**RIN number 1875**

**- AA86** 

**Fa mily Educational Rights and Privacy Act (FERPA)** 

**Supporting Statement**
**1. Necessity of Information Collected.** 
The Famil y Educational Rights and Privacy Act (FERPA) is codified at 20 U.S.C. § 1232g. The purpose of the Act is to protect the privacy of students’ education records. FERPA affords certain rights to parents and to eligible students (a student who has reached 18 ye ars of age or is attending a postsecondary institution at any

age) with respect to students’ education records. FERPA applies to educational agencies and institutions that receive funds from an y program administered b y the Department of Education. The regulations a re found at 34 CFR Part 99. 20 U.S.C. § 1232g(e) requires each educational agency or institution to annually inform parents and students of their rights under FERPA (34 CFR § 99.7). 20 U.S.C. § 1232g(b)(1)(F) permits the nonconsensual disclosure of p ersonally identifiable information from students’ education records to organizations conducting studies “for, or on behalf of” an educational agency or institution. A change in 2008 to the FERPA regulations requires an educational agency or institution th at discloses information under this exception to consent to enter into a written agreement with the organization that is conducting the stud y (34 CFR § 99.31(a)(6)(ii)(C)(1)

- (4)). 20 U.S.C. § 1232g(b)(4)(A) requires each educational agency or institutio n to keep a record of parties who have asked for and/or received access to the student’s records (34 CFR § 99.32). In 2008, the FERPA regulations were amended to require that State and local educational authorities and Federal officials and agencies list ed in § 99.31(a)(3) maintain a record of further disclosures these parties may make on behalf of an educational agency or institution if the educational agency

or institution does not record the further disclosures (34 CFR § 99.32(a)(1)).

I n 2008, the FE RPA regulations were amended to require that educational agencies and institutions record the particular and significant threat to the health or safety of a student or other individuals that formed the basis for a disclosure under 34 CFR § 99.31(a)(10) . T his is in addition to the longstanding requirement in § 99.32 that educational agencies and institutions keep a record of parties who have asked for and/or received access to the students’ education records (34 CFR § 99.32(a)(5) )

.2

In 2008, the FERPA re gulations were amended to require educational agencies and institutions to maintain a listing in each student’s record of the State and local educational authorities and Federal officials and agencies that may make further disclosures of the student’s educ ation records without consent (34 CFR § 99.32(b)(2)).
The notice of proposed rulemaking ( NPRM ) was published on March 24, 200 8 . The final regulations w ere published on December 9, 2008, and relate to this collection . Changes in the information collecti on as a result of comments on the 2008 regulations have been provided as necessary for historical background.
The NPRM that this collection follows was published on April 8, 2011, and propos ed additional changes to the FERPA regulations. There wa s one pro posed change in the NPRM affecting paperwork burden (§ 99.35(a)(3))

. The final regulations, which published on December 2, 2011 , relate to this collection

. The amendments and changes made in the collection requirements as a result of feedback received on the regulations are identified below.
The 2011 final regulations modif ied the information collection requirements in § 99.31(a)(6)(ii) by

permitting a State or local educational authority or Federal agencies and officials listed in § 99.31(a)(3) to ent er into written agreements with organizations conducting studies for, or on behalf of, educational agencies and institutions. However, it is our opinion that this does not constitute a change or increase in burden because this change permits this activity to be undertaken by an official or agency

listed in § 99.31(a)(3) on behalf of an educational agency or institution under its jurisdiction

. The 2011 final regulations add ed a definition of the term “authorized representative” to § 99.3 which would permit the officials listed in § 99.31(a)(3) (a State or local educational authority , the Secretary , the Comptroller General of the United States, or the Attorney General of the United States) to designate an y entity or individual to carry

out any audit, evaluat ion, or the enforcement of, or compliance with, Federal legal requirements related to Federal or State supported education programs. It is our opinion that this does not constitute a change or an increase in burden because these entities are alread y requi red to record disclosures, pursuant to § 99.32(b)(2).
The 2011 final regulations modif ied the definition of “directory information” in § 99.3, as well as makes changes to the directory information provisions in § 99.37. Specificall y, the regulations modi f

y the definition of “directory information” to clarify

that an educational agency or institution may designate as directory information and disclose , without consent, a student I D number of other unique personal identifier that is display ed on a student I D card or badge if the identifier cannot be used to gain access to education records, except when used in conjunction with one or more factors that authenticate the user’s identity , such as a PI N, password, or other factor known or possessed only by the au thorized user. In addition, the regulations maketwo changes to § 99.37 concerning directory information: (1) provides that parents and eligible student may not use their right to opt out of directory information disclosures to prevent an educational agen cy or institution from requiring students to wear or otherwise disclose ID cards or badges; and (2) clarifies that an educational agency or3

institution may

specify in the public notice it provides to parents and eligible student in attendance provided in § 99.37(a) that disclosure of directory information will be limited to specific parties, for specific purposes, or both , and that, if an educational agency or institution adopts a limited directory information policy , it must limit directory information dis closures only

to the parties or purposes specified

. Itis our opinion that this does not constitute a change or an increase in burden because educational agencies and institutions ty picall y include their directory information notice with their required annual notification of rights to parents and eligible students. The model annual notification of rights that is discussed under number 3 (Consideration of Improved Information Technology ) includes a notation that the agency

or institution may

want to includ e its directory information public notice, as required b y § 99.37 of the regulations, with its annual notification of rights under FERPA.
This discussion about § 99.37 was not included in the Paperwork Reduction Act portion of the 2011 NPRM, however a discussion was included in our Supplemental Statement to OMB about this matter. W e noted that , since publication of the NPRM, it has been determined that § 99.37(d) also has an information collection associated with it. As a result, details about this inf ormation collection are included in this information collection and included in the final regulations. Section 99.37(d) requires an y educational agency or institution that elects to implement a limited directory information policy

to specify

its policy in the public notice to parents and eligible students in attendance at the educational agency or institution. Itis our opinion that this requirement will not result in an additional burden for most educational agencies and institutions because educational agencies and institutions are alread y required under § 99.37 (a) to provide public notice of its directory information policy. However, the change reflected in amended § 99.37(d) could result in a burden increase for an educational agency or institution th at currentl y has a policy of disclosing all directory information and elects, under the new regulations, to limit the disclosure of directory information. The agency or institution would now be required to inform parents and eligible students that it has a limited directory

information policy . The notice provides parents and eligible students with the opportunity

to opt out of the disclosure of directory information. (An educational agency or institution may

decide how to handle any opt outs, depending o n individual circumstances of the school community .) Additionally , man y educational agencies and institutions include their directory

information notice as part of the required annual notification of rights under § 99.7 , which is alread y listed as a burde n and approved under OMB Control Number 1875

– 0246. These educational agencies and institutions, therefore, would not experience an increase in burden associated with the changes reflected in § 99.37(d)

. Although no changes were proposed to § 99.7, which r equires that educational agencies and institutions annually

notify parents and eligible students of their rights under FERPA, some modifications were made to our model notification associated with this requirement. Specificall y, to allow parents and elig ible students to more fully understand the circumstances under which disclosures may occur without their consent, we have amended the model annual notifications to include a listing of the various exceptions to the general consent rule in the regulations. The model notices (one for elementary and secondary schools and another one for postsecondary institutions) are included as Appendix B and Appendix C with this information collection as well as with the final regulation s
. The model4

notifications are post ed on our Web site at the following site address: http://www2.ed.gov/policy /gen/guid/fpco/index.html . (A copy of the model notifications are enclosed as an appendix.) Itis our opinion that this addition to the model notification does not increases the currently approved burden of .25 hours (15 minutes) previously estimated for the annual notification of rights requirement.
The 2011 final regulations amend ed the enforcement provis ions (§§ 99.60

- 67) to clearl y set forth the Department’s authority to investigate and enforce alleged violations of FERPA by State and local educational authorities or an y other recipients of Department funds under a program administered b y the Secretary

. It is our belief that this does not constitute a change or increase in burden because the change just clarifies the Department’s authority to enforce applicable FERPA requirements with all recipients of Department funds.
The 2011 final regulations add ed a new requirement under § 99.35(a)(3) that requires that the agency headed b y an official listed in § 99.31(a)(3) to use a written agreement to designate any authorized representative other than an agency employ ee. The written agreement must: (1) designa te the individual or entity as an authorized representative; (2) specify the information to be disclosed and the purpose for which the information is disclosed to the authorized representative (i.e., to carry out an audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs); (3) require the authorized representative to destroy or return to the State or local educational authority or agency

heade d by

an official listed in § 99.31(a)(3) personally identifiable information from education records when the information is no longer needed for the purpose specified; (4) specify the time period in which the information must be returned or destro yed; and (5) establish policies and procedures to protect personally identifiable information from education records from further disclosure (except back to the disclosing entit y) and unauthorized use, included limiting use of information by

onl y those authorized r epresentatives of the entity with legitimate interested. The burden for States is estimated at 40 hours annuall y for each educational authority (one for K

- 12 and one for postsecondary). This 40 hours of burden was reached b y estimating that 103 State auth orities (including both K

- 12 and postsecondary authorities) may handle the agreements up to 10 times per y ear with an estimated time of 4 hours per agreement. This would be an increase in burden of 4,120 burden hours.
In the 2011 final regulations, a burd en estimate of 4 hours annuall y was added for large school districts or local educational agencies ( LEAs ) and postsecondary institutions (1,452 educational agencies and institutions with a student population of over 10,000)

. Assuming each large LEA and po stsecondary institution handles the agreements up to 1 time per y ear with an estimated 4 hours per agreement, the total anticipated increase in annual burden for large LEAs and postsecondary institutions would be 5,808 hours for this requirement. Therefor e, the total estimated burden for this provision is 9,928 hours. Note : For purposes of the burden anal ys is for §99.35(a)(3), the burden on large LEAs and postsecondary institutions was estimated because we believe that estimating burden for these institutions captures the high

- end of the burden estimate. The burden for smaller LEAs and postsecondary

institutions under §99.35(a)(3) is expected to be much less than estimated here.5

This is an extension of a previously approved information collection requ est.
**2. Purpose of Use of Information Collected.**  Educational agencies and institutions, such as school districts and postsecondary institutions are required to annually

notify parents and students of their rights under FERPA. A school is not required to no tify

parents and students individually , but rather is required to provide the notice by any means that are reasonabl y likel y to inform them of their rights under FERPA. These means could include publication in the school activities calendar, newsletter, s chool website, student handbook, or a combination of these methods. In addition, educational agencies and institutions must keep a record of each request for access to and each disclosure of personall y identifiable information from the education records of each student. FERPA includes several exceptions to the recordation requirement. The recordation requirement does not apply to requests from or disclosures to: (1) the parent or eligible student; (2) a school official with legitimate educational inter est; (3) a part y with written consent from the parent or eligible student; (4) a part y s eeking directory information; or (5) a part y seeking or receiving the records as directed b y a Federal gran d jury or other law enforcement subpoena and the issuing cour t or agency

has ordered that the existence or contents of the subpoena or the information furnished in response not be disclosed. FERPA requires that educational agencies and institutions

– ty picall y schools, school districts, and postsecondary institut ions

– also record the names of additional parties , if an y, to which the receiving party may make further disclos ures of the information on behalf of the educational agency

or institution. The 2008 changes to the FERPA regulations require that State and l ocal educational authorities and Federal officials and agencies that receive personall y identifiable information from students’ education records

– such as a State department of education

– record an y further disclosures of the information they make if the disclosing school did not record the further disclosures , or if the information was received from another education authority or Federal official or agency listed in § 99.31(a)(3) of the FERPA regulations.
As a result of the 2008 changes to the recordati on requirements in the regulations, educational agencies and institutions must also maintain a listing in students’ records of the State and local educational authorities and Federal officials and agencies that may make further disclosures of the students’ education records on behalf of the agency or institution so that parents and eligible students will be made aware of these further disclosures. This requirement would onl y apply in those cases where educational agencies and institutions have disclos ed pe rsonally identifiable information from education records to any of these authorities listed in § 99.31(a)(3) of the FERPA regulations. Under this exception to FERPA’s general rule of consent, educational agencies and institutions are permitted to disclose education records to these particular officials and authorities for audit, evaluation, or compliance or enforcement activities, under the conditions of § 99.35 of the regulations. The information collection requirements are necessary to carry out the pur

pose of FERPA

.6

Further, the FERPA re gulations re quire an educational agency or institution to enter into a written agreement with an organization conducting studies, for or on its behalf, for purposes of testing, student aid, and improvement of instructio n. The written agreement requirement only applies if the educational agency or institution opts to disclose personally identifiable information from student’s education records under this exception to the general consent requirement of FERPA. The agreeme nt must: (1) designate the individual or entity as an authorized representative; (2) specify the PII from education records to be disclosed; (3) specify that the purpose for which the PII from education records is disclosed to the authorized representativ e is to carry out an audit or evaluation of Federal

- or State

- supported education programs, or to enforce or to compl y with Federal legal requirements that relate to those programs; (4) describe the activity to make clear that it legitimately fits within the exception of §99.31; (5) require the authorized representative to destro y P II from education records when the information is no longer needed for the purpose specified; (6) specify the time period in which the PII from education records must be destroy e d; and (7) establish policies and procedures, consistent with FERPA and other Federal and State confidentialit y and privacy

provisions, to protect PII from education records from further disclosure (except back to the disclosing entity ) and unauthorized us e. The information collection requirements are necessary

to carry out the purpose s of FERPA

. **3. Consideration of Improved Information Technology.**  The advancement of and more common use of computer sy stems have dramatically reduced the burden of graphicall y producing the notification of rights required under the FERPA since it was enacted in 1974. Electronic s ys tems also enable schools to more easil y create and maintain disclosure information for the mandatory recordation requirements.
The Famil y Policy Compliance Office (FPCO), which administers FERPA, makes available to school officials a model notification that can be adapted b y schools. The models are posted on the Department’s Web site

-- http://www.ed.gov/policy /gen/guid/fpco/ferpa/lea

officials.html and http://www.ed.gov/policy /g en/guid/fpco/ferpa/ps

- officials.html

. FPCO routinely responds to telephone and email inquiries from school officials ( elementary

/secondary

as well as postsecondary ), providing them with technical assistance on FERPA

. The technical assistance often includes information on where to locate and download the model notif ications. In addition, FPCO annually notifies school districts of their obligations under FERPA, as required b y the Elementary and Secondary

Education Act (ESEA) . The annual notice includes a cop y of the model FERPA notification and information on where to locate and download the model. This greatly reduces the burden on schools of having to write the required notification. Other than the use of computers to reduce the burden of writing agreements, there is no specific technology

that would reduce the b urden of written agreements . However, FPCO will provide technical assistance and guidance to those educational agencies and institutions that request assistance.
**4. Efforts to Identify Duplication.** 7

The provisions do not duplicate an y other Federal requirem ents. No other agency has this information.
**5. Burden Minimization as Applied to Small Businesses.**  These regulations are consistent with the Administration’s regulatory principles to minimize burden on small entities.
**6. Consequences of Less Frequent Data Col**  **lection.** Should these collections of information under FERPA be conducted less frequently , the requirements of the Act would not be carried out.
**7. Special Circumstances Governing Data Collection.**  These information collection requirements are consistent wi th the guidelines in 5 CFR 1320.5(d)(2).
**8. Consultation**  **O utside**  **the Agency.** The Department inform ed the public of these information collection activities through th e NPRM for FERPA which published on April 8, 2011 (Vol. 76 , No. 68 , page 19726 ) and provided the comment period for th is information collection activity

. The information collection w as submitted to OMB as soon as the NPRM was published. Although some changes have been made to the final regulations, no public comments on information collection r equirements were received as a result of the April 8, 2011 , NPRM. For the previous NPRM, t he Department informed the public through a 60

- day and a 30

- day notice that the NPRM for FERPA was published on March 24, 2008. The NPRM (Vol. 73, No. 57, page 15574 ) did not provide a comment period for the information collection activity . However, the 60

- day notice provided and the 30

- day notice provide d the appropriate comment period for the information collection activity

. Prior to this time, t he public had the opportunity to comment on the proposed changes in the collection of information under FERPA during the publication of an NPRM in the March 14, 1996, Federal Register. See 61 Fed. Reg. 10664 (March 14, 1996). One of the proposed changes (which was adopted ) was to remove the previous requirement that educational agencies and institutions have a student records “policy ” pursuant to § 99.6 of the regulations and to transfer some of the policy requirements to the notification requirement of § 99.7 of the regu lations. As explained in the final regulations

– 61 Fed. Reg. 59292 (November 21, 1996)

– the purposes in removing the requirement that schools maintain a policy were: (1) the change will help to ensure that parents and eligible students receive more eff ective notification of their rights under the law; and (2) the change will afford schools greater flexibility by removing requirements that are not statutory and not necessary

to implement the law.8

Seven commenters submitted letters in support of the prop osal to remove the regulatory requirement that schools adopt student records policies. One commenter said that the change will not only

lessen the burden on schools, but would facilitate communication between the schools and parents or eligible students. The same commenter also said that the cost associated with the change would not be significant because his school district updates its notices regardless of statutory requirements. Another commenter representing a large public university stated that the “flexibility offered by

not requiring having such a [student records] policy is a laudable goal.” Six commenters opposed the change. One commenter stated that the current requirements are not burdensome. Two noted that the policy is helpful in educating school officials about FERPA, and that the change in requirements would be burdensome on schools because they would incur costs to publish a longer notification. After consideration of the last comment, the Department removed some of the information that was proposed to be included in the notification as not necessary to meet the statutory requirement. ( See discussion at 61 Fed. Reg. 59293, first column.) At the time of these final regulations, FPCO made a hard cop y model notification available to schoo ls. Both model notifications (one for elementary /secondary

schools and one for postsecondary institutions) were published in the Federal Register. ( See 61 Fed. Reg. 59297

– 59298.) Since that time, we have included the models on our Web site.
The othe r change in 1996 involving the collection of information under FERPA was a change to the recordation requirements of § 99.32. The change resulted in the addition of the fifth exception to the requirement. Specificall y, schools are not required to record disclosure of information resulting from certain t ypes of subpoenas and court orders issued for law enforcement purposes. This change reduced the recordkeeping burden for these types of disclosures. No comments were received on this change. Regulations from 1996 until 2008 did not involve any changes in the collection of information under FERPA

. However, in 2008, additional information collection requirements were added to FERPA. While no specific consultation with school officials
occur red, they had the o pportunity

to comment on the new requirements at the time of the 2008 NPRM. Educational agencies and institutions did not independently expressed concern over costs or burden because of these requirements. FPCO sought way s to minimize burden of thes e requirements, such as making model notices easil y available to school officials.
As a result of the March 28, 2008, NPRM, the Department did receive comments on some of the information collection activities. In the NPRM, we specifically noted that the Department was interested in relieving an y administrative burdens associated with recording disclosures of education records and, therefore, invited public comments on whether a State educational agency

(SEA) , the Department, or other authorit y or official listed in § 99.31(a ) ( 3) should be allowed to maintain the record of the redisclosures it makes on behalf of an educational agency

or institution under § 99.32.
Several commenter’s , including officials representing State departments of education, stated that an SEA (or other authority or official listed in § 99.31(a ) ( 3)) should be responsible for maintaining the record of disclosure required under § 99.32 when it rediscloses information on behalf of educational agencies and institutions. The commenter’s stated that requiring9

each educational agency

or institution, such as school districts, to record each redisclosure made b y an SEA or other State educational authority on its behalf imposes an unacceptable recordkeeping burden on school districts and is i mpractical for State educational authorities to adhere to in making further disclosures on behalf of the agency or institution. I n response to these comments, we revis ed § 99.32 to require the State and local educational authorities and Federal officials listed in § 99.31(a)(3) to maintain the record of further disclosures if the educational agency

or institution does not do so and make it available to the educational agency or institution upon request. We agree that by requiring State and Federal authori ties and officials to record their redisclosures in these circumstances school districts will have less total paperwork burden because schools will not have to comply with the recordkeeping requirement in these instances. The Department also received comm ents from a number of parties express ing support and appreciation for the explicit requirement for a written agreement whenever an educational agency or institution discloses personall y identifiable information from education records to organizations condu cting certain studies under § 99.31(a)(6). A national association of school boards pointed out that, while this change created another paperwork burden for school districts, the group did not object to the written agreement requirement because putting in writing the requirements regarding the use and destruction of data may improve compliance with FERPA. This commenter also recommended that the use and destruction of data should be made clear in this new provision

. A national association representing pos tsecondary

officials commented that, among other things, we should restrict access to personall y identifiable information within the organization conducting the study to those individuals with a legitimate interest in the information. We received other co mments that indicated a need to further clarify the specific t yp es of information that must be contained in the written agreement between an educational agency and institution and an organization conducting a study

for the agency

or institution , and we inc luded these clarifications in the final regulations

. A 60 day and 30 day

notice will be published in the Federal Register for public comment.
**9. Payments or Gifts to Respondents.**  The information collection’s respondents will not receive any pay ment or g ift for submitting any information related to FERPA.

**10. Assurance of Confidentiality.**  FERPA requires that educational agencies and institutions protect the privacy of student’s education records, including the privacy of the record of request for the stude nt’s education records. As the respondents of the information collection requirements, school officials do not need assurance of confidentiality because the requirements are intended to advance the privacy rights of parents and eligible students (a studen t who has reach 18 years of age or is attending a postsecondary institution at any

age).10

**11. Questions of Sensitive Nature.**  The Act does not address nor call for questions of a sensitive nature.
**12. Annual Hour Burden for Respondents/**  **Record keepers**
**FERPA’s An nual Notification of Rights Requirement (34 CFR § 99.7)**  There are approximately

20,629 school districts and postsecondary institutions affected by the annual notification of rights requirement in FERPA (34 CFR § 99.7)

. We estimate that an average of .25 h ours (15 minutes) per response is required for the annual notification of rights requirement. From administrative experience, we have determined that, at the elementary

/secondary

level, school districts (as opposed to individual schools) are the entities that ty picall y issue the annual notification of FERPA rights. At the postsecondary level, it is the individual institutions that issue the notice. Following is a breakdown of school districts and postsecondary

institutions: No. School Districts: 14,166 Burden Hours: x .25
Total Burden Hours = 3,54 2
No. Postsec. Inst.: 6,463 Burden Hours: x .25 Total Burden Hours = 1,616
School District Burden Hours: 3,542 Postsec . Inst. Burden Hours: + 1,616 Grand Total Burden Hours: 5,15 8 Since most agencies and institutions met major requirements during the early ye ars after FERPA’s passage in 1974 and after publication of the revised regulations in 1988, the ye ar - to

- ye ar cost is minima l. **FERPA’s Written Agreement Requirement (34 CFR § 99.31(a)(6)(ii)(C)(1)**

**- (4))**  20 U.S.C. § 1232g(b)(1)(F) permits the nonconsensual disclosure of personally identifiable information from students’ education records to organizations conducting studies “fo r, or on behalf of” an educational agency or institution for specified purposes . A change to the FERPA regulations in 2008 requires that , if an educational agency or institution discloses personall y identifiable information under this exception to consent , it must enter into a written agreement with the organization that is conducting the stud y (34 CFR § 99.31(a)(6)(ii)(C)(1)

- (4)).11

The regulations in § 99.31(a)(6)(ii)(C) require an educational agency or institution to enter into a written agreement befo re disclosing personally identifiable information from education records, without consent, to organizations conducting studies for, or on behalf of, the educational agency

or institution to: (a) develop, validate, or administer predictive tests; (b) admini ster student aid programs; or (c) improve instruction. The written agreement must specify the purpose or purposes, scope, and duration of the study or studies and the information to be disclosed, require the organization to conduct the study in a manner that does not permit personal identification of parents and students by any one other than representatives of the organization with legitimate interests, require the destruction or return of the information to the educational agency or institution when the s tudy is completed, and specify the time period for destruction or return of the information.
As discussed with OMB, the Department does not have an y information on how many educational agencies and institutions actually disclose information to organizatio ns under this exception. Therefore, we are unable to estimate the additional burden, if any , for the new requirements in § 99.31(a)(6)(ii)(C). However, it is our opinion that any additional burden of entering into written agreements to comply with this c hange is unlikely to be significant because most educational agencies and institutions alread y specify the terms under which personall y identifiable information can be used when it is disclosed to organizations for these ty pes of studies. Although this ch ange will create an additional information collection requirement, the Department believe s the benefits of the written agreement outweigh an y additional burden because it will ensure better compliance with FERPA and provide clarit y for both researchers and educational agencies and institutions about the restrictions and use of personall y identifiable information disclosed under § 99.31(a)(6) for studies.
The 2011 final regulations modif ied this provision to permit a State or local educational authority or Federal agencies and officials listed in § 99.31(a)(3) to enter into these written agreements with organizations conducting studies for, or on behalf of, educational agencies and institutions. The Department does not believe this constitutes a change or an increase in burden because there is no evidence that this would be considered a burden. Additionally , we only anticipate that State educational authorities (and not the other officials listed in § 99.31(a)(3)) will enter into these agreements on be half of the schools under their jurisdictions. Also as noted above, it is our opinion that the benefits of the written agreement outweigh an y additional burden because it will ensure better compliance with FERPA . I t will also provide clarif

ication for both organizations conducting studies and educational agencies about the restrictions and use of personally identifiable information disclosed under this exception to FERPA consent requirement. **FERPA’s Recordkeeping Requirement (34 CFR § 99.32)** In 2010, w e informally

contacted eight school officials

– three officials at elementary

/secondary

school districts , one official at an elementary school , and four officials at postsecondary

institutions

– to find out about their individual recordkeeping practices

. M ost of the schools we contacted use d a paper - based sy stem for recordkeeping, while some of the postsecondary

institutions use d both paper

- based and electronic. From our informal review, it was clear that recordkeeping is done at the individual school (as opposed to the12

school district at the elementary /secondary

level) and the individual postsecondary institution. As a result, it was estimate d that an average of .0833 hours (5 minutes) per disclosure is required for the recordkeeping requirement. The ave rage number of disclosures of individual student records per ye ar was based on responses from the eight school officials. (Based on the t ype and size of the school, the number of releases varies .)
It was not clear that schools recognize that FERPA requ ires that they record disclosures made of personally

identifiable information from students’ education records to State authorities , such as when a school discloses personally identifiable information on all students in attendance to a State education department on the elementary /secondary

level or to the State postsecondary educational authorit y on the college level. Without more information on the practices of schools in this regard, it is difficult to accurately estimate the specific burden hours for th is recordkeeping requirement

. However, w e assume d that many of these schools, especially at the postsecondary

level and more urban school districts , utilize computerized methods to record disclosures , which would make it less burdensome to record disclos ures for large numbers of students. Where there are large numbers of disclosures and no computerized method is used to indicate that a disclosure occurred, FPCO has advised schools that they may utilize a single notice about the mass disclosure. When a p arent or student requests access to his or her record of disclosure, the school may provide the notice with the information concerning the disclosure to the parent or student a t the time of the request , thereb y minimizing the burden on the school

. However , because these recordations are not exempt from FERPA’s recordkeeping requirement, we have included an estimate for the burden of recording disclosures of all students in attendance to State authorities. We estimate that schools must share this informati on with State officials twice a ye ar and estimate that it would take schools 1 hour to either make the recording via their computer s ys tem or develop a notation and make it available to parents or students asking to inspect this record. As explained elsew here, it is our administrative experience that few parents and students request to see this record.
The 2011 NPRM propose d a definition of the term “authorized representative” to § 99.3 which would permit the officials listed in § 99.31(a)(3) (a Stat e or local educational authority , the Secretary , the Comptroller General of the United States, or the Attorney General of the United States) to designate an y entity or individual to carry

out any audit, evaluation, or the enforcement of, or compliance with , Federal legal requirements related to Federal or State supported education programs. It is our opinion that this does not constitute a change or an increase in burden because these entities are alread y required to record disclosures, pursuant to § 99.32( b)(2), as described in this section.

F or the general recordkeeping requirement of § 99.32(a) for recordation of individual disclosures , f

ollowing is a breakdown of individual schools (public elementary , secondary , or combined) and postsecondary institutio ns:
No. of Schools: 97,382 Average No. of Disclosures: x 192 # Of Responses 18,697,34413 Hours /Response : x .0833
Burden Hours 1,557,489

No. of Postsec. Inst.: 6,463 Aver age No. of Disclosures: x 192 # of Responses 1,240,896
Hours /Response : x .0833
Burden Hours 103,367

Elementary

/Secondary

S chool Burden Hours: 1,557,489 Postsec. I nst. Burden Hours: + 103,36 7 Total Burden Hours for recordation of individual disclosures : 1,660,85 6

For the recordkeeping requirement for disclosures of all students in attendance to State educational authorities, following is a breakdown of individual schools (public elementary , secondary , or combined) and postsecondary institutions:
No. of Schools: 97,382 Average No. of Disclosures: x 2 # of Responses 194,764 Hours/Response: x 1
Burden Hours 194 ,764

No. of Postsec. Inst.: 6,463 Average No. of Disclosures: x 2 # of Responses 12,926 Hours/Response: x 1
Burden Hours 12,926

Elementary

/Secondary

School Burden Hour s: 194.764 Postsec. I nst. Burden Hours: + 12,926 Total Burden Hours for recordation14 of disclosures of all students : 207,690

**Total Burden Hours for recordation**

**of individual disclosures: 1,660,856** 
**Total Burde n Hours for recordation** 

**of disclosures of all students: 207,690** 
**Total Burden Hours for Recordation 1,868,546**  The number of school districts and the number of postsecondary institutions subject to FERPA is based on the number of public school districts and the number of Title I V postsecondary

institutions, as reported in the National Center for Education Statistics’ (NCES’) Digest of Education Statistics. See htt p://nces.ed.gov/programs/digest/d07/tables/dt07_005.asp . The number of affected schools reported to OMB in previous y ears was higher, but we believe this number that is based on NCES’ count is more accurate. **§ 99.32(a)(1)**

**–** In 2008, the regulations wer e amended ( § 99.32(a)(1) ) to require educational agencies and institutions to maintain a listing in each student’s records of the State and local educational authorities and Federal officials and agencies that may make further disclosures of the student’s education records on behalf of the agency or institution without consent. This only applies when the school discloses personall y identifiable information to one of these parties. Because schools are already required to record their disclosures to a State and Federal authorit ies under § 99.32(a), we do not believe that this new requirement will impose any
new burden

. **§ 99.32(a)(4)**

**–** The 2008 final regulations also added § 99.32(a)(4) to require that, upon the request of a parent or eligible student, an educational agency or institution must obtain a copy of the record of further redisclosures described under § 99.32(b)(2) and make it available for review to the parent or eligible student.
State educational authorities and Federal officials and agencies that maintain records of redisclosures will have to make that information available to the educational agency or institution whose records were redisclosed, upon request, so that the agency or institution can make that record available to a parent or elig ible student who has asked to inspect and review the student’s record of disclosures. Our estimate is that two educational authorities or agencies in each State and the District of Columbia (one for K

- 12 and one for postsecondary ) and the Department itsel f, for a total of 103 authorities, will maintain the required records of redisclosures. It is also estimate d that it will take .25 hours (15 minutes)15

per disclosure t o locate and print a record of disclosures for this requirement. Based on our administr ative experience over the ye ars, we assume that few parents and students request this information and, therefore, use an estimate that one tenth of one percent of a total of 68.1 million students will make such a request each y ear, or 68,076 requests. Thi s translates to an average of 3 disclosures per school. ( We d ivide d total number of schools by total number of requests.) The total number of disclosures b y State and Federal educational authorities will be the same as that calculated for schools.
No. of Schools & Postsec. Inst.: 20,629 Average No. of Disclosures : x 3 # of Responses 61,887 Hours/Response: x .25
Burden Hours 15,472 Average No. of Disclosures by State & Fed. Ed. Authorities: 61,887
Hour s/Response: x .25
Burden Hours 15,472

School Burden Hours: 15,472 State & Fed. Burden Hours: + 15,472 **Total Burden Hours 30,944** 

**§ 99.32(a)(5)**

**–** The 2008 f

inal regulations added a new section (§ 99.32(a)(5)) that r equires that a school that discloses information under the health and safety emergency

exception in § 99.36 record the p articul ar and significant threat that formed the basis for the disclosure and the parties to whom the education records were disclosed. Because § 99.32(a) alread y requires schools to record disclosures made under §99.36, including the legitimate interests the parties had in requesting or obtaining the information, we believe these changes will not create an y significant additional adminis trative costs for schools and that the benefit of requiring recordation of this information outweighs the costs. This new requirement in § 99.32(a)(5) simply clarifies the ty

pe of information that must be recorded when a school discloses personall y identi fiable information in response to a health or safety emergency , either for one student or for all students in a school. We do not believe that the new requirement modifies the burden reported under § 99.32.16

**§ 99.32(b)(2)**

**–** The 2008 f

inal regulations a dded a requirement (§ 99.32(b)(2)) that State and local educational authorities and Federal officials listed in § 99.31(a)(3) maintain a record of further disclosures these parties may

make of personall y identifiable information from education records if the educational agency

or institution does not do so. While the Department did not officially seek comments on any

information collection activities in the March 28, 2008, NPRM, we did receive comments on some of these activities. In the NPRM, we specific ally noted that the Department was interested in relieving an y administrative burdens associated with recording disclosures of education records and, therefore, invited public comments on whether a State educational agency (SEA), the Department, or other a uthorit y or official listed in § 99.31(a)(3) should be allowed to maintain the record of the redisclosures it makes on behalf of an educational agency or institution under § 99.32.
Several commenters , including officials representing State departments of education, stated that an SEA (or other authority or official listed in § 99.31(a)(3)) should be responsible for maintaining the record of disclosure required under § 99.32 when it rediscloses information on behalf of educational agencies and institutions. The commenter’s stated that requiring each educational agency

or institution, such as school districts, to record each redisclosure made b y an SEA or other State educational authority on its behalf imposes an unacceptable recordkeeping burden on school d istricts and is impractical for State educational authorities to adhere to in making further disclosures on behalf of the agency or institution. In response to these comments, we revised § 99.32 to require the State and local educational authorities and Federal officials listed in § 99.31(a)(3) to maintain the record of further disclosures if the educational agency or institution does not do so and make it available to the educational agency

or institution upon request. We agree that by requiring State and Federal authorities and officials to record their redisclosures in these circumstances school districts will have less total paperwork burden because schools will not have to comply with the recordkeeping requirement in these instances.
State educat ional authorities and Federal officials listed in § 99.31(a)(3) will incur new information collection burdens if they maintain the record of redisclosure for the educational agency or institution on whose behalf they redisclose education records under the regulations. We estimate that two educational authorities or agencies in each State and the District of Columbia (one for K

- 12 and one for postsecondary ) and the Department itself, for a total of 103 authorities, will maintain the required records of redi sclosures. (We anticipate that educational agencies and institutions will record under § 99.32(b)(1) any further disclosures made by the other Federal officials listed in § 99.31(a)(3), the U.S. Comptroller General and the U.S. Attorney General, as is cur

rentl y required for redisclosures made b y other parties on behalf of the educational agency

or institution. See 34 CFR § 99.32(b)(1).) We estimate further that these authorities will need to record two redisclosures per y ear from their records. We estim ate that an average of .0833 hours (5 minutes) per disclosure is required for this new recordkeeping requirement. We also assume for purposes of this anal ys is that State educational authorities and the Department alread y have software that will allow them to record these disclosures electronically

.17

No. of St. & Fed. Edu. Authorities: 103 Average No. of Disclosures: x 2 # of Responses 206 Hours/Response: x .0833
Burden Hours 17 **§ 99.35(a)(3 )** 
The 2011 final regulation s add ed a new requirement under § 99.35(a)(3) that requires an agency headed b y an official listed in § 99.31(a)(3) to use a written agreement to designate any authorized representative other than an agency employ ee. The written agreement must: (1) designate the indiv idual or entity as an authorized representative; (2) specify the PII from education records to be disclosed; (3) specify that the purpose for which the PII from education records is disclosed to the authorized representative is to carry out an audit or eva luation of Federal

- or State

- supported education programs, or to enforce or to compl y with Federal legal requirements that relate to those programs; (4) describe the activity to make clear that it legitimatel y fits within the exception of §99.31; (5) requi re the authorized representative to destroy PII from education records when the information is no longer needed for the purpose specified; (6) specify

the time period in which the PII from education records must be destroy ed; and (7) establish policies and procedures, consistent with FERPA and other Federal and State confidentiality

and privacy

provisions, to protect PII from education records from further disclosure (except back to the disclosing entit y) and unauthorized use. We estimate that the burden f or States is estimated at 40 hours annually for each educational authority (one for K

- 12 and one for postsecondary ). This 40 hours of burden was reached by estimating that 103 State authorities may

handle the agreements up to 10 times per y ear with an esti mated time of 4 hours per agreement. Total anticipated increase in annual burden would be 4,120 hours for this new requirement. In addition, the burden for large LEAs and postsecondary institutions (1,452 educational agencies and institutions with a stud ent population of over 10,000) is estimated to be 4 hours annually . Assuming each large LEA and postsecondary institution handles the agreements up to 1 time per y ear with an estimated 4 hours per agreement, the total anticipated increase in annual burden for large LEAs and postsecondary institutions would be 5,808 hours for this requirement. The total estimated burden under this provision is 9,928 hours.
No. of St. & Fed. Edu. Authorities: 103 Average No. of Disclosures: x 10 # of Responses 1,030 Hours/Response: x 4__
Burden Hours 4,12018

No. of Large LEAs & Post. I nst : 1,452 Average No. of Disclosures: x 1 # of Responses 1,452 Hours/Response: x 4_
Burden Hours 5,808

State & Fed. Burden Hours: 4,120 School Burden Hours: 5,808 Total Burden Hours for Written Agreements: 9,928

**GRAND TOTAL Total Number of Respondents:**  **10 5,399**  **Total Number of Respo nses:**  **20,29 3,021**  **Total Number of Burden Hours: 1,9**  **14,593**

This is a list of the regulatory requirements which is provided with more detailed d escription (above) in the Supporting Statement, A12

. Each requirement lists the burden for schools, insti tutions , and/or state or local education authorities with the number of responses and total burden hours.

Remove IC Title Status Responses Hours Dollars Document Type Form No. Form Name

Annual Notification of Rights Requirement (Section 99.7) for School Districts No Change 14166 3542 0 Other Regulatory Requirement

Annual Notification of Rights Requirement (Section 99.7) for Postsecondary Institutions No Change 6463 1616 0 Other Regulatory Requirement

FERPA Recordkeeping Requirement (99.32) for schools No Change 18697344 1557489 0 Other Regulatory Requirement

FERPA Recordkeeping Requirement (Section 99.32) for Postsecondary Institutions No Change 1240896 103367 0 Other Regulatory Requirement19 FERPA Section 99.32 Recordkeeping Requirement for Disclosures (Schools) No Change 194764 194764 0 Other Regulatory Requirement

FERPA Section 99.32 Recordkeeping Requirement for Disclosures (Postsecondary Institutions) No Change 12926 12926 0 Other Regulatory Requirement

FERPA Section 99.32(a)(4) Regulatory Requirement for Schools and Postsecondary Institutions No Change 61887 15472 0 Other Regulatory Requirement

FERPA Section 99.32(a)(4) for State Education Authorities No Change 61887 15472 0 Other Regulatory Requirement

FERPA Section 99.32(b)(2) for State Education Authorities No Change 206 17 0 Other Regulatory Requirement

FERPA Section 99.35 ( a) (3) For State E ducational Authorities New 1030 4120 0 Ot her Regulatory Requirement

FERPA Section 99.35 ( a) (3) For large LE A s and postsecondary institution Authorities

New

1452 5808 0 Other Regulatory Requirement

Total responses under this IC R: 20,293,021 Total b urden h ours under this I CR : 1,914,593

**13. Annual Cost Burden to Respondents**  The total for the capital and start

- up cost components of both information collection requirements is zero. The information collection requirement s under FERPA do not require the purchase of an y capital equipment nor create any start

- up costs. Computers and word processing software used to complete this information collection are part of the respondents’ customary

and usual business or private prac tices, and therefore are not included. The total for operation and maintenance for this information collection is zero. The information collection does not create costs associated with generating, maintaining, and disclosing or providing the information that is not alread y identified in question 12 of this supporting statement.
**14. Estimated Annual Cost to the Federal Government.** 20

No measurable percentage of staff time is devoted to assisting educational agencies and institutions in either of these informatio n collection requirements. With regard to the annual notification requirement, as explained in the response to question 3, the Department posts model notifications (one for elementary /secondary and one for postsecondary ) on its website. The model can be downloaded and easily be adapted by

schools for use. With regard to the recordkeeping requirements, staff routinely provides technical assistance on other aspects of the law, but the recordkeeping requirements have become routine with schools and appear t o not be an issue of concern.
**15. Reasons for Changes to Burden Hours Estimated**  This is an extension of a previously approved information collection request. There are no changes in burden and responses. **16. Collection of Information with Public Results.**  The results of the collection of information will not be published.
**17. Approval to Not Display Expiration Date.**  ED is not seeking this approval.
**18. Exception to the Certification Statement.**  ED is not requesting an y exceptions to the “Certification for Pa perwork Reduction Act Submissions.”