Congress Weighs Changes in Key Student-Privacy Law
Ohanian Comment: The ramifications of this could get big. As always, the devil is in the details.
Washington
The U.S. Congress will probably consider a bill this fall that, if passed, would fundamentally alter how colleges respond to accusations that they have violated the privacy of student records.
The bill, HR 1848, would modify the Family Educational Rights and Privacy Act, or Ferpa, by giving parents and students the right to sue institutions for releasing information that ends up harming a student. In addition, Ferpa, which forbids colleges that receive federal funds from releasing most student records without permission from parents or an adult student, would be extended to protect college applicants and third parties, such as business partners, who might be hurt by divulged information.
Right now, under Ferpa, colleges that reveal private records without permission can lose their federal financial-aid funds. But no college has ever been sanctioned under the law, says LeRoy S. Rooker, director of the Family Policy Compliance Office, which administers Ferpa at the U.S. Education Department. The only recourse that students or their families have is to complain to the Education Department in the hope that it will investigate.
The legislation before Congress would bring about the most significant changes in the law in the past several years, college officials say. "If that passes, it would be big," says Margaret L. O'Donnell, assistant general counsel at Catholic University of America. "It would be very big."
But opinions differ on whether the measure will even get through Congress. Some college officials and members of Congress argue that Ferpa does not need to be updated, and may not even need to exist. Others, though, say the law is vital and should be changed to give students more protection and hold colleges more accountable for violations.
The discussions will take on additional importance this year as Congress gears up to reauthorize the Higher Education Act, the law that governs most federal financial-aid programs, and of which Ferpa is a part.
The new bill is a direct response to a U.S. Supreme Court decision last year in favor of Gonzaga University, a private Jesuit institution in Spokane, Wash. A former undergraduate student, who requested anonymity in the case, had claimed that he had been denied the ability to work as an elementary-school teacher in Washington State because a Gonzaga administrator had released private information without his consent.
The administrator, Roberta S. League, had overheard a conversation in October 1993, in which one student told another that the male student in question, a senior at the time, had sexually assaulted a female student. Ms. League investigated the allegations and contacted Washington State's agency responsible for teacher certification, where she discussed the allegations and mentioned the man by name.
The man did not learn of the investigation until March 1994, when Ms. League told him that he was ineligible for teacher certification because he lacked sufficiently good moral character. The allegations could not be proved, however, and no criminal charges were filed. The man sued Gonzaga and Ms. League for $1.2-million under federal and state law. He argued that individuals have the right to sue colleges for releasing private information that results in harm.
The Supreme Court sided with Gonzaga. The justices said that in passing a law, Congress must explicitly give people the right to sue under it, which it had not done when it crafted Ferpa.
In April, U.S. Rep. Robert E. Andrews, a New Jersey Democrat, introduced HR 1848 in reaction to the Gonzaga decision. The law needs to be modified, he says, to give people the explicit right to sue, and permit additional, more-refined ways to punish institutions for violating privacy. The congressman says he has had five or six instances of privacy violations in his own district in the last few years. One constituent successfully underwent counseling for substance abuse, he recalls, but later did not get a job because the college erroneously sent out medical information to the person's prospective employer.
"The bill clarifies what a lot of people thought the law already is," Representative Andrews says. Calling the current law "wholly inadequate," he says he based his bill on the privacy rights included in laws that govern health and employment information.
In addition to giving students and parents the right to sue, Representative Andrews says, Ferpa should protect college applicants because they already assume they have Ferpa rights. "You have reasonable expectations of privacy when you fill out that form," he says. He included third parties who claim that releasing information damaged them, such as a business partner of someone who was defamed. And he wants to permit judges to force colleges to pay three times normal damages for knowingly releasing private information.
More Headaches
College officials fret that the bill would open their institutions up to legions of frivolous lawsuits. "To allow a private right of action is to permit a cottage industry" of lawyers who sue colleges, who would have "another avenue to harass institutions and try and coerce settlements," says Sheldon E. Steinbach, vice president and general counsel of the American Council on Education. The new law would cost colleges money, he says, either through litigation and court costs or settlements to avoid them and negative publicity.
Representative Andrews does not think his bill would flood colleges with lawsuits. Litigation is expensive, and few privacy violations result in actual harm worthy of a lawsuit, he says. Colleges are overreacting to the bill, since most of them are already are careful about privacy, he adds.
Reports vary on how prevalent privacy violations are. The congressman says that there are thousands of additional cases across the country. Greg Lukianoff, director of legal and public advocacy for the Foundation for Individual Rights in Education, a civil-liberties group, says colleges constantly and arbitrarily abuse the law. Facing a potential lawsuit, he says, "takes it out of universities' hands whether or not they want to follow Ferpa."
But Mr. Steinbach says privacy infractions are not rampant. "The instances of individuals having purported Ferpa violations have been so infinitesimal as to not warrant a change in the law," he says.
Jim Bradshaw, a spokesman for the Education Department, says the policy-compliance office received more than 1,000 letters, 1,500 e-mail messages, and 3,800 phone calls about Ferpa in 2002. Many were complaints from parents and students, he says. The office did not investigate the majority of the complaints, he says, because they were not specific enough to suggest a reasonable chance that a violation had occurred.
Representative Andrews's legislation could also give colleges more headaches by tripling or quadrupling the number of records they must keep, says Daren L. Bakst, president and general counsel of the Council on Law in Higher Education, an advocacy group that concentrates on legal issues at colleges. Currently, protection exists only for enrolled students. By extending Ferpa to applicants, he says, "they're creating rights for people who may never go to the school."
Mr. Rooker, of the Education Department, agrees: "It would mean a lot more work, particularly for colleges."
Other Changes Possible
The new rights and expanded penalties are unnecessary, Mr. Bakst adds, because students have the right to sue colleges under state law for privacy violations. Even in the Gonzaga case, he notes, the plaintiff still received more than $700,000 in defamation and privacy-invasion damages under Washington law.
While Representative Andrews's bill would make the biggest changes in Ferpa, other revisions are also on the table. Another bill that could affect colleges under Ferpa is HR 2732, which gives elementary- and secondary-school students who are home-schooled the same privacy rights as students at public schools. It would do so by defining a student as a person with academic records, and no longer requiring the person to be enrolled at an institution.
Mr. Bakst says he worries that the bill could be interpreted to give Ferpa rights to college applicants. But Mr. Rooker, of the Education Department, says the bill would probably not apply to colleges.
What is more likely to pass is a proposed change that would allow colleges to accept electronic signatures from parents and students to give third parties access to records online (The Chronicle, September 5). The Education Department is proposing the change because so many institutions have asked for it, department officials say. "There's been a hue and cry for it for several years, actually," says Mr. Rooker.
None of the proposed revisions actually improve student privacy, says Barmak Nassirian, associate executive director of external relations for the American Association of Collegiate Registrars and Admissions Officers. The changes would just expand who is protected and their possible responses, he says.
The real problem, Mr. Nassirian says, are exceptions made to Ferpa over the past 30 years, which he believes have whittled away the protections the law provides.
For example, the Solomon Amendment in 1996 gave the military privileged access to student information for recruitment purposes. The Taxpayer Relief Act of 1997 gave the U.S. Internal Revenue Service access to certain personal information about students. The U.S.A. Patriot Act of 2001 lowered the oversight that federal judges have over requests that the U.S. Department of Justice makes for court orders to acquire information in student records. All three laws impose harsh penalties for noncompliance.
"All added up together, they almost eviscerate Ferpa to the point of meaninglessness," Mr. Nassirian says.
— Michael Arnone
Congress Weighs Changes in Key Student-Privacy Law
Chronicle of Higher Education
2003-10-02
http://chronicle.com/prm/weekly/v50/i06/06a02202.htm
INDEX OF OUTRAGES
