FERPA, the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99), is a federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.
FERPA protects the privacy of student educational records and affords students the right to refuse to permit New Mexico State University (and other educational institutions) from releasing or disclosing any information about them.
Students have three fundamental rights under FERPA:
- Right to review and inspect education records.
- Right to request to amend education records.
- Right to limit disclosure of personally identifiable information contained in education records.
Who is responsible for FERPA?
Educational institutions are required to develop policies for implementing appropriate provisions of FERPA. New Mexico State University Administrative Rules and Procedures 5.40 (Access to Student Educational Records – FERPA Compliance) addresses FERPA. At NMSU, the Registrar is the steward of all current and former enrolled student academic records and has been delegated the responsibility to ensure that information from education records is released only to those individuals and agencies that:
- Have a legitimate educational interest, or
- Have been granted legally authorized access.
At the federal level, the responsibility for administering FERPA has been assigned to the Family Compliance Office within the Department of Education.
To whom does FERPA apply?
At New Mexico State University, FERPA applies to the education records of:
- Persons who attend a postsecondary school (regardless of age) and
- All educational agencies or institutions receiving funds under any program administered by the U.S. Department of Education.
A student’s FERPA rights begin on their first day of class at New Mexico State University.
What is an education record?
“Education records” mean records that are maintained by New Mexico State University in any form or format (e.g. paper, electronic, digital image, film, video, audio tape), which contain information directly related to a student and are personally identifiable to a student. Education records do not include:
- Personal records of university employees that are in the sole possession of the maker (i.e. notes of conversations), are used as a personal memory aid, and are not accessible or revealed to any individual except to a successor in the position held;
- Records of the New Mexico State University police department used for law enforcement purposes;
- Student medical and counseling records maintained and used only in connection with the provision of medical treatment or counseling of the student and are made available only to the individuals providing the treatment;
- Employment records unrelated to the student’s status as a student;
- Records created or received after an individual is no longer a student in attendance and that are not directly related to the individual’s attendance as a student (i.e. alumni records); or
- Grades on peer-graded papers before they are collected and recorded by a faculty member.
What are the rights of students?
Students who attend New Mexico State University:
- Have the right to inspect and review their education records.
- Have the right to request amendment of records.
- Have some control over the disclosure of personally identifiable information from these records.
- Have authority through Proxy Management to add or modify access for parents, guardians, spouse, friends, or others to view myNMSU information.
School officials may not disclose FERPA protected information about nor permit inspection of their records to anyone, including parents unless prior written permission is obtained from the student or such actions are covered in exceptions permitted by the act.
When can a student’s education records be disclosed without the student’s consent?
The general rule is that the university may not disclose personally identifiable information from a student’s education records to a third party unless the student has provided written consent. However, there are several exceptions which may permit the university to disclose personally identifiable information from education records without consent. Some of the more commonly invoked exceptions are described below:
Student directory information
One exception permits the school to disclose a student’s personally identifiable information when the information is properly designated as “directory information.” Directory information is information that would not generally be considered harmful nor an invasion of privacy if disclosed. At New Mexico State University, in accordance with Administrative Rules and Procedures Chapter 5 Section 40, student directory information is defined as:
- Name
- Aggie ID number
- Class (i.e. Freshman, Sophomore, Junior, Senior)
- College and major
- Dates of attendance
- Degree(s) earned
- Honors and awards received, including selection to the dean’s or chancellor’s list, honorary organization, or the GPA range for the selection
- Address
- Local or contact telephone number
- NMSU e-mail address
- Most recent previous educational institution attended
- Job title, hiring department, departmental address, and departmental telephone number of undergraduate and graduate student employees.
- Participation in officially recognized activities and sports
- The weight and height and age of members of athletic teams
However, a student has the right to restrict the university’s right to disclose directory information, in which case, NO student education information may be disclosed without a court order (subpoena), signed consent from the student, or application of another exception justifying disclosure without consent. To suppress directory information, a student must make a written request by completing and signing the “No Release of Information” form and submitting it to University Student Records via email to records@nmsu.edu.
Students who do not elect to suppress their directory information may still manage their privacy preferences to control the information that will be displayed in the New Mexico State University Phonebook.
Certain information should never be released by New Mexico State University. This includes confidential information such as:
- Social Security Number
- Grade Point Average (GPA)
- Academic Standing
- Grades
This also includes sensitive demographic information such as:
- Gender
- Race
- Ethnicity
- Nationality
Release to school officials
A second exception is that the university may release personally identifiable information from student education records without the student’s consent to school officials who have a legitimate educational interest to access the records. FERPA rights do not supersede the financial obligation of a student, former student or alumnus to NMSU. Requests for official transcripts will be withheld until all financial obligations are paid. “School official” means:
- An employee, agent or officer of the university acting in his or her official capacity;
- A person serving on university committees, boards, and/or councils, including an individual serving on a disciplinary or grievance committee;
- Another educational institution that requests records for a particular student who seeks or intends to enroll or where the student is already enrolled provided the disclosure is for purposes related to the student’s enrollment or transfer; and
- A person or company with whom the university has contracted (e.g. internship and clinical facilities, attorney, auditor, or collection agent) but limited to only the specific student information needed to fulfill the contract. The contracting entity is bound to follow FERPA regulations for control, maintenance, use and re-disclosure of the information provided to it.
“Legitimate educational interest,” means the school official is performing an authorized task or an activity within their scope of authority on behalf of NMSU, and access to an educational record is necessary or appropriate to fulfill the school official’s professional responsibilities for the university.
Additional exceptions
FERPA contains some additional exceptions, including, but not limited to, those listed below. FERPA rights do not supersede the financial obligation of a student, former student or alumnus to NMSU. Requests for official transcripts will be withheld until all financial obligations are paid. Depending upon the exception, the institution may be required to make a reasonable attempt to notify the student in advance when educational records are sought (e.g. subpoenas) and/or to permanently notate in the educational record the details relating to a nonconsensual disclosure permitted by an exception.
- Disclosure to another school in which the student seeks or intends to enroll;
- Disclosure in connection with financial aid for which the student has applied or w which the student has received, if necessary for certain purposes outlined in the Act;
- Disclosure to appropriate parties, including parents, in connection with a health or safety emergency;
- Disclosure to certain authorized representatives of the Comptroller General or the Attorney General of the USA, the U.S. Secretary of Education, state and local educational authorities for audit or evaluation of federal or state supported education programs, or for the enforcement of or compliance with federal legal requirements that relate to those programs;
- Disclosure to comply with a judicial order or a lawfully issued subpoena;
- Disclosure to the victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense concerning the final results of a disciplinary hearing with respect to the alleged crime, and disclosure to any third party the final results results (limited to name, violation and sanction) of a disciplinary proceeding related to a crime of violence of non-forcible sex offense if the student who is the alleged perpetrator is found to have violated the school’s rules or policies.
What should I do if become aware of a FERPA violation?
If you inadvertently disclose protected student data, or suspect someone else has, you should immediately email privacy@nmsu.edu and provide a description of the situation.
