Source: https://www.powerslaw.com/department-announces-new-approach-to-ferpa-enforcement/
Timestamp: 2019-04-18 11:06:50+00:00

Document:
The Department will assess risk based, in part, on the number of students who could be affected by the identified issue. Schools, online program management companies (“OPMs”), and other education-related companies should expect that the Department will now spend more time reviewing entities’ FERPA policies, because each policy can impact many students.
These enforcement procedures are memorialized in the Department’s regulations. As discussed below, the Department recently clarified that these regulations do not require formal investigation of all complaints.
The OIG recommended that the Department take several actions to begin reducing the backlog and improve the processing of FERPA complaints. These included a recommendation that the Department “design and implement a risk-based approach to processing and resolving FERPA complaints, where complaints deemed highest risk are prioritized.”13 The Department agreed that a risk-based approach to processing and resolving FERPA complaints should be designed and implemented14 and, as explained below, issued a guidance document describing how this would impact its FERPA enforcement procedures.
On December 20, 2018, the Department issued a guidance document titled Improving the Effectiveness and Efficiency of FERPA Enforcement. The Department acknowledges in this document that, up to this point, the Department opened formal investigations regarding all complaints that were timely and contained specific allegations of fact giving reasonable cause to believe a FERPA violation occurred. The Department states this practice was not required by the Department’s FERPA regulations and, moreover, contributed to lengthy processing times.
On the basis of its interpretation that neither the statute nor the regulations require formal investigation of all complaints, the Department announced a new risk-based approach under which it will “make a case-by-case determination for every timely complaint to determine the best mechanism for resolving the underlying situation.”15 It appears the Department will use three different “mechanisms”: (1) acting as an intermediary; (2) providing resolution assistance; and (3) conducting formal investigation.
The Department will provide resolution assistance when it receives complaints regarding isolated incidents of inadvertent or accidental disclosures of FERPA-protected information. The Department noted that the most effective response in these situations is to provide technical assistance to the school or entity.
The Department will still conduct formal investigations where necessary to enforce rights and resolve violations based “on the severity of risk to student privacy, the number of students affected, [and] other relevant factors.”17 It appears formal investigations will be used, for example, when an entity’s FERPA policies may be deficient, potentially impacting the FERPA rights of many students.
By ending formal investigations regarding minor FERPA issues, the Department aims to reduce its complaint backlog, conduct more Department-initiated investigations,18 and focus on noncompliance that poses the highest risk to student privacy. As a deficient institutional FERPA policy impacts all students who are subject to the policy, the Department is likely to consider such problems as high-risk and deserving of formal investigation. Thus, schools and other entities should consider redoubling efforts to review policies for compliance.
Schools and other entities also should expect to have more frequent contact with the Department regarding student privacy issues. When the Department acts as an intermediary or provides resolution assistance, it may call and/or email rather than using formal notification letters. Schools and other entities should consider preparing staff for these informal – and perhaps unanticipated – interactions by deciding in advance which employees should be in contact with the Department and providing FERPA training to these employees as necessary.
Nick Michiels is a Principal in the Powers Education Practice Group. He can be reached at Nick.Michiels@PowersLaw.com and 202-872-6727.
1 20 U.S.C. § 1232g(f).
2 34 C.F.R. § 99.63.
3 34 C.F.R. § 99.64(c) (“A timely complaint is defined as an allegation of a violation of the Act that is submitted to the Office within 180 days of the date of the alleged violation or of the date that the complainant knew or reasonably should have known of the alleged violation.”).
4 34 C.F.R. § 99.64(a).
5 34 C.F.R. § 99.65(b).
6 34 C.F.R. § 99.65(a).
7 34 C.F.R. § 99.65(a)(2).
8 34 C.F.R. § 99.66(b).
9 34 C.F.R. § 99.66(c).
10 34 C.F.R. § 99.67(a).
11 U.S. Department of Education, Office of Inspector General, “Office of the Chief Privacy Officer’s Processing of Family Educational Rights and Privacy Act Complaints,” ED-OIG/A09R0008, pp. 5 (November 26, 2018) (ED IG Rep.). The OIG began studying this issue in 2017, when the OIG’s Annual Plan identified as “new priority work” the review of the Department’s administration of FERPA, including whether the agency was appropriately processing and resolving complaints alleging FERPA violations.
12 ED IG Rep., pp. 13-14. The OIG characterized the backlog in this way because the Department had originally estimated that the backlog was approximately two years.
13 ED IG Rep., pp. 29-30.
14 ED IG Rep., pp. 42.
15 Improving the Effectiveness and Efficiency of FERPA Enforcement, U.S. Dep’t of Educ., Office of Mgmt., Guidance Letter (December 20, 2018), pp. 2 (Guidance Ltr.).
16 Guidance Ltr., pp. 2.
17 Guidance Ltr., pp. 3, quoting the ED IG Rep.
18 ED IG Rep., pp. 43 (“The Compliance Office is optimistic that as process improvements are implemented (including those discussed in our response to Recommendation 1.7), it will conduct more self-initiated investigations.”).

References: § 1232
 § 99
 § 99
 § 99
 § 99
 § 99
 § 99
 § 99
 § 99
 § 99