NSBA '19: Federal Student Privacy Update

I'm at the National School Boards Convention in Philadelphia this weekend; periodic blogging as warranted. This morning, I'm at the Council of School Attorneys' section with an update on FERPA
with Michael Hawes, Director, Student Privacy Policy Office, US DoE
"there's been so much change over the past few months in the Department over the past few months that my bio has changed I think three times since I submitted it"

"I want to be a resource for all of you"
"have had a major reorganization of the Department" now consolidated into Student Privacy Policy Office (SPPC) reports to Assistant Secertary for Planning, Evaluation, and Policy Development
"all of our functions...are still there, they're just in one place"
Inspector General report on Department's enforcement of FERPA
"had some pretty critical findings over enforcement of FERPA"
longstanding and substantial backlog of FERPA complaints, control weaknesses
by May 2018 had 1197 still pending complaints; by mid-March 2019, down to 621 open complaints
now regular updates on all complaints to complainants
new investigation processes "Improving the Effectiveness and Efficiency of FERPA Enforcement" issued
"implement a risk-based approach to processing and resolving FERPA complaints"
now providing resolution assistance and intermediation, in addition to formal complaint investigation

Rulemaking is coming soon: updating FERPA regulations to address some unanswered policy issues

conducting a review of district websites to assess how well they communicate with parents and students about their data practices; he stresses that this is not an audit
will then provide technical assistance follow up

Letter to AGORA: parents cannot be forced to waive their rights under FERPA
"if you are using education technology, if those apps and services are required, you cannot require" parents and students to agree to terms of service
using school official exception

integrated data systems guidance

college admissions examinations: disclosure of information
providing parental opt-out for the pre-test surveys
students are under 18; pre-test surveys include religion, salary information
redisclosure of information to colleges and such; students cannot consent as they are not of age
hm...I know I didn't get this

photos and videos

School safety:
FERPA in context of immunization
federal commission school safety report
school resource officers, school law enforcement units, and family education rights and privacy act

who can see video from school cameras without waivers?
parents of students
FERPA allowed to view, not to give copies; up to discretion of schools
advised getting consent of parents "if possible"
school cannot redact vidoe school school can view entire video
"directly related": use in discipline; depiction of activity that results in discipline; student being hurt; student in violation of law
hallway marker didn't intend to make student "focus" of video (student may make themselves a focus)
schools cannot charge parents for redaction of records; can charge for copies
schools may not give videos that are education records to law enforcement without a subpoena unless video is directly related or student is in danger
district protocol for maintaining video

giving education records to law enforcement
schools cannot simply turn over records of student statements without a warrant
"talk to your police department before it gets to the subpoena and warrant stage"

to be a school official you must be so designated by the district each year; is your school resource officer an educational official?
must be "a legitimate educational interest"
Law enforcement "in my experience" don't want records for educational purposes (which is the only reason they can have them that don't violate FERPA)
can easily violate FERPA if they take records and redisclose them
Letter to Montgomery County Schools
personal knowledge is allowed to be disclosed; cannot take from educational record

"Improving Effectiveness" report notes that there is still some confusion (no kidding!) and retains a pre-internet view of data

is redaction ever sufficient? very often parents can figure out the identify of other students

eligible students: once students are enrolled at an institute of higher education, they are "eligible" and have their own rights (while also still being underaged, which students ALSO are, so parents have rights, too)
I did not know this, and I had a kid so enrolled. Has anyone in Massachusetts talked about this?

"there is no penal provision in FERPA" Cohen letter