Clarifying Data Sharing Through a Defined Pedagogical Exception
June 2024
Katherine Kalpos, Morgan Sexton, Amelia Vance, and Casey Waughn
CC BY-NC 4.0
A second-grade teacher, Ms. Montana, is teaching her class about multiplication. She writes “2 x 3 = _” on the board and asks if anyone would like to come forward and write the answer. When a student raises his hand, Ms. Montana says, “Yes, Jackson, come on up.” Jackson walks to the board, writes the number “6”, and goes back to his seat. Ms. Montana congratulates him on getting the correct answer and continues the lesson.
Sounds pretty routine, right? But technically, Ms. Montana may have violated Jackson’s privacy by calling him by name in front of other students and allowing other students to see his answer to the math problem. Such a strict reading of FERPA’s privacy protections would be ridiculous, making it impractical for teachers to educate multiple students together in the same classroom. For this reason, schools operate under an implied exception to FERPA’s consent requirement so that teachers like Ms. Montana can engage in everyday instructional encounters like this. We can call this the implied “pedagogical exception.”
But FERPA needs more than an implied exception to protect students’ personally identifiable information (PII) disclosed in this manner from additional and other types of disclosures in the future; in our example, it is fine for other students to see Jackson’s answer to the math problem in class, but Ms. Montana should not then be allowed to post Jackson’s answer on social media. Instead of relying on an implied pedagogical exception that few teachers have ever heard of, an explicit pedagogical exception should be added to FERPA that permits disclosures of student PII specifically for classroom instruction while maintaining all other FERPA protections for that information in the future.
FERPA and Routine Sharing of Student Information in Schools
Student PII is shared every day at schools in ways that are so common that we often don’t even notice. Teachers call students by name in class, assign group projects, display student artwork, and share student PII in many other non-invasive ways for various educational purposes. And this makes sense––teachers need to share student data in these ways to facilitate everyday instruction. However, despite these activities being generally accepted (and often necessary) in K-12 classrooms, there is widespread uncertainty among education stakeholders and scholars about whether these activities technically violate FERPA.
In practice, FERPA is not used as a strict barrier to prevent common, non-invasive sharing of student PII when doing so is necessary and central to an educational purpose. Instead, schools rely on an implied pedagogical exception to FERPA’s consent requirement to engage in these activities.
Where Does the Implied Pedagogical Exception Come From?
While there is no explicit pedagogical exception to FERPA’s consent requirement, FERPA regulations allude to an implied pedagogical exception at 34 CFR 99.37(c)(1). This part of the regulations says that a student cannot opt out of disclosures of directory information when the opt-out would prevent schools “from disclosing or requiring a student to disclose the student's name, identifier, or institutional email address in a class in which the student is enrolled.”
Additionally, the Supreme Court has alluded to the existence of an implied pedagogical exception in its 2002 decision Owasso Independent School Dist. v. Falvo. In Owasso, the Court considered whether peer grading violates FERPA, and concluded that it does not. Explaining their reasoning, the Owasso Court wrote, “We doubt Congress meant to intervene in this drastic fashion with traditional state functions…[to] exercise minute control over specific teaching methods and instructional dynamics in classrooms throughout the country. The Congress is not likely to have mandated this result, and we do not interpret [FERPA] to require it.” While the Owasso Court recognized that certain student information must be shared in order for educational activities to occur in a school setting, thus supporting the logic underlying the implied pedagogical exception, the court ultimately did not rely on a pedagogical exception as the reason to permit peer grading.
An Implied Pedagogical Exception Isn’t Sufficient
People tend to think of FERPA in binary terms: that it either does or does not protect student data. This viewpoint entirely overlooks student PII that may need to be shared in classrooms to facilitate ordinary instruction but that still deserves to be protected from other disclosures. While the implied pedagogical exception may account for this nuance, there is no definitive way to know what the specific requirements of this exception are without it being explicitly written out. Schools are intuitively relying on FERPA’s implied pedagogical exception, but they may not be incorporating the necessary safeguards to protect student PII because they are not familiar with what FERPA requires under this exception. For the pedagogical exception to be effective, teachers need to know about it and have an accessible way to see what it requires. This will not happen until the pedagogical exception is explicitly written into FERPA.
At this point you may be asking: “Do we really need to create another FERPA exception for this?” Our short answer: Yes. While there are already several established FERPA exceptions (see our chart), none of them account for the unique circumstance of teachers needing to disclose student PII for effective classroom instruction while still protecting the information from other disclosures.
For example, because student names are PII that the school maintains in education records, FERPA prohibits their disclosure without consent or an applicable exception to FERPA’s consent requirement. Teachers can access students’ names for educational purposes under FERPA’s school official exception but then must protect the confidentiality of this information from future unauthorized disclosures. Since FERPA does not have an exception to the consent requirement for addressing students by name in class, revealing a student’s name in front of other students could be an unauthorized disclosure under a strict interpretation of FERPA, preventing Ms. Montana from saying Jackson’s name in front of other students. Not only would this place unreasonable restrictions on her, but it could also create a very impersonal classroom environment for her students if she isn’t able to obtain parental consent for this disclosure.
Ms. Montana likely could not rely on FERPA’s directory information exception in this case, either. The directory information exception permits disclosing “information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed” 34 CFR 99.3, including student names. The problem arises because parents and eligible students must be given the right to opt out of a student’s PII being disclosed under this exception, which presumably would allow students to opt out of being called by name in class. While the Department of Education has somewhat clarified this issue in the past (they directly stated that “the right to opt out of directory information disclosures may not be used to allow a student to remain anonymous in class” in the 2008 Federal Register, p. 74808), it’s unreasonable to expect Ms. Montana to read and fully understand historical federal registers to decipher the limitations of FERPA’s directory information exception in this context. And even if she did, the directory information exception does not prohibit further disclosures of student information once it has been shared, meaning that any student PII she discloses under the directory information exception for pedagogical purposes would lose all FERPA protections once she shares that information with the class.
Make FERPA’s Pedagogical Exception Explicit
While we can point to the FERPA regulations and Owasso as alluding to an implied pedagogical exception, they do not firmly establish that an implied pedagogical exception to FERPA’s consent requirement exists. To provide clarity to school staff questioning whether they can disclose student PII in everyday circumstances, an explicit pedagogical exception with defined parameters and factors to be considered on a case-by-case basis should be added to FERPA. This exception should give teachers a set of much-needed boundaries for when they can disclose relatively non-sensitive student PII in educational settings, and it should prevent some of the confusion we have seen arise, especially when other laws further complicate the matter. For example, Virginia passed a bill in 2018 that aimed to limit the disclosure of student information under Freedom of Information Act requests. That law was interpreted by some as prohibiting instructors from sharing student email addresses without prior opt-in consent from each student, causing significant problems for teachers wanting to assign group projects and share student email addresses to facilitate group communication outside the classroom. Since there is no explicit pedagogical exception to FERPA, teachers were left navigating whether sending a single email to a four-student project group would involve improperly disclosing the email addresses of the other three group members.
The pedagogical exception should incorporate a set of flexible factors to be considered on a case-by-case basis to ensure that the exception does not go too far. Factors may include, but should not be limited to:
- Whether the disclosure is necessary to facilitate an educational purpose;
- The potential harms to the student that could result from such disclosure;
- The likelihood of those potential harms occurring, based on an evaluation of students of varying backgrounds and needs; and
- If there are less privacy-invasive alternatives available instead of the disclosure.
While disclosures necessary for instruction should be permitted, any disclosures that tip the scale toward being harmful to students should be prohibited. For example, teachers should be able to tell students the names and email addresses of their team members for a group project, as well as the group’s final project grade, because such sharing is a necessary educational purpose and is unlikely to be harmful to the students. In this example, the disclosure should be permitted under the pedagogical exception because its importance to classroom instruction outweighs any limited potential harms to students that may result from such disclosure. On the other hand, disclosures that are likely to be harmful to students, such as a gym teacher weighing students in front of other students and announcing their BMI, should not be permitted under the pedagogical exception. In this case, such disclosures have a greater potential for harm to students than there is value for educational purposes.
Students should not be able to opt out of disclosures under the pedagogical exception since the disclosures are necessary for an educational purpose and considering the factors would account for the potential risks of disclosure. This mirrors how FERPA’s regulations currently do not allow students to opt out of necessary disclosures of directory information.
Lastly, all PII disclosed under the explicit pedagogical exception should retain FERPA protections subsequently. For example, if a teacher hangs a chart showing their students’ individual progress on the classroom wall for instructional purposes, the teacher should not then be permitted under this exception to keep the chart up when third parties come into the room (such as for parent-teacher conferences) because that extends beyond the pedagogical purpose and would otherwise constitute a disclosure under FERPA.
Closing Thoughts
The implied pedagogical exception is not sufficient to ensure that student PII will be protected in all situations. By adding an explicit pedagogical exception, teachers can continue to engage in everyday instructional encounters without fear of violating FERPA, and students can feel confident that their personal information will not be shared beyond the classroom. It is time for FERPA to be updated to reflect modern educational practices, protecting student privacy while also allowing for effective classroom instruction.
