Necessity of Information Collected.
The Family Educational Rights and Privacy Act (FERPA) is codified at 20 U.S.C. § 1232g. The purpose of the Act is to protect the privacy of students’ education records. FERPA affords certain rights to parents and to eligible students (a student who has reached 18 years of age or is attending a postsecondary institution at any age) with respect to students’ education records. FERPA applies to educational agencies and institutions that receive funds from any program administered by the Department of Education. The regulations are found at 34 CFR Part 99.
20 U.S.C. § 1232g(e) requires each educational agency or institution to annually inform parents and students of their rights under FERPA (34 CFR § 99.7).
20 U.S.C. § 1232g(b)(1)(F) permits the nonconsensual disclosure of personally identifiable information from students’ education records to organizations conducting studies “for, or on behalf of” an educational agency or institution. A change in 2008 to the FERPA regulations requires an educational agency or institution that discloses information under this exception to consent to enter into a written agreement with the organization that is conducting the study (34 CFR § 99.31(a)(6)(ii)(C)(1)-(4)).
20 U.S.C. § 1232g(b)(4)(A) requires each educational agency or institution to keep a record of parties who have asked for and/or received access to the student’s records (34 CFR § 99.32).
In 2008, the FERPA regulations were amended to require that State and local educational authorities and Federal officials and agencies listed in § 99.31(a)(3) maintain a record of further disclosures these parties may make on behalf of an educational agency or institution if the educational agency or institution does not record the further disclosures (34 CFR § 99.32(a)(1)).
In 2008, the FERPA regulations were amended to require that educational agencies and institutions record the particular and significant threat to the health or safety of a student or other individuals that formed the basis for a disclosure under 34 CFR § 99.31(a)(10). This is in addition to the longstanding requirement in § 99.32 that educational agencies and institutions keep a record of parties who have asked for and/or received access to the students’ education records (34 CFR § 99.32(a)(5)).
In 2008, the FERPA regulations were amended to require educational agencies and institutions to maintain a listing in each student’s record of the State and local educational authorities and Federal officials and agencies that may make further disclosures of the student’s education records without consent (34 CFR § 99.32(b)(2)).
The notice of proposed rulemaking (NPRM) was published on March 24, 2008. The final regulations were published on December 9, 2008, and relate to this collection. Changes in the information collection as a result of comments on the 2008 regulations have been provided as necessary for historical background.
The NPRM that this collection follows was published on April 8, 2011, and proposed additional changes to the FERPA regulations. There was one proposed change in the NPRM affecting paperwork burden (§ 99.35(a)(3)). The final regulations, which published on December 2, 2011, relate to this collection. The amendments and changes made in the collection requirements as a result of feedback received on the regulations are identified below.
The 2011 final regulations modified the information collection requirements in § 99.31(a)(6)(ii) by permitting a State or local educational authority or Federal agencies and officials listed in § 99.31(a)(3) to enter into written agreements with organizations conducting studies for, or on behalf of, educational agencies and institutions. However, it is our opinion that this does not constitute a change or increase in burden because this change permits this activity to be undertaken by an official or agency listed in § 99.31(a)(3) on behalf of an educational agency or institution under its jurisdiction.
The 2011 final regulations added a definition of the term “authorized representative” to § 99.3 which would permit the officials listed in § 99.31(a)(3) (a State or local educational authority, the Secretary, the Comptroller General of the United States, or the Attorney General of the United States) to designate any entity or individual to carry out any audit, evaluation, or the enforcement of, or compliance with, Federal legal requirements related to Federal or State supported education programs. It is our opinion that this does not constitute a change or an increase in burden because these entities are already required to record disclosures, pursuant to § 99.32(b)(2).
The 2011 final regulations modified the definition of “directory information” in § 99.3, as well as makes changes to the directory information provisions in § 99.37. Specifically, the regulations modify the definition of “directory information” to clarify that an educational agency or institution may designate as directory information and disclose, without consent, a student ID number of other unique personal identifier that is displayed on a student ID card or badge if the identifier cannot be used to gain access to education records, except when used in conjunction with one or more factors that authenticate the user’s identity, such as a PIN, password, or other factor known or possessed only by the authorized user. In addition, the regulations maketwo changes to § 99.37 concerning directory information: (1) provides that parents and eligible student may not use their right to opt out of directory information disclosures to prevent an educational agency or institution from requiring students to wear or otherwise disclose ID cards or badges; and (2) clarifies that an educational agency or institution may specify in the public notice it provides to parents and eligible student in attendance provided in § 99.37(a) that disclosure of directory information will be limited to specific parties, for specific purposes, or both, and that, if an educational agency or institution adopts a limited directory information policy, it must limit directory information disclosures only to the parties or purposes specified. It is our opinion that this does not constitute a change or an increase in burden because educational agencies and institutions typically include their directory information notice with their required annual notification of rights to parents and eligible students. The model annual notification of rights that is discussed under number 3 (Consideration of Improved Information Technology) includes a notation that the agency or institution may want to include its directory information public notice, as required by § 99.37 of the regulations, with its annual notification of rights under FERPA.
This discussion about § 99.37 was not included in the Paperwork Reduction Act portion of the 2011 NPRM, however a discussion was included in our Supplemental Statement to OMB about this matter. We noted that, since publication of the NPRM, it has been determined that § 99.37(d) also has an information collection associated with it. As a result, details about this information collection are included in this information collection and included in the final regulations. Section 99.37(d) requires any educational agency or institution that elects to implement a limited directory information policy to specify its policy in the public notice to parents and eligible students in attendance at the educational agency or institution. It is our opinion that this requirement will not result in an additional burden for most educational agencies and institutions because educational agencies and institutions are already required under § 99.37(a) to provide public notice of its directory information policy. However, the change reflected in amended § 99.37(d) could result in a burden increase for an educational agency or institution that currently has a policy of disclosing all directory information and elects, under the new regulations, to limit the disclosure of directory information. The agency or institution would now be required to inform parents and eligible students that it has a limited directory information policy. The notice provides parents and eligible students with the opportunity to opt out of the disclosure of directory information. (An educational agency or institution may decide how to handle any opt outs, depending on individual circumstances of the school community.) Additionally, many educational agencies and institutions include their directory information notice as part of the required annual notification of rights under § 99.7, which is already listed as a burden and approved under OMB Control Number 1875–0246. These educational agencies and institutions, therefore, would not experience an increase in burden associated with the changes reflected in §99.37(d).
Although no changes were proposed to § 99.7, which requires that educational agencies and institutions annually notify parents and eligible students of their rights under FERPA, some modifications were made to our model notification associated with this requirement. Specifically, to allow parents and eligible students to more fully understand the circumstances under which disclosures may occur without their consent, we have amended the model annual notifications to include a listing of the various exceptions to the general consent rule in the regulations. The model notices (one for elementary and secondary schools and another one for postsecondary institutions) are included as Appendix B and Appendix C with this information collection as well as with the final regulations. The model notifications are posted on our Web site at the following site address: http://www2.ed.gov/policy/gen/guid/fpco/index.html. (A copy of the model notifications are enclosed as an appendix.) It is our opinion that this addition to the model notification does not increases the currently approved burden of .25 hours (15 minutes) previously estimated for the annual notification of rights requirement.
The 2011 final regulations amended the enforcement provisions (§§ 99.60-67) to clearly set forth the Department’s authority to investigate and enforce alleged violations of FERPA by State and local educational authorities or any other recipients of Department funds under a program administered by the Secretary. It is our belief that this does not constitute a change or increase in burden because the change just clarifies the Department’s authority to enforce applicable FERPA requirements with all recipients of Department funds.
The 2011 final regulations added a new requirement under § 99.35(a)(3) that requires that the agency headed by an official listed in § 99.31(a)(3) to use a written agreement to designate any authorized representative other than an agency employee. The written agreement must: (1) designate the individual or entity as an authorized representative; (2) specify the information to be disclosed and the purpose for which the information is disclosed to the authorized representative (i.e., to carry out an audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs); (3) require the authorized representative to destroy or return to the State or local educational authority or agency headed by an official listed in § 99.31(a)(3) personally identifiable information from education records when the information is no longer needed for the purpose specified; (4) specify the time period in which the information must be returned or destroyed; and (5) establish policies and procedures to protect personally identifiable information from education records from further disclosure (except back to the disclosing entity) and unauthorized use, included limiting use of information by only those authorized representatives of the entity with legitimate interested. The burden for States is estimated at 40 hours annually for each educational authority (one for K-12 and one for postsecondary). This 40 hours of burden was reached by estimating that 103 State authorities (including both K-12 and postsecondary authorities) may handle the agreements up to 10 times per year with an estimated time of 4 hours per agreement. This would be an increase in burden of 4,120 burden hours.
In the 2011 final regulations, a burden estimate of 4 hours annually was added for large school districts or local educational agencies (LEAs) and postsecondary institutions (1,452 educational agencies and institutions with a student population of over 10,000). Assuming each large LEA and postsecondary institution handles the agreements up to 1 time per year with an estimated 4 hours per agreement, the total anticipated increase in annual burden for large LEAs and postsecondary institutions would be 5,808 hours for this requirement. Therefore, the total estimated burden for this provision is 9,928 hours. Note: For purposes of the burden analysis for §99.35(a)(3), the burden on large LEAs and postsecondary institutions was estimated because we believe that estimating burden for these institutions captures the high-end of the burden estimate. The burden for smaller LEAs and postsecondary institutions under §99.35(a)(3) is expected to be much less than estimated here.
This is an extension of a previously approved information collection request.
Purpose of Use of Information Collected.
Educational agencies and institutions, such as school districts and postsecondary institutions are required to annually notify parents and students of their rights under FERPA. A school is not required to notify parents and students individually, but rather is required to provide the notice by any means that are reasonably likely to inform them of their rights under FERPA. These means could include publication in the school activities calendar, newsletter, school website, student handbook, or a combination of these methods.
In addition, educational agencies and institutions must keep a record of each request for access to and each disclosure of personally identifiable information from the education records of each student. FERPA includes several exceptions to the recordation requirement. The recordation requirement does not apply to requests from or disclosures to: (1) the parent or eligible student; (2) a school official with legitimate educational interest; (3) a party with written consent from the parent or eligible student; (4) a party seeking directory information; or (5) a party seeking or receiving the records as directed by a Federal grand jury or other law enforcement subpoena and the issuing court or agency has ordered that the existence or contents of the subpoena or the information furnished in response not be disclosed.
FERPA requires that educational agencies and institutions – typically schools, school districts, and postsecondary institutions – also record the names of additional parties, if any, to which the receiving party may make further disclosures of the information on behalf of the educational agency or institution. The 2008 changes to the FERPA regulations require that State and local educational authorities and Federal officials and agencies that receive personally identifiable information from students’ education records – such as a State department of education – record any further disclosures of the information they make if the disclosing school did not record the further disclosures, or if the information was received from another education authority or Federal official or agency listed in § 99.31(a)(3) of the FERPA regulations.
As a result of the 2008 changes to the recordation requirements in the regulations, educational agencies and institutions must also maintain a listing in students’ records of the State and local educational authorities and Federal officials and agencies that may make further disclosures of the students’ education records on behalf of the agency or institution so that parents and eligible students will be made aware of these further disclosures. This requirement would only apply in those cases where educational agencies and institutions have disclosed personally identifiable information from education records to any of these authorities listed in § 99.31(a)(3) of the FERPA regulations. Under this exception to FERPA’s general rule of consent, educational agencies and institutions are permitted to disclose education records to these particular officials and authorities for audit, evaluation, or compliance or enforcement activities, under the conditions of § 99.35 of the regulations. The information collection requirements are necessary to carry out the purpose of FERPA.
Further, the FERPA regulations require an educational agency or institution to enter into a written agreement with an organization conducting studies, for or on its behalf, for purposes of testing, student aid, and improvement of instruction. The written agreement requirement only applies if the educational agency or institution opts to disclose personally identifiable information from student’s education records under this exception to the general consent requirement of FERPA. The agreement must: (1) designate the individual or entity as an authorized representative; (2) specify the PII from education records to be disclosed; (3) specify that the purpose for which the PII from education records is disclosed to the authorized representative is to carry out an audit or evaluation of Federal- or State-supported education programs, or to enforce or to comply with Federal legal requirements that relate to those programs; (4) describe the activity to make clear that it legitimately fits within the exception of §99.31; (5) require the authorized representative to destroy PII from education records when the information is no longer needed for the purpose specified; (6) specify the time period in which the PII from education records must be destroyed; and (7) establish policies and procedures, consistent with FERPA and other Federal and State confidentiality and privacy provisions, to protect PII from education records from further disclosure (except back to the disclosing entity) and unauthorized use. The information collection requirements are necessary to carry out the purposes of FERPA.
Consideration of Improved Information Technology.
The advancement of and more common use of computer systems have dramatically reduced the burden of graphically producing the notification of rights required under the FERPA since it was enacted in 1974. Electronic systems also enable schools to more easily create and maintain disclosure information for the mandatory recordation requirements.
The Family Policy Compliance Office (FPCO), which administers FERPA, makes available to school officials a model notification that can be adapted by schools. The models are posted on the Department’s Web site -- http://www.ed.gov/policy/gen/guid/fpco/ferpa/lea-officials.html and http://www.ed.gov/policy/gen/guid/fpco/ferpa/ps-officials.html. FPCO routinely responds to telephone and email inquiries from school officials (elementary/secondary as well as postsecondary), providing them with technical assistance on FERPA. The technical assistance often includes information on where to locate and download the model notifications. In addition, FPCO annually notifies school districts of their obligations under FERPA, as required by the Elementary and Secondary Education Act (ESEA). The annual notice includes a copy of the model FERPA notification and information on where to locate and download the model. This greatly reduces the burden on schools of having to write the required notification.
Other than the use of computers to reduce the burden of writing agreements, there is no specific technology that would reduce the burden of written agreements. However, FPCO will provide technical assistance and guidance to those educational agencies and institutions that request assistance.
Efforts to Identify Duplication.
The provisions do not duplicate any other Federal requirements. No other agency has this information.
Burden Minimization as Applied to Small Businesses.
These regulations are consistent with the Administration’s regulatory principles to minimize burden on small entities.
Consequences of Less Frequent Data Collection.
Should these collections of information under FERPA be conducted less frequently, the requirements of the Act would not be carried out.
Special Circumstances Governing Data Collection.
These information collection requirements are consistent with the guidelines in 5 CFR 1320.5(d)(2).
Consultation Outside the Agency.
The Department informed the public of these information collection activities through the NPRM for FERPA which published on April 8, 2011 (Vol. 76, No. 68, page 19726) and provided the comment period for this information collection activity. The information collection was submitted to OMB as soon as the NPRM was published. Although some changes have been made to the final regulations, no public comments on information collection requirements were received as a result of the April 8, 2011, NPRM.
For the previous NPRM, the Department informed the public through a 60-day and a 30-day notice that the NPRM for FERPA was published on March 24, 2008. The NPRM (Vol. 73, No. 57, page 15574) did not provide a comment period for the information collection activity. However, the 60-day notice provided and the 30-day notice provided the appropriate comment period for the information collection activity.
Prior to this time, the public had the opportunity to comment on the proposed changes in the collection of information under FERPA during the publication of an NPRM in the March 14, 1996, Federal Register. See 61 Fed. Reg. 10664 (March 14, 1996). One of the proposed changes (which was adopted) was to remove the previous requirement that educational agencies and institutions have a student records “policy” pursuant to § 99.6 of the regulations and to transfer some of the policy requirements to the notification requirement of § 99.7 of the regulations. As explained in the final regulations – 61 Fed. Reg. 59292 (November 21, 1996) – the purposes in removing the requirement that schools maintain a policy were: (1) the change will help to ensure that parents and eligible students receive more effective notification of their rights under the law; and (2) the change will afford schools greater flexibility by removing requirements that are not statutory and not necessary to implement the law.
Seven commenters submitted letters in support of the proposal to remove the regulatory requirement that schools adopt student records policies. One commenter said that the change will not only lessen the burden on schools, but would facilitate communication between the schools and parents or eligible students. The same commenter also said that the cost associated with the change would not be significant because his school district updates its notices regardless of statutory requirements. Another commenter representing a large public university stated that the “flexibility offered by not requiring having such a [student records] policy is a laudable goal.” Six commenters opposed the change. One commenter stated that the current requirements are not burdensome. Two noted that the policy is helpful in educating school officials about FERPA, and that the change in requirements would be burdensome on schools because they would incur costs to publish a longer notification. After consideration of the last comment, the Department removed some of the information that was proposed to be included in the notification as not necessary to meet the statutory requirement. (See discussion at 61 Fed. Reg. 59293, first column.) At the time of these final regulations, FPCO made a hard copy model notification available to schools. Both model notifications (one for elementary/secondary schools and one for postsecondary institutions) were published in the Federal Register. (See 61 Fed. Reg. 59297 – 59298.) Since that time, we have included the models on our Web site.
The other change in 1996 involving the collection of information under FERPA was a change to the recordation requirements of § 99.32. The change resulted in the addition of the fifth exception to the requirement. Specifically, schools are not required to record disclosure of information resulting from certain types of subpoenas and court orders issued for law enforcement purposes. This change reduced the recordkeeping burden for these types of disclosures. No comments were received on this change.
Regulations from 1996 until 2008 did not involve any changes in the collection of information under FERPA. However, in 2008, additional information collection requirements were added to FERPA. While no specific consultation with school officials occurred, they had the opportunity to comment on the new requirements at the time of the 2008 NPRM. Educational agencies and institutions did not independently expressed concern over costs or burden because of these requirements. FPCO sought ways to minimize burden of these requirements, such as making model notices easily available to school officials.
As a result of the March 28, 2008, NPRM, the Department did receive comments on some of the information collection activities. In the NPRM, we specifically noted that the Department was interested in relieving any administrative burdens associated with recording disclosures of education records and, therefore, invited public comments on whether a State educational agency (SEA), the Department, or other authority or official listed in § 99.31(a) (3) should be allowed to maintain the record of the redisclosures it makes on behalf of an educational agency or institution under § 99.32.
Several commenter’s, including officials representing State departments of education, stated that an SEA (or other authority or official listed in § 99.31(a) (3)) should be responsible for maintaining the record of disclosure required under § 99.32 when it rediscloses information on behalf of educational agencies and institutions. The commenter’s stated that requiring each educational agency or institution, such as school districts, to record each redisclosure made by an SEA or other State educational authority on its behalf imposes an unacceptable recordkeeping burden on school districts and is impractical for State educational authorities to adhere to in making further disclosures on behalf of the agency or institution. In response to these comments, we revised § 99.32 to require the State and local educational authorities and Federal officials listed in § 99.31(a)(3) to maintain the record of further disclosures if the educational agency or institution does not do so and make it available to the educational agency or institution upon request. We agree that by requiring State and Federal authorities and officials to record their redisclosures in these circumstances school districts will have less total paperwork burden because schools will not have to comply with the recordkeeping requirement in these instances.
The Department also received comments from a number of parties expressing support and appreciation for the explicit requirement for a written agreement whenever an educational agency or institution discloses personally identifiable information from education records to organizations conducting certain studies under § 99.31(a)(6). A national association of school boards pointed out that, while this change created another paperwork burden for school districts, the group did not object to the written agreement requirement because putting in writing the requirements regarding the use and destruction of data may improve compliance with FERPA. This commenter also recommended that the use and destruction of data should be made clear in this new provision. A national association representing postsecondary officials commented that, among other things, we should restrict access to personally identifiable information within the organization conducting the study to those individuals with a legitimate interest in the information. We received other comments that indicated a need to further clarify the specific types of information that must be contained in the written agreement between an educational agency and institution and an organization conducting a study for the agency or institution, and we included these clarifications in the final regulations.
A 60 day comment notice was published in the Federal Register on June 2, 2014 (74 Fr 31315). The department received 64 comments. A summary response to the comments is provided in the attached “Comments Response 082714.doc”. A 30 day notice was published.
Payments or Gifts to Respondents.
The information collection’s respondents will not receive any payment or gift for submitting any information related to FERPA.
Assurance of Confidentiality.
FERPA requires that educational agencies and institutions protect the privacy of student’s education records, including the privacy of the record of request for the student’s education records. As the respondents of the information collection requirements, school officials do not need assurance of confidentiality because the requirements are intended to advance the privacy rights of parents and eligible students (a student who has reach 18 years of age or is attending a postsecondary institution at any age).
Questions of Sensitive Nature.
The Act does not address nor call for questions of a sensitive nature.
Annual Hour Burden for Respondents/Record keepers
FERPA’s Annual Notification of Rights Requirement (34 CFR § 99.7)
There are approximately 20,629 school districts and postsecondary institutions affected by the annual notification of rights requirement in FERPA (34 CFR § 99.7). We estimate that an average of .25 hours (15 minutes) per response is required for the annual notification of rights requirement. From administrative experience, we have determined that, at the elementary/secondary level, school districts (as opposed to individual schools) are the entities that typically issue the annual notification of FERPA rights. At the postsecondary level, it is the individual institutions that issue the notice. Following is a breakdown of school districts and postsecondary institutions:
No. School Districts: 14,166
Burden Hours: x .25
Total Burden Hours = 3,542
No. Postsec. Inst.: 6,463
Total Burden Hours = 1,616
School District Burden Hours: 3,542
Grand Total Burden Hours: 5,158
Since most agencies and institutions met major requirements during the early years after FERPA’s passage in 1974 and after publication of the revised regulations in 1988, the year-to-year cost is minimal.
FERPA’s Written Agreement Requirement (34 CFR § 99.31(a)(6)(ii)(C)(1)-(4))
20 U.S.C. § 1232g(b)(1)(F) permits the nonconsensual disclosure of personally identifiable information from students’ education records to organizations conducting studies “for, or on behalf of” an educational agency or institution for specified purposes. A change to the FERPA regulations in 2008 requires that, if an educational agency or institution discloses personally identifiable information under this exception to consent, it must enter into a written agreement with the organization that is conducting the study (34 CFR § 99.31(a)(6)(ii)(C)(1)-(4)).
The regulations in § 99.31(a)(6)(ii)(C) require an educational agency or institution to enter into a written agreement before disclosing personally identifiable information from education records, without consent, to organizations conducting studies for, or on behalf of, the educational agency or institution to: (a) develop, validate, or administer predictive tests; (b) administer student aid programs; or (c) improve instruction. The written agreement must specify the purpose or purposes, scope, and duration of the study or studies and the information to be disclosed, require the organization to conduct the study in a manner that does not permit personal identification of parents and students by anyone other than representatives of the organization with legitimate interests, require the destruction or return of the information to the educational agency or institution when the study is completed, and specify the time period for destruction or return of the information.
As discussed with OMB, the Department does not have any information on how many educational agencies and institutions actually disclose information to organizations under this exception. Therefore, we are unable to estimate the additional burden, if any, for the new requirements in § 99.31(a)(6)(ii)(C). However, it is our opinion that any additional burden of entering into written agreements to comply with this change is unlikely to be significant because most educational agencies and institutions already specify the terms under which personally identifiable information can be used when it is disclosed to organizations for these types of studies. Although this change will create an additional information collection requirement, the Department believes the benefits of the written agreement outweigh any additional burden because it will ensure better compliance with FERPA and provide clarity for both researchers and educational agencies and institutions about the restrictions and use of personally identifiable information disclosed under § 99.31(a)(6) for studies.
The 2011 final regulations modified this provision to permit a State or local educational authority or Federal agencies and officials listed in § 99.31(a)(3) to enter into these written agreements with organizations conducting studies for, or on behalf of, educational agencies and institutions. The Department does not believe this constitutes a change or an increase in burden because there is no evidence that this would be considered a burden. Additionally, we only anticipate that State educational authorities (and not the other officials listed in § 99.31(a)(3)) will enter into these agreements on behalf of the schools under their jurisdictions. Also as noted above, it is our opinion that the benefits of the written agreement outweigh any additional burden because it will ensure better compliance with FERPA. It will also provide clarification for both organizations conducting studies and educational agencies about the restrictions and use of personally identifiable information disclosed under this exception to FERPA consent requirement.
FERPA’s Recordkeeping Requirement (34 CFR § 99.32)
In 2010, we informally contacted eight school officials – three officials at elementary/secondary school districts, one official at an elementary school, and four officials at postsecondary institutions – to find out about their individual recordkeeping practices. Most of the schools we contacted used a paper-based system for recordkeeping, while some of the postsecondary institutions used both paper-based and electronic. From our informal review, it was clear that recordkeeping is done at the individual school (as opposed to the school district at the elementary/secondary level) and the individual postsecondary institution. As a result, it was estimated that an average of .0833 hours (5 minutes) per disclosure is required for the recordkeeping requirement. The average number of disclosures of individual student records per year was based on responses from the eight school officials. (Based on the type and size of the school, the number of releases varies.)
It was not clear that schools recognize that FERPA requires that they record disclosures made of personally identifiable information from students’ education records to State authorities, such as when a school discloses personally identifiable information on all students in attendance to a State education department on the elementary/secondary level or to the State postsecondary educational authority on the college level. Without more information on the practices of schools in this regard, it is difficult to accurately estimate the specific burden hours for this recordkeeping requirement. However, we assumed that many of these schools, especially at the postsecondary level and more urban school districts, utilize computerized methods to record disclosures, which would make it less burdensome to record disclosures for large numbers of students. Where there are large numbers of disclosures and no computerized method is used to indicate that a disclosure occurred, FPCO has advised schools that they may utilize a single notice about the mass disclosure. When a parent or student requests access to his or her record of disclosure, the school may provide the notice with the information concerning the disclosure to the parent or student at the time of the request, thereby minimizing the burden on the school. However, because these recordations are not exempt from FERPA’s recordkeeping requirement, we have included an estimate for the burden of recording disclosures of all students in attendance to State authorities. We estimate that schools must share this information with State officials twice a year and estimate that it would take schools 1 hour to either make the recording via their computer system or develop a notation and make it available to parents or students asking to inspect this record. As explained elsewhere, it is our administrative experience that few parents and students request to see this record.
The 2011 NPRM proposed a definition of the term “authorized representative” to § 99.3 which would permit the officials listed in § 99.31(a)(3) (a State or local educational authority, the Secretary, the Comptroller General of the United States, or the Attorney General of the United States) to designate any entity or individual to carry out any audit, evaluation, or the enforcement of, or compliance with, Federal legal requirements related to Federal or State supported education programs. It is our opinion that this does not constitute a change or an increase in burden because these entities are already required to record disclosures, pursuant to § 99.32(b)(2), as described in this section.
For the general recordkeeping requirement of § 99.32(a) for recordation of individual disclosures, following is a breakdown of individual schools (public elementary, secondary, or combined) and postsecondary institutions:
No. of Schools: 97,382
Average No. of Disclosures: x 192
# Of Responses 18,697,344
Hours/Response: x .0833
Burden Hours 1,557,489
No. of Postsec. Inst.: 6,463
Average No. of Disclosures: x 192
# of Responses 1,240,896
Hours/Response: x .0833
Burden Hours 103,367
Elementary/Secondary School Burden Hours: 1,557,489
Postsec. Inst. Burden Hours: + 103,367
Total Burden Hours for recordation
of individual disclosures: 1,660,856
For the recordkeeping requirement for disclosures of all students in attendance to State educational authorities, following is a breakdown of individual schools (public elementary, secondary, or combined) and postsecondary institutions:
No. of Schools: 97,382
Average No. of Disclosures: x 2
# of Responses 194,764
Hours/Response: x 1
Burden Hours 194,764
No. of Postsec. Inst.: 6,463
Average No. of Disclosures: x 2
# of Responses 12,926
Hours/Response: x 1
Burden Hours 12,926
Elementary/Secondary School Burden Hours: 194.764
Postsec. Inst. Burden Hours: + 12,926
Total Burden Hours for recordation
of disclosures of all students: 207,690
Total Burden Hours for recordation
of individual disclosures: 1,660,856
Total Burden Hours for recordation
of disclosures of all students: 207,690
Total Burden Hours for Recordation 1,868,546
The number of school districts and the number of postsecondary institutions subject to FERPA is based on the number of public school districts and the number of Title IV postsecondary institutions, as reported in the National Center for Education Statistics’ (NCES’) Digest of Education Statistics. See http://nces.ed.gov/programs/digest/d07/tables/dt07_005.asp. The number of affected schools reported to OMB in previous years was higher, but we believe this number that is based on NCES’ count is more accurate.
§ 99.32(a)(1) –
In 2008, the regulations were amended (§ 99.32(a)(1)) to require educational agencies and institutions to maintain a listing in each student’s records of the State and local educational authorities and Federal officials and agencies that may make further disclosures of the student’s education records on behalf of the agency or institution without consent. This only applies when the school discloses personally identifiable information to one of these parties. Because schools are already required to record their disclosures to a State and Federal authorities under § 99.32(a), we do not believe that this new requirement will impose any new burden.
§ 99.32(a)(4) –
The 2008 final regulations also added § 99.32(a)(4) to require that, upon the request of a parent or eligible student, an educational agency or institution must obtain a copy of the record of further redisclosures described under § 99.32(b)(2) and make it available for review to the parent or eligible student.
State educational authorities and Federal officials and agencies that maintain records of redisclosures will have to make that information available to the educational agency or institution whose records were redisclosed, upon request, so that the agency or institution can make that record available to a parent or eligible student who has asked to inspect and review the student’s record of disclosures. Our estimate is that two educational authorities or agencies in each State and the District of Columbia (one for K-12 and one for postsecondary) and the Department itself, for a total of 103 authorities, will maintain the required records of redisclosures. It is also estimated that it will take .25 hours (15 minutes) per disclosure to locate and print a record of disclosures for this requirement. Based on our administrative experience over the years, we assume that few parents and students request this information and, therefore, use an estimate that one tenth of one percent of a total of 68.1 million students will make such a request each year, or 68,076 requests. This translates to an average of 3 disclosures per school. (We divided total number of schools by total number of requests.) The total number of disclosures by State and Federal educational authorities will be the same as that calculated for schools.
No. of Schools & Postsec. Inst.: 20,629
Average No. of Disclosures: x 3
# of Responses 61,887
Hours/Response: x .25
Burden Hours 15,472
Average No. of Disclosures by
State & Fed. Ed. Authorities: 61,887
Hours/Response: x .25
Burden Hours 15,472
School Burden Hours: 15,472
State & Fed. Burden Hours: + 15,472
Total Burden Hours 30,944
§ 99.32(a)(5) –
The 2008 final regulations added a new section (§ 99.32(a)(5)) that requires that a school that discloses information under the health and safety emergency exception in § 99.36 record the particular and significant threat that formed the basis for the disclosure and the parties to whom the education records were disclosed. Because § 99.32(a) already requires schools to record disclosures made under §99.36, including the legitimate interests the parties had in requesting or obtaining the information, we believe these changes will not create any significant additional administrative costs for schools and that the benefit of requiring recordation of this information outweighs the costs. This new requirement in § 99.32(a)(5) simply clarifies the type of information that must be recorded when a school discloses personally identifiable information in response to a health or safety emergency, either for one student or for all students in a school. We do not believe that the new requirement modifies the burden reported under § 99.32.
§ 99.32(b)(2) –
The 2008 final regulations added a requirement (§ 99.32(b)(2)) that State and local educational authorities and Federal officials listed in § 99.31(a)(3) maintain a record of further disclosures these parties may make of personally identifiable information from education records if the educational agency or institution does not do so. While the Department did not officially seek comments on any information collection activities in the March 28, 2008, NPRM, we did receive comments on some of these activities. In the NPRM, we specifically noted that the Department was interested in relieving any administrative burdens associated with recording disclosures of education records and, therefore, invited public comments on whether a State educational agency (SEA), the Department, or other authority or official listed in § 99.31(a)(3) should be allowed to maintain the record of the redisclosures it makes on behalf of an educational agency or institution under § 99.32.
Several commenters, including officials representing State departments of education, stated that an SEA (or other authority or official listed in § 99.31(a)(3)) should be responsible for maintaining the record of disclosure required under § 99.32 when it rediscloses information on behalf of educational agencies and institutions. The commenter’s stated that requiring each educational agency or institution, such as school districts, to record each redisclosure made by an SEA or other State educational authority on its behalf imposes an unacceptable recordkeeping burden on school districts and is impractical for State educational authorities to adhere to in making further disclosures on behalf of the agency or institution.
In response to these comments, we revised § 99.32 to require the State and local educational authorities and Federal officials listed in § 99.31(a)(3) to maintain the record of further disclosures if the educational agency or institution does not do so and make it available to the educational agency or institution upon request. We agree that by requiring State and Federal authorities and officials to record their redisclosures in these circumstances school districts will have less total paperwork burden because schools will not have to comply with the recordkeeping requirement in these instances.
State educational authorities and Federal officials listed in § 99.31(a)(3) will incur new information collection burdens if they maintain the record of redisclosure for the educational agency or institution on whose behalf they redisclose education records under the regulations. We estimate that two educational authorities or agencies in each State and the District of Columbia (one for K-12 and one for postsecondary) and the Department itself, for a total of 103 authorities, will maintain the required records of redisclosures. (We anticipate that educational agencies and institutions will record under § 99.32(b)(1) any further disclosures made by the other Federal officials listed in § 99.31(a)(3), the U.S. Comptroller General and the U.S. Attorney General, as is currently required for redisclosures made by other parties on behalf of the educational agency or institution. See 34 CFR § 99.32(b)(1).) We estimate further that these authorities will need to record two redisclosures per year from their records. We estimate that an average of .0833 hours (5 minutes) per disclosure is required for this new recordkeeping requirement. We also assume for purposes of this analysis that State educational authorities and the Department already have software that will allow them to record these disclosures electronically.
No. of St. & Fed. Edu. Authorities: 103
Average No. of Disclosures: x 2
# of Responses 206
Hours/Response: x .0833
Burden Hours 17
§ 99.35(a)(3)
The 2011 final regulations added a new requirement under § 99.35(a)(3) that requires an agency headed by an official listed in § 99.31(a)(3) to use a written agreement to designate any authorized representative other than an agency employee. The written agreement must: (1) designate the individual or entity as an authorized representative; (2) specify the PII from education records to be disclosed; (3) specify that the purpose for which the PII from education records is disclosed to the authorized representative is to carry out an audit or evaluation of Federal- or State-supported education programs, or to enforce or to comply with Federal legal requirements that relate to those programs; (4) describe the activity to make clear that it legitimately fits within the exception of §99.31; (5) require the authorized representative to destroy PII from education records when the information is no longer needed for the purpose specified; (6) specify the time period in which the PII from education records must be destroyed; and (7) establish policies and procedures, consistent with FERPA and other Federal and State confidentiality and privacy provisions, to protect PII from education records from further disclosure (except back to the disclosing entity) and unauthorized use. We estimate that the burden for States is estimated at 40 hours annually for each educational authority (one for K-12 and one for postsecondary). This 40 hours of burden was reached by estimating that 103 State authorities may handle the agreements up to 10 times per year with an estimated time of 4 hours per agreement. Total anticipated increase in annual burden would be 4,120 hours for this new requirement.
In addition, the burden for large LEAs and postsecondary institutions (1,452 educational agencies and institutions with a student population of over 10,000) is estimated to be 4 hours annually. Assuming each large LEA and postsecondary institution handles the agreements up to 1 time per year with an estimated 4 hours per agreement, the total anticipated increase in annual burden for large LEAs and postsecondary institutions would be 5,808 hours for this requirement.
The total estimated burden under this provision is 9,928 hours.
No. of St. & Fed. Edu. Authorities: 103
Average No. of Disclosures: x 10
# of Responses 1,030
Hours/Response: x 4__
Burden Hours 4,120
No. of Large LEAs & Post. Inst: 1,452
Average No. of Disclosures: x 1
# of Responses 1,452
Hours/Response: x 4_
Burden Hours 5,808
State & Fed. Burden Hours: 4,120
School Burden Hours: 5,808
Total Burden Hours for
Written Agreements: 9,928
GRAND TOTAL
Total Number of Respondents: 105,399 Total Number of Responses: 20,293,021 Total Number of Burden Hours: 1,914,593
This is a list of the regulatory requirements which is provided with more detailed description (above) in the Supporting Statement, A12. Each requirement lists the burden for schools, institutions, and/or state or local education authorities with the number of responses and total burden hours.
Remove |
IC Title |
Status |
Responses |
Hours |
Dollars |
Document Type |
Form No. |
Form Name |
|
Annual Notification of Rights Requirement (Section 99.7) for School Districts |
No Change |
14166 |
3542 |
0 |
Other Regulatory Requirement |
|
|
|
Annual Notification of Rights Requirement (Section 99.7) for Postsecondary Institutions |
No Change |
6463 |
1616 |
0 |
Other Regulatory Requirement |
|
|
|
FERPA Recordkeeping Requirement (99.32) for schools |
No Change |
18697344 |
1557489 |
0 |
Other Regulatory Requirement |
|
|
|
FERPA Recordkeeping Requirement (Section 99.32) for Postsecondary Institutions |
No Change |
1240896 |
103367 |
0 |
Other Regulatory Requirement |
|
|
|
FERPA Section 99.32 Recordkeeping Requirement for Disclosures (Schools) |
No Change |
194764 |
194764 |
0 |
Other Regulatory Requirement |
|
|
|
FERPA Section 99.32 Recordkeeping Requirement for Disclosures (Postsecondary Institutions) |
No Change |
12926 |
12926 |
0 |
Other Regulatory Requirement |
|
|
|
FERPA Section 99.32(a)(4) Regulatory Requirement for Schools and Postsecondary Institutions |
No Change |
61887 |
15472 |
0 |
Other Regulatory Requirement |
|
|
|
No Change |
61887 |
15472 |
0 |
Other Regulatory Requirement |
|
|
|
|
No Change |
206 |
17 |
0 |
Other Regulatory Requirement |
|
|
|
|
FERPA Section 99.35 (a) (3) For State Educational Authorities
|
No Change |
1030 |
4120 |
0 |
Other Regulatory Requirement |
|
|
|
FERPA Section 99.35 (a) (3) For large LEAs and postsecondary institution Authorities |
No Change |
1452 |
5808 |
0 |
Other Regulatory Requirement |
|
|
Total responses under this ICR: 20,293,021 Total burden hours under this ICR: 1,914,593
Annual Cost Burden to Respondents
The total for the capital and start-up cost components of both information collection requirements is zero. The information collection requirements under FERPA do not require the purchase of any capital equipment nor create any start-up costs. Computers and word processing software used to complete this information collection are part of the respondents’ customary and usual business or private practices, and therefore are not included.
The total for operation and maintenance for this information collection is zero. The information collection does not create costs associated with generating, maintaining, and disclosing or providing the information that is not already identified in question 12 of this supporting statement.
Estimated Annual Cost to the Federal Government.
No measurable percentage of staff time is devoted to assisting educational agencies and institutions in either of these information collection requirements. With regard to the annual notification requirement, as explained in the response to question 3, the Department posts model notifications (one for elementary/secondary and one for postsecondary) on its website. The model can be downloaded and easily be adapted by schools for use. With regard to the recordkeeping requirements, staff routinely provides technical assistance on other aspects of the law, but the recordkeeping requirements have become routine with schools and appear to not be an issue of concern.
Reasons for Changes to Burden Hours Estimated
This is an extension of a previously approved information collection request. There are no changes in burden and responses.
Collection of Information with Public Results.
The results of the collection of information will not be published.
Approval to Not Display Expiration Date.
ED is not seeking this approval.
Exception to the Certification Statement.
ED is not requesting any exceptions to the “Certification for Paperwork Reduction Act Submissions.”
| File Type | application/msword |
| File Title | Family Educational Rights and Privacy Act (FERPA) Support Statement |
| Author | Rhonda Kelly |
| Last Modified By | Authorised User |
| File Modified | 2014-08-27 |
| File Created | 2014-08-27 |