FERPA Privacy

Medium

Student Privacy: FERPA

Student Privacy

The purpose of this policy is to protect student privacy. All NDCDE employees are required to comply with this policy and all requirements under FERPA. Failure to comply is considered a violation of the Employee Conduct Policy, B4j. 
As a virtual school, NDCDE maintains all student educational records in an electronic format. 
The Family Educational Rights and Privacy Act (FERPA) affords parents and students who are 18 years of age or older ("eligible students") certain rights with respect to the student's education records. These rights are:

  1. The right to inspect and review the student's education records within 45 days after the day the NDCDE receives a request for access. Parents or eligible students who wish to inspect their child’s or their education records should submit to the dean of students or assistant superintendent a written request (sent via email) that identifies the records they wish to inspect. The school official will make arrangements for access and notify the parent or eligible student of when and how the electronic records may be inspected.
  2. The right to request the amendment of the student’s education records that the parent or eligible student believes are inaccurate, misleading, or otherwise in violation of the student’s privacy rights under FERPA. Parents or eligible students who wish to ask NDCDE to amend their child’s or their education record should email the NDCDE dean of students or assistant superintendent, clearly identify the part of the record they want changed, and specify why it should be changed. If the school decides not to amend the record as requested by the parent or eligible student, the school will notify the parent or eligible student of the decision and of their right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the parent or eligible student when notified of the right to a hearing.
  3. The right to provide written consent before the school discloses personally identifiable information (PII) from the student's education records, except to the extent that FERPA authorizes disclosure without consent.

One exception, which permits disclosure without consent, is disclosure to school officials with legitimate educational interests. The criteria for determining who constitutes a school official and what constitutes a legitimate educational interest must be set forth in the school’s or school district’s annual notification for FERPA rights.

  • A school official typically includes a person employed by NDCDE as an administrator, supervisor, instructor, or support staff member (including health or medical staff and law enforcement unit personnel) or a person serving in a supervisory capacity over NDCDE per NDCC Chapter 15-19. A school official also may include a volunteer, contractor, or consultant who, while not employed by the school, performs an institutional service or function for which the school would otherwise use its own employees and who is under the direct control of the school with respect to the use and maintenance of PII from education records, such as an attorney, auditor, medical consultant, or therapist; a parent or student volunteering to serve on an official committee, such as a disciplinary or grievance committee; or a parent, student, or other volunteer assisting another school official in performing his or her tasks. NDCDE considers learning coaches as school officials.
  • A school official typically has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.
  • Because the majority of NDCDE students attend its courses on a supplementary basis, NDCDE discloses education records without consent to officials of another school or school district in which a student seeks or intends to enroll, or is already enrolled if the disclosure is for purposes of the student’s enrollment or transfer.

Complaints

The right to file a complaint with the U.S. Department of Education concerning alleged failures by the NDCDE to comply with the requirements of FERPA. The name and address of the Office that administers FERPA are: 
Student Privacy Policy Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202

Permitted Disclosures without Parental Consent

FERPA permits the disclosure of PII from students’ education records, without consent of the parent or eligible student, if the disclosure meets certain conditions found in § 99.31 of the FERPA regulations. Except for disclosures to school officials, disclosures related to some judicial orders or lawfully issued subpoenas, disclosures of directory information, and disclosures to the parent or eligible student, § 99.32 of the FERPA regulations requires the school to record the disclosure. Parents and eligible students have a right to inspect and review the record of disclosures. 
NDCDE may disclose PII from the education records of a student without obtaining prior written consent of the parents or the eligible student only if one of the following criterion apply:

  • To other school officials, including teachers, within the educational agency or institution whom the school has determined to have legitimate educational interests. This includes contractors, consultants, volunteers, or other parties to whom the school has outsourced institutional services or functions, provided that the conditions listed in § 99.31(a)(1)(i)(B)(1) - (a)(1)(i)(B)(3) are met. (§ 99.31(a)(1))
  • To officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already enrolled if the disclosure is for purposes related to the student’s enrollment or transfer, subject to the requirements of § 99.34. (§ 99.31(a)(2))
  • To authorized representatives of the U. S. Comptroller General, the U. S. Attorney General, the U.S. Secretary of Education, or State and local educational authorities, such as the State educational agency (SEA) in the parent or eligible student’s State. Disclosures under this provision may be made, subject to the requirements of § 99.35, in connection with an audit or evaluation of Federal- or State-supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs. These entities may make further disclosures of PII to outside entities that are designated by them as their authorized representatives to conduct any audit, evaluation, or enforcement or compliance activity on their behalf, if applicable requirements are met. (§§ 99.31(a)(3) and 99.35)
  • In connection with financial aid for which the student has applied or which the student has received, if the information is necessary for such purposes as to determine eligibility for the aid, determine the amount of the aid, determine the conditions of the aid, or enforce the terms and conditions of the aid. (§ 99.31(a)(4))
  • To State and local officials or authorities to whom information is specifically allowed to be reported or disclosed by a State statute that concerns the juvenile justice system and the system’s ability to effectively serve, prior to adjudication, the student whose records were released, subject to § 99.38. (§ 99.31(a)(5))
  • To organizations conducting studies for, or on behalf of, the school, in order to: (a) develop, validate, or administer predictive tests; (b) administer student aid programs; or (c) improve instruction, if applicable requirements are met. (§ 99.31(a)(6)
  • To accrediting organizations to carry out their accrediting functions. (§ 99.31(a)(7))
  • To parents of an eligible student if the student is a dependent for IRS tax purposes. (§ 99.31(a)(8))
  • To comply with a judicial order or lawfully issued subpoena if applicable requirements are met. (§ 99.31(a)(9))
  • To comply with a judicial order or lawfully issued subpoena if applicable requirements are met. (§ 99.31(a)(9))
  • Information the school has designated as “directory information” if applicable requirements under § 99.37 are met. (§ 99.31(a)(11)). NDCDE defines the following as directory information:
    • Student's name
    • Address
    • Telephone listing
    • Electronic mail address
    • Photograph
    • Dates of attendance
    • Grade level
    • Degrees, honors, and awards received
    • The most recent educational agency or institution attended
    • Student ID number, user ID, or other unique personal identifier used to communicate in electronic systems but only if the identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity, such as a PIN, password, or other factor known or possessed only by the authorized user
  • To an agency caseworker or other representative of a State or local child welfare agency or tribal organization who is authorized to access a student’s case plan when such agency or organization is legally responsible, in accordance with State or tribal law, for the care and protection of the student in foster care placement. (20 U.S.C. § 1232g(b)(1)(L))
  • To the Secretary of Agriculture or authorized representatives of the Food and Nutrition Service for purposes of conducting program monitoring, evaluations, and performance measurements of programs authorized under the Richard B. Russell National School Lunch Act or the Child Nutrition Act of 1966, under certain conditions. (20 U.S.C. § 1232g(b)(1)(K))

Disclosure to non-Custodial Parents

NDCDE shall follow the standards contained in its Student Custody Policy, C4d, when a non-custodial parent requests access to a student educational records.

Disclosure Authority

External disclosure of information in student educational records, whether directory information or PII, requires pre-approval from the employee's department head (leadership team member), standing written approval from the applicable department head (leadership team member) in writing, or standing disclosure authority given to the employee through his/her job description. Employees who disclose student educational records without such approval will be subject to disciplinary consequences. Leadership team members shall check with a Chief Privacy Officer before authorizing or expanding employee authority to disclose student educational records. They should also check with a Chief Privacy Officer if uncertain of an employee's scope of authority to disclose student educational records. Any NDCDE employee who releases educational records to parents shall review and acknowledge their understanding and compliance with the Student Educational Records Parental Disclosure & Amendment Procedure, A10a.

Designation and Responsibilities of Privacy Officers

The NDCDE director, assistant superintendent, and IT director shall serve as NDCDE Privacy Officers. In this role, they are responsible for approving requests from third-party individuals/entities to access student educational records, excluding parents, learning coaches, and school district officials in which a student is enrolled who are all deemed to have a legitimate educational interest or rights to access student educational records under FERPA. The Privacy Officers shall jointly maintain a master list of all vendors and other entities that have access to NDCDE student educational records and the scope of their access. The Privacy Officers ensure that NDCDE grants access to student data only to the extent there is a legitimate educational interest or a provision allowing disclosure in law.

Data Breaches

NDCDE employees are responsible for informing a Privacy Officer of any known or suspected breach of PII. When a privacy officer becomes aware of a breach of student PII, s/he shall contact the NDCDE director. The NDCDE director shall determine if enactment of data breach response procedures contained in NDCC Ch. 51-30 is appropriate.

Training

NDCDE employees shall receive information and/or training on confidentiality requirements pertaining to student education records and consequences for breaching confidentiality. NDCDE shall also provide training to applicable personnel on the procedures for requesting to release student information contained in this policy.

Annual Notices

Because NDCDE accepts enrollments on a rolling basis, causing frequent changes to its student body, it will comply with all FERPA annual notice requirements by posting them on the NDCDE website and ensuring that parents are directed to review these notices and submit opt-out paperwork to the dean of students or assistant superintendent when necessary. NDCDE will honor opt-out notices indefinitely or until a parent notifies NDCDE of a change to them.

Record Amendment Procedure

Please click on Record Amendment Procedure for details on amending an education record.