July 25, 2006

Ms. Katherine Minter Cary

Chief, Open Records Division

Office of the Attorney General

P. O. Box 12548

Austin, Texas 78711-2548

Dear Ms. Cary:

This is in response to your letter, dated February 1, 2005, concerning
the Family Educational Rights and Privacy Act (FERPA) as it relates to a
request for information from a student's education records under the
Texas Public Information Act (PIA). (Tex. Gov't Code § 552.) This Office
administers FERPA and is responsible for providing technical assistance
to educational agencies and institutions to ensure compliance with the
statute and regulations. 20 U.S.C. § 1232g; 34 CFR Part 99.

Specifically, the \[School District\] (District) provided a redacted
copy of a report that was written by a student concerning an incident \[
\] to the \[media\], in response to a request under the PIA. The
District removed personally identifiable information from the education
record, in accordance with FERPA, before providing the report to the
\[media\]*.* The newspaper filed a complaint with the Texas Office of
the Attorney General (OAG) because it believed that the District
redacted too much of the student report. The OAG requested that the
District provide an unredacted copy of the student's report to its Open
Records Division (ORD) for review and so that it may make a
determination in the complaint filed by the \[media\]. The District
refused to provide the OAG with a copy of the education records because
it believes that FERPA does not authorize it to do so.

In follow-up to a telephone conversation with Kay Hastings and Brenda
Loudermilk in your office on January 27, 2005, and in response to a
request from the District, we were asked to review this document that
the District redacted. The OAG asked that the District either provide an
unredacted copy of the record to the OAG's ORD or to this Office for
review in order to ascertain whether the District had redacted too much
information from the education record for release under the PIA. The
District also asked this Office for guidance whether FERPA would permit
a school district to disclose education records in unredacted form to
the OAG for the purpose of making a determination on a complaint filed
under the PIA. Enclosed is a copy of our response to the District
regarding the redacted report. As explained more fully below, FERPA does
not permit the District to disclose personally identifiable information
from students' education records to the OAG, without prior written
parental consent, for the purpose of determining whether the District is
in compliance with the PIA.

Page 2 -- Ms. Katherine Minter Cary

In your letter to this Office, you state the following:

> The PIA generally requires a governmental body to seek an open records
> ruling from this office when it wishes to withhold requested
> information from disclosure. In Open Records Decision No. 634 (1995),
> for reasons explained in that decision, the Attorney General
> determined that the PIA does not require an educational agency or
> institution to request an attorney general decision as to personally
> identifiable nondirectory information in an "education records" as
> defined by FERPA. The Attorney General also concluded in that decision
> that an educational agency or institution may withhold from public
> disclosure information that is protected by FERPA and excepted from
> required public disclosure by section 552.101 as "information
> considered to be confidential by law," without the necessity of
> requesting an attorney general decision as to that exception.
>
> However, if an educational agency or institution chooses to seek an
> open records ruling from \[the ORD\] on the applicability of FERPA or
> any exception to required disclosure, it must comply with the PIA's
> procedures for seeking a ruling, including section 552.303. Section
> 552.303 of the PIA states that "\[a\] governmental body that requests
> an attorney general decision shall supply to the Attorney General, in
> accordance with section 552.301, the specific information requested."
> In 1998, in a letter to David Anderson, Chief Counsel, Texas Education
> Agency \[TEA\], you informed Mr. Anderson that educational agencies
> and institutions subject to FERPA "may disclose personally
> identifiable information from education records, without first
> obtaining the parent's prior written consent, when the agency or
> institution seeks advice from the Attorney General where a particular
> disclosure would violate FERPA." As you noted in that letter, section
> (b)(5) of FERPA permits the release of education records to state
> officials which may be necessary in connection with the enforcement of
> the federal legal requirements of any federal or state education
> program, including to the Attorney General for the enforcement of
> FERPA. In reliance on this letter from your office, numerous Texas
> educational agencies and institutions seek an open records ruling from
> this office on whether they must withhold requested information based
> on FERPA. In the open records ruling process, this office reviews
> education records to determine what redactions, if any, are
> appropriate under FERPA.

In this case, the District did not ask the Texas Attorney General for a
ruling, which, as you explained in your letter, it is not required to
do.

FERPA protects the privacy interests of parents and students in a
student's "education records." Educational agencies and institutions
subject to FERPA may not have a policy or practice of permitting the
release of or providing access to "education records, or personally
identifiable information contained therein other than directory
information ... without the written consent of their parents ..." except
as provided by statute. 20 U.S.C. § 1232g(b)(1) and (b)(2); 34 CFR

Page 3 -- Ms. Katherine Minter Cary

§ 99.30. All FERPA rights transfer from parents to students when the
student reaches 18 years of age or attends a postsecondary institution.
20 U.S.C. § 1232g(d); 34 CFR § 99.3 ("Eligible student").

Under FERPA, "education records" are defined as

[]{.mark}

> those records, files, documents, and other materials which --
>
> \(i\) contain information directly related to a student; and
>
> \(ii\) are maintained by an educational agency or institution or by a
> person acting for such agency or institution.

20 U.S.C. § 1232g(a)(4)(A); 34 CFR § 99.3 ("Education records").

One exception to the prior written consent requirement in FERPA allows
an educational agency or institution to disclose education records to
"authorized representatives of . . . State and local educational
authorities . . . in connection with an audit or evaluation of Federal
or State supported education programs, or for the enforcement of or
compliance with Federal legal requirements which relate to those
programs." 34 CFR §§ 99.31(a)(3)(iv) and 99.35(a); 20 U.S.C. §
1232g(b)(3) and (b)(5). Information that is collected under this
provision must:

[]{.mark}

(1) Be protected in a manner that does not permit personal
    identification of individuals by anyone except the officials
    referred to in paragraph (a) of this section; and

(2) Be destroyed when no longer needed for the purposes listed in
    paragraph (a) of this section.

34 CFR § 99.35(b).

As you noted, this Office advised Mr. Anderson by letter dated April 29,
1998, that FERPA would permit the nonconsensual disclosure of personally
identifiable information from students' education records to the OAG in
connection with the "enforcement of or compliance with Federal legal
requirements" that relate to Federal or State supported education
programs. See 20 U.S.C. § 1232g(b)(1)(C), (b)(3), and (b)(5); 34 CFR §§
99.31(a)(3)(iii) and 99.35. The premise in our reasoning -- which was
not made explicit in the letter -- was that the OAG could act as an
"authorized representative" of the TEA for the purpose of "enforcement
of or compliance with Federal legal requirements" concerning FERPA.
Subsequent to issuing that letter, we had an opportunity to address a
related issue and, in doing so, clarified the meaning of the term
"authorized representative." As explained below, we conclude that the
OAG is not "authorized representative" of the TEA or of school districts
in Texas under this FERPA exception to the consent requirement.

On January 30, 2003, the Department issued guidance that addressed the
issue of whether FERPA permits a State or local educational authority,
such as the TEA or local school districts, to authorize or designate
another State agency as its "authorized representative" in order to
conduct data matching with the other entity. This memorandum (a copy
which is enclosed) was issued to all Chief State School Officers on
January 30, 2003, by former Deputy Secretary

Page 4 -- Ms. Katherine Minter Cary

William D. Hansen and is available on this Office's website
(<http://www.ed.gov/policy/gen/guid/fpco/pdf/ht031103.pdf>. The Deputy
Secretary's memorandum rescinded previous Department guidance that
relied on an expansive interpretation of the term "authorized
representative" in § 99.31(a)(3) to support data matching with state
labor departments and other non-educational agencies in order to meet
Workforce Investment Act and other Federal reporting requirements. It
grew out of concern that unlimited discretion to appoint or designate an
"authorized representative" for data matching purposes essentially
vitiates the specific conditions for nonconsensual disclosure under §§
99.31(a)(3) and 99.35 and, more generally, FERPA's prohibition on
disclosure without written consent.

As explained in our February 2004 letters to the California and
Pennsylvania Departments of Education --

> The memo explains that multiple references to "officials" in the
> statutory text for this exception reflect congressional concern that
> the "authorized representatives" of a State educational authority (or
> other official listed in § 99.31(a)(3)) must be under the *direct
> control* of that authority, which means an employee, appointed
> official, or "contractor."
>
> "Contracting" in this sense means outsourcing or using third-parties
> to provide services that the State educational authority would
> otherwise provide for itself, in circumstances where internal
> disclosure would be appropriate under § 99.35 if the State educational
> authority were providing the service itself, and where the parties
> have entered into an agreement that establishes the State educational
> authority's direct control over the contractor with respect to the
> service provided by the contractor. Any contractor that obtains access
> to personally identifiable information from education records in these
> circumstances is bound by the same restrictions on redisclosure and
> destruction of information that apply to the State educational
> authority itself under § 99.35, and the State educational authority is
> responsible for ensuring that its contractor does not redisclose or
> allow any other party to have access to any personally identifiable
> information from education records.

These letters are available at
<http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/pacdc.html> and
<http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/ca21804.html>.

"Authorized representatives" may include outside legal counsel retained
by a State educational authority in circumstances where internal
disclosure would be appropriate under § 99.35 if the service were
provided in-house and where outside counsel is bound by the same
restrictions on redisclosure and destruction of information that apply
to the State educational authority itself under § 99.35.

It is our understanding that OAG does not serve as outside legal counsel
under the direct control of the District in this matter in accordance
with the requirements discussed above. Since the OAG is neither a "State
educational authority" nor an authorized representative of a State
educational authority, as discussed above, the District may not disclose
personally identifiable information from education records to the OAG,
without consent, under §§ 99.31(a)(3) and 99.35 of the FERPA
regulations. Furthermore, the District's situation is distinguishable
from

Page 5 -- Ms. Katherine Minter Cary

that discussed in our 1998 letter to the TEA because the OAG is not
seeking to review this information in connection with the District's
compliance with FERPA, but rather to resolve the requestor's complaint
about the District compliance with the PIA. FERPA does not require
educational agencies and institutions to redact the minimum information
necessary in order to provide the maximum information possible to an
outside party requesting access under State open records laws. Since
only parents and eligible students have a right to inspect and review
education records under FERPA, there is no FERPA compliance issue if the
District removes more than the absolute minimum of personally
identifiable information when disclosing records, without consent, to a
third party. For these reasons, FERPA does not permit an educational
agency or institution in Texas to disclose, without parental consent,
education records to the OAG for the purpose of determining whether it
has complied with the PIA or whether it has redacted more than is
necessary under FERPA.

I trust that the above information is helpful in explaining the scope
and limitations of FERPA as it relates to this matter. Enclosed is a
copy of our letter to \[the District\], in which we discuss the manner
in which educational agencies and institutions may disclose records in
non-personally identifiable format without violating FERPA. If you have
any questions about this guidance, please do not hesitate to contact us.

> Sincerely,
>
> **/s/**
>
> LeRoy S. Rooker
>
> Director
>
> Family Policy Compliance Office

cc: David Anderson

General Counsel, TEA