FERPA generally prohibits the release of personally identifiable information (PII) from education records without parental consent, but there are several specific exceptions where disclosure is permitted without consent. Common exceptions include:
- Disclosure to school officials with legitimate educational interests.
- Disclosure to other schools where the student seeks or intends to enroll.
- Disclosure to authorized education officials for audit, evaluation, or enforcement of federal or state supported education programs.
- Disclosure to accrediting organizations.
- Disclosure in connection with financial aid for the student.
- Disclosure to organizations conducting certain studies "for or on behalf of" the school, under strict conditions including written agreements and data protection requirements.
- Disclosure to comply with judicial orders or subpoenas.
- Disclosure to appropriate officials in health and safety emergencies, but only limited to the emergency period and not a blanket release.
- Disclosure to state and local authorities within the juvenile justice system pursuant to specific state law.
- Disclosure of "directory information" (such as name, address) if the school has given public notice and parents/students have not opted out.
- Disclosure to parents of dependent students as defined by IRS rules, even if the student is an eligible student (18 or older or in postsecondary education)
One important point is that FERPA does not have a general "research exception" allowing disclosure of student information for research purposes without consent. The so-called "studies exception" is limited to studies conducted for or on behalf of the school under strict terms, not general research
Which is NOT an exception?
- General research use of student data without parental consent is not an exception under FERPA.
- Blanket release of information in health and safety emergencies beyond the emergency period is not allowed.
- Disclosure without parental consent for purposes other than those specified (e.g., marketing, general public release) is not permitted.
Thus, if given a list of options, the one that is not an exception would be something like "release of personally identifiable information for general research purposes without parental consent" or "blanket release during health emergencies" or any disclosure outside the legally defined exceptions. In summary, FERPA permits release without consent only under narrowly defined exceptions; general research or broad disclosures without consent are not allowed exceptions
