July 11, 2005

Ms. Deborah T. Wilkins

General Counsel

Western Kentucky University

1 Big Red Way

Bowling Green, Kentucky 42101-3576

Dear Ms. Wilkins:

This responds to your November 8, 2004, request for guidance regarding
the disclosure of education records by Western Kentucky University (WKU)
to the Kentucky Council on Postsecondary Education (CPE) in accordance
with the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. §
1232g. You noted that WKU supported a similar request submitted to this
Office by Eastern Kentucky University (EKU) in a letter dated February
22, 2002. This Office administers FERPA and is responsible for providing
technical assistance to ensure compliance with the statute and
regulations, which are codified at 34 CFR Part 99.

Your letter asks for guidance on the following two issues:

1)  Whether disclosure of the requested information to CPE (as outlined
    below), without student consent violates FERPA; and

2)  Assuming that the disclosure to CPE does not violate FERPA, whether
    further or subsequent disclosure of personally identifiable
    information to third parties or entities without student consent
    would be prohibited under FERPA.

You explained that CPE has asked state universities to produce
"student-specific final grade information," including each student's
Social Security number (SSN); first and last name; year of birth; state
of origin; number of transfer hours; full or part-time status; whether
the student is a first-time transfer; the transfer institution; total
number of credit hours; high school identifier; date of high school
graduation; declared major; home county and/or address including zip
code; courses in current enrollment; audited courses; gender;
race/ethnicity; and classification level (freshman, sophomore, junior,
or senior). You indicated that CPE does not intend to obtain student
consent for the release and cannot identify a specific date when the use
of the data will be complete and the data will be destroyed.

As explained more fully below, it is our opinion that these disclosures
are permissible under the assumptions and conditions described in this
letter.

FERPA applies to an educational agency or institution that receives
funds under any program administered by the Secretary of Education. See
34 CFR § 99.1(a). We assume for purposes of this discussion that WKU
(like EKU) is an educational agency or institution subject directly to
FERPA requirements. Eligible students (i.e., those who have reached 18
years of age or attend a postsecondary institution) have a right under
FERPA to inspect and review the student's education records and to seek
to have them amended in certain circumstances. 34 CFR Part 99, Subparts
B and C. In addition, an eligible student must generally provide a
signed and dated written consent in accordance with § 99.30 of the FERPA
regulations before an educational agency or institution discloses
education records, or personally identifiable information from education
records. Exceptions to this requirement are set forth in § 99.31 of the
regulations.

One of the exceptions to FERPA's prior written consent requirement
allows an educational agency or institution to disclose education
records to "authorized representatives" of

(1) The Comptroller General of the United States;

(2) The Attorney General of the United States;

(3) The Secretary \[of Education\]; or

(4) State and local educational authorities,

34 CFR § 99.31(a)(3), provided the disclosure is in connection with an
audit or evaluation of Federal or State supported education program, or
for the enforcement of or compliance with Federal legal requirements
that relate to those programs. 34 CFR § 99.35(a). Information that is
collected under this provision must:

(1) Be protected in a manner that does not permit personal
    identification of individuals by anyone except the officials
    referred to in paragraph (a) of this section; and

(2) Be destroyed when no longer needed for the purposes listed in
    paragraph (a) of this section.

34 CFR § 99.35(b).

The phrase "State and local educational authorities" is not defined in
FERPA or elsewhere in Federal law or regulations. However, this Office
has generally interpreted the term to mean an agency or other party with
educational expertise and experience that is responsible for and
authorized under State or local law to regulate, plan, coordinate,
advise, supervise or evaluate elementary, secondary, or postsecondary
education programs, services, agencies, or institutions in the State.
(Note that "State or local educational authorities" need not exercise
the "direction and control" that characterizes the relationship between
an "educational agency" and an "educational institution" under 34 CFR §
99.1(a)(2).)

CPE is a 16 member public agency composed of the Commissioner of
Education, a faculty member, a student member, and 13 citizen members.
KRS § 164.011. Among its various duties, CPE is required to develop,
plan, implement, and revise the strategic postsecondary agenda (with the
advice and counsel of the Strategic Committee on Postsecondary
Education); review, revise, and approve the missions of the State's
universities and the Kentucky Community and Technical College System;
and ensure that all postsecondary institutions in the state provide
cooperatively for an integrated system of postsecondary education by
promoting transferability of credits and easy access of information
among institutions. KRS § 164.020(1), (2), (4) and (5). CPE leads and
provides staff support for the biennial budget process and advises the
Governor on recommendations to the General Assembly on appropriations
for postsecondary institutions and devises policies for allocation of
funds among these institutions. KRS § 164.020(9) and (10).

CPE constitutes the State's representative agency in all matters of
postsecondary education that are not otherwise delegated to one or more
postsecondary institutions. KRS § 164.020(21). CPE determines tuition
and approves the minimum qualifications for admission to the State
postsecondary educational system. KRS § 164.020(8). It defines and
approves the offerings of all public postsecondary education degree,
certificate or diploma programs; eliminates or makes changes in existing
programs; approves the teacher education programs in public
institutions; and recommends to the Governor the establishment of new
institutions within the State. KRS § 164.020(14), (15), (17) and (20).
CPE maintains a uniform financial reporting procedure used by all state
postsecondary institutions and procedures for the approval of a
designated receiver to maintain student records of specified public
institutions that cease to operate. KRS § 164.020(22) and (25). The
executive officer of each institution may be required to submit reports
to CPE as needed for the effective performance of CPE's duties. KRS §
164.020(12).

CPE is directed to develop a system of public accountability related to
the postsecondary strategic agenda by evaluating the performance and
effectiveness of the State's postsecondary system. KRS § 164.020(3). In
that vein, CPE is required to engage in analyses and research to
determine the overall needs of postsecondary and adult education in the
State and develop and implement a system of accountability for
postsecondary institutions that measures educational quality and
outcomes; student progress in the postsecondary system; research and
service activities; use of resources; other performance or outcomes that
support achievement of the strategic agenda, including involvement in
quality enhancement of elementary and secondary education; and other
indicators as deemed appropriate by CPE. KRS §§ 164.020(6) and
164.095(3). The postsecondary education accountability process requires
CPE to "collect information, maintain a comprehensive database, and
publish reports on the condition of the postsecondary education system
that include but are not limited to student enrollments, utilization of
facilities, and the finances of the institutions." KRS § 164.095(4).
Each year, CPE must submit to the Governor and the Legislative Research
Commission an "annual accountability report" providing information on
the implementation of performance standards and the achievement of
performance goals during the prior year. KRS § 164.095(4).

You also provided a memorandum from CPE President Thomas D. Layzell
dated September 9, 2004, regarding collection of final grades. Mr.
Layzell's memo states that CPE "currently \[collects\] final grades for
all first-time freshmen for purposes of the high school feedback report"
and was ready to move forward, starting with the 2004 fall semester,
with collecting final grades as part of the "comprehensive database."
The memo explains further:

> Increasingly, we are asked to address factors that contribute to or
> detract from student success. State leaders want to know what factors
> contribute to a successful transition from high school to college.
> Student-specific final grade information is necessary for us to
> evaluate the relationship of performance in remedial education courses
> to performance in credit bearing courses, retention, and ultimately to
> graduation. Final grades also will help determine predictors of
> success for two-year transfer students. More broadly, final grades
> will help determine what courses and what performance (grades) in what
> types of courses (math, writing, general education core, technical
> courses), for what types of students (minority, first time college
> goers, adult learners, full/part time) predict success (retention,
> graduation rate, time to degree, level of learning, transition to the
> workplace). These questions require student level performance data,
> more specifically grades, that show the level of success.

In addition, Katherine M. Coleman, then University Counsel for EKU,
indicated in her

February 22, 2002, letter to this Office that CPE would begin requiring
institutions to submit "End of Term Credit Reports" that would include
students' SSNs and final grade data. At that time, a representative of
CPE had indicated to EKU that the data would be used as follows:

> \[to\] ... avoid making increasing numbers of specialized grade
> requests for special cohorts of students. Already we know we currently
> need or will require grade reports for:

-   High school feedback report

-   Monitoring the Mandatory Placement Policy

-   Validating CATS scores as a predictor of college performance

-   Providing the KCTCS \] Kentucky Community and Technical College
    System\] feedback report

-   Evaluating the KEES \[Kentucky Educational Excellence\] scholarship
    program.

> With this one data report we can handle these and other coming
> analysis from here. The alternative would be recurring requests for
> data in various forms from you.
>
> Our focus will be on statewide issues related to student success: P-12
> factors that predict student success in college, success of remedial
> programs in enabling students to succeed in college, links between
> adult education programs and college success, links between college
> performance and employment 1 and 5 years out, links between student
> performance and civic engagement, alumni satisfaction, employer
> satisfaction, etc.

Based on our review of statutory authority, we conclude that CPE
qualifies as a "State or local educational authority" under
§99.31(a)(3)(iv) of the FERPA regulations because it is an agency with
educational expertise and experience that is responsible for and
authorized under State law to regulate, plan, coordinate, advise,
supervise and evaluate postsecondary education programs, services,
agencies, and institutions in the State. We conclude further that WKU
(and EKU) may provide CPE with the information requested, without prior
written consent, under § 99.35(a) of the FERPA regulations because of
CPE's stated purposes, as described in the Layzell memo and Ms.
Coleman's letter, of using the information in connection with CPE's
evaluation of Federal and State funded education programs.

The Layzell memo noted CPE's commitment to protection and security of
the data, as required by Federal and State law, and attached a draft
"Data Access Policy" (Attachment A) and a separate "formal document
describing the purpose for the data collection and analysis, and
detailing \[CPE's\] commitment to conforming to the federal privacy
statute" (Attachment B). We note that many of the security and
confidentiality requirements in these policies comply with FERPA
requirements, as asserted in section 3 of the Data Access Policy.
However, as explained in more detail below, some of CPE's plans for
using and redisclosing information in the comprehensive database would
fail to comply with the requirements of § 99.35(b) of the regulations
(and we are aware of no other exception to the written consent
requirement in FERPA that would apply to the disclosure of education
records to CPE as requested). Therefore, since WKU is the responsible
party for compliance with FERPA, it should not disclose personally
identifiable information from education records to CPE without
assurances that CPE will not redisclose information in personally
identifiable form except in accordance with FERPA requirements.

Under § 99.35 of the FERPA regulations, CPE may not redisclose
information from education records it has received from WKU (or any
other educational agency or institution), in personally identifiable
form, to State health, labor, employment or other non-educational
agencies, as suggested in section 3, paragraph 2 of the Data Access
Policy, and in material quoted from

Ms. Coleman's letter (i.e., "links between college performance and
employment 1 and 5 years out, links between student performance and
civic engagement, ... employer satisfaction, etc."). As explained in our
February 18, 2004, letter to the California Department of Education
(available at
http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/ca21804.html):

> Earlier this year, the Department issued guidance regarding whether
> FERPA permits a State or local educational authority, such as an SEA
> \[State educational agency\], to authorize or designate another State
> agency as its \"authorized representative\" in order to conduct data
> matching with the other entity. This memorandum was issued to all
> Chief State School Officers on January 30, 2003, by former Deputy
> Secretary William D. Hansen and is available on this Office\'s website
> ([www.ed.gov/offices/OII/fpco](http://www.ed.gov/offices/OII/fpco)).
> The Deputy Secretary\'s memorandum .... grew out of concern that
> unlimited discretion to appoint or designate an \"authorized
> representative\" for data matching purposes essentially vitiates the
> specific conditions for nonconsensual disclosure under §§ 99.31(a)(3)
> and 99.35 and, more generally, FERPA\'s prohibition on disclosure
> without written consent. The memo explains that multiple references to
> \"officials\" in the statutory text for this exception reflect
> congressional concern that the \"authorized representatives\" of a
> State educational authority (or other official listed in §
> 99.31(a)(3)) must be under the *direct control* of that authority,
> which means an employee, appointed official, or \"contractor."

In regard to CPE's use of contractors to perform CPE functions, as noted
in section 5.C.6 of the Data Access Policy, the letter explained
further:

> \"Contractor\" in this sense means outsourcing or using third-parties
> to provide services that the State educational authority would
> otherwise provide for itself, in circumstances where internal
> disclosure would be appropriate under § 99.35 if the State educational
> authority were providing the service itself, and where the parties
> have entered into an agreement that establishes the State educational
> authority\'s direct control over the contractor with respect to the
> service provided by the contractor. Any contractor that obtains access
> to personally identifiable information from education records in these
> circumstances is bound by the same restrictions on redisclosure and
> destruction of information that apply to the State educational
> authority itself under § 99.35, and the State educational authority is
> responsible for ensuring that its contractor does not redisclose or
> allow any other party to have access to any personally identifiable
> information from education records.

We note also that KRS § 164.283(7) provides that "\[a\]ll student
academic records shall be made available upon request to a public or
private junior college from which the individual student was graduated
or to a public or private secondary school from which the individual
student was graduated." In that vein, KRS § 164.020(5) directs CPE to
"\[promote\] transferability of credits and easy access of information
among institutions" in the State. CPE may permit staff of a
postsecondary institution to have access to data from education records
that it disclosed to the comprehensive database, as indicated in section
5.C.7.a. of the Data Access Policy. However,

§ 99.35(b) of the FERPA regulations does not permit CPE to redisclose
personally identifiable information from education records to a school
previously attended by a student, for example in order to report on a
student's subsequent progress, unless that school qualifies as a "State
or local educational authority" that is auditing or evaluating Federal
or State supported education programs. Accordingly, WKU may not disclose
information from education records to CPE with the understanding that
CPE will redisclose information, in personally identifiable form, to
other educational institutions.

Finally, CPE's Data Access policy provides in section D.1 for release of
personally identifiable data in five levels of access, including Level
2, which --

> allows researchers, education groups, and other parties who express
> legitimate educational interests to read all records and fields in the
> database to further the understanding of educational practices,
> methods, or theory that would be expected through acceptable research
> practice. Level 2 access will be granted only after approval of a data
> request form. The CPE will notify institutions when a level 2 data
> request has been approved for a third party.

Section D.2. provides further that --

> Researchers, education groups, and other parties who express
> legitimate education interests in using personally identifiable data
> shall submit a Data Request Form that explains what data are
> requested, and how the data are to be stored, used, maintained,
> disseminated, and ultimately destroyed.

There is no exception to the prior written consent requirement in FERPA
that allows a State educational authority, such as CPE, to redisclose
information from education records, in personally identifiable form, to
outside researchers, whether or not they demonstrate "legitimate
education interests." Educational agencies and institutions themselves
may disclose education records, without prior written consent, to
organizations conducting studies for them or on their behalf, for the
improvement of instruction and other purposes set forth in § 99.31(a)(6)
of the regulations. However, this exception does not apply to a State
educational authority that has received information from education
records under § 99.31(a)(3) and is subject to the specific limitations
on redisclosure of information set forth in § 99.35, as described above.
The Department recognizes, of course, the importance of research-based
decision making and has outlined a method for removing personally
identifiable information from education records, including information
that would make a student's identity "easily traceable," so that it may
be disclosed for education research purposes. See our November 18, 2004,
letter to the Tennessee Department of Education on the use of
"anonymous" data from education records available at
www.ed.gov/policy/gen/guid/fpco/ferpa/library/nashville_tn2004.html.

Finally, please note that WKU is required to comply with the
recordkeeping requirements in

§ 99.32(a) of the regulations with respect to its disclosure of
information to CPE. In lieu of recording every single disclosure, this
Office has advised that an educational agency or institution may
maintain with each student's records a notice of the annual or other
schedule under which personally identifiable information is disclosed to
CPE for the purposes specified.

I trust that the above information is helpful in explaining the scope
and limitations of FERPA as it relates to your inquiry.

Sincerely,

/s/

LeRoy S. Rooker

Director

Family Policy Compliance Office

cc: Joanne K. Glasser, President, Eastern Kentucky University

Cheryl Harris, University Counsel, Eastern Kentucky University

Dennis Taulbee, General Counsel, Kentucky Council on Postsecondary
Education