Student Privacy’s History of Unintended Consequences
June 2020
Amelia Vance and Casey Waughn1
Previously published in the Seton Hall Journal of Legislation and Public Policy
I. INTRODUCTION
It is difficult to imagine a world in which schools cannot print students’ names on the honor roll or in school playbills; announce student athletes’ names, heights, and weights at the start of a game; and share financial aid information with appropriate institutions to ensure that students can finance their education. Yet, in the months following the enactment of the Family Educational Rights and Privacy Act (FERPA) of 1974, and forty years later in the wake of more than one-hundred new state student privacy laws, schools at all levels have struggled with the scope of new student privacy mandates. These mandates have raised questions about the schools’ ability to perform long-standing functions.
The student privacy legal landscape over the past forty-five years tells a story of unintended consequences that have required legislative clarifications and changes. The story makes a case for nuance and careful deliberation in drafting laws, but also for creating a long-term culture of privacy that addresses real or potential harms, rather than responding to unfounded fears. Accordingly, this article examines the passage of the first major U.S. privacy law, FERPA. The article will address the initial questions FERPA raised as well as the concerns that prompted more than one-hundred new student privacy laws forty years after FERPA’s passage and the unintended consequences of those laws. By analyzing the lessons from FERPA’s first amendment and changes in recent student privacy laws, the article proposes strategies to avoid certain unintended consequences in privacy legislation. The evidence is derived from case studies of student privacy laws in Louisiana, Virginia, New Hampshire, and Connecticut, where significant unintended results of these laws occurred, prompting their amendment. The lessons from these cases also apply to wider current debates as the U.S. creates broad consumer privacy protections, including new and expanded privacy protections for children.
II. FERPA AND ITS FIRST AMENDMENT
A. The Landscape Before FERPA
FERPA was not subject to the scrutiny of committees or hearings before its passage into law because it was originally offered on the Senate floor as a rider to a broader education bill.2 Its legislative history was largely post-dated, cobbled together from speeches and debates in Congress that occurred after it passed.3 As FERPA was the first legislation that contemplated student privacy, both the original act and its first amendment are largely considered the birth of federal privacy rights for students.4 On a larger scale, however, FERPA and its first amendment also demonstrate how unintended consequences have plagued the student privacy sphere since the inception of educational privacy rights.
The period leading to FERPA’s enactment in August 1974 was fraught with concerns about government secrecy.5 In the aftermath of Watergate and the disclosure of secret FBI files on U.S. citizens, including members of Congress, public trust in the government was at an all-time low.6 Prior to his resignation, in his last State of the Union address, President Nixon said:
As technology has advanced in America, it has increasingly encroached on one of those liberties that I term the right of personal privacy. Modern information systems, data banks, credit records, mailing list abuses, electronic snooping, the collection of personal data for one purpose that may be used for another—all these have left millions of Americans deeply concerned about the privacy they cherish. The time has come, therefore, for a major initiative to define the nature and extent of the basic rights of privacy and to erect new safeguards to insure [sic] that those rights are respected.7
Policymakers and the public began to express concerns about large government and business repositories containing personal information,8 including repositories kept by schools.
In 1969, sociologists from the Russell Sage Foundation conducted a study of record-keeping practices in fifty-four elementary and secondary schools in twenty-nine states.9 They found that the records contained a great deal of sensitive information, including student grades, attendance records, personality ratings, informal teachers’ notes, and student diaries.10 The study found that school personnel did not consistently maintain records.11 Several of the districts surveyed also provided law enforcement––including juvenile courts, CIA, and FBI officials––with unfettered access to student records but prohibited parents from accessing the same information.12
In the same year, the Sage Foundation also convened a conference that produced a report titled “Guidelines for the Collection, Maintenance and Dissemination of Pupil Records.”13 The Guidelines produced by the conference noted that schools generally collected information in student records without obtaining informed consent, and even when consent was obtained, information was “often used subsequently for other purposes.”14 The Guidelines also noted that students and parents generally had “little or, at, best, incomplete knowledge” of existing information and how schools used it, and there were no formal procedures for parents to discover and challenge inaccurate information.15
The report heavily criticized schools for “few provisions . . . to protect school records from examination by unauthorized school personnel” and for the lack of formal policies for access to records by “law-enforcement officials, the courts, potential employers, colleges, researchers, and others.” The report called this state of affairs “a serious threat to individual privacy in the United States,” and guidelines for record-keeping were distributed to schools nationwide.16 Three years later, the Sage Foundation revisited school policies and found that “the vast majority of schools in this country still do not have records policies that adequately protect the privacy of students and their parents,” and that even when policies existed, school employees did not clearly understand when those policies applied to them.17
In 1973 and 1974, Diane Divoky gained policymakers’ attention by publishing multiple articles about student privacy in widely read publications such as Parade magazine and The Washington Post. 18 She explained that school record-keeping, “like Frankenstein’s monster, . . . now has the potential to destroy those it was created to protect.” She described the makeup of this “monster” as “the swift development of modern communications technology and the widening employment of that technology by a social system increasingly bent on snooping” as well as “the emergence of education’s ambitious goal of dealing with the ‘whole child.’” She noted that “as the records began to contain more detailed and varied information, they took on lives of their own; they became, somehow, more trustworthy and permanent than the quixotic people they represented.”
Among other disturbing anecdotes, Diane Divoky highlighted a case before the Supreme Court where the House Committee for the District of Columbia requested and then published “cumulative records of students,” including “[c]opies of actual test papers, disciplinary reports and evaluations . . . with the students’ names still on them.”19 She also cited cases that she had witnessed while serving on the New York City board of education. She included stories of a junior high school principal telling the secretary at a private tutoring agency who had called to ask about a child’s reading level that “the child has a history of bedwetting, his mother is an alcoholic, and a different man sleeps at the home every night;” and a black father whose daughter’s record noted that “his own community activities as a ‘black militant’ are causing his daughter to be ‘to [sic] challenging’ in class.”20
Perhaps most troubling in an era of political protests and suspicions of anti-government activities was a project funded by the California Council on Criminal Justice. This project “computerize[d] and centralize[d] all juvenile records,” and was a system that, under state law, recorded “children down to the age of six years who have been identified as being ‘in danger of becoming delinquent,’” who could be “declared ‘pre-delinquent.’”21 Divoky noted that one of the council’s related programs “instructed kindergarten teachers in sophisticated methods of identifying ‘target students’—those five-year-olds whose social and academic profiles were similar to those of adolescents who ended up in juvenile courts.”22
Divoky posited that the most significant problem was living “in a world of technologically recorded, maintained and communicated information.”23 She cited Florida’s centralized computer system that used “an IBM 1230 Optical Scanner to enter data for all pupils from the ninth grade on up into a computer.”24 She also described a school record system in Arizona allowing employees to call into a remote recording system and leave comments to create a virtual record.25 Other employees could then play back the recordings to be transcribed and placed into students’ files.26
Less than one week after one of Divoky’s articles was published in March 1974, Congressman Jack F. Kemp (NY) cited it in a speech on the floor, noting that Congress “must come to grips with the potential abuses which can arise from the disclosure of this information,” particularly because those abuses affect “everyone who has even gone to a public or private school―in other words, virtually all of us.”27 Just over a month later, Senator James L. Buckley (NY) introduced FERPA.28
B. FERPA’s Introduction and Passage
FERPA was introduced on the Senate floor as an amendment to the Elementary and Secondary Education Act of 1974 (ESEA).29 In his remarks, Senator Buckley said that “[t]he secrecy and denial of parental rights that seem to be a frequent feature of American education is disturbing,” and cited examples from Divoky’s article.30 He further explained that, “[s]ome school administrators and educators seem to have forgotten that parents have the primary legal and moral responsibility for the upbringing of their children and only entrust them to the schools for basic educational purposes.”31 The amendment aimed to ensure that parents could access their children’s records, and to prevent “abuse and improper disclosure of such records and personal data on students and their parents.”32 The amendment also required schools to seek parental consent before records were disclosed to third parties and before children were tested or made to participate in “experimental or attitude-affecting programs.”33 Buckley recognized that new requirements would create new administrative burdens, but stated that he was not “concerned about the workload or convenience of the educational bureaucracy but, rather, with the personal rights of America’s children and their parents.”34
Because FERPA was an add-on amendment to another proposed bill, it did not go through hearings or committees, resulting in limited legislative history.35 This subsequently made it difficult for schools to understand the Act’s basic requirements and limitations.36 In less than one hour, Buckley introduced the amendment, and it was debated and amended multiple times on the Senate floor. The Senate ultimately accepted the Act as part of the ESEA bill.37
When FERPA was introduced, many senators raised concerns about the Act’s potential unintended consequences.38 Nearly every senator who spoke acknowledged the good intent behind the proposed student privacy legislation but feared that unintended consequences would occur given the lack of formal committee debate and vetting.39 Senators were also concerned about FERPA’s vague language and restrictions on programs, including experimental programs or courses, designed to alter students’ behavior and values.40 The version of FERPA that Senator Buckley originally proposed required parental consent for students “to participate in any project, program, or course, the primary purpose or principal effect of which is to affect or alter the personal behavior or personal values of a student, or to explore and develop teaching techniques or courses primarily intended to affect such behavior and values.”41 Senator Hart asked whether this provision would apply to “the new math, which I still do not understand, but to which my children have been exposed? Could I say ‘no’ if we were to adopt this amendment?”42 Senator Buckley immediately replied, “That is not at all the situation. A normal person would agree to experimentation with new math.”43 When a similar question was posed by Senator Mathais, Senator Buckley replied that of course “all education has an effect on attitude . . . I believe there is a tacit rule of commonsense that applies to the interpretation and application of all legislation.”44
Yet, Senator Cranston argued that the legislation could undermine attendance laws by allowing parents to refuse to have their child attend a class “if, after notification, the parent finds the content of the course or activity to be objectionable.”45 He characterized the language as “breathtaking in its sweeping generalities,” asking:
How do you determine in advance, and provide notification to the parent, of classroom activities that might bear on the values of a student? A course in American history, for example, that discusses contemporary American ethics in the light of Watergate could be construed as tending to “affect the personal values” of a student. Or, how do you go about discouraging violent or overly aggressive behavior without tending to “alter the personal behavior” of a student? These are serious questions, Mr. President, that we cannot take lightly. Because the penalty for even accidental transgression of these Federal directives is the total loss of Federal funding to any educational institution— public or private, preschool through postsecondary—that is found “out of compliance.”46
While Senator Buckley further clarified the intent and limits of the provision on the floor, Senator Pell stated, “We are concerned here not with what the Senator from New York intends the language he proposes to accomplish. It is what the language would do. This is what bureaucrats in future years will rely on, what the language in the bill is.”47 Other points of contention involved the bill’s strict limitations on sharing personal data, such as requiring a court order prior to sharing student information with law enforcement, and confusion regarding disclosing information to postsecondary institutions for financial aid.48
At least two education groups also raised concerns that were discussed in the congressional record. The National School Board Association (NSBA) was concerned that the thirty-day time frame for schools to turn over records was insufficient, and advocated forty five or sixty days, among other concerns.49 The National Education Association (NEA), in their 1971 Code of Student Rights and Responsibilities, urged strict policies to protect students’ and parents’ rights to privacy.50 The NEA thus also opposed the provision requiring parental consent for “experimental programs.”51 The opposition was heard and substantial changes were made to Buckley’s original language, including cutting the “experimental program” clause through a roll call vote.52
Other than brief debates in the Senate (and the House, for its iteration of the bill that was eventually folded into the Senate version) and a few brief paragraphs in the larger ESEA Conference Report,53 very little legislative history is available from prior to FERPA’s enactment that would further clarify the law’s scope and intent. Because of this limited history, many relevant stakeholder groups may have known about the law only after it passed.54
Thus, the senators discussed several potential unintended consequences that were not addressed in the aforementioned hearings. Senator Dominick worried that the amendment would block post-secondary institutions’ ability to obtain information from high schools regarding admissions or to determine whether students were eligible for loans or work-study.55 This was due to the fact that many students begin college when they are under eighteen years old and parents may not consent to have such information shared. Senator Buckley dismissed this concern, stating, “I find it implausible that parents would not cooperate in helping a child qualify for financial help,” but he also pointed out that the bill’s language permitted information to be shared for financial aid purposes.56
Because of the numerous concerns, Senator Stevens advised further consideration: “Mr. President, I again applaud what the Senator from New York is trying to do, but I think any proposal that has to have so many amendments on the floor to try to perfect the original intent is a measure that should not be passed.”57 Senator Stevens recommended committee hearings to clarify the scope of the section that did not permit data sharing with third parties without their consent.58
Once FERPA was passed, and as schools continued to try to implement the law, these unaddressed concerns and others emerged repeatedly, resulting in significant confusion.
C. Unintended Consequences in Practice
Almost immediately upon FERPA’s passage, stakeholders began to question the law’s applicability, its scope, and weighed in on its potential consequences. Much of the confusion regarded whether K-12 schools could continue to share routine information with various individuals and entities. Schools questioned whether they could print students’ names in bulletins and read student athletes’ information at sporting events, since these activities involved sharing personal information with other students, school personnel, and third parties.59 Senator Buckley and Senator Pell’s Joint Statement in Explanation of the Buckley/Pell Amendment echoed the schools’ concerns: “A literal interpretation of this language has led school attorneys around the country to advise their clients [to] no longer routinely to print football players’ weights in athletic programs and to seek written consent of the cast of the school play that their names may be printed in the program.”60 Schools also questioned whether districts were allowed to transfer students’ records when students attended new schools.61
The permissible scope of information sharing was also an issue for colleges and graduate programs. One example pertained to student loan information, including the need to inform lenders about dates of attendance for repayment obligations.62 A member of Congress noted, “[A] student is allowed a nine-month grace period after his last date of attendance before he is required to begin repayment of his obligation. If a school cannot routinely inform the lender of the student’s last date of attendance, the lender has no basis for calculating when he may begin to collect the loan.”63 Congress also noted that groups such as the Law School Admissions Council, Educational Testing Service, and the College Entrance Examination Board “need student data in order to perform their function” of developing and validating tests used to help students gain admission to colleges and to predict their success at these institutions.64 Educational accreditation groups similarly required student data in order to function. A narrow reading of FERPA as originally written could prevent the sharing of this data.65
FERPA’s sharing restrictions also prompted schools to question whether they could share information with third parties in the event of a health or safety emergency.66 For example, schools questioned whether, in the event of an epidemic outbreak, they could share information about students tested or affected by the outbreak with appropriate officials such as the Centers for Disease Control.67 Congress noted, “In the case of the outbreak of an epidemic, it is unrealistic to expect an educational official to seek consent from every parent before a health warning can be issued.”68
Another significant concern among K-12 and post-secondary institutions was the sharp cutoff and transfer of rights from parents to students when students reached the age of eighteen or enrolled in postsecondary study. Many feared that this requirement would inhibit the sharing of necessary information, such as tuition bills, with parents.69 Multiple erroneous cross-references and typographical errors within the Act also resulted in confusion, uncertainty, and concern on behalf of educational institutions.70
Despite this criticism and confusion, most institutions attempted to comply with the new law.71 A memo addressed to Senator Buckley stated, “While there is an effort underway to lobby for delay in the implementation of [FERPA], most schools and agencies seem to be able and are in fact preparing to comply with implementation on November 20 [sic], 1974.”72
Dr. Phil Salmon, Director of the American Association of School Administrators, noted that some schools had “‘drop[ped] everything that came along’ into the cumulative folder,”73 and he advised schools “to remove from the folders and destroy such things as unsubstantiated teacher opinions, or language which tends to ‘categorize’ students.’”74 Thus, FERPA forced many schools to consider student privacy—perhaps for the first time—and to update their policies and procedures accordingly. Nonetheless, the memorandum also noted that Congress had received numerous calls from schools, districts, colleges, and universities around the country: “nearly all the callers have said that their schools are developing a policy and procedures for compliance, but they have a question or two as to what a particular aspect of the bill means or includes, or whether such and such procedure on their part would be appropriate.”75
Rumors surfaced that, although Senator Buckley was a long-time, active part of the education field, he asked an aide to draft FERPA slightly more than one month before he introduced the bill.76 This led some stakeholders to question FERPA’s conception, especially since the bill never underwent a formal committee process.77 In response, many called for Congress to delay the Act’s date of enactment on November 19.78 A Washington Post article, printed in the congressional record as evidence of the need for the amendment, commented, “Senator James L. Buckley has found out recently that opening up school records is more complicated than it first appeared.”79 On November 14, 1974, a few days before FERPA’s initial effective date, Senator Pell’s office issued a press release stating that if legislators and institutions could not reach agreement on FERPA’s uncertainties and when the law should take effect, he would likely sponsor an amendment to defer the effective date.80 Shortly thereafter, the process to amend FERPA began.
D. The Buckley/Pell Amendment
FERPA’s first amendment, known as the Buckley/Pell Amendment, was offered on the Senate floor on December 13, 1974.81 During its introduction, Senator Buckley noted that “the educational community has pointed to certain ambiguities . . . contained in the language and provisions—that because there was none of the normal legislative history, it means that [the U.S. Department of Health, Education, and Welfare] HEW does not have an adequate record . . . to develop the necessary regulations.”82 Senators Buckley and Pell offered a joint statement explaining the need for an amendment of FERPA, noting that FERPA’s “restrictions are too narrow and, if strictly applied, would seriously interfere in the operation of educational institutions.”83
The Buckley/Pell Amendment also addressed many problems resulting from FERPA’s initial language. The amendment defined key terms, including “education records” and “educational institutions,”84 and created the “directory information” exception, which addressed concerns about the necessary or routine sharing of student information.85 As the name suggests, the directory information exception allows schools to share names, addresses, birth dates, heights and weights of student athletes, and students’ most recently attended educational institutions, among other information. The amendment described this as information “that would not generally be considered harmful or an invasion of privacy if disclosed.”86 Since recipients of this information could redisclose it, FERPA requires that schools notify parents and students about which categories of information the school chooses to designate as directory information, and offer an opportunity to opt out of this sharing.87
The amendment also clarified that schools could share, without obtaining consent, de-identified data with federal authorities and bodies for auditing and accreditation purposes, state authorities pursuant to state law, and organizations such as the Law School Admissions Council and the College Entrance Exam Board.88 Sharing this information would allow these organizations to predict applicants’ potential success in post-graduate programs.89 Post-secondary institutions were also concerned about sharing students’ personal data with third parties for financial aid applications.90 The Buckley/Pell Amendment clarified that schools could use and share social security numbers, with consent, for financial aid applications.91 The amendment also noted that parents’ financial information would not be shared with students as part of the latter’s right to access their records.92
The Buckley/Pell Amendment also allowed students to waive their rights to access and confidentiality, a noteworthy addition since it seemed to be at odds with FERPA’s original aims regarding student record accessibility. A 1975 law review article reflected that, since this provision might cause students to “waive their future rights of access to certain confidential information,” it ironically would “effectively close up many of the files which the original [FERPA] intended to open.”93 Several members of Congress carefully drafted this provision so that schools could not condition attendance or matriculation on a waiver of these rights.94 The House of Representatives, when it adopted the Buckley/Pell Amendment, added this language protecting these waiver rights.95 In addition to exempting directory information, parents’ financial records, psychiatric and physician records, certain confidential letters of recommendation, and medical information in the case of an emergency, the Buckley/Pell Amendment also created an exception for “personal notes of education staff.”96 This exception included records written by and ancillary to education personnel, solely in the possession of the education staff member, that are not available or revealed to anyone other than a substitute teacher.97
Although the Buckley/Pell Amendment seemed to relax some of FERPA’s sharing restrictions, it also clarified who had access to student data and the third parties with which schools shared it. The amendment required schools to maintain a list of all these parties and to make this list available to parents and students when appropriate, for review.98
The new language also gave parents substantive rights that were not present in the original FERPA. For example, while FERPA originally allowed educators’ personal comments and impressions to become part of a student’s record––and gave parents no way to prevent this from occurring– –the Buckley/Pell Amendment allowed parents to insert an explanatory statement into their children’s education record.99 While the original FERPA cut off parents’ rights after a student turned eighteen or enrolled in college, the amendment also allowed parents who claimed a student as a dependent on their tax returns to retain access to that student’s records and grade information after the student turned eighteen.100 The Buckley/Pell Amendment was passed on December 31, 1974 as P.L. 93-568, effective retroactively to FERPA’s initial effective date of November 19, 1974.101
Despite the initial backlash from schools following the enactment of FERPA and the Buckley/Pell Amendment, some critics continued to question FERPA’s impact on students and educational institutions. Two years after FERPA was passed, Katherine Cudlipp, Assistant Counsel to the Public Works Committee of the Senate, suggested that the law raised awareness more than it spurred requests for information:
Approximately twenty-one months have passed since the effective date of the Act. Although institutions have modified certain practices, some of the worst fears about red tape have not been realized. There has been no great surge in requests by parents or students for access to files, but public awareness of the provisions of the Amendment— measured by reports in the press and inquiries to HEW— appears to be substantial . . . . It is suggested that the real value of the Amendment may be first that it has caused educational institutions to consider their policies and practices with respect to student records—many perhaps for the first time. 102
Cudlipp also noted that because of the Act’s enforcement mechanisms, much of the law’s effect depends on whether students and parents are aware of their rights under FERPA.103 Many stakeholders also feared that the FERPA and the Buckley/Pell Amendment would be costly for schools to implement. These fears proved largely unfounded because FERPA’s regulations did not impose affirmative obligations on schools to submit procedures, conduct audits, or produce policies in order to receive federal funding.104 National Association of Elementary School Principals President Edward Keller noted in March of 1976, “[t]he Amendment, in fact, requires little more than what many schools were already doing.”105