.wmf)

**Relating to Anti-Terrorism Activities**

April 12, 2002

Dear Colleague:

The purpose of this guidance is to provide you with an overview of
recent changes made by Congress to the Family Educational Rights and
Privacy Act (FERPA) in response to the September 11th terrorist attacks
on the United States. In so doing, we also will provide an overview of
the relevant provisions of current law. The changes to FERPA became
effective on October 26, 2001, when the President signed into law the
"Uniting and Strengthening America by Providing Appropriate Tools
Required to Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act of
2001." (Public Law 107-56; 115 Stat. 272.) Section 507 of the USA
PATRIOT ACT amends FERPA, and is attached for your convenience at the
end of this letter.

*[Overview of FERPA]{.underline}*

FERPA is a federal law that applies to educational agencies and
institutions that receive federal funds under any program administered
by the Secretary of Education. 20 U.S.C. § 1232g; 34 C.F.R. Part 99.
Generally, FERPA prohibits the funding of an educational agency or
institution that has a policy or practice of disclosing a student's
"education record" (or personally identifiable information contained
therein) without the consent of the parent. When a student turns 18
years old or attends a postsecondary institution at any age, the rights
under FERPA transfer from the parent to the student ("eligible
student").

FERPA defines "education records" as "those records, files, documents
and other materials which --

(i) contain information directly related to a student; and

(ii) are maintained by an educational agency or institution or by a
     person acting for such agency or institution."

20 U.S.C. § 1232g(a)(4)(A)(i) and (ii).

FERPA generally requires prior written consent from the parent or
eligible student before an educational agency or institution may
disclose personally identifiable information from education records to a
third party. However, the law contains 16 exceptions to this general
rule. Pertinent exceptions that allow release of personally identifiable
information without prior written consent are discussed below.

*[Ex Parte Orders]{.underline}*

Significantly, the recent amendment to FERPA permits educational
agencies and institutions to disclose -- without the consent or
knowledge of the student or parent -- personally identifiable
information from the student's education records to the Attorney General
of the United States or to his designee in response to an *ex parte*
order in connection with the investigation or prosecution of terrorism
crimes specified in sections 2332b(g)(5)(B) and 2331 of title 18, U.S.
Code.[^1] An *ex parte* order is an order issued by a court of competent
jurisdiction without notice to an adverse party.

In addition to allowing disclosure without prior written consent or
prior notification, this provision amends FERPA's record keeping
requirements (20 U.S.C. § 1232g(b)(4); 34 C.F.R. § 99.32). As a result,
FERPA, as amended, does not require a school official to record a
disclosure of information from a student's education record when the
school makes that disclosure pursuant to an *ex parte* order. Further,
an educational agency or institution that, in good faith, produces
information from education records in compliance with an *ex parte*
order issued under the amendment "shall not be liable to any person for
that production."

A copy of the new statutory language follows this guidance. The
Department will be working with the Department of Justice in the
implementation of this new provision. In addition to this guidance, we
will be amending and updating the FERPA regulations to include this new
exception to the written consent requirement. You should address any
questions you have on the new amendment to <FERPA@ED.Gov>.

*[Lawfully Issued Subpoenas and Court Orders]{.underline}*

FERPA permits educational agencies and institutions to disclose, without
consent, information from a student's education records in order to
comply with a "lawfully issued subpoena or court order" in three
contexts. 20 U.S.C. § 1232g(b)(1)(J)(i) and (ii), (b)(2)(B); 34 C.F.R. §
99.31(a)(9). These three contexts are:

1.  [Grand Jury Subpoenas]{.underline} -- Educational agencies and
    institutions may disclose education records to the entity or persons
    designated in a Federal grand jury subpoena. In addition, the court
    may order the institution not to disclose to anyone the existence or
    contents of the subpoena or the institution's response. If the court
    so orders, then neither the prior notification requirements of §
    99.31(a)(9) nor the recordation requirements at 34 C.F.R. § 99.32
    would apply.

2.  [Law Enforcement Subpoenas]{.underline} -- Educational agencies and
    institutions may disclose education records to the entity or persons
    designated in any other subpoena issued for a law enforcement
    purpose. As with Federal grand jury subpoenas, the issuing court or
    agency may, for good cause shown, order the institution not to
    disclose to anyone the existence or contents of the subpoena or the
    institution's response**.** In the case of an agency subpoena, the
    educational institution has the option of requesting a copy of the
    good cause determination. Also, if a court or an agency issues such
    an order, then the notification requirements of § 99.31(a)(9) do not
    apply, nor would the recordation requirements at 34 C.F.R. § 99.32
    apply to the disclosure of education records issued pursuant to the
    law enforcement subpoena.

3.  [All other Subpoenas]{.underline} -- In contrast to the exception to
    the notification and record keeping requirements described above,
    educational agencies or institutions may disclose information
    pursuant to any other court order or lawfully issued subpoena only
    if the school makes a reasonable effort to notify the parent or
    eligible student of the order or subpoena in advance of compliance,
    so that the parent or eligible student may seek protective action.
    Additionally, schools must comply with FERPA's record keeping
    requirements under 34 C.F.R. § 99.32 when disclosing information
    pursuant to a standard court order or subpoena.

*[Health or Safety Emergency]{.underline}*

FERPA permits non-consensual disclosure of education records, or
personally identifiable, non-directory information from education
records, in connection with a health or safety emergency under §
99.31(a)(10) and § 99.36 of the FERPA regulations. In particular, §
99.36(a) and (c) provide that educational agencies and institutions may
disclose information from an education record "to appropriate parties in
connection with an emergency if knowledge of the information is
necessary to protect the health or safety of the student or other
individuals" and that the exception will be "strictly construed."
Congress' intent that the applicability of this exception be limited is
reflected in the *Joint Statement in Explanation of Buckley/Pell
Amendment*, 120 Cong. Rec. S21489 (Dec. 13, 1974).

Accordingly, the Department consistently has limited the health and
safety exception to a specific situation that presents imminent danger
to a student, other students, or other members of the school community
-- or to a situation that requires the immediate need for information
from education records in order to avert or diffuse serious threats to
the safety or health of a student or other individuals. For example, the
health or safety exception would apply to nonconsensual disclosures to
appropriate persons in the case of a smallpox, anthrax or other
bioterrorism attack. This exception also would apply to nonconsensual
disclosures to appropriate persons in the case of another terrorist
attack such as the September 11 attack. However, any release must be
narrowly tailored considering the immediacy, magnitude, and specificity
of information concerning the emergency. As the legislative history
indicates, this exception is temporally limited to the period of the
emergency and generally will not allow for a blanket release of
personally identifiable information from a student's education records.

Under the health and safety exception school officials may share
relevant information with "appropriate parties," that is, those parties
whose knowledge of the information is necessary to provide immediate
protection of the health and safety of the student or other individuals.
20 U.S.C. § 1232g(b)(1)(I); 34 C.F.R. § 99.36(a). Typically, law
enforcement officials, public health officials, and trained medical
personnel are the types of parties to whom information may be disclosed
under this FERPA exception. FERPA's record keeping requirements (§
99.32) apply to disclosures made pursuant to the health or safety
exception.

The educational agency or institution has the responsibility to make the
initial determination of whether a disclosure is necessary to protect
the health or safety of the student or other individuals. However, the
Department is available to work with institutions to assist them in
making such decisions in order to ensure that the disclosure comes
within the exception to FERPA's requirement of prior written consent.

In short, the health or safety exception will permit the disclosure of
personally identifiable information from a student's education record
without the written consent of the student in the case of an immediate
threat to the health or safety of students or other individuals. Of
course, a school official, based on his or her own observations, may
notify law enforcement officials of suspicious activity or behavior.
Nothing in FERPA prohibits a school official from disclosing to federal,
State, or local law enforcement authorities information that is based on
that official's personal knowledge or observation and not from an
education record.

## [Law Enforcement Unit Records]{.underline}

Under FERPA, schools may disclose information from "law enforcement unit
records" to anyone -- including federal, State, or local law enforcement
authorities -- without the consent of the parent or eligible student.
FERPA specifically exempts from the definition of "education records" --
and thereby from the privacy restrictions of FERPA -- records that a law
enforcement unit of a school district or postsecondary institution
creates and maintains for a law enforcement purpose. A "law enforcement
unit" is an individual, office, department, division, or other component
of a school district or postsecondary institution -- such as a unit of
commissioned officers or noncommissioned security guards -- that is
officially authorized or designated by the school district or
institution to: (1) enforce any federal, State, or local law; or (2)
maintain the physical security and safety of the school. See 34 C.F.R. §
99.8.

FERPA narrowly defines a law enforcement record as a record that is: (i)
created by the law enforcement unit; (ii) created for a law enforcement
purpose; and (iii) maintained by the law enforcement unit. 34 C.F.R. §
99.8(b). While other components of an educational institution generally
can disclose, without student consent, student education records to
school law enforcement units (under FERPA's exception for school
officials with legitimate educational interests), these records are not
thereby converted into law enforcement unit records because the records
were not created by the law enforcement unit. Thus, a law enforcement
unit cannot disclose, without student consent, information obtained from
education records maintained by other components of an educational
institution.

## 

## [Directory Information]{.underline}

FERPA's regulations define "directory information" as information
contained in an education record of a student "that would not generally
be considered harmful or an invasion of privacy." 34 C.F.R. § 99.3.
Specifically, "directory information" includes, but is not limited to
the student's name, address, telephone listing, electronic mail address,
photograph, date and place of birth, major field of study, dates of
attendance, grade level, enrollment status (e.g., undergraduate or
graduate, full-time or part-time), participation in officially
recognized activities or sports, weight and height of members of
athletic teams, degrees, honors and awards received, and the most recent
educational agency or institution attended. [Id.]{.underline} A school
may disclose "directory information" from the education records without
prior consent only after giving notice to the student of its directory
information policy, and providing parents and eligible students with an
opportunity to opt out of having their "directory information"
disclosed. See 34 C.F.R. § 99.37.

Under FERPA, a school may not comply with a request for "directory
information" that is linked to other non-directory information. For
instance, a school cannot disclose "directory information" on students
of a certain race, gender, or national origin. However, the school could
disclose "directory information" on *all* students (who have not opted
out) to law enforcement authorities who may be requesting "directory
information."

## [Disclosures to the Immigration and Naturalization Service (INS)]{.underline}

The Immigration and Naturalization Service (INS) requires foreign
students attending an educational institution under an F-1 visa to sign
the Form I-20. The Form I-20 contains a consent provision allowing for
the disclosure of information to INS. The consent provision states that,
"I authorize the named school to release any information from my records
which is needed by the INS pursuant to 8 C.F.R. 214.3(g) to determine my
nonimmigrant status." This consent is sufficiently broad to permit an
educational institution to release personally identifiable information
of a student who has signed a Form I-20 to the INS for the purpose of
allowing the INS to determine the student's nonimmigrant status.
Students that have an M-1 or J-1 visa have signed similar consents and
education records on these students may also be disclosed to the INS.

Finally, we anticipate there may be a need for additional guidance in
the future on other INS disclosure issues.

[Technical Assistance on FERPA]{.underline}

For additional guidance on these or other provisions of FERPA contact
the Family Policy Compliance Office at the following address and
telephone number:

Family Policy Compliance Office

U.S. Department of Education

400 Maryland Avenue, SW

Washington, D.C. 20202-4605

\(202\) 260-3887 -- Telephone

\(202\) 260-9001 -- Fax

Additionally, schools officials may contact the Family Policy Compliance
Office by e-mail for quick, informal responses to routine questions
about FERPA. That address is: <FERPA@ED.Gov>. The Web site address is:
[www.ed.gov/offices/OM/fpco](http://www.ed.gov/offices/OM/fpco).

Sincerely,

/s/

LeRoy S. Rooker

Director

Family Policy Compliance Office

Enclosure

Public Law 107-56, October 26, 2001; 115 Stat. 272

\"Uniting and Strengthening America Act by Providing Appropriate Tools
Required to Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act of
2001\"

SEC. 507. DISCLOSURE OF EDUCATIONAL RECORDS. \[115 Stat. 367-68\]

Section 444 of the General Education Provisions Act (20 U.S.C. 1232g),
is amended by adding after subsection (i) a new subsection (j) to read
as follows:

\`\`(j) Investigation and Prosecution of Terrorism.---

\`\`(1) In general.\--Notwithstanding subsections (a) through (i) or any
provision of State law, the Attorney General (or any Federal officer or
employee, in a position not lower than an Assistant Attorney General,
designated by the Attorney General) may submit a written application to
a court of competent jurisdiction for an ex parte order requiring an
educational agency or institution to permit the Attorney General (or his
designee) to\--

\`\`(A) collect education records in the possession of the educational
agency or institution that are relevant to an authorized investigation
or prosecution of an offense listed in section 2332b(g)(5)(B) of title
18 United States Code, or an act of domestic or international terrorism
as defined in section 2331 of that title; and

\"(B) for official purposes related to the investigation or prosecution
of an offense described in paragraph (1)(A), retain, disseminate, and
use (including as evidence at trial or in other administrative or
judicial proceedings) such records, consistent with such guidelines as
the Attorney General, after consultation with the Secretary, shall issue
to protect confidentiality.

\`\`(2) Application and approval.\--

\`\`(A) In general.\--An application under paragraph (1) shall certify
that there are specific and articulable facts giving reason to believe
that the education records are likely to contain information described
in paragraph (1)(A).

\`\`(B) The court shall issue an order described in paragraph (1) if the
court finds that the application for the order includes the
certification described in subparagraph (A).

\`\`(3) Protection of educational agency or institution.---An
educational agency or institution that, in good faith, produces
education records in accordance with an order issued under this
subsection shall not be liable to any person for that production.

\`\`(4) Record-keeping.\--Subsection (b)(4) does not apply to education
records subject to a court order under this subsection.\'\'.

[^1]: These statutes define Federal crimes of terrorism as offenses
    calculated to influence the conduct of government such as
    destruction of aircraft, assassination, arson, hostage taking,
    destruction of communications lines or national defense premises,
    and use of weapons of mass destruction.