Privacy vs. Safety: Does FERPA Apply to Sexual Assault Cases?

Navigating the muddy waters between protecting student privacy and addressing complaints of sexual misconduct still causes confusion. Does FERPA prohibit disclosure of information about sexual assault cases? Many perceive a conflict between the confidentiality of student records under the Family Educational Rights and Privacy Act (FERPA) on the one hand, and the competing rights of sexual assault victims and other students under Title IX and the Clery Act on the other.

While this post is only intended to address whether FERPA prohibits disclosure of information about peer sexual assault complaints, a few basics are in order. As the Department of Education explained in a 2006 interpretation letter, FERPA protects "education records" maintained by or for the school which are tangible documents (including media and electronic data). FERPA does not, however, protect personal knowledge or observations:

FERPA applies to the disclosure of tangible records and of information derived from tangible records … As a general rule, information that is obtained through personal knowledge or observation, and not from an education record, is not protected from disclosure under FERPA.

Therefore, even if an education record exists containing the same information, FERPA doesn't protect the confidentiality of information independently obtained from personal knowledge or observations.

In addition, the education records must contain "information directly related to a student" — in other words, they must directly or indirectly identify the student. So far this seems pretty straightforward. However, the various exceptions to FERPA protection when sexual assault is involved seem to cause confusion.

Starting with a clear exception, schools may disclose — without the accused student's consent — the final results of a disciplinary proceeding involving alleged acts that, if proven, would constitute a violent crime or non-forcible sex offense:¹

• to anyone if the alleged perpetrator is found to have committed the offense
• only to the alleged victim if the accused is not found responsible. In this case the victim must be told not to disclose the outcome to a third party

The result of a disciplinary proceeding is not final until after any appeals. Once the result is final the school may disclose the student's name, the offense, and any sanction imposed, as indicated above.

Another slightly more confusing exception allows disclosure of the investigative reports and other records²of campus police and security units involving sexual assault complaints if they are created for a "law enforcement purpose." Whether the records qualify for this exception depends on (1) who created the records, (2) why they were created, and (3) who maintains them.

Under FERPA, if the records are created "exclusively for the purpose of a possible disciplinary action against the student" those records would be "education records." However, the ED Secretary has said that it "expects such occasions to be very rare, especially when incidents involv[e] criminal conduct by students at postsecondary institutions." Thus, if a student reports a sexual assault to campus police and other security staff their records are probably not protected from disclosure by FERPA.

A couple of cases illustrate how FERPA has been misapplied at the expense of student safety. Last year Oklahoma State University did not alert campus or local police when a victim reported to Student Affairs that he'd been molested. Over the next month the accused molester committed more assaults. Finally, a student newspaper reporter received an anonymous tip and contacted police, which led to the perpetrator's arrest. In September, Nathan Cochran pled guilty to three criminal counts of sexual battery for fondling and performing oral sex on other male students while they slept in his fraternity house. Cochran was suspended from OSU for three years.

When the OSU victim first came forward, no tangible education record existed relating to the accused student. LeRoy Rooker, the ED's chief FERPA enforcer for 21 years, said "Just forget FERPA at that point."

And even if an education record existed a third exception, FERPA's health and safety exception likely applied. Again, Rooker provides guidance in ED's 2006 interpretation letter: 

This provision allows an educational agency or institution to disclose personally identifiable information from education records, without prior written consent,

in connection with an emergency [to] appropriate persons if the knowledge of such information is necessary to protect the health or safety of the student or other persons. 20 U.S.C. §1232g(b)(1)(I); 34 CFR §§99.31(a)(10) 99.36.³

In another case, Swarthmore College's disciplinary proceeding found the accused student responsible but the victim felt the sanction did not protect her or other students in part because the accused's identity was never revealed by the school. Though her assailant was found responsible for rape and suspended, he will be allowed to re-enroll after she graduates. In the meantime, his suspension wasn't made public so he continues to visit the campus and present a safety risk. When Liz Braun, Dean of Students at Swarthmore, asked for student feedback about the school's College Judiciary Committee process, the victim described the CJC process as "unnecessarily torturous." She asked a valid question in her response to Dean Braun: "Should the outcomes of CJC hearings and appeals be made public with identifiable names of perpetrators?" In fact, the accused student's name could be made public if the CJC's final decision found him responsible. This would not violate FERPA and could help protect other students.

Responding to a question about obtaining information from schools regarding sexual assaults against college students, ED Secretary Arne Duncan encouraged journalists to seek assistance from Department of Education staff if they encounter schools misapplying FERPA. While participating in a conference call organized by the Education Writers Association, Duncan stated, "Where districts or schools are — I'm not saying they are — but if they're sort of hiding behind FERPA and not sharing simple information, we're happy to try and assist there."

A journalist from Student Press Law Center said she plans to follow up with ED's chief privacy officer, Kathleen Styles. We'll be looking for further guidance on this issue but hope that in the meantime this post provides some explanation of what is and isn't a legitimate use of FERPA when it comes to protecting the privacy of students accused of committing sexual assault.

---

<sup>1. While this post focuses on sexual assault complaints, this exception to FERPA protection covers a number of violent crimes and non-forcible sex offenses listed in 34 CFR §99.39 and 34 CFR §99.31(13)and (14) covers the conditions that allow disclosure of information without consent.

2. 34 CFR §99.8(b)(1) defines "law enforcement records" as "records, files, documents, and other materials that are — (i) Created by a law enforcement unit; (ii) Created for a law enforcement purpose; and (iii) Maintained by the law enforcement unit." While FERPA allows disclosure, the confidentiality of records maintained by a school's security staff may be restricted by the school's policies or applicable State law.

3. 34 CFR §99.31(10) provides that prior consent not required to disclose information where "The disclosure is in connection with a health or safety emergency, under the conditions described in §99.36."</sup>