Reminder: Review Directory Data Pupil Record Notices Before School Starts

It is well understood that public school districts must keep student records confidential under Wisconsin’s Pupil Records law and the federal Family Educational Rights and Privacy Act of 1974 (“FERPA”).[1]  Both laws include exceptions that authorize disclosure without parental consent.  One such exception applies to the disclosure of directory data.[2]  However, this exception only applies if the school has first taken specific actions.  With a new school year quickly approaching, this article provides helpful reminders on the specific notices required under state and federal laws that schools must provide to parents, guardians, individuals acting as parents in the absence of a parent or guardian, and adult students (hereinafter collectively referred to as “parents”) in order for schools to be able to release directory data.

Directory data is information about a student that would not generally be considered harmful or an invasion of privacy if disclosed.[3]  Wisconsin law defines directory data as the student’s name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports; weight and height (of members of an athletic team); the student’s dates of attendance; photographs; degrees and awards received by the student; and the name of the school most recently previously attended by the student.[4]

Under FERPA and Wisconsin law, a school may disclose directory data without parental consent only if the school has given parents notice of:

1. The categories of information the school has designated as directory data;
2. Their right to prevent the school from releasing all or any category of directory data without prior parental consent[5]; and
3. The requirement to inform the school within 14 days that they do not want any or all categories of directory data to be disclosed without prior parental consent.[6]

A school may include in its notice to parents that its disclosures of directory data will be limited to specific parties, for specific purposes, or both.  If the school notifies parents that it will limit the disclosure of directory data, it must be sure to limit directory data disclosures accordingly.[7]

The above notices are required before disclosing the name and address of each student who is expected to graduate in the current year to a technical college district board.[8]  Further, the notices are also required before the school may release a student’s directory data to a law enforcement agency, district attorney, certain county departments, a court of record, or municipal court for the purpose of enforcing that student’s attendance or investigating alleged criminal or delinquent activity by the student, or responding to a health or safety emergency, except as otherwise allowed by law.[9]

A parent’s decision to opt-out of releasing directory data does not limit the disclosure of such data during classroom instruction to other students enrolled in and attending a class.[10]

With respect to former students, a school may disclose directory data of former students without complying with the annual notice.  Still, the school must continue to honor any valid opt-out request made while the student was in attendance, unless the student rescinds that request.[11]

Schools should also be mindful of directory data requests that utilize social security numbers or other non-directory data to identify the request’s subject.  Schools may inadvertently disclose or confirm confidential information by responding to such requests.[12]  For example, responding to a request for directory data that identifies a student by name and social security number could confirm that the social security number provided is accurate.  In those situations, the school should indicate that it located the directory data without reference to the social security number (or other non-directory data) and that its response neither confirms nor denies the accuracy of the confidential information provided.

Unless the student’s parent provides written consent to disclose the student’s social security number (or other non-directory data) to the specific requester (among other written consent requirements), the school should rely solely on the student’s name to produce the other requested directory data.  If the student has a common name, the school could use additional directory data (e.g., address or phone number) to confirm the student’s identity.

Given the significant limitations on disclosing directory data if the required notices are not provided, now is an opportune time to review your school’s directory data notices.  Whether delivered by mail or through an online registration process, school districts should ensure they include all the necessary information, including notifying parents they have 14 days to opt-out before the disclosure of directory data may occur without their written consent.

---

[1] Wis. Stat. § 118.125(2); 34 CFR § 99.30; see 34 CFR § 99.31.

[2] FERPA uses the term Directory Information.  To avoid confusion, this article uses the term Directory Data.

[3] 34 CFR § 99.3, “Directory Information.”

[4] Id.; Wis. Stat. § 118.125(1)(b).

[5] Note, however, a parent may not opt-out of directory data disclosures to prevent the school from disclosing (or requiring a student to disclose) the student’s name, identifier, or school email address in a class in which the student is enrolled, or to prevent a school from requiring the student to wear, display publicly, or disclose a student ID card/badge that exhibits information that may be designated as directory information, provided the school gave the required annual notice that the information was directory information. 34 CFR 99.37(c).

[6] Wis. Stat. § 118.125(2)(j)1; 34 CFR 99.31(a)(11).

[7] 34 CFR 99.37(d).

[8] Wis. Stat. § 118.125(2)(j)2. (Note: Disclosure under this subdivision would not include the students whose parents notified the school that they do not permit that directory data disclosure).

[9] Wis. Stat. § 118.125(2)(j)3. (Note: Disclosure under this subdivision would not include the students whose parents notified the school that they do not permit that directory data disclosure); but see Wis. Stat. § 118.125(2)(n)-(q) (authorizing disclosure to court of law for certain proceedings, to law enforcement, and other specific departments for specific purposes).

[10] 34 CFR § 99.37(c)(1).

[11] 34 CFR 99.37(b).

[12] See 34 CFR 99.37(e).