Privacy Rights Clearinghouse

3100 Fifth Ave., Ste. B Voice: (619) 298-3396 E-mail:
bgivens@privacyrights.org

San Diego, CA 92103 Fax: (619) 298-5681 Web:
[www.privacyrights.org](http://www.privacyrights.org/)

May 5, 2008

LeRoy S. Rooker

U.S. Department of Education,

400 Maryland Avenue, SW, Room 6W243

Washington, DC 20202--5920

Filed electronically at:
[http://www.regulations.gov](http://www.regulations.gov/)

**Re:** **Docket ID ED--2008--OPEPD--0002**

Dear Mr. Rooker:

The Privacy Rights Clearinghouse (PRC) is a nonprofit privacy and
consumer advocacy organization, based in San Diego, California, and
established in 1992. The PRC invites consumers' questions and complaints
via e-mail and telephone, providing consumers with information and
assistance on a wide variety of privacy issues. As such, we are in a
unique position to track consumers' privacy concerns.

We are writing to comment on the proposed regulations governing
education records maintained by educational agencies and institutions
under section 444 of the General Education Provisions Act, which is also
known as the Family Educational Rights and Privacy Act of 1974, as
amended (FERPA). These proposed regulations would implement amendments
to FERPA contained in the USA Patriot Act and the Campus Sex Crimes
Prevention Act, implement two U.S. Supreme Court decisions interpreting
FERPA, and make changes identified as a result of the Department's
experience administering FERPA.

Our comments will specifically address the Department's revisions to 34
CFR Sections 99.3, 99.31(c), and 99.37. In general, we note that
education records are likely to contain highly sensitive information.
Consequently, it is essential that the Department maintain adequate
regulatory controls over access to education records (34 CFR Section
99.31(c)), disclosure by educational institutions of directory
information (4 CFR Section 99.3), and the ability of current and former
students to opt out of directory information disclosures (4 CFR Section
99.37).

*34 CFR Section 99.3*

The Department's proposed regulations in section 99.3 would provide that
an educational agency or institution may not designate as directory
information a student's Social Security number (SSN) or other student ID
number. However, directory information may include a student's user ID
or other unique identifier used by the student to access or communicate
in electronic systems, but only if the electronic identifier cannot be
used to gain access to education records except when used in conjunction
with one or more factors that authenticate the student's identity, such
as a personal identification number (PIN), password, or other factor
known or possessed only by the student.

We support this change to the regulations. The proposed regulations are
needed to ensure that educational institutions do not disclose these
identifiers as directory information, or include them with other
personally identifiable information that may be disclosed as directory
information, because SSNs and other student ID numbers can be used to
impersonate the owner of the number and obtain information or services
by fraud. Unlike names and addresses, SSNs and other student ID numbers
are typically used to obtain a variety of non-public information about
an individual, such as employment, credit, financial, health, motor
vehicle, and educational information, that would be harmful or an
invasion of privacy if disclosed.

A SSN or other student ID number can also be used in conjunction with
commonly available information, such as name, address, and date of
birth, to establish fraudulent accounts and otherwise impersonate an
individual. The proposed regulations will address a significant weakness
in the current regulations. Failure to curtail the use of these
identifiers as directory information could have the effect of
facilitating identity theft and other fraudulent activity.

*34 CFR Section 99.31(c)*

The Department's proposed regulations in section 99.31(c) would provide
that an educational agency or institution must use reasonable methods to
identify and authenticate the identity of parents, students, school
officials, and any other parties to whom the agency or institution
discloses personally identifiable information from education records.

We support this change to the regulations. The proposed regulations are
needed to ensure that educational institutions disclose personally
identifiable information from education records only to authorized
recipients. Identification in this context means determining who is the
intended or authorized recipient of such personally identifiable
information. Authentication of identity means ensuring that the
recipient is, in fact, who he or she purports to be.

Under the proposed regulations, an educational institution may determine
that single-factor authentication, such as a standard form user name
combined with a secret PIN or password, is reasonable for protecting
access to electronic grades and transcripts. However, single-factor
authentication may not be reasonable for protecting access to SSNs,
credit card numbers, and similar information that could be used for
identity theft and financial fraud. While we support mandated two-factor
authentication for *all* disclosures of personally identifiable
information from education records, *at a minimum*, two-factor
authentication should be required for protecting access to SSNs, credit
card numbers, and similar information that could be used for identity
theft and financial fraud.

*34 CFR Section 99.37*

The Department's proposed regulations in section 99.37 would clarify
that an agency or

institution must continue to honor any valid request to opt out of
directory information disclosures made while the individual was a
student unless the parent or eligible student rescinds the decision to
opt out of directory information disclosures.

We support this change to the regulations. The proposed regulations are
needed to ensure that educational institutions continue to honor a
parent's or eligible student's decision to opt out of directory
information disclosures once the student no longer attends the
institution. The proposed regulations are needed to insure that
information may not be disclosed once an individual is no longer a
student if the individual made a valid request to opt out while a
student in attendance and has not rescinded that request.

Sincerely,

![](media/image1.jpeg){width="1.8798611111111112in"
height="0.8798611111111111in"}

Beth Givens, Director

Privacy Rights Clearinghouse