FERPA-Student Privacy and Information Technology
The Family Education Rights and Privacy Act (FERPA) was passed in 1974 to protect the privacy rights of students in higher education institutions. It is appropriate to mention that the motivation for the passage of FERPA was generated by the desire of our legislators to prevent the release of information concerning students (or protect the privacy of the student) to anyone without the consent of the students. It is no coincidence that the FERPA law was passed soon after the minimum age for voting in Federal elections was lowered from 21 to 18 years. Since FERPA affected the conveyance of information about a student's activities at an educational institution without her/his agreement, this law created a code of ethics indirectly. Apart from the publicity associated with some FERPA related litigation, this law remained relatively unnoticed by general public and most of the students.
When FERPA legislation was passed, Information Technology (IT) was still in its infancy. Many privacy related protections/provisions that are embedded in the laws passed during the last twenty five years (e.g., HIPAA) were not included in this law. Phenomena and processes such as identity theft, E-commerce, customized prospect lists, and information security were relatively unknown at that time. In the 1970s, practically all student records were created and stored in the form of paper documents.
As a result of rapid diffusion of IT in the operation and administration of higher education institutions during the last 15 years, business organizations and government agencies are constantly trying to secure information about students, often without the approval of the students involved. In response to this changing scenario, the U.S. Department of Education released its proposed changes in FERPA, in March 2008. These proposed changes were focused on the latitude granted to college officials for determining under what circumstances, and to whom, students' information could be disclosed. This issue became really important after the disclosure of information concerning the mental health of the student responsible for the tragedy at Virginia Tech in April 2007 was made public. It is believed that the disclosure of this mental health information to some appropriate recipients, many months prior to the Virginia Tech episode, could have prevented the loss of life, serious injuries and mental stress caused by the action of one student.
The original FERPA regulations distinguished between "Directory" information", and "Non-directory" information. Directory information, which includes names, addresses, phone numbers, can be made public unless a student opts out of disclosure. Non-directory information, which includes grades and disciplinary history for a student, cannot be disclosed to anyone without explicit approval of the student. With the emergence of threat to privacy in the form of identity theft, as a consequence to the utilization of IT for operation, administration, marketing and promotion by universities/colleges, the Social Security Number and Student ID Number have become very valuable data items for business entities, and cyber criminals. The proposed changes in FERPA will mandate that these two data items be included in the Non-directory information in the context of disclosure.
In the textbook titled "Using Information Technology', there is a reference to FERPA on page 454. On that page a number of relevant web sites have been identified. Please utilize the information available at these web sites and other appropriate web portals,
Please answer the following questions in this discussion conference:
- Before you read the introduction to this conference, were you aware of FERPA regulation?
- Did you know how FERPA regulations affect your privacy and relationship with your parents/guardians?
- In your opinion, what are the ethical implications of FERPA?
- Has the rapid proliferation of IT made FERPA more desirable or less desirable in the context of privacy of students?