FAQs below:
- Student Data Privacy
Acronym Quick Reference Guide
DPCO—Data Practices Act Compliance Official (college or university president designates)
FERPA—Family Educational Rights and Privacy Act
MGDPA—Minnesota Government Data Practices Act
ISRS—Integrated Student Record System (Minnesota State’s database)
FAQ: Student Data Privacy
What laws protect the privacy of a student's educational records?
The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g; 34 C.F.R. Part 99, and the Minnesota Government Data Practices Act (MGDPA), Minn. Stat. § 13.32.
What is an educational record of a student?
Records maintained by the college or university that are directly related to a student. Educational records can be in any format.
What are common types of educational records held by Minnesota State colleges and universities?
Because the definition of educational record is broad, most information about a student maintained by a college or university is an educational record. This may include things such as a student's application for admission, records in the Integrated Student Record System (ISRS), records concerning financial aid, academic records such as class lists and grades, student housing records, conduct records, etc.
What is the basic responsibility of all Minnesota State employees towards student educational records?
Generally, student educational records are private. As a result, a college or university needs written permission (consent) from a student in order to release any information from a student's educational records to a person or entity outside the institution unless an exception to FERPA applies.
What is "directory" information?
Directory information is information in a student's educational records that would not generally be considered harmful or an invasion of privacy is disclosed. As a result, directory information is public unless a student opts out of release of directory information. Each college and university establishes its own definition of directory information but common examples include a student's name, dates of attendance, major field of study, etc. Please review student records policy at your college or university for a specific list of directory information, as well as the procedures for a particular student opting-out of allowing release of directory information. This information is often found in the student handbook, online, or at the Registrar's Office.
What are exceptions allowing non-consensual release of student records?
There are exceptions to FERPA and the MGDPA that allow educational record disclosure without a student’s consent. These include release in a health or safety emergency, release to officials at a college or university to which a student is transferring, etc. One important exception that allow non-consensual release of student records is “to comply with a judicial order or lawfully issued subpoena.”
What if law enforcement requests a student's educational records?
A college or university must follow FERPA and the MGDPA when law enforcement requests student educational records. This means that a college or university must obtain a student’s voluntary consent to release their records to law enforcement OR there must be an exception that authorizes non-consensual release. As noted above, one such exception is “to comply with a judicial order or lawfully issued subpoena.”
How should a college or university handle judicial orders or lawfully issued subpoenas?
We suggest that each college and university designate a single point of contact responsible for receipt of subpoenas, warrants, or other judicial orders. This could be your Data Practices Compliance Official (DPCO) or other administrator. All employees should refer legal documents to the designated contact who will work with the Office of General Counsel to determine how to respond to the judicial order or subpoena.
Who is responsible for protecting student records at a college and university?
It is the responsibility of all employees to protect student educational records. Any person requesting information on students should be referred to the Data Practices Compliance Official (DPCO) or other appropriate administrator at the college or university.
What resources are available on FERPA and student educational records?
- Every college and university has a student records policy that describes how it complies with FERPA and the MGDPA.
- The Office of General Counsel has information on its website at Minnesota State - DPCO Directory.
- The Family Compliance Office, which is part of the United States Department of
Education, has resources on FERPA, including summary documents, guidance, and
frequently asked questions available at OCPO Home Page | U.S. Department of
Education.