The Student Privacy Policy Office (SPPO) is a division of the U.S. Department of Education tasked with, among other things, the administration of federal laws related to student privacy in local educational agencies that receive federal funds. Each year, two laws — the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA) — require the SPPO to provide notice to schools of their obligations related to student privacy matters. Briefly, FERPA relates to privacy interests and access rights for parents and students to “education records,” which are student-related information and/or materials maintained by educational agencies or institutions or people acting on behalf of those entities. PPRA provides and protects rights for students and parents related to marketing activities, the administration and/or distribution of surveys or physical examinations and screenings to students, and parental access to certain instructional materials.
This year, in addition to the notice, a cover letter was released on March 28, 2025, by the acting director of the SPPO and includes details of several “priority concerns” that the SPPO will take “proactive measures to address.” First in those areas of concern is parental rights to inspect and review education records under FERPA. The acting director explains that while FERPA does not require school officials to provide notice to parents about any information, it does require schools, upon request, to provide parents with an opportunity to inspect and review education records of their child. According to the acting director, FERPA does not include a distinction between an official student record and a cumulative file. Therefore, the acting director maintains that all information related to a student and maintained by a school (with some statutory exceptions) is an education record that can be reviewed by a parent if requested. Although uncertain, this view could expand the U.S. Supreme Court’s narrower interpretation of “education records” in Owasso Indep. Sch. Dist. v. Falvo (2002) 534 U.S. 426, which found that education records are generally those kept by a single, centralized custodian, such as a registrar, rather than records kept in disparate locations.
Student safety is another area of concern noted in the SPPO letter. Specifically, the letter provides that schools should not withhold information that identifies a student who has made a death threat against another student from the parents of the threatened child. If an education record relates to both students involved in a death threat situation, then all parents of those students have a right to the information when the information contained in the record cannot be segregated and redacted without ruining the record’s meaning. This includes sharing any responsive action taken related to a threat assessment or potential disciplinary action against another student because of a threat made. Further, the letter states that FERPA does not prohibit a school from implementing protective actions for the threatened student, such as classroom reassignment and protective actions, that affect both students and may be disclosed to the parents of the students.
The letter also alleges that LEAs are failing to provide parents with the annual notice of their rights as required under FERPA. As described in the letter, notice may be provided in any way that is reasonably likely to inform parents of their rights, such as in the school activities calendar, newsletters, student handbooks, etc. The annual notice does not have to be given to each parent individually.
The letter concludes with a section describing “assurance of compliance.” In taking proactive action to enforce FERPA, the SPPO requested that each state education agency (the California Department of Education, in the case of California) submit “documentation such as ‘reports, information on policies and procedures, annual notifications, training materials or other information necessary’ to provide assurance that the State Education Agency and their respective LEAs are complying” with the law. This requested assurance will focus specifically on the areas of concern noted in the letter. Materials that may be relevant in responding to SPPO’s assurance request include LEA trainings related to maintaining student records, the language used in and location of their annual notice to parents regarding their FERPA rights, any policies related to the annual notification, and other relevant policies, including any of the following:
- Board Policy/Administrative Regulation 5020 – Parent Rights and Responsibilities
- BP/AR 5125 – Student Records
- BP/AR/Exhibit (1) 5125.1 – Release of Directory Information
- BP/AR/E(1) 5145.6 – Parent/Guardian Notifications
The letter requests that state education agencies submit this assurance of compliance information by April 30, 2025. Consequently, LEAs may be receiving requests for their information related to FERPA compliance in the coming days.
