Student Privacy Rights and Wrongs on the Web.

These days, it seems the sky is the limit when it comes to school technology. You can buy computers that fit in your pocket and monitors that cover entire walls. The letters CD-ROM, CPU and HTML are more than alphabet soup. Schools everywhere are gaining access to the broadest broadband you can imagine.

But with all that power at your fingertips, sometimes you'll need to stop, take a deep breath and call your lawyer--especially if you're posting student information on the Internet.

Many schools and districts would like to put student information online to promote community relations and facilitate internal communications. A district may want to use its Web site to showcase its successes with the community. Schools may create an intranet or internal network to maximize communications among students and staff. When these forms of communication are used to post personally identifiable student information, student privacy rights are involved.

Personally identifiable student information is protected by the Family Educational Rights and Privacy Act and by state privacy laws. FERPA prevents school districts from releasing students' education records without written parental consent, except in limited circumstances. An "education record" is any information directly related to a student that is maintained by a school district or someone acting for the school district.

Students' education records can be released in only two circumstances. First, a school district may release student information that has been designated "directory information," so long as the school district has given the notice described below. Second, student information can be released in accordance with a parent's written consent.

Student Data

Directory information means anything contained in an education record that would not generally be considered harmful or an invasion of privacy if disclosed. The FERPA regulations list the following examples of directory information: a student's name, address, telephone listing, electronic mail address, photograph, date and place of birth, major field of study, dates of attendance, grade level, enrollment status, participation in officially recognized activities and sports, weight and height of athletes, degrees, honors and awards received and most recent educational institution attended. FERPA's regulations and comments state that school districts may add items to this list.

Student information that has been designated as directory information can be disclosed only if the school district has given public notice of (1) the types of information included in its definition of directory information; (2) parents' right to restrict the disclosure of such information; and (3) the time within which a parent must notify the district in writing that he or she does not want all or part of the information designated directory information.

Public notice is all that is required. It can be done through a newsletter, a local newspaper or the student handbook. In practice, however, many school districts send parents individual notice of these rights.

Parental Consent

To post personally identifiable student information that is not directory information, schools must obtain parental consent. FERPA requires parental consent to be written and specific. The consent must specify the records to be released, the reason for such release and to whom the records are to be released.

School districts may be tempted to simplify this process by asking for broad parental consent once each school year. A blanket parental consent form may not comply with FERPA, however, meaning schools should obtain separate permission prior to each Web posting.

These privacy protections apply to any release, online or otherwise, of personally identifiable student information. With these rules in mind, schools may consider posting specific categories of student information on the Web.

Student Work

Student work is protected by FERPA if it is personally identifiable. Obviously, student work is personally identifiable if it is labeled with the student's name. But even without a name, student work can be considered identifiable if it contains sufficient information about the student to enable someone to identify the author or artist. If student work is personally identifiable, the district should seek parental consent before posting the work.

For every rule, there is an exception. In some circumstances, student work may qualify as directory information because it is an honor or award. For example, the Department of Education Family Policy Compliance Office, which is the federal office charged with overseeing FERPA compliance, has considered a complaint alleging that a school violated FERPA when it sent a letter inviting a student to participate in an arts program to other recipients as well.

The compliance office believed the invitation could be considered an award. If the school district gave public notice that awards would be directory information, and the student's parent did not object, the invitation could be released without prior parental consent. Including honors and awards in the list of directory information will allow school districts to publicize much of their good news, such as releasing the names of students in the Top 10 percent of the graduating class or the names of the district's National Merit Finalists.

Student Photos

Recent changes to FERPA have made it easier to include student photos on your district Web site. Specific parental permission is not required if your district has listed photographs as directory information and the parents of the photographed student have not objected in writing to that designation.

When considering whether to post a student's photograph, follow these steps: (1) ensure your district included photographs as directory information in policy; (2) ensure your district provided parents and eligible students with notice that photographs are considered directory information; and (3) ensure the parents of the student in question have not objected in writing to the release of the student's photograph.

If all these conditions are met, the photograph may be disclosed. If not, you should not release the photograph absent specific written consent.

Online Communications

The new FERPA regulations also list electronic mail address as directory information. The drafters of the regulations state, "We do not believe that the disclosure of student e-mail addresses will generally be considered harmful or an invasion of privacy." The drafters also note that parents who object to disclosure may opt out of any or all of the categories of directory information.

Students' online correspondence, such as e-mail or chat room messages, also may qualify as protected records. Consider, for example, the implications when a high school Advanced Placement program opens a chat room on an intranet. The purpose of the chat room is to allow students to conduct scholarly discussions from home after school. Teachers monitor the students' work. Parents often become involved, working with their students, but also observing the work of their students' classmates.

Are the messages considered protected student records? The messages will be personally identifiable if students attach their names to their messages. Therefore, the messages will be subject to FERPA protection if they are maintained by the school district. Arguably, this depends on how the messages are stored--a complicated technical issue that will vary from case to case. In light of the potential confidentiality of these records, school districts might choose to seek specific parental consent for participation in such a program.

School districts everywhere are striving to tap the potential of the information age. But as your district acquires access to the best that technology has to offer, don't forget your legal obligations to protect the privacy of your students.

Joy Surrait Baskin is a senior attorney with the Texas Association of School Boards, P.O. Box 400, Austin, Texas 78767. E-mail: [e-mail]. Jim Surratt is superintendent of the Klein, Texas, Independent School District.