Filing a FERPA Complaint: Understanding Your Rights and the Process

Last updated 3 weeks ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

The Family Educational Rights and Privacy Act (FERPA), often called the Buckley Amendment, is a cornerstone federal law in the United States designed to protect the privacy of student education records. Enacted in 1974, FERPA applies to all educational agencies and institutions, such as public schools, school districts, and most private and public postsecondary institutions, that receive funding from any program administered by the U.S. Department of Education.

This law establishes critical rights for parents and students concerning access to and control over student information. While FERPA grants several rights, this article focuses specifically on the right to file a complaint if you believe an educational institution has violated FERPA, providing a clear guide to the process managed by the U.S. Department of Education’s Student Privacy Policy Office (SPPO).

Your Fundamental FERPA Rights

Before examining the complaint process, it’s essential to understand the core rights FERPA provides regarding student records.

Education Records and Personally Identifiable Information (PII)

FERPA’s protections center on “education records” and the “personally identifiable information” (PII) they contain.

“Education Records” Defined: These are records directly related to a student and maintained by an educational agency or institution, or by a party acting on their behalf. This broad definition encompasses academic transcripts, class schedules, grades, disciplinary files, and health or immunization records kept by the school.

“Personally Identifiable Information” (PII) Defined: PII under FERPA includes information that can be used to identify a student. This includes obvious identifiers like the student’s name, address, Social Security number, or student ID number. It also covers indirect identifiers such as date and place of birth, mother’s maiden name, biometric data (like fingerprints or facial characteristics), and other information that, alone or combined, would allow a reasonable person in the school community to identify the student with reasonable certainty.

Important Exclusions from “Education Records”

FERPA explicitly excludes certain types of records from its definition of “education records.” These include:

• Records kept in the sole possession of the maker (e.g., a teacher’s private notes) used only as a personal memory aid and not shared with others (except a temporary substitute). Once shared, they may become education records.
• Records created and maintained by a law enforcement unit of the educational institution for law enforcement purposes.
• Employment records of individuals employed by the institution, provided they relate solely to their capacity as an employee and are not available for other purposes.
• Medical or psychological treatment records made or maintained by a professional (like a physician or psychologist) used only for the treatment of a student aged 18 or older or attending a postsecondary institution, and not disclosed to anyone other than those providing treatment.
• Grades on peer-graded papers before they are collected and recorded by a teacher.
• Alumni records created after the student is no longer enrolled.
• Certain surveillance footage may also fall outside the definition if it is not focused on a specific student’s actions and is not maintained as part of an individual student’s record.

A critical factor in determining if a record is covered by FERPA is whether it is “maintained by” the educational institution. This distinction is important because information about a student that exists at a school might not be protected if it’s not officially kept or managed by the institution under FERPA’s definition.

For instance, disputes have arisen over whether certain security videos that are routinely erased are considered “maintained”. Therefore, a potential complaint must concern records the school officially keeps as part of its educational record-keeping system.

Inspecting, Reviewing, and Seeking Amendments to Records

FERPA grants parents and eligible students specific rights regarding the content of education records:

Right to Inspect and Review: Parents or eligible students have the right to inspect and review the student’s education records. Schools must provide access within a reasonable time, not exceeding 45 days from the date of the request. This right includes receiving reasonable explanations and interpretations of the records from the school.

While schools are not always obligated to provide copies of records, they must do so if circumstances like distance prevent the parent or eligible student from exercising their right to inspect and review in person. Schools may charge a fee for copies, but not for the cost of searching for or retrieving the records.

Right to Seek Amendment: If a parent or eligible student believes information in the education records is inaccurate, misleading, or violates the student’s privacy, they have the right to request that the school amend the records. The process involves submitting a written request to the school identifying the specific part of the record they want changed and specifying why it is inaccurate or misleading. The school must decide within a reasonable time whether to amend the record as requested.

Hearing Rights: If the school refuses the amendment request, it must inform the parent or eligible student of their right to a formal hearing to challenge the content. The hearing provides an opportunity to present evidence that the record is inaccurate, misleading, or violates privacy.

Right to Add a Statement: If, even after the hearing, the school still decides not to amend the record, the parent or eligible student has the right to place a statement in the record explaining their view about the contested information. This statement must be maintained with the contested part of the record and disclosed whenever that part of the record is disclosed.

Limitations on Amendment Rights

It is crucial to understand that the right to seek amendment under FERPA is primarily about correcting factual inaccuracies or misleading information within the record itself. It generally does not provide a basis to challenge the substance of a correctly recorded grade, a disciplinary decision, or other evaluations made by the school.

For example, one can request to correct a transcript that shows the wrong grade was recorded, but cannot use the FERPA amendment process simply to argue that a correctly recorded grade should have been higher. This procedural focus on accuracy means that complaints filed with SPPO regarding a school’s refusal to amend a record are unlikely to succeed if the dispute is fundamentally about disagreeing with a school’s judgment rather than a demonstrable error in the record-keeping.

Controlling Disclosure: The Consent Requirement and Its Exceptions

A central tenet of FERPA is controlling who can access student records.

General Consent Rule: As a general rule, educational institutions must obtain prior written consent from the parent or eligible student before disclosing PII from a student’s education records to third parties. This written consent must specify the records to be disclosed, state the purpose of the disclosure, and identify the party or parties to whom the disclosure may be made. Electronic consent is permissible if it meets specific authentication and identification requirements.

Exceptions to Prior Written Consent: FERPA includes numerous specific exceptions that permit schools to disclose PII from education records without obtaining prior consent. Understanding these exceptions is vital, as many disclosures are legally permissible under FERPA. Key exceptions include disclosures:

• To school officials (including teachers, administrators, contractors, consultants, volunteers, or other parties acting for the school) who have been determined by the institution to have “legitimate educational interests” in the information. This interest typically relates to performing assigned job duties.
• To officials of another school, school system, or postsecondary institution where the student seeks or intends to enroll, or is already enrolled, for purposes related to the student’s enrollment or transfer.
• To authorized representatives of certain federal and state authorities (like the U.S. Comptroller General, Attorney General, Secretary of Education, and state educational authorities) for audit, evaluation, or enforcement of federal or state-supported education programs.
• In connection with financial aid for which the student has applied or received, if the information is necessary to determine eligibility, amount, conditions, or enforce terms of the aid.
• To organizations conducting studies for, or on behalf of, the school to develop tests, administer student aid, or improve instruction, provided specific conditions regarding data use and destruction are met.
• To accrediting organizations to carry out their accrediting functions.
• To comply with a judicial order or lawfully issued subpoena. The school must generally make a reasonable effort to notify the parent or eligible student before compliance, unless the subpoena involves law enforcement or a grand jury and orders non-disclosure.
• In connection with a health or safety emergency, if the information is necessary to protect the health or safety of the student or other individuals.
• Of “directory information,” provided the school has given public notice of the types of information designated as directory information, informed parents/eligible students of their right to refuse designation (opt-out), and provided a reasonable time to exercise that right. Directory information typically includes items like name, address, phone number, date/place of birth, participation in activities, honors/awards, and dates of attendance.
• To parents of a dependent student (as defined for IRS tax purposes) at the postsecondary level.
• To parents of a student under 21 regarding a violation of laws or policies concerning alcohol or controlled substances at the postsecondary level.
• To the victim of an alleged crime of violence or non-forcible sex offense, concerning the final results of a disciplinary proceeding conducted by a postsecondary institution against the alleged perpetrator.

The sheer number and complexity of these exceptions can make it challenging for both families and school officials to navigate FERPA correctly. Disputes or complaints can arise not necessarily from intentional wrongdoing, but from misinterpretations or misapplications of these detailed rules, such as what constitutes a “legitimate educational interest” or how to properly handle directory information opt-outs.

Therefore, before concluding that an improper disclosure violation has occurred, it’s important to consider whether one of these exceptions might apply.

Who Holds These Rights?

The authority to exercise FERPA rights depends on the student’s age and educational level:

Parental Rights: In elementary and secondary schools (K-12), FERPA rights generally belong to the parents of the student. This can include natural parents, guardians, or individuals acting as a parent in the absence of a parent or guardian. Stepparents may also exercise these rights under certain conditions, such as being present in the home daily with the child and natural parent while the other parent is absent.

Transfer of Rights to “Eligible Students”: FERPA rights transfer from the parents to the student when the student either reaches the age of 18 OR attends a postsecondary institution (college or university) at any age. At this point, the student becomes an “eligible student” and holds the FERPA rights previously held by the parents.

Postsecondary Considerations: Even after rights transfer to an eligible student, FERPA permits (but does not require) postsecondary institutions to disclose education records to the student’s parents without the student’s consent if the student is claimed as a dependent for federal income tax purposes or under specific circumstances like violations of alcohol or drug policies if the student is under 21. Special considerations may also apply to dual-enrollment students attending both high school and college.

This automatic transfer of rights at age 18 or postsecondary enrollment can sometimes create challenges. Parents who were previously involved in their child’s education may find themselves without access to information unless the eligible student provides written consent.

Conversely, newly eligible students might not be fully aware of their rights and responsibilities under FERPA or how to grant consent if they wish for their parents to remain involved. This potential disconnect underscores the importance of clear communication and understanding about the transfer of rights for both parents and students transitioning into postsecondary education or adulthood.

Annual Notification

Educational institutions subject to FERPA must annually notify parents and eligible students of their rights under the Act. This notification must include information about the right to inspect and review records, the right to seek amendment, the right to consent to disclosures (and exceptions), and the right to file a complaint with the Department of Education. The method of notification (e.g., letter, student handbook, website posting) is left to the discretion of the institution.

Identifying a FERPA Violation: Grounds for a Complaint

A FERPA complaint is filed when a parent or eligible student believes an educational institution has failed to comply with the requirements of the Act. Common situations that may constitute a violation and form the basis of a complaint include:

Improper Disclosure of PII

Releasing personally identifiable information from a student’s education records to third parties without the required written consent, when no FERPA exception applies. Examples include:

• Publicly posting grades or other sensitive information linked to student names or IDs.
• Sending emails containing PII to incorrect recipients or using group email features (like CC instead of BCC) that expose student information inappropriately.
• Discussing confidential student information in public areas or with staff members who lack a legitimate educational interest.
• Releasing PII over the phone without properly verifying the recipient’s identity and right to access.
• Sharing education records with potential employers without student consent.

Other Common Violations

• Denial of Access Rights: Refusing a parent or eligible student’s request to inspect and review their education records, or causing unreasonable delays (beyond the 45-day limit) in providing access.
• Refusal to Amend Records or Provide Hearing: Improperly denying a valid request to amend records believed to be inaccurate, misleading, or violating privacy, OR failing to offer a hearing after denying such a request.
• Improper Handling of Directory Information: Releasing information designated as directory information without first providing the required annual notice and opportunity for parents/eligible students to opt out of disclosure, or releasing directory information about a student who has specifically opted out.
• Failure to Provide Annual Notification: Neglecting to inform parents and eligible students of their FERPA rights on an annual basis.
• Failure to Maintain Disclosure Records: Not keeping required records of requests for access and disclosures made from education records, particularly those made under certain exceptions.
• Inadequate Record Security: Failing to take reasonable steps to secure physical or electronic education records, leading to potential or actual unauthorized access. This includes improper disposal of records containing PII (e.g., not shredding paper records or securely wiping electronic media).

It is important to distinguish FERPA violations from general disagreements with school policies or decisions. As noted earlier, FERPA typically does not cover disputes about the substance of grades or disciplinary actions if the information was recorded accurately and not improperly disclosed. Furthermore, actions taken by individuals not acting on behalf of the school, or disclosures of information not considered part of an “education record,” may fall outside FERPA’s scope.

The Student Privacy Policy Office (SPPO): Your Point of Contact

The primary federal office responsible for handling FERPA complaints is the Student Privacy Policy Office (SPPO) within the U.S. Department of Education. This office, previously known as the Family Policy Compliance Office, leads the Department’s efforts to protect student privacy.

SPPO’s responsibilities regarding FERPA include:

• Investigating complaints filed by parents and eligible students alleging FERPA violations.
• Providing technical assistance and guidance to educational institutions, parents, and students on FERPA compliance and privacy best practices.
• Operating the Privacy Technical Assistance Center (PTAC), which includes a help desk for inquiries.
• Developing policy and regulations related to student privacy.
• Enforcing FERPA requirements.

The main resource for information is the SPPO website: Student Privacy at the U.S. Department of Education. For general questions about FERPA (not for filing complaints), the PTAC help desk can be reached at [email protected] or 1-855-249-3072. As of the time of this writing, the Acting Director of SPPO and Chief Privacy Officer is Frank Miller.

Filing Your FERPA Complaint: A Step-by-Step Guide

If you believe an educational institution has violated FERPA rights, follow these steps to file a formal complaint with SPPO:

Confirm Your Eligibility to File

The complaint must be filed by the individual whose rights were allegedly violated. This means:

• A parent or legal guardian of a student who is under 18 years old and enrolled in an elementary or secondary school.
• The “eligible student” themselves if they are 18 years or older OR attending a postsecondary institution at any age.

Complaints filed anonymously or by third parties who do not hold the FERPA rights for the student in question will generally be dismissed. An attorney or advocate may file the complaint on behalf of the parent or eligible student, but SPPO requires the parent’s or eligible student’s prior written consent to communicate with the attorney/advocate about the complaint.

Consider Contacting the School First (Optional but Encouraged)

Before filing a formal complaint, SPPO strongly encourages (though does not require for FERPA) complainants to attempt to resolve the issue directly with the educational agency or institution involved. Direct communication can sometimes lead to a faster resolution or clarification. (Note: For complaints under the Protection of Pupil Rights Amendment (PPRA), contacting the institution first is required).

Meet the Critical 180-Day Filing Deadline

This is a strict requirement. A FERPA complaint must be submitted to SPPO within 180 days of the date the alleged violation occurred.

Alternatively, if the complainant was not aware of the violation when it happened, the complaint must be filed within 180 days of the date the complainant knew or reasonably should have known about the alleged violation. This “reasonably should have known” standard provides some flexibility but also introduces a degree of subjectivity.

It means the 180-day clock might start later than the actual violation date, but determining precisely when someone should have known can be complex. Therefore, it is best to file the complaint as soon as possible after becoming aware of a potential violation.

Be prepared to clearly state on the complaint form the specific date of the alleged violation and explain when and how you became aware of it, especially if filing near or after the 180-day mark from the event itself. SPPO may grant an extension to the 180-day limit only if it determines the complainant was prevented from filing on time due to circumstances beyond their control.

Gather Necessary Information for the Complaint Form

The complaint must be in writing and contain specific, factual allegations providing reasonable cause to believe a FERPA violation has occurred. Using the official SPPO FERPA Complaint Form is the recommended way to ensure all necessary information is included.

The form requires detailed information across several sections. Use the following checklist to prepare:

Ensure the educational institution named receives funds from the U.S. Department of Education. For public K-12 schools, SPPO generally only investigates schools listed on the National Center for Education Statistics (NCES) website. Private K-12 schools often do not receive such funds and may not be subject to FERPA.

Complete and Submit the Complaint Form

Obtain the Form: Download the official FERPA Complaint Form from the SPPO website’s “File a Complaint” page. The form is a fillable PDF and works best with Adobe Reader (a free download link is usually provided on the SPPO site).

Choose Submission Method: You can submit the completed form in one of two ways:

• Email: Send the completed PDF form as an attachment to [email protected]. The form might have a “Submit Form” button that tries to use your computer’s default email program. If this doesn’t work, save the completed form to your computer, open your email program, create a new email to [email protected], attach the saved form, and send it.
• Mail: Print the completed form, sign it by hand, and mail it to: U.S. Department of Education Student Privacy Policy Office 400 Maryland Ave, SW Washington, DC 20202-8520

Privacy Act Notice: Be aware that to investigate the complaint, SPPO needs to collect PII about the complainant and the student. While providing information is voluntary, failure to provide the information requested on the form may result in the complaint being dismissed. Under the Privacy Act of 1974 and published routine uses, SPPO may disclose information from the complaint form without prior consent to the educational institution named in the complaint to verify facts, gather additional information, or otherwise resolve the matter.

After You File: What the SPPO Does Next

Once a complaint is submitted, SPPO follows a process to review and potentially investigate the allegations.

Initial Review and Acknowledgement

SPPO typically sends an acknowledgement confirming receipt of the complaint, often within about three business days. The office then conducts an initial review to ensure the complaint meets basic requirements:

• Timeliness: Was it filed within the 180-day limit?
• Standing: Was it filed by a parent with rights or an eligible student?
• Jurisdiction: Does FERPA apply to the institution?
• Sufficiency: Does it contain specific factual allegations giving reasonable cause to believe a violation occurred?

If the complaint is deficient (e.g., missing information, untimely, lacking specific facts), SPPO may dismiss it or return it to the complainant for more information.

The Investigation Process

If SPPO determines the complaint warrants investigation, the process generally involves the following steps, guided by FERPA regulations (specifically 34 CFR § 99.64):

Notification: SPPO notifies both the complainant and the educational institution that an investigation has been opened. The notice to the institution outlines the substance of the alleged violation(s).

Institution’s Response: The educational institution is given an opportunity to submit a written response to the allegations.

Information Gathering: SPPO may request additional documents, records, or information from the institution and potentially from the complainant to fully understand the facts. As mentioned, this may involve SPPO sharing some complaint details with the institution.

Alternative Resolution Paths: SPPO may decide that a formal investigation is not the most effective route. Based on the nature of the complaint, they might pursue:

• Intermediation: Acting as a facilitator between the complainant and the institution to reach a mutually agreeable resolution, often used for access or amendment disputes.
• Resolution Assistance: Working with the institution to improve its policies and procedures, typically used when an isolated, inadvertent disclosure has occurred, focusing on preventing future incidents.

The use of these alternative methods reflects that SPPO’s approach often prioritizes achieving compliance and implementing systemic fixes rather than solely focusing on punitive measures, especially for unintentional errors. The ultimate goal is often voluntary compliance.

Communication During the Process

SPPO is responsible for communicating its findings to both the complainant and the institution. The complainant may also have opportunities to provide further information during the investigation. Following recommendations from oversight bodies, SPPO aims to improve communication with complainants throughout the process.

Understanding Potential Outcomes

The conclusion of SPPO’s review or investigation leads to specific outcomes.

Notification of Findings

Regardless of the path taken (formal investigation, intermediation, etc.), SPPO will issue a written notification to both the complainant and the educational institution detailing its findings and the basis for those findings. This letter will state whether SPPO determined that a violation of FERPA occurred.

Corrective Actions for Schools Found in Violation

If SPPO finds that the institution failed to comply with FERPA, particularly if it identifies a systemic issue described as a “policy or practice” of non-compliance, the notification letter to the institution will outline specific corrective actions required to bring it into compliance. The institution will be given a reasonable period to implement these changes.

Examples of potential corrective actions include:

• Revising institutional policies and procedures related to student records.
• Providing mandatory FERPA training for staff and faculty.
• Implementing enhanced data security measures for electronic and physical records.
• Improving methods for annual notification of rights.
• Correcting record-keeping practices for disclosures.

Potential Consequences for Non-Compliance

If an institution fails to take the required corrective actions voluntarily within the specified timeframe, the Department of Education has the authority to take stronger enforcement measures. These can include issuing a cease-and-desist order or, ultimately, withholding federal program funds administered by the Department.

While the termination of federal funding is a possible sanction under the law, it is considered a measure of last resort and has reportedly never been used for a FERPA violation. For third parties (like vendors) found to have improperly used or permitted access to PII, the Department can prohibit the educational institution from allowing that third party access to PII from education records for at least five years.

Important Limitations: What a FERPA Complaint Can and Cannot Do

It is essential for complainants to have realistic expectations about the outcomes of the SPPO complaint process.

Focus on Institutional Compliance: The primary goal of the process is to ensure the educational institution complies with FERPA now and in the future.

No Private Right to Sue via SPPO: FERPA itself does not grant individuals the right to sue the educational institution for monetary damages through the SPPO administrative complaint process. While court cases related to FERPA exist, the SPPO complaint mechanism is administrative, not judicial.

No Individual Remedies: The SPPO process typically does not result in personal remedies for the complainant, such as financial compensation or apologies. Furthermore, while the institution might take internal disciplinary action against employees involved in a violation, SPPO’s findings and required actions focus on the institution’s compliance, not specific personnel punishment.

Understanding these limitations is important. While filing a FERPA complaint may not lead to personal compensation or redress for past harm through the SPPO process, it serves a critical function in holding institutions accountable, prompting corrective actions, and preventing similar violations from affecting other students in the future. It is a mechanism focused on systemic improvement and future adherence to the law.

Authoritative FERPA Resources

For the most accurate and detailed information on FERPA, consult the official sources:

• FERPA Statute (Law): Title 20, United States Code, Section 1232g (20 U.S.C. § 1232g). Available via government publishing sites or legal information institutes.
• FERPA Regulations (Detailed Rules): Title 34, Code of Federal Regulations, Part 99 (34 CFR Part 99). Access the up-to-date version via the Electronic Code of Federal Regulations.
• Student Privacy Policy Office (SPPO) Main Website: Student Privacy at the U.S. Department of Education
• SPPO Complaint Filing Page: File a Complaint
• SPPO Guidance Documents: Official interpretations and explanations
• SPPO Parent Guide to FERPA: A helpful overview for parents (Spanish version also available via SPPO site)
• SPPO Eligible Student Guide to FERPA: An overview for students 18+ or in postsecondary education (Spanish version also available via SPPO site)
• SPPO Frequently Asked Questions (FAQs): Answers to common questions
• SPPO Training Resources (Videos/Webinars): Educational materials on FERPA

Our articles make government information more accessible. Please consult a qualified professional for financial, legal, or health advice specific to your circumstances.