I 
114TH CONGRESS 
1ST SESSION H. R. 3157 
To amend the General Education Provisions Act to strengthen privacy 
protections for students and parents. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 22, 2015 
Mr. ROKITA (for himself, Ms. FUDGE, Mr. KLINE, and Mr. SCOTT of Virginia) 
introduced the following bill; which was referred to the Committee on 
Education and the Workforce 
A BILL 
To amend the General Education Provisions Act to 
strengthen privacy protections for students and parents. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Student Privacy Pro-
tection Act’’. 
SEC. 2. REFERENCES. 
Except as otherwise expressly provided, whenever in 
this Act an amendment or repeal is expressed in terms 
of an amendment to, or repeal of, a subsection or other 
provision, the reference shall be considered to be made to 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
a subsection or other provision of section 444 of the Gen-
eral Education Provisions Act (20 U.S.C. 1232g) (com-
monly known as the ‘‘Family Educational Rights and Pri-
vacy Act of 1974’’). 
SEC. 3. FERPA SHORT TITLE. 
Subsection (a) (20 U.S.C. 1232g(a)) is amended to 
read as follows: 
‘‘(a) SHORT TITLE.—This section may be cited as the 
‘Family Educational Rights and Privacy Act of 1974’.’’. 
SEC. 4. REQUIREMENTS. 
Such section (20 U.S.C. 1232g) is amended by strik-
ing subsection (b), except for paragraph (1)(J), and in-
serting the following: 
‘‘(b) IN GENERAL.—No funds shall be made available 
under any applicable program to any educational agency 
or institution, or State educational authority, unless such 
agency or institution, or State educational authority, com-
plies with the following requirements: 
‘‘(1) PARENTAL ACCESS.— 
‘‘(A) EDUCATIONAL AGENCY OR INSTITU-
TION.—The educational agency or institution 
shall not deny or effectively prevent the parents 
of students who are or have been in attendance 
at a school of such agency or at such institu-
tion, as the case may be, the right to inspect 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
and review the education records of their chil-
dren. If any material or document in the edu-
cation record of a student includes information 
on more than one student, a parent shall have 
the right to inspect and review only such part 
of such material or document that relates to 
such parent’s child. 
‘‘(B) APPROPRIATE PROCEDURES.— 
‘‘(i) IN
GENERAL.—The State edu-
cational authority shall establish appro-
priate procedures for the granting of a re-
quest by parents for access to the edu-
cation records of their children who are or 
have been in attendance at any educational 
agency or institution under the jurisdiction 
of the State educational authority. 
‘‘(ii) REASONABLE RESPONSE TIME.— 
The educational agency or institution, or 
the State educational authority, shall es-
tablish appropriate procedures for the 
granting of a request by parents for access 
to the education records of their children 
within a reasonable period of time, but in 
no case more than 30 days after the re-
quest has been received. 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(2) RESTRICTIONS ON PARENT AND STUDENT 
ACCESS.— 
‘‘(A) 
RESTRICTIONS.—The 
educational 
agency or institution shall not make available to 
students enrolled in an institution of higher 
education the following: 
‘‘(i) Financial records of the parents 
of the student or any information con-
tained therein. 
‘‘(ii) Confidential letters and state-
ments of recommendation, which were 
placed in the education records prior to 
January 1, 1975, if such letters or state-
ments are not used for purposes other than 
those for which they were specifically in-
tended. 
‘‘(iii) If the student, while in high 
school at any age, has signed a waiver of 
the student’s right of access in accordance 
with subparagraph (B), confidential rec-
ommendations— 
‘‘(I) respecting admission to any 
educational agency or institution; 
‘‘(II) respecting an application 
for employment; and 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(III) respecting the receipt of 
an honor or honorary recognition. 
‘‘(B) WAIVER.— 
‘‘(i) IN
GENERAL.—A student or a 
person applying for admission may waive 
the right to access confidential statements 
described in subparagraph (A)(ii), except 
that such waiver shall apply to rec-
ommendations only if— 
‘‘(I) the student is, upon request, 
notified of the names of all persons 
making confidential recommendations; 
and 
‘‘(II) such recommendations are 
used solely for the purposes for which 
they were specifically intended. 
‘‘(ii) LIMITATIONS.—A waiver under 
this subparagraph may not be required as 
a condition for admission to, receipt of fi-
nancial aid from, or receipt of any other 
services or benefits from such agency or in-
stitution. 
‘‘(3) ADJUSTMENTS
TO
RECORD.—The edu-
cational agency or institution shall provide parents 
of students who are or have been in attendance at 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
a school of such agency or at such institution an op-
portunity to— 
‘‘(A) challenge and correct the content of 
the education record that the parent believes is 
inaccurate or misleading at the time of attend-
ance or otherwise in violation of privacy rights 
of students through a hearing by such agency 
or institution, in accordance with the regula-
tions of the Secretary; and 
‘‘(B) insert into such education records a 
written explanation of the parents respecting 
the content of such records. 
‘‘(4) DISCLOSURE OF RECORDS WITHOUT PA-
RENTAL
CONSENT.—Except as otherwise provided 
under subsection (c), the educational agency or insti-
tution shall not permit the disclosure of education 
records (or personally identifiable information con-
tained therein) of students without the written con-
sent of their parents to any individual, agency, or 
organization. 
‘‘(5) RECORDKEEPING.— 
‘‘(A) IN GENERAL.—The educational agen-
cy or institution shall maintain a record, kept 
with the education records of each student, in 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
an easy to retrieve and understandable format, 
which will indicate— 
‘‘(i) each individual, agency, or orga-
nization (other than an individual, agency, 
or organization specified under subsection 
(c)) that has obtained access to a student’s 
education record maintained by such edu-
cational agency or institution; and 
‘‘(ii) specifically the legitimate interest 
that each such individual, agency, or orga-
nization has in obtaining such information. 
‘‘(B) AVAILABILITY
OF
RECORDS.—Such 
record of access shall be available only to par-
ents, to the school officials and their assistants 
who are responsible for the custody of such 
record of access, and to the Secretary or the 
designee of the Secretary, as a means of moni-
toring compliance with this section. 
‘‘(C) WRITTEN
AGREEMENTS.—The edu-
cational agency or institution and the State 
educational authority shall maintain a copy of 
and make available to parents, upon request, 
any written agreements that are required under 
this section. 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(6) SECURITY
PRACTICES.—The educational 
agency or institution, and the State educational au-
thority shall— 
‘‘(A) establish, implement, and enforce 
policies and procedures regarding information 
security practices that— 
‘‘(i) serve to protect the education 
records (and personally identifiable infor-
mation contained therein) held or main-
tained by that educational agency or insti-
tution, or State educational authority; and 
‘‘(ii) require any party that is given 
access to such education records (or per-
sonally identifiable information contained 
therein) on behalf of the educational agen-
cy or institution, or State educational au-
thority, to have information security prac-
tices that serve to protect such records and 
information; 
‘‘(B) designate an official who shall be re-
sponsible for maintaining the security of its 
education records; and 
‘‘(C) establish a breach notification policy 
in the case of a breach of the security practices 
under subparagraph (A) or the release of the 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
education records or information contained 
therein in violation of this section, under which 
the educational agency or institution, or State 
educational authority— 
‘‘(i) provides notification of the breach 
or violation to parents in not less than 3 
days of being made aware of such breach; 
and 
‘‘(ii) works with the third parties in-
volved with such breach or violation to 
gather the information necessary to pro-
vide such notification. 
‘‘(7) DUTY TO INFORM.—The educational agen-
cy or institution shall effectively— 
‘‘(A) inform the parents of students, or the 
students (if such students are 18 years of age 
or older, or are attending an institution of high-
er education) of the rights accorded them by 
this section; and 
‘‘(B) inform students of high school age of 
the rights of parents and students under this 
section, and how those rights transfer from a 
parent to a student in accordance with para-
graph (8). 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(8) TRANSFER OF RIGHTS.—The educational 
agency or institution shall ensure that whenever a 
student has attained 18 years of age, or is attending 
an institution of higher education, the consent re-
quired of and the rights accorded to the parents of 
the student shall thereafter only be required of and 
accorded to the student. 
‘‘(9) ENSURING COMPLIANCE.—The State edu-
cational authority shall— 
‘‘(A) verify that each educational agency 
and institution under its jurisdiction— 
‘‘(i) has provided the appropriate no-
tices to parents and students required 
under this section in an easy-to-understand 
format; and 
‘‘(ii) is in compliance with the require-
ments of this section; and 
‘‘(B) certify to the Secretary that each 
educational agency and institution under its ju-
risdiction is in compliance with the require-
ments of this section.’’. 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
SEC. 5. DISCLOSURE OF RECORDS WITHOUT PARENTAL 
CONSENT. 
(a) IN GENERAL.—Such section (20 U.S.C. 1232g) 
is amended by striking subsection (c) and inserting the 
following: 
‘‘(c) DISCLOSURE OF RECORDS WITHOUT PARENTAL 
CONSENT.—Notwithstanding subsection (b)(4) and sub-
ject to subsection (h), an educational agency or institution 
may permit the disclosure of education records (or person-
ally identifiable information contained therein) of students 
without the written consent of their parents to, or for, any 
of the following: 
‘‘(1) Other school officials, including teachers, 
within the same educational agency or institution, 
who have been determined by such agency or institu-
tion to have legitimate educational interests, includ-
ing the educational interests of the child for whom 
consent would otherwise be required. 
‘‘(2) An education service provider, contractor, 
consultant, volunteer, or other party who has been 
determined by such educational agency or institution 
to have legitimate educational interests and to whom 
the educational agency or institution has outsourced 
institutional services or functions, provided that— 
‘‘(A) the party— 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(i) performs an institutional service 
or function for which the agency or institu-
tion would otherwise use employees; 
‘‘(ii) is under the direct control of the 
educational agency or institution with re-
spect to the use and maintenance of edu-
cation records; 
‘‘(iii) is in compliance with the re-
quirements of this section relating to the 
use and release of personally identifiable 
information contained in such education 
records; and 
‘‘(iv) has entered into a written agree-
ment with the educational agency or insti-
tution, subject to the regulations of the 
Secretary, that establishes requirements 
concerning the protection of the informa-
tion that will be disclosed to the party, in-
cluding— 
‘‘(I) clear provisions outlining 
how and what information from the 
education records shall be disclosed to 
the party and what personally identifi-
able information the party will create 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
in carrying out the party’s duties 
under the agreement; 
‘‘(II) a description of any subcon-
tractor or person acting for the party 
in carrying out its duties under the 
agreement; 
‘‘(III) requirements that prohibit 
the party from releasing personally 
identifiable information to any other 
party, except to a subcontractor or 
person acting for the party described 
in subclause (II); 
‘‘(IV) clear provisions— 
‘‘(aa) outlining policies and 
practices to ensure that edu-
cation records (including person-
ally identifiable information con-
tained therein) will be secured 
using commonly accepted indus-
try standards, by electronic or 
physical means by such party; 
and 
‘‘(bb) which stipulate that 
such means will secure such 
records and information from un-
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
authorized access and that such 
policies and practices will be fol-
lowed; 
‘‘(V) the penalties for a security 
breach in violation of the agreement; 
and 
‘‘(VI) provisions that specify the 
acceptable uses by such party of the 
personally identifiable information in 
compliance with this section; and 
‘‘(B) the educational agency or institu-
tion— 
‘‘(i) notifies parents and students of 
the policies and means the party uses, 
without disclosing the specific policies or 
means used, to protect the security of per-
sonally identifiable information maintained 
by the party; and 
‘‘(ii) ensures that— 
‘‘(I) any education records that 
are held by the party shall, at a min-
imum, be handled and stored in a 
manner that meets the commonly ac-
cepted industry standards on privacy 
protection; and 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(II) upon request, a parent is 
provided access by the educational 
agency or institution to the personally 
identifiable information held about 
their children by the party to the 
same extent and in the same manner 
as such access is provided in sub-
section (b)(1). 
‘‘(3) The disclosure of directory information, as 
so designated by the educational agency or institu-
tion under this paragraph, provided that the edu-
cational agency or institution which the student at-
tends— 
‘‘(A) has implemented a directory informa-
tion policy, which may include a directory infor-
mation policy limiting the parties to or purposes 
for which directory information may be dis-
closed; 
‘‘(B) has given public notice, including an 
easy-to-understand notice to parents of stu-
dents, of— 
‘‘(i) the categories of information 
which the agency or institution has des-
ignated as directory information with re-
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
spect to students attending the institution 
or agency; and 
‘‘(ii) the right of a parent to opt out 
of allowing their child’s information to be 
disclosed as directory information; and 
‘‘(C) has allowed a reasonable period of 
time after such notice has been given under 
subparagraph (B), but not less than 15 school 
days, for a parent to inform the institution or 
agency that any or all of the information des-
ignated as directory information shall not be 
disclosed without the parent’s prior consent. 
‘‘(4) Officials of another educational agency or 
institution in which the student seeks or intends to 
enroll, upon condition that the student’s parents be 
notified of the transfer, receive a copy of the edu-
cation record if desired, and have an opportunity for 
a hearing to challenge the content of the record. 
‘‘(5)(A) An official listed in subparagraph (B) 
or an authorized representative working for, or on 
behalf of, such official, subject to the limitations de-
scribed in this paragraph and subsection (m)(1)(B), 
and only in connection with and to the extent nec-
essary for— 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(i) the audit, evaluation, or enforcement 
of local, State, or Federal law; 
‘‘(ii) the audit or evaluation of locally sup-
ported, State-supported, or federally supported 
education programs pursuant to local, State, or 
Federal law; or 
‘‘(iii) the enforcement of the Federal or 
State legal requirements which relate to the 
programs described in clause (ii). 
‘‘(B) The following officials are covered by this 
paragraph: 
‘‘(i) The Comptroller of the United States. 
‘‘(ii) The Secretary. 
‘‘(iii) State or local educational authorities. 
‘‘(iv) The Attorney General. 
‘‘(C) Any data collected by an official listed in 
subparagraph (B) shall be protected in a manner 
that will not permit the personal identification of 
students and their parents by other than such offi-
cial, and such education records and personally iden-
tifiable information in such records shall be de-
stroyed when no longer needed for the audit, evalua-
tion, and enforcement of legal requirements de-
scribed in clause (i), (ii), or (iii) of subparagraph 
(A). 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(6) Organizations conducting a study for, or 
on behalf of, an educational agency or institution, 
provided that— 
‘‘(A) such study is conducted in such a 
manner as will not permit the personal identi-
fication of students and their parents by per-
sons other than representatives of such organi-
zations and such personally identifiable infor-
mation will be destroyed when no longer needed 
for the purpose of the study; 
‘‘(B) the organization has agreed to and 
has appropriate security that meets the infor-
mation security requirements of subparagraphs 
(A) and (C) of subsection (b)(6); and 
‘‘(C) the purpose of the study is limited to 
improving the academic outcomes of students 
attending that educational agency or institu-
tion. 
‘‘(7) Officials in connection with a student’s ap-
plication for, or receipt of, financial aid. 
‘‘(8) State and local officials or authorities to 
whom personally identifiable information in edu-
cation records is specifically allowed to be reported 
or disclosed pursuant to a State statute regarding 
the juvenile justice system. 
VerDate Sep 11 2014 
00:35 Jul 25, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H3157.IH
H3157
SSpencer on DSK4SPTVN1PROD with BILLS