OMB83 Change Memo

February 16, 2016

M e m o r a n d u m

TO: Robert Sivinski

Office of Management and Budget

FROM: Tracy Hunt-White

National Center for Education Statistics

THROUGH: Kashka Kubzdela

National Center for Education Statistics

RE: 2015-16 National Postsecondary Student Aid Study (NPSAS:16) Full Scale Data Collection Authorization Citation Update (OMB# 1850-0666 v. 18)

This requests is to amend the 2015-16 National Postsecondary Student Aid Study (NPSAS:16) supporting statement Part A and institution contacting materials to correct the legislative citation under the Family Educational Rights and Privacy Act (FERPA), which provides NCES with the authority to collect personally identifying information from postsecondary students’ education records without their consent.

NCES was incorrectly citing 34 CFR § 99.31(a)(6) which indicated that its exception to collect student records without consent was because it were administering studies for, or on behalf of educational agencies or institutions. The correct authority is 34 CFR § 99.31(a)(3) which permits NCES to collect student records without consent as an authorized representative of the Secretary of Education.

Specifically, FERPA permits educational institutions to disclose personally identifiable information from students’ education records, without consent, to authorized representatives of the Secretary of Education in connection with an evaluation of federally supported education programs. 34 CFR §§ 99.31(a)(3) and 99.35.

To incorporate the correct citation, we revised references to and citations of FERPA from 34 CFR § 99.31(a)(6) to 34 CFR § 99.31(a)(3) in Supporting Statement Part A of both the NPSAS:16 Full-Scale Student Records and Student Interview package (page 9) and the carryover NPSAS:16 Full-Scale Institution Contacting package (pages 8 to 9). We also corrected this reference in the contacting materials in Appendix D of these packages. We correct the citation on pages D-34 and D-38 of the full-scale student data collection package and pages D-17 and D-34 carryover full-scale institution list collection package (see below for the explicit changes).

Changes to Part A of NPSAS:16 Full-Scale Institution List Collection Package (pages 8 to 9) and Part A of NPSAS:16 Full-Scale Student Records and Student Interview Package (pages 8 to 9)

Old Citation:

Regarding file matching with administrative sources, the Family Educational Rights and Privacy Act (FERPA) (34 CFR Part 99) allows the disclosure of information without prior consent for the purposes of NPSAS:16 according to the following excerpts: 34 CFR § 99.31 asks, “Under what conditions is prior consent not required to disclose information?” and explains in 34 CFR § 99.31(a) that “An educational agency or institution may disclose personally identifiable information from an education record of a student without the consent required by §99.30 if the disclosure meets one or more” of several conditions. These conditions include, at 34 CFR § 99.31(a)(6)(i):

“The disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions to:

(A) Develop, validate, or administer predictive tests;

(B) Administer student aid programs; or

(C) Improve instruction.”

In addition, 34 CFR § 99.31(a)(6)(v) specifies: “For the purposes of paragraph (a)(6) of this section, the term organization includes, but is not limited to, Federal, State, and local agencies, and independent organizations.”

All three parts of 34 CFR § 99.31(a)(6)(i) apply to NPSAS:16. The purpose of NPSAS:16 is to create a research data set for a large sample of students that brings together information about federal, state, and private aid programs, and gathers additional demographic and enrollment data to establish the appropriate context. The resultant data set allows research and policy analysts to address basic issues about the affordability of postsecondary education and the effectiveness of the existing financial aid programs. The data set can be used for, or on behalf of, educational agencies or institutions to accomplish activities (A), (B), and (C).

In 34 CFR § 99.31 (a)(6)(iii), FERPA further specifies that such disclosure may only occur if “[the] study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of the organization” and “[the] information is destroyed when no longer needed for the purposes for which the study was conducted.”

New Citation:

The Family Educational Rights and Privacy Act (FERPA) (34 CFR Part 99) allows the disclosure of personally identifiable information from students’ education records without prior consent for the purposes of NPSAS:16 according to the following excerpts: 34 CFR § 99.31 asks, “Under what conditions is prior consent not required to disclose information?” and explains in 34 CFR § 99.31(a) that “An educational agency or institution may disclose personally identifiable information from an education record of a student without the consent required by §99.30 if the disclosure meets one or more” of several conditions. These conditions include, at 34 CFR § 99.31(a)(3):

The disclosure is, subject to the requirements of §99.35, to authorized representatives of--

(i) The Comptroller General of the United States;

(ii) The Attorney General of the United States;

(iii) The Secretary; or

(iv) State and local educational authorities.

NPSAS:16 is collecting data under the Secretary’s authority. Specifically, NCES, as an authorized representative of the Secretary of Education, is collecting this information for the purpose of evaluating a federally supported education program. Any personally identifiable information is collected with adherence to the security protocol detailed in 34 CFR § 99.35:

(a)(1) Authorized representatives of the officials or agencies headed by officials listed in §99.31(a)(3) may have access to education records in connection with an audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs.

(2) The State or local educational authority or agency headed by an official listed in §99.31(a)(3) is responsible for using reasonable methods to ensure to the greatest extent practicable that any entity or individual designated as its authorized representative—

(i) Uses personally identifiable information only to carry out an audit or evaluation of Federal- or State-supported education programs, or for the enforcement of or compliance with Federal legal requirements related to these programs;

(ii) Protects the personally identifiable information from further disclosures or other uses, except as authorized in paragraph (b)(1) of this section; and

(iii) Destroys the personally identifiable information in accordance with the requirements of paragraphs (b) and (c) of this section.

(b) Information that is collected under paragraph (a) of this section must—

(1) Be protected in a manner that does not permit personal identification of individuals by anyone other than the State or local educational authority or agency headed by an official listed in §99.31(a)(3) and their authorized representatives, except that the State or local educational authority or agency headed by an official listed in §99.31(a)(3) may make further disclosures of personally identifiable information from education records on behalf of the educational agency or institution in accordance with the requirements of §99.33(b); and

(2) Be destroyed when no longer needed for the purposes listed in paragraph (a) of this section.

(c) Paragraph (b) of this section does not apply if:

(1) The parent or eligible student has given written consent for the disclosure under §99.30; or

(2) The collection of personally identifiable information is specifically authorized by Federal law.

Changes to Frequently Asked Questions in Appendix D of the NPSAS:16 Full-Scale Institution List Collection Package (page D-17)

Old Citation:

Do we need to have the student's permission before providing this information?

No. Student or parental consent is not required for release of student record information for the purposes of these studies. The data request conforms fully to the requirements of the Family Educational Rights and Privacy Act of 1974 (FERPA) (34 CFR Part 99). Under FERPA’s general consent rule, NCES is authorized to obtain student level data from institutions for any study-eligible student, without prior consent, if the disclosure is to an organization administering studies for, or on behalf of, NCES. Student data are subject to strict protections that are adhered to by NCES and its contractor organizations. You can review this legislation on the U.S. Department of Education's website at http://www2.ed.gov/policy/gen/reg/ferpa.

New Citation:

Do we need to have the student's permission before providing this information?

No. Student or parental consent is not required for release of student record information for the purposes of these studies. The data request conforms fully to the requirements of the Family Educational Rights and Privacy Act of 1974 (FERPA) (34 CFR Part 99). Under FERPA’s general consent rule, NCES is authorized to obtain student level data from institutions for any study-eligible student, without prior consent, if the disclosure is to authorized representatives of the Secretary of Education [34 CFR § 99.31(a)(3)]. Student data are subject to strict protections that are adhered to by NCES and its contractor organizations. You can review this legislation on the U.S. Department of Education's website at http://www2.ed.gov/policy/gen/reg/ferpa.

Changes to Confidentiality Fact Sheet in Appendix D of the NPSAS:16 Full-Scale Institution List Collection Package (page D-34)

Old Citation:

The data request for NPSAS fully conforms to the requirements of the Family Educational Rights and Privacy Act of 1974 (FERPA) [20 U.S.C. 1232g; 34 CFR Part 99]. FERPA is designed to protect the privacy rights of students and their families, by providing consistent standards for the release of personally identifiable student and family information. NCES and its agent, RTI International, are explicitly authorized under an exception to FERPA’s general consent rule (in which the right to consent is held by the student, regardless of age) to obtain student level data from institutions. This exception provides for the collection of data on any eligible student, without prior consent if the disclosure is to an organization administering studies for, or on behalf of educational agencies or institutions.

New Citation:

The data request for NPSAS fully conforms to the requirements of the Family Educational Rights and Privacy Act of 1974 (FERPA) [20 U.S.C. 1232g; 34 CFR Part 99]. FERPA is designed to protect the privacy rights of students and their families, by providing consistent standards for the release of personally identifiable student and family information. NCES and its agent, RTI International, are explicitly authorized under an exception to FERPA’s general consent rule (in which the right to consent is held by the student, regardless of age) to obtain student level data from institutions. For the purposes of this collection of data, FERPA permits educational institutions to disclose personally identifiable information from students’ education records, without consent, to authorized representatives of the Secretary of Education in connection with an evaluation of Federally supported education programs. 34 CFR §§ 99.31(a)(3) and 99.35.

Changes to Frequently Asked Questions in Appendix D of the NPSAS:16 Full-Scale Student Records and Student Interview Package (pages D-34 and D-38)

Old Citation:

No. Student or parental consent is not required for release of student record information for the purposes of these studies. The data request conforms fully to the requirements of the Family Educational Rights and Privacy Act of 1974 (FERPA) (34 CFR Part 99). Under FERPA’s general consent rule, NCES is authorized to obtain student level data from institutions for any study-eligible student, without prior consent, if the disclosure is to an organization conducting studies for, or on behalf of, NCES. Student data are subject to strict protections that are adhered to by NCES and its contractor organizations. You can review this legislation on the U.S. Department of Education's website at http://www2.ed.gov/policy/gen/reg/ferpa.

New Citation:

No. Student or parental consent is not required for release of student record information for the purposes of these studies. The data request conforms fully to the requirements of the Family Educational Rights and Privacy Act of 1974 (FERPA) (34 CFR Part 99). Under FERPA’s general consent rule, NCES is authorized to obtain student level data from institutions for any study-eligible student, without prior consent, if the disclosure is to authorized representatives of the Secretary of Education [34 CFR § 99.31(a)(3)]. Student data are subject to strict protections that are adhered to by NCES and its contractor organizations. You can review this legislation on the U.S. Department of Education's website at http://www2.ed.gov/policy/gen/reg/ferpa.