FERPA (Family Educational Rights and Privacy Act)

Yes. FERPA does not prohibit a teacher from taking PII from students' education records home with her as long as the teacher:

1) Has a legitimate educational interest in the education records;

2) Does not re-disclose the PII unless such disclosure is permitted under FERPA; and

3) Takes reasonable measures to protect the education records from further disclosure, such as physical, technological, and administrative controls. See 34 CFR 99.31 (a)(1)(i)(A).

Yes. Under the "school officials" exception to FERPA's parental consent requirement, a district may disclose students' PII to the third-party provider of such a service or application as long as the provider:

1) Performs an institutional function;

2) Meets the district's definition of a "school official";

3) Is under the district's direct control regarding the use and maintenance of education records and PII; and

4) Uses education records and PII only for authorized purposes and does not re-disclose the records or PII to other parties. See 34 CFR 99.31 (a)(1)(i)(B).

Before a district uses any third-party online educational services or apps, the Student Privacy Policy Office advises the district to read the platform's terms-of-service agreement to ensure it complies with FERPA.

No. FERPA does not impose explicit security or privacy requirements for third-party online educational service providers. However, SPPO advises districts to use apps and services that apply security best practices such as encryption, strong identity authentication, and a terms-of-service agreement that is transparent and explains how the third-party provider's use of PII complies with FERPA. SPPO also recommends that districts work with their information security officers and legal counsel to vet all prospective third-party apps and services using a risk-based analysis.

It depends. If PII from education records is not disclosed, FERPA would not prohibit a non-student from observing the lesson. As a best practice, however, districts should discourage non-students from observing virtual classrooms in the event that PII from a student's education record is inadvertently disclosed during the lesson. Additionally, a district may instruct students participating in the virtual classroom not to share or record any PII that may be disclosed during the virtual lesson.

Yes, as long as no PII was disclosed during the virtual class. Alternatively, if the teacher or a student disclosed sensitive information pertaining to a child during the lesson, the teacher may request prior written consent from the child's parent before sharing the recording with students who were unable to attend. See Frequently Asked Questions on Photos and Videos under FERPA, 118 LRP 16524 (FPCO 04/19/18).

In some cases, yes. Video recordings of virtual class lessons may qualify as education records if they: 1) directly relate to a student; and 2) are maintained by the district or agent of the district. If a district uses a third-party app or service to hold virtual class lessons, it should review its vendor agreement to determine whether the third-party provider will maintain recordings of those lessons beyond the period of instruction and, if so, how and by whom. See Frequently Asked Questions on Photos and Videos under FERPA, 118 LRP 16524 (FPCO 04/19/18).

Yes, FERPA permits electronic consent to disclosures. A "signed and dated written consent" under FERPA must:

1) Specify the records that may be disclosed;

2) State the purpose of the disclosure;

3) Identify the party or class of parties to whom the disclosure may be made; and

4) May include a record and signature in electronic form that identifies and authenticates a particular person as the source of the consent and indicates such person's approval of the information contained in the electronic consent.

Yes. Under FERPA, a teacher who is working from home may hold a parent or student conference while a spouse or child is in the same room if the teacher:

1) Does not disclose PII from the student's education records in hearing distance of her spouse or child;

2) Moves away from her spouse or child to discuss PII so that the spouse or child does not overhear the discussion; or

3) Obtains prior written consent, including electronic consent, from the parent permitting the disclosure.