Fixing FERPA: Clarifying Law Enforcement Access to Student Data
August 2025
Jessica Arciniega, Katherine Kalpos, Morgan Sexton, and Amelia Vance
CC BY-NC 4.0
A middle school teacher, Ms. Walters, notices one of her students exhibiting increasingly concerning behaviors as he struggles to process his parents’ ongoing divorce. She knows that the school resource officer (SRO), Officer Luke, went through his own parents' divorce in high school and has built strong, supportive relationships with students facing similar challenges. Ms. Walters wants to connect them, knowing this kind of mentorship and support often helps students navigate difficult family transitions. But she hesitates…
Does federal student privacy law protect the information that Officer Luke may write down about his conversation with the student?
Both Ms. Walters and Officer Luke understand that situations like this call for supporting students, not initiating law enforcement action. However, legal misunderstandings and the unclear intersection of Officer Luke’s roles as both a school official and law enforcement unit have the potential to transform Officer Luke’s routine support into the beginning of a law enforcement file, regardless of the reason Ms. Walters referred the student to him in the first place.
This scenario reflects a broader problem plaguing K-12 schools across the country: confusion about how federal student privacy law applies to SROs. While the Family Educational Rights and Privacy Act (FERPA) has a provision addressing “law enforcement unit records,” this exception was not designed with K-12 in mind. As a result, it is often unclear when information falls within FERPA’s law enforcement unit records exemption in the K-12 context.
No one in K-12 benefits from the current system. School staff struggle to provide student support without accidentally triggering potential law enforcement actions. Students can't predict whether their SRO interactions will result in confidential educational support or law enforcement documentation. Parents worry that the same behaviors previous generations handled as normal childhood development will now create criminal records that may follow their children into adulthood. Communities lack sufficient transparency to trust whether schools are handling safety and discipline issues fairly and effectively.
Understanding how to fix these problems requires examining both how the current confusion manifests in daily school operations and how we arrived at such a contradictory system.
Overview: Law Enforcement Unit Records Exemption
FERPA establishes federal privacy protections for student personally identifiable information (PII) in education records. However, FERPA contains several exemptions that can make PII not subject to FERPA’s privacy protections at all. One of these exemptions is for law enforcement unit records:
| Law Enforcement Unit Records (34 CFR 99.3 “Education records” and 34 CFR 99.8) | Records created and maintained by a school’s designated law enforcement unit for a law enforcement purpose. | School camera footage showing a student spray-painting classroom doors, so long as the cameras are used for security purposes and maintained by the SRO. |
Whether materials are classified as education records or as law enforcement unit records has major implications in practice:
PROTECTED under FERPA:
|
NOT PROTECTED under FERPA:
|
The distinction ultimately boils down to the default level of protections for student PII. For PII in education records, privacy protections are the default. Parents have the right to access their child’s education records and to limit when schools may share them, unless the safeguards of a specific FERPA exception are in place. For law enforcement unit records, the default allows the information to be shared. Unless state law or a contract with the school says otherwise, law enforcement unit records may be shared with other law enforcement or even the public–no parental consent necessary.
How We Got Here: Applying a Higher Education Solution to K-12 Schools
The Original Goal: Campus Police and Sunshine Laws
To understand why the current system is so challenging, it helps to examine the problem it was originally designed to solve. When Congress expanded and clarified FERPA's law enforcement unit records exemption in 1992,* the language was crafted to address a conflict that university police departments faced when navigating state transparency requirements and federal privacy law.
Several states had freedom of information laws requiring government agencies (including public universities) to make law enforcement records available to the public. This transparency served many important purposes: it allowed journalists to report on campus crime, enabled communities to assess university safety measures, and ensured that campus police operated with the same accountability as municipal police departments. But a problem arose when the Department of Education (USED) interpreted these disclosures as FERPA violations, sending a letter to Colorado State University threatening to cut off federal funding if the school continued to routinely release arrest information pursuant to state open records laws (Congressional Record, June 27, 1991).
This led to a frustrating lack of transparency and accountability following school safety incidents. As explained in a 1991 article from the Denver Post:
“Last fall, a serial murderer stalked students living near the campus of the University of Florida at Gainseville. To date, the man who molested, executed and mutilated five students at the school has not been apprehended. But if he is a student, and is arrested by the university's campus police force, U.S. Department of Education has a surprise in store for any Floridians who might be curious as to his identity: His name must be kept confidential, or the school will lose all of its federal funding. Say what?” (Congressional Record, article on page 16854)
Universities were stuck in an impossible position–complying with federal law meant going against state transparency goals, likely losing community trust as a result.
The Congressional Solution: Refining an Exemption
Congress resolved this dilemma in a way that made sense in the higher education context, where clear boundaries exist between law enforcement functions and educational activities. Large universities operate much like small cities, with dedicated police departments that investigate burglaries, assaults, or other crimes. In doing so, campus police create records that serve the same public safety purposes as those created by local police departments. FERPA’s law enforcement unit records exemption allows these records to be treated consistently for public disclosure purposes, regardless of where illegal activities take place.
Senator Wirth’s statements in the Congressional Record illustrate Congress’s desire for campus police records to be available to the community members under state sunshine laws:
“To reiterate, this amendment will help to ensure public safety by allowing students and campus communities to know about criminal activity at their schools. Campus crime is a growing problem that not only threatens the safety of that community, but hinders the education of our students.
Many States in this country have open record laws-which means the public has access to police records and can find out who has been arrested and for what crimes. This is the kind of access that can promote community involvement and help to bring peace to college campuses…
My amendment would allow campus police units to release the information that States have determined play a role in protecting the public safety without violating Federal law.” (page 16854)
The goal was to clarify that campus police are subject to the same public disclosure requirements as off-campus police departments, ensuring public access to information about illegal activity both on- and off-campus.
Application to K-12 Schools
As K-12 schools began employing more security personnel to address school safety concerns, this goal–ensuring that disclosures of crime on campus were handled consistently with how the information is treated off-campus–was lost. Unlike most college students, K-12 students are often minors. Juvenile police records are typically sealed and often provide mechanisms for expungement that acknowledge young people's capacity for rehabilitation and change. Applying FERPA’s law enforcement unit records exemption to K-12 risks more information about young students’ mistakes at school being released to the public, even if information about that child engaging in the same behavior outside of school would be protected from disclosure.
Another challenge in the K-12 context is that the policymakers crafting the law enforcement unit records exemption in 1992 assumed clear boundaries between educational and law enforcement functions, but today's K-12 schools often blur these lines extensively. This evolution from the focused law enforcement roles Congress envisioned to the multi-faceted positions common in today's K-12 schools has created significant confusion and contradictions.
But this isn’t to say that FERPA shouldn’t have a law enforcement unit records exemption for K-12 schools. SROs in K-12 schools frequently respond to student conduct widely understood to be criminal, including physical violence, sexual assault, and illegal drug use. Providing SROs with a method to disclose certain records may be an appropriate way to facilitate law enforcement in K-12 schools. However, because the current law enforcement unit records exemption was not designed with the nuances of K-12 in mind, this approach doesn’t make sense right now. To better facilitate SRO’s ability to uphold the law while also maintaining student privacy, FERPA must be amended to reflect the current realities of K-12.
The Difference Between K-12 and Higher Education Institutions
While the differences may seem obvious, it can be difficult to explain what makes it challenging to apply a policy from higher ed to K-12 (or vice versa). Here are a few reasons:
- Attendance Requirements: While students choose whether or not to enroll in higher ed, they are required to attend K-12.
- Supervision: K-12 schools guide and correct students, while students in higher ed are expected to take more responsibility and face the consequences independently.
- Structure: K-12 operates on highly regimented, closely monitored schedules, whereas college students tend to have more free, unstructured time.
- Service Models: K-12 schools proactively arrange services and accommodations for students. In higher ed, students must initiate requests for these services themselves.
- Organizational Structure: K-12 schools are the educational branch of local communities, while colleges and universities operate like their own self-contained small cities.
- Developmental Considerations: Children are less culpable due to lack of maturity, vulnerability to peer pressure, and ongoing character development in adolescence. (Jacquelyn Greene) The juvenile court system reflects this by focusing on rehabilitation rather than punishment, sometimes allowing records to be sealed so that mistakes made during childhood do not permanently impact a person's future.
- Constitutional Access Requirements: Many states guarantee free public elementary and secondary education (but not higher ed) as a constitutional right.(Education Commission of the States). The Supreme Court ruled in Plyler v. Doe that all children, regardless of citizenship, have a constitutionally protected right to free, appropriate public elementary and secondary education if the state provides it to other students.
Challenges Applying a Higher Education Solution to K-12 Schools
Law enforcement unit records are any materials:
- “Created by a law enforcement unit;
- Created for a law enforcement purpose; and
- Maintained by the law enforcement unit.” (34 CFR 99.8(b)(1))
While at first glance this test may seem straightforward, there are major problems with all three prongs in the K-12 context. We will briefly talk through common challenges that arise in K-12 related to each part of the test.
Prong 1: Created by a law enforcement unit
“Records of a law enforcement unit means those records, files, documents, and other materials that are— (i) Created by a law enforcement unit; (ii) Created for a law enforcement purpose; and (iii) Maintained by the law enforcement unit.”
1) SROs May Create Records in Other Capacities
A school may designate an SRO to serve as their law enforcement unit. However, that does not mean that the SRO will always be acting in their law enforcement capacity. How–and if–FERPA’s privacy protections apply to an SRO’s records depends upon what role the SRO was acting in when they made the record.
K-12 may task SROs to engage in a broad range of activities: 95.5% respond to calls on campus, 93.5% make arrests, 91% respond to classroom incidents, 75.4% conduct security assessments, 75.3% engage in crisis planning, and 49.5% monitor social media. (Bureau of Justice Statistics) An SRO might assist with operating school metal detectors in the morning, monitor the cafeteria for student disruptions at lunch, and counsel a struggling student before school ends.
At a high level, these activities can be broken down into serving two functions under FERPA: SROs can act as both (1) school officials; and (2) law enforcement units.
Note: FERPA states that no one other than parents and eligible students can access student PII in education records unless they have consent or an exception to FERPA’s consent requirement applies. FERPA’s school official exception offers a practical way for educators and third parties providing institutional services to the school–like edtech companies–to access student data for everyday instructional and administrative use. While SROs may qualify as school officials if all required safeguards are in place, FERPA’s school official exception was not designed to share data specifically with law enforcement.
For example, imagine an SRO acting as a school official to monitor a middle school cafeteria for student disruptions at lunch. If the SRO sends an email to the principal about two students yelling at each other, that email becomes part of those two students’ education records and is protected under FERPA. But what if, instead of yelling, the SRO observes a group of students engaging in illegal activity, like vaping? The SRO would remain a school official monitoring the entire cafeteria, while also serving as a law enforcement unit when observing the students vaping unless the school specifies otherwise.
The privacy protections that apply to the SRO’s records about the students’ vaping will depend upon whether the SRO created the documentation as a school official or as a law enforcement unit. On one hand, the SRO may send another email to the principal noting this behavior for use in school disciplinary proceedings. Like the prior email about students yelling, this email would be sent in the SRO’s school official capacity for internal disciplinary purposes, so it would also become part of the students’ education records and will be protected under FERPA. On the other hand, if the SRO creates records about those students vaping in their law enforcement unit capacity, those records may not be protected under FERPA at all. Unless the scope of when an SRO is permitted to act in their law enforcement unit capacity is clearly defined in a contract or Memorandum of Understanding (MOU) with the school, almost any SRO response to potential illegal activity–from writing down details to interviewing students–may be interpreted to have been done in their law enforcement unit capacity.
Can SROs use information they learn as a school official for law enforcement purposes?
No. FERPA requires SROs to bifurcate both their written files and, essentially, their brains, keeping information obtained while acting in their role as school officials separate from information they can use in their capacity as a law enforcement unit. In theory, this disconnect makes sense: police departments investigating illegal activity cannot access student data without consent or a FERPA exception, and an SRO’s position in the school should not be a loophole to gain such access.
However, it can be very challenging to actually separate the details in practice. No matter how hard an SRO may try to forget information they learned in their school official capacity–for example, information they heard about a student while at a school threat assessment team meeting–the SRO still knows that information and it may unintentionally color their future interactions with and reports about said student.
Even more confusing for SROs and school staff: what happens when an SRO is acting as both a school official and a law enforcement unit at the same time? Think back to our example of an SRO monitoring the school cafeteria for disruptive behavior and seeing students drinking underage. It’s impractical to expect the SRO to clearly know how to separate information learned while simultaneously acting in both capacities.
2) School Staff May Create Records as Law Enforcement Units
What happens if a school doesn’t have an SRO? Unlike colleges and universities, many K-12 schools lack the resources to maintain their own dedicated police units. That being said, K-12 schools still need to address safety concerns.
FERPA regulations give schools the flexibility to designate any individual or component of a school as their “law enforcement unit,” so long as the school has officially authorized or designated them to enforce laws, refer matters to law enforcement authorities, or maintain physical security and safety. (34 CFR 99.8(a)(1)) In 2019, USED emphasized this flexibility in guidance, explicitly stating that schools may choose to “designate a vice principal or other school official to act as the law enforcement unit officer.” (emphasis added)
Schools have significant discretion in determining who may utilize the law enforcement unit records exemption. However, tasking school staff with also serving as the school’s law enforcement unit can further compound the issue we just explored in the context of SROs–distinguishing when records are created as a school official vs. in a law enforcement unit capacity.
For example, consider a scenario where a principal oversees internal disciplinary proceedings for a student who brought a weapon to school. FERPA is very clear that disciplinary information is considered education records protected by FERPA—the student’s parents have a right to access this information, and the principal cannot share information about the incident without consent or a FERPA exception. Now imagine that the school also designated the principal as the school’s law enforcement unit. In many states, bringing a weapon to school is a crime. When responding to the incident, the principal must now analyze if (and when) they switch between acting as a school official facilitating school discipline and being a law enforcement unit enforcing state law.
Unless a written agreement with the school says otherwise, the principal may determine that some records created during their investigation were created in their capacity as a law enforcement unit. In this case, that documentation may qualify as law enforcement unit records that are exempt from FERPA entirely (and depending on state law, may immediately or sometime in the future be subject to public disclosure under state freedom of information laws).
When Congress added the law enforcement unit exemption, they envisioned a clear separation between the school officials carrying out a school’s disciplinary process and the law enforcement units reporting student information back to local police departments. When these roles are conflated, it introduces unnecessary confusion into the mix and undermines student privacy.
“Law enforcement unit” is not a term of art or a catch-all term for staff working on school safety issues. The only reason to designate someone as a “law enforcement unit” under FERPA is to specify what type of record falls outside of FERPA’s protections. Not all staff members involved with school safety planning and response need to be designated as law enforcement units. For example, a school should not make every member of their threat assessment team a law enforcement unit. Instead, schools should only designate staff as law enforcement units if they want the possibility of that staff member sharing student information outside of the school, such as reporting incidents back to local law enforcement or talking to the press following an incident on campus.
Note: For simplicity and consistency, in this blog we will default to analyzing situations where a K-12 school has partnered with an SRO to serve as the school’s law enforcement unit. We will specify before switching to contexts where the school designates school staff to serve as the school’s law enforcement unit.
Prong 2: Created for a law enforcement purpose
“Records of a law enforcement unit means those records, files, documents, and other materials that are— (i) Created by a law enforcement unit; (ii) Created for a law enforcement purpose; and (iii) Maintained by the law enforcement unit.”
1) “Law Enforcement Purpose” is Undefined
FERPA does not define the term “law enforcement purpose.” Instead, the scope of this term varies depending on schools’ administrative decisions about how (and if) to define permissible law enforcement purposes in a written agreement with the law enforcement unit. Schools are generally free to define “law enforcement purpose” however narrowly they want to in contracts. But if a school doesn’t establish a definition for what it deems to be a “law enforcement purpose,” the decision may be left up to an SRO’s own discretion. In this case, there is a risk that the term may unintentionally be interpreted too broadly so that it is not actually a limitation in practice.
For example, imagine that a school asks their SRO to monitor student social media accounts to identify potential cyberbullying incidents and safety threats. The SRO screenshots a student’s post saying they broke into the school after-hours to find a copy of tomorrow’s history test, sharing pictures of the questions and answer key with their followers. Was the screenshot taken for a law enforcement purpose? It depends on if the school has set boundaries on what may count as a law enforcement response.
If the school specified in their contract with the SRO that all records created while monitoring student social media posts for the school are done solely for internal school disciplinary purposes, the screenshot would be protected under FERPA. However, if the school does not define the scope of law enforcement purposes, the SRO may understandably reason that they acted for law enforcement purposes once discovering a legal violation–bringing the screenshot outside of FERPA’s protections.
2) Dual Purpose Records
To make things even more complicated, previous USED guidance noted that materials can still be law enforcement unit records while simultaneously being protected by FERPA. When issuing regulations to implement the law enforcement unit records exemption in 1995, the Department wrote that:
“where a law enforcement unit also performs non-law enforcement functions, the records created and maintained by that unit are considered law enforcement unit records, even where those records were created for dual purposes (e.g. for both law enforcement and disciplinary purposes).” (page 3467)
Again, this approach makes sense in the higher education context: while serving in their law enforcement capacity, campus police frequently respond to incidents that might ultimately lead to both school discipline and criminal charges. Allowing them to create one record that can be used for both purposes–one copy of which is protected by FERPA as an education record, and one copy of which is not protected because it is a law enforcement unit record–is a practical solution that avoids duplicating their work. Recognizing this reality, the Department noted that they expected LEUs creating records exclusively for a non-law enforcement purpose “to be very rare, especially with incidents involving criminal conduct by students at postsecondary institutions.” (page 3467)
But a problem arises in K-12 because, as we previously discussed, SROs frequently act outside of their law enforcement unit capacity. Allowing dual purpose records–combined with the note that it is rare for designated law enforcement units to create records unrelated to law enforcement purposes–means that almost any interaction between an SRO and K-12 students could potentially lead to the creation of law enforcement unit records. If the school does not proactively limit when records may be created for dual purposes, it could be argued that essentially any records an SRO creates–regardless of why the primary purpose they made the record in the first place–were also created for law enforcement purposes.
Think back to the example of an SRO monitoring the school cafeteria for disruptive behavior and seeing students vaping. We noted before that the SRO may send an email to the principal noting this behavior for school disciplinary proceedings, and that email would become part of the students’ education records and will be protected under FERPA. If we add in the dual purpose complexity, it could be argued that this email was also written for law enforcement purposes.
Unfortunately, guidance has not been updated or clarified to align with this reality, meaning that essentially any safety-related documentation created by SROs in K-12 could simultaneously qualify as both an education record protected under FERPA and law enforcement unit record exempt from FERPA coverage.
Prong 3: Maintained by a law enforcement unit
“Records of a law enforcement unit means those records, files, documents, and other materials that are— (i) Created by a law enforcement unit; (ii) Created for a law enforcement purpose; and (iii) Maintained by the law enforcement unit.”
1) Sharing Records
What happens when a law enforcement unit shares copies of their records with the school? Like we just discussed–in certain scenarios, FERPA permits the same records to simultaneously be classified as both an education record (which is protected under FERPA) and a law enforcement unit record (which is not protected under FERPA). Sharing records presents another situation where this confusion arises.
For example, imagine that a high school student created an AI-generated, deep fake nude image of one of their classmates and texted the picture to their friends, causing a major disruption at school. We’ve already established that if the principal (who is not part of the law enforcement unit) investigates and disciplines the student, the related documentation will be education records protected under FERPA; but if the SRO investigates the same conduct for a law enforcement purpose, the SRO’s records will be law enforcement unit records not covered under FERPA at all.
But let’s add another layer of complexity: suppose the SRO shares documents or information from their investigation with the principal for disciplinary purposes. In this case, the “copy” given to the principal would be protected under FERPA, but the SRO’s original documentation remains outside the scope of FERPA’s privacy protections–even though it contains the exact same information protected under FERPA when in the principal’s hands.
2) Commingling Law Enforcement Unit Records with Education Records
When the same person serves both educational and law enforcement functions, maintaining separate record-keeping systems distinguishing education records from law enforcement unit records can be extremely difficult. Without a clear delineation between the education records and law enforcement unit records, it can be very complicated for schools to ensure that they are honoring parents and eligible students’ FERPA right to inspect and review all of their education records.
An Extra Layer of Complexity: FERPA Right to Request Amendment
Imagine that an SRO writes an incident report following a safety incident at school. The SRO makes two copies: one to use in the school’s internal disciplinary process for the student involved (an education record), and the other for the SRO to keep for law enforcement purposes. We’ve already established that the student’s parents only have FERPA rights to inspect and review the copy of the report that is an education record. But what if in their review, the parents discover a factual error and ask to have it corrected? FERPA only provides a mechanism for parents to request an amendment for the copy of the report that is an education record. The law enforcement unit record exemption moves the copy maintained by the SRO outside of FERPA’s student privacy protections. This creates a significant gap where the report used for law enforcement purposes may remain inaccurate even after an identical record given to the school has been corrected.
This also creates significant hurdles for education research. Confusion over record classification has made it significantly more difficult to obtain the specific data needed to evaluate how school safety and disciplinary practices actually affect students. When schools are uncertain about the line between disciplinary records (which are education records covered by FERPA) and law enforcement unit records (which are exempted from FERPA), communities lose the ability to monitor whether discipline is being administered fairly or to identify concerning trends that might require intervention.
Suggested Solutions: Creating Clarity and Consistency in K-12
Effective reform must recognize that K-12 schools face fundamentally different challenges than the universities for which the current law enforcement unit records exemption was designed. The goal of reforming FERPA's law enforcement unit records exemption is not to prevent schools from maintaining safe learning environments or to eliminate appropriate law enforcement activities when they're genuinely needed to protect students. Rather, it's to create clear, consistent rules that protect both student privacy and legitimate community transparency interests while ensuring that parents’ FERPA rights are clearly and consistently upheld.
Notify Parents about Law Enforcement Units in Annual FERPA Notices
Schools should be transparent and proactively communicate to students and parents their policies about when and how student information may be shared with law enforcement, and what protections are in place when such sharing occurs. To promote such transparency, USED should amend FERPA regulations to require schools to disclose in their annual FERPA notice:
- Whether the school has a designated law enforcement unit, and the effects this decision has regarding student information sharing;
-
- If yes, schools should also be required to specify the name and/or position title of designated law enforcement units.
-
- Which information is classified as law enforcement unit records; and
- How–if at all–students and parents can access law enforcement unit records.
This transparency would help parents understand their rights and enable communities to hold schools accountable for their information practices. It would also serve as an important reminder that federal parental rights to these records under FERPA is contingent on them being classified as education records, since parents’ ability to access information about their children that is exempt from FERPA coverage will be dependent on state law. Adding the recommended disclosures to annual FERPA notices will encourage schools to think more carefully about their law enforcement designations and record-keeping procedures.
Differentiate Between Safety Roles and Law Enforcement Units
FERPA’s law enforcement unit records exemption grants select individuals in the school community the ability to completely bypass FERPA’s student privacy safeguards in certain scenarios. This is a significant deviation from established student privacy norms. As such, the school staff capable of initiating this exemption should be appropriately limited to those serving traditional campus security and policing roles–not extending to all staff who may engage in routine, safety-related functions. For example, while supervising children as they get on and off the school bus inherently involves a level of safety monitoring, this should not be a reason for the school to designate all of their bus drivers as law enforcement units who can create records outside the scope of FERPA.
To quickly address most of the K-12 challenges we have identified in this resource, USED could issue guidance clearly differentiating staff serving routine school safety functions from law enforcement units. This approach would better align the scope of FERPA’s law enforcement unit records exemption with what Congress originally envisioned: permitting public disclosure of on-campus incidents and arrest records.
Require Schools to Have a Written Agreement With Law Enforcement Units
If a school chooses to designate an entity as their law enforcement unit, Congress or USED should act to amend FERPA to require the school to enter into a written agreement–such as a Memorandum of Understanding (MOU)–with them that clearly establishes the law enforcement unit’s role within the school. For example, while a school may want their SRO to intervene in a fight, the school may not want the SRO to report the fight to law enforcement even though it is technically a crime. The school should specify this boundary in an MOU with the SRO.
The National Association of School Resource Officers advises that all “school-law enforcement partnership[s] should have such an agreement,” writing in their To Protect & Serve report that:
“The case for an MOU in a safe schools program is easy to state. It sets forth the nature of the tasks to be performed by the SRO when assisting school officials in providing a safe and effective learning environment. It allows both the schools and law enforcement to find balance and a zone of comfort in the unique tasks that are performed when an SRO works on a public school campus. For example, it is assumed that SROs are already operating within the scope of their legal duties as a sworn law enforcement officer. What additional roles, if any, will the SRO fill as the safe schools plan is implemented? Will the SRO assist in enforcing the school code of conduct? Will the SRO teach classes or supervise school-sponsored events? Will the SRO be an extension of the police department when assigned to the school, or considered an independent contractor? To whom will the SRO report, the school administrator, or the law enforcement commander? These issues must be clearly spelled out in the MOU so that legal rules can be rigorously applied to protect the rights of students and other school personnel.”
USED should issue guidance requiring the written agreements between schools and law enforcement units to:
- Identify the individuals (names, job titles, and contact information) serving as the school’s law enforcement unit;
- Define the scope of what the law enforcement unit is responsible for and what they are prohibited from doing within the school;
- Establish when the law enforcement unit is acting in their law enforcement unit capacity;
- Designate what the school deems to be permissible law enforcement purposes;
- List FERPA’s requirements for law enforcement officers when acting in their role as a school official and when acting in their role as a law enforcement unit; and
- Require all designated law enforcement units to certify that they understand their responsibilities to protect student data when acting in both roles.
Add a Fourth Prong to the Law Enforcement Unit Records Test for K-12
While necessary conditions, the existing three-prong test for determining when materials constitute law enforcement unit records is not enough in the K-12 context because it does not address the additional complexities stemming from SROs acting as both school officials and law enforcement units. To further the underlying goal of the law enforcement unit records exemption–ensuring that disclosures of crime on campus are handled consistently with how the information is treated off-campus–while also accounting for the unique circumstances of K-12, we recommend USED update the FERPA regulations to add a fourth prong to the test:
In the K-12 context, law enforcement unit records must be created at or after the time a school decides to refer a matter to local law enforcement.
Adding this timing element finds a crucial balance: it allows SROs to collaborate with local law enforcement and promotes community transparency into that process while ensuring that schools are the ultimate decisionmaker about if and when student information will lose all protections under FERPA. But even if the school decides not to refer an incident to local law enforcement–meaning all records related to the matter remain protected under FERPA– law enforcement may still access that information in other ways. For example, police departments may utilize FERPA’s subpoena or health and safety exceptions. The crucial difference here is that there would be established student privacy guardrails around law enforcement’s access to the data and specific parental rights are in place.
This would not change an SRO’s ability to access student PII when needed.
SROs can still access student PII under FERPA’s school official exception when they have a legitimate need to know that information (such as when they are serving on a threat assessment team). However, our recommendation would provide SROs with much-needed clarity about where the line is when determining what documents related to an internal disciplinary incident may also be considered law enforcement unit records.
To provide even more clarity, it would also be helpful for USED to provide specific examples of what may not constitute law enforcement unit records, such as:
- Records of disciplinary action at an educational institution;
- Records of a threat assessment team at an educational institution;
- Records made by a law enforcement unit using insights or information that they obtained while acting in their capacity as a school official; and
- Records commingled with, or not clearly delineated from, education records.
Note: We are concerned about times it may be unclear what records parents and eligible students have the right to inspect and review under FERPA, especially when a single individual designated as the school’s sole law enforcement unit (such as the principal) does not have a sophisticated filing system that clearly distinguishes which records are protected under FERPA and which are not. To promote transparency and ensure parents may access all of their child’s education records, we recommend treating all commingled records as education records subject to FERPA.
End Notes:
*The FERPA statute, 20 U.S.C. 1232g, includes the following note about the scope of the law enforcement unit records exemption pre-1992 amendment:
“1992—Subsec. (a)(4)(B)(ii). Pub. L. 102–325 amended cl. (ii) generally. Prior to amendment, cl. (ii) read as follows: ‘if the personnel of a law enforcement unit do not have access to education records under subsection (b)(1) of this section, the records and documents of such law enforcement unit which (I) are kept apart from records described in subparagraph (A), (II) are maintained solely for law enforcement purposes, and (III) are not made available to persons other than law enforcement officials of the same jurisdiction;’”
