Family Educational Rights and Privacy Act (FERPA) 

 The following is for informational purposes only and does not constitute an offer of a contract. If there are any inconsistencies with the University of Missouri’s policy, the UM System policies apply. Direct questions to the Office of the University Registrar.

Overview

The Family Educational Rights and Privacy Act of 1974 is a federal law designed to protect the privacy of educational records; to establish the rights of students to inspect and review their education records; and to provide guidelines for the correction of inaccurate and misleading data through informal and formal hearings. The law applies to any individual who is or has been in attendance at an institution and regarding whom the institution maintains educational records.

Once students have matriculated to the University of Missouri, i.e. enrolled in course work, FERPA rights transfer to the student, regardless of the student’s age.

Primary rights under FERPA

  1. To inspect and review educational records
  2. To seek to amend educational records through informal and formal hearings
  3. To have some control over the release of information about educational records

Educational records contain information that is directly related to a student and are maintained by an educational agency or institution, or by a third party acting on the behalf of the agency or institution.

Examples include:

  • handwritten notes
  • computer files/generated information
  • printed information
  • video or audio tapes
  • film
  • microfilm or microfiche
  • any information maintained in any way about a student

Directory information

Directory information may be shared, unless restricted.  You can change this information in myZou by going to Student Center > Personal Information > Other Personal > Privacy Settings and clicking the FERPA-Restrict Release of Personal Information box. 

Some students may have restricted the release of directory information in accordance with the Family Rights and Privacy Act as well as University policy, in which case their names will not appear on the Dean's list.

 The University of Missouri defines directory information as:

  • name
  • address
  • telephone listing
  • e-mail address
  • major or field of study
  • dates of attendance
  • student level
  • degrees and awards received
  • enrollment status in any past or present semester (i.e. full/part time)
  • the most recent education agency or institution attended
  • participation in officially recognized activities and sports

Limited restriction of release of address and phone number

If students wish only to restrict visibility of telephone number and/or address, students may do so by going to Student Center > Personal Information > Other Personal > Privacy Settings. The online directory may be updated at any time via myZou.

Unless covered by an exception, staff may not release:

  1. Social Security number
  2. student number
  3. race/ethnicity/nationality
  4. gender
  5. grades
  6. other personally identifiable information without written consent or when covered by an exception

Complete University of Missouri policies related to sharing of student record information.

To release information other than directory information, students must authorize access to non-directory information for third parties, including parents, by completing the FERPA Release process.  See also: Non-Directory Information Release and Additional Authorized Access (AAA) - What is the difference?

Additional Authorized Access and Third Party FERPA Release Instructions

The consent must specify records to be disclosed, state the purpose of the disclosure and identify the party or class of parties to whom the disclosure must be made.

Policy Source: UM System Policy, Chapter 180

FERPA Exceptions »

European Union's General Data Protection Regulation (GDPR)

European Union's General Data Protection Regulation (GDPR) affords individuals certain rights as to how their data is used and processed, and may give them rights to access, correct, or delete their data.
https://www.umsystem.edu/ums/is/infosec/gdpr-students-applicants

Research and Student Information

In accordance with University of Missouri policies and the Family Educational Rights and Privacy Act (FERPA), the University may (but is not required to) provide the following:

Requests from inside the campus:

  • Directory Information:
    • Directory information, unless restricted by the student, MAY be released, but we are not REQUIRED to release it
      • Students may change their restriction on release of directory information at any time, so check each and every time information is requested
      • Students may delegate access to some third parties. That is not covered in this document as it does not relate to research requests or requests for lists of student information
    • Directory information at MU/UM includes:
      • name
      • address
      • telephone listing
      • e-mail address
      • major or field of study
      • dates of attendance
      • student level
      • degrees and awards received
      • enrollment status in any past or present semester (i.e. full/part time)
      • the most recent education agency or institution attended
      • participation in officially recognized activities and sports

If you are requesting information beyond what is identified as Directory Information at MU there are some exceptions under FERPA that allow for release of non-directory information. However you must demonstrate that you meet one of these exceptions. Please see below and provide to MU SIS (MU Student Info Sys ProdSupport (UMCStudentInfoSyspds@missouri.edu) the requested information that best matches your intent with this research. In addition to what is provided below IRB (https://research.missouri.edu/irb/) approval will be required before any data will be released.

Non-Directory Information* may be provided for research under the following circumstances:
Studies by the institution or for the institution:
  • Study is being done by those within the institution with a legitimate educational interest to know or by an organization contracted to provide the study.
  • The legitimate educational need to know is:
    • Performing a task that it specified in his or her position description, or contract agreement related to the student’s education or related to the discipline of the student
    • Providing a service or benefit relating to the student or the student’s family, such as financial aid
    • Maintaining the safety and security of the campus
  • The record custodian will determine whether a legitimate educational interest exists, whether the school official has a legal right to know, on a case-by-case basis. When the custodian has any question regarding the request, the custodian should withhold disclosure unless the custodian obtains written consent from the student, or the concurrence of a supervisor or other appropriate official that the record may be released. Consult with the Office of the University Registrar, MU Univ Registrar All Staff umcunivregistraralst@missouri.edu
  • Requires the organization to use personally identifiable information from education records only to meet the purpose or purposes of the study as stated in the written agreement;
  • Requires the organization to conduct the study in a manner that does not permit personal identification of parents and students, as defined in this part, by anyone other than representatives of the organization with legitimate interests; and
  • Requires the organization to destroy or return to the educational agency or institution all personally identifiable information when the information is no longer needed for the purposes for which the study was conducted and specifies the time period in which the information must be returned or destroyed.
  • Information may only be provided to those considered University Officials. This includes faculty and staff, but it does not include students nor individuals who are staff and faculty but are asking for the information to complete requirements for course work or a degree such as a thesis or dissertation.
  • If you feel that your research qualifies under this exception, you must provide:
    • Documentation of sponsorship by a senior MU official that verifies that the intent of the research is to improve the educational experience at the University of Missouri as the primary purpose. (Results may be published, but that cannot be the primary reason if data is obtained under this exception.)
    • Provide a list of data you are seeking or plan to use
    • Indicate if the information will be aggregated and if so, by whom.
    • Provide documentation of how data will be secured
    • Provide documentation to prove that data will be destroyed in five years
    • To whom will the data be released. Please note that data may not be released directly to students (graduate or undergraduate), as they are not a school official as defined by FERPA. Even if they are a staff member, if the data is for research related to a degree, then the data must be released to the faculty member who is the PI for the research.
  • Studies by independent researchers within the institution/ campus, from other UM campuses or from other entities:
    • If the research is not sponsored by a senior MU official who verifies that the research is being done primarily to improve the educational experience at MU, then researchers must obtain documented, written consent from the students
      • Prior to providing the release forms to the students, they must be approved by the Office of the Univ. Registrar. (Examples of previous forms are enclosed.)
      • Please provide copies of the release forms with the student signatures attached. Signatures need to be connected to the agreement to verify to what the students have agreed.
      • Please provide copies of the release forms with the student signatures attached. Signatures need to be connected to the agreement to verify to what the students have agreed.
      • Provide information confirming how the researcher will obtain signatures for the agreement or meet the appropriate legal standard if it is to be “electronically” signed. (See: https://doit.missouri.edu/services
        /infosec/infosec-resources/electronic-signature/
        )
      • In order to provide the information, the requestor must document how
        • Specific purpose, scope, and duration of the study or studies and the information to be disclosed;
        • How the researcher or the organization’s will meet the requirement that the use of personally identifiable information from education records only for the purpose or purposes of the study as stated in the written agreement;
        • How the research or organization will meet the requirement that the organization to conduct the study in a manner that does not permit personal identification of parents and students, as defined in this part, by anyone other than representatives of the organization with legitimate interests; and
        • How the researcher or the organization will meet the requirement that the organization to destroy or return to the educational agency or institution all personally identifiable information when the information is no longer needed for the purposes for which the study was conducted and specifies the time period in which the information must be returned or destroyed. (The University standard is five years or earlier. Exceptions need to be noted in the request.)
      • Note that a release is needed even if the data will be aggregated or de-identified by another party within the university since the student has to agree to be part of the study since the data is not being provided under one of the exceptions within FERPA. (See below.)
        • Students cannot be obligated to participate and must have the ability to opt out at any point and have request honored
        • If the research information will be aggregated or de- identified, who will be responsible?
        • You must obtain copies of the data releases before providing the information
        • Data may be released to students (graduate or undergraduate), if they are specifically named in the release and adhere to all the previously specified standards.
        • MU SIS is not able to provide information for independent research generally, due to staffing limitations and the process that the University Administration has set

*From the Federal Government’s website: http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html

  • Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):
    • School officials with legitimate educational interest;
    • Other schools to which a student is transferring;
    • Specified officials for audit or evaluation purposes;
    • Appropriate parties in connection with financial aid to a student;
    • Organizations conducting certain studies for or on behalf of the school;
    • Accrediting organizations;
    • To comply with a judicial order or lawfully issued subpoena;
    • Appropriate officials in cases of health and safety emergencies; and
    • State and local authorities, within a juvenile justice system, pursuant to specific State law.