Under FERPA, colleges must not release education records—except under certain circumstances which you'll learn about in a few minutes—without prior written consent from the student.
Penn State must obtain prior written consent from a student before disclosing any non-directory information from their education records. The prior written consent must:
In recent years, the U.S. Department of Education has clarified that an electronic signature may substitute for a written one. In order to qualify as an electronic signature, appropriate authentication must occur. Penn State's access account satisfies the requirements for an electronic signature. Since students must log in to Penn State's email system using their Penn State access accounts, an email note from a student's @psu.edu email address satisfies FERPA's written consent requirement. However because security measures for other email systems are not as strict, an email received from a Gmail, Yahoo mail, or AOL mail account for example would NOT qualify as written consent.
FERPA permits disclosure of a student's education record without the student's consent to University officials having a legitimate educational interest in the record.
University officials are University employees with general or specific responsibility for promoting the educational objectives of the University, or third parties under contract with the University to provide professional, business and similar administrative services related to the University's educational mission. These include:
A Penn State employee exercises legitimate educational interest if that person needs to review an education record in order to fulfill his or her professional responsibilities. The concept of legitimate educational interest only applies to University officials. Legitimate educational interests include:
Disclosure of information in a student's education record to a University official does not constitute authorization to share that information with a third party.
Access to information does not authorize unrestricted use.
Records should be used only in the context of official business in conjunction with the educational success of the student.
Curiosity does not qualify as legitimate educational interest.
The fact that someone is a Penn State employee is not the sole qualification for legitimate educational interest.
For more information on appropriate use of student data, review Penn State's guideline ADG06.
*Anyone conducting research using information from student education records must receive approval for that research from Penn State's Office of Research Protections. In addition, researchers who are utilizing student education records in their research must agree to: