Dr. Hunter Rawlings III
President
Cornell University
300 Day Hall
Ithaca, New York 14853

Complaint No. XXXX
Family Educational Rights
and Privacy Act

Dear Dr. Rawlings:

This is in regard to the complaint filed by [Student] against Cornell University (University) under the Family Educational Rights and Privacy Act (FERPA). By letter dated February 28, 2000, this Office informed you of our finding that the University violated FERPA when it provided [the Student's] education records to an emeritus professor who had not been appropriately designated in the University's annual notification as a school official with legitimate educational interest. We requested written assurance that appropriate officials have been informed of FERPA as it relates to the disclosure of education records to "school officials" with "legitimate educational interest." By letter dated April 10, 2000, Wendy Tarlow, Associate University Counsel provided the requested assurance. Ms. Tarlow also indicated in her response that the University will amend its annual notification to include emeritus professors as school officials with legitimate educational interest. However, the University has also asked that we reconsider our finding.

In brief, this Office set forth [the Student's] allegation in a letter dated July 13, 1999, as follows:

. . . [the Student] has alleged that the University disclosed, without her consent, information regarding her specific problems at the School of Veterinary Medicine to

Dr. Wolfgang O. Sack, a retired professor. [The Student] states that she contacted

Dr. Sack for "his assistance in reviewing [her] disputed exam." However, she further alleges that

[I] did not mention the grade I received — I could have received a grade of B, C, D, or F and been dissatisfied because I believed a higher grade was earned/deserved. His letter of [January 22, 1999,] indicates/states college personnel told him I had failed and then was given a second chance. Repeating Block I is only permitted/required if you receive a grade of "F" . . . .

In her letter requesting assistance from Dr. Sack, dated January 2, 1999, [the Student] asked: "I have been unsuccessful in my attempt to have my Block I Assessment = Anatomy Exam reviewed by any member of the Cornell faculty. . . . could you sir please meet with me and review the exam."

In his January 22, 1999, response to [the Student], Dr. Sack stated:

I . . . learned of your problems with [the 1^st year curriculum] including that you had a chance to try the anatomy part a second time. Seeing that your efforts have already been evaluated by a team of faculty, I feel that . . . I do neither have the desire nor the prerogative to interfere with the academic activities of the present faculty of the College. [Emphasis provided.]

In Ms. Tarlow's August 27, 1999, response, she did not refute the fact that Dr. Sack gained access to [the Student's] exam grade or to additional information from her education records relative to the fact that she was given an opportunity to try the exam a second time and that her efforts had already been reviewed by University staff. Rather the University believed that no violation of FERPA occurred because on one hand the information that Dr. Sack obtained from the University was already a matter of public record stemming from [the Student's] May 15, 1998, lawsuit against the University and that furthermore, Dr. Sack has access on a regular basis to student education records due to his status as an emeritus professor and the fact that he is invited in that capacity to attend all faculty meetings. With regard to Ms. Tarlow's assertion that [the Student] herself made the details regarding her problems public information when she filed the suit in court, this Office explained that FERPA prohibits the disclosure of personally identifiable information derived from education records, whether or not that information is available from another source. As for the University's argument that Dr. Sack had a legitimate educational interest, we explained that while FERPA does not prevent the University from designating emeritus professors as school officials with legitimate educational interest, Professor Sack did not meet the definition of a school official with legitimate educational interest because the University did not define emeritus professors as school officials with legitimate educational interest in its annual notification.

In the University's Arpril 10 letter requesting that we reconsider our finding, Ms. Tarlow writes:

• [the Student] failed the "Block I" exam twice. First, in November 1997, she scored only 427 of a possible 1,000 points on the exam and received a grade of "F" for the course. She (and her lawyer) repeatedly contacted school officials and demanded that her exam be regraded. However, [the Student] never turned in the original exam for regrading as required by College policy. The following year, in November 1998,

[the Student] left blank essentially the entire exam and again received a failing grade.

• On May 15, 1998, [the Student] filed a lawsuit in New York Supreme Court contesting her grade on the exam. Both the verified complaint filed by [the Student] and the Court's decision dismissing the lawsuit indicate [the Student's] failing grade. Both the complaint and the Court's decision are a matter of public record.

• In a letter dated January 2, 2000, [the Student] wrote to an emeritus professor in the Cornell Veterinary College, Dr. Wolfgang Sack, and asked him to review her exam. Her letter indicates that she has been "unsuccessful in [her] attempt to have [her] Block I Assessment = Anatomy Exam reviewed by any member of the Cornell faculty." In other words, [the Student] sought out Dr. Sack and involved him in the issue of her examination grade.

In the University's response, Ms. Tarlow continues:

The Department of Education has previously ruled that "if a student has taken an adversarial position against an institution, made written allegations of wrongdoing against the institution and shared this information with third parties, the institution must be able to defend itself. In order to defend itself, it would be difficult for an institution to provide a response without referring to the student's education records." National Association of College and University Attorneys, The Family Educational Rights and Privacy Act: A Legal Compendium 205, 206 (Steven J. McDonald, ed., 1999)(Department of Education Letter to John Hopkins University, Feb. 19, 1997).

As indicated in Cornell's response to these allegations dated August 27, 1999, Cornell believes that disclosure of [the Student's] failing grade to Dr. Sack was appropriate

. . . because Dr. Sack had a "legitimate educational interest" in knowing this information. As an emeritus faculty member of the College of Veterinary Medicine, Dr. Sack was invited to attend all faculty meetings and could receive minutes of those meetings, either of which would have disclosed the names of failing students (including the Student). The fact that [the Student] would seek out Dr. Sack for assistance in challenging her grade supports the position that Dr. Sack had a legitimate educational interest in knowing of her failing grade.

Given the Department's ruling that Dr. Sack was not covered by that exception, however, Cornell submits that the rationale cited above, in the ruling in favor of Johns Hopkins, applies in this case. If Dr. Sack is not an "insider" with a legitimate educational interest, it follows that Dr. Sack was a third party. [The Student's] written complaint to Dr. Sack about her exam was essentially a complaint that the College had acted wrongfully in assessing her exam. In order for the College to defend its assessment of her exam, the College would necessarily have to explain its evaluation that she had failed.

In fact, Dr. Sack's initial letter of response to [the Student](dated January 16, 2000) indicates that he knows little about the current curriculum's "scope, what was taught, and its exams." He further states that he will need to "familiarize" himself with the curriculum's structure and functioning before he can decide if he can assist her.

The Student, then, was on notice that Dr. Sack would be contacting the College regarding the complaint over her grade. To the extent that [the Student] was effectively asking

Dr. Sack to serve as an impartial arbiter, it was essential that the College release information about her failing grade in order to defend its assessment.

As an additional reason for reconsideration, Cornell believes that the standard set forth in your February 28, 2000 letter imposes an unrealistic and unnecessary burden on educational institutions that are served by students (and former students). [The Student] published her own failing grade in a public forum, Cornell did not. [The Student] made clear by publicly publishing her failing grade that she did not consider it to be confidential (wholly apart from the implied waiver inherent in suing Cornell over the grade, as discussed above). School officials were, of course, aware of [the Student's] failing grade both from her educational records and because they reviewed [the Student's] complaint and the court's decision after [the Student]sued the University. Your letter appears to prohibit further disclosure of the grade notwithstanding the fact that knowledge of the grade was based upon review of public records solely because the grade was also contained in an educational record as well, suggesting that it would not have violated FERPA if Professor Sack had gone to the courthouse himself and reviewed [the Student's] public filing. If Professor Sack could have obtained the information from public records filed by the Student, certainly disclosure by the dean's office of the same widely-publicized information from the same legal documents already in the possession of the dean's office would not appear to intrude on any interest protected by FERPA. [Emphasis provided.]

Following is this Office's response to the University's above statements and request for reconsideration of our finding.

This Office did not determine that Professor Sack could not meet the definition of a school official with legitimate educational interest. Rather, this Office determined that the annual notification must indicate that emeritus professors are school officials with legitimate educational interest in order for them to meet the definition under FERPA. Thus, the University can release to an emeritus professor information from student education records as long as the University appropriately designates emeritus professor as a school official with legitimate educational interest in its notification of rights under FERPA to students.

Having, therefore, reiterated our position on the appropriate designation of school official with legitimate educational interest, we will now address FERPA and "implied consent." As an initial matter, after issuing the finding dated February 19, 1997, in Johns Hopkins case (referenced above by the University,) some confusion developed over the exact conditions that apply when the implied waiver of consent may be used by schools in order to disclose education records absent prior written consent of the student. Therefore, we clarified the conditions for an implied waiver of consent waiver in a letter dated June 22, 1998, to Towson State University (copy enclosed).

We explained in that letter that neither the FERPA statute nor the FERPA regulations specifically permit an educational agency or institution to infer an implied waiver of the right to consent to disclosures of information from education records. However, this Office has a policy of permitting a school to infer an implied waiver of consent to such disclosures if the parent or student has sued the institution. The rationale for this policy is based on the belief that a student or parent should not be permitted to use rights afforded them under FERPA to prevent an educational agency or institution from defending itself in a court of law when the parent or student has initiated legal action and seeks damages against the agency or institution. In such circumstances, the educational agency or institution must be able to defend itself. The Department has maintained a consistent position on this issue, and advises educational institutions that any disclosure of personally identifiable information from a student's education records to a court of law in response to a lawsuit filed against the institution by the student must be limited to that information necessary to defend itself against the specific charges made.

In our February 19, 1997, finding in the Johns Hopkins letter we stated:

Based on the additional information provided by the University in its July 10 letter, we have determined that this complaint is analogous to an educational institution inferring a student's implied waiver of the right to consent to the release of information from his or her education records when the student has sued the institution. In both instances, the student had requested the involvement of an entity outside of the institution, and it is logical and appropriate that the institution would respond on the record.

Therefore, we believe that if a student has taken an adversarial position against an institution, made written allegations of wrongdoing against the institution, and shared this information with third parties, the institution must be able to defend itself. In order to defend itself, it would be difficult for an institution to provide a response without referring to the student's education records.

While the policy statement made in the Johns Hopkins finding was general and suited toward a broad application, the extension of the policy on implied waiver of the right to consent was based on a narrow set of facts. In retrospect, this Office believed that it should have more clearly delineated guidelines in the Johns Hopkins ruling that would have better clarified those situations, other than those in which the student has sued the agency or institution, where it is appropriate for an educational agency or institution to infer an implied waiver of the right to consent.

We, therefore, set forth the following guidelines on permitting an educational agency or institution to infer an implied waiver of the right to consent to disclosure of personally identifiable information from a student's education records in a non-litigation context in our June 22 letter to Towson State University:

The Department will support an educational agency or institution that has inferred an implied waiver of the student's right to consent to disclosure when:

1. the student has taken an adversarial position against the educational agency or institution;
2. the student has initiated the involvement of the third party by contacting that party in writing, and, in so doing:

a) set forth specific allegations against the educational agency or institution; and,

b) requested that action be taken against the educational agency or institution or that the third party assist the student in circumventing decisions made about the student by the educational agency or institution;

3. the third party's special relationship with the educational agency or institution:

a) gives the third party authority to take specific action against the educational agency or institution; or,

b) reasonably could be significantly adversely affected if the educational agency or institution cannot refute the allegations; and

4. the disclosure is as limited as is necessary for the educational agency or institution adequately to defend itself from the student's charges or complaint. The third party should follow the procedures set forth in 34 CFR § 99.33 on limitations that apply to the redisclosure of information derived from education records.

In formulating and establishing a policy that is not directly addressed by FERPA and is being implied, the Department seeks to ensure that the basis for such policy is strong enough to outweigh the potential harm. In this circumstance, the strong policy consideration behind the waiver of the right to consent doctrine is that an educational agency or institution should be able to defend itself against an adversarial position that has been taken against it by a student where the student has shared this information in writing with a third party that has a special relationship with the educational agency or institution in a way that could significantly adversely affect the educational agency or institution. The potential harm is the dissemination of personally identifiable information from education records without the appropriate written consent. The above guidelines are our effort to clarify for the institution the circumstances under which implied consent is appropriate.

In this complaint, while some of the guidelines invoking implied consent may apply, all of the guidelines do not. More importantly, we do not believe that FERPA's implied consent could be read to cover routine requests like this one where a student asks a professor for a meeting in order to review an exam. Rather, when a student asks a professor in writing to meet to review an exam, this Office would first consider whether the request to the professor meets FERPA's prior written consent requirement outlined under § 99.30 of the regulations. That section states that the student should provide a signed and dated written consent before a school discloses information from their education records. The signed consent must 1) specify the records that may be disclosed; 2) state the purpose of the disclosure; and 3) identify the party or class of parties to whom the disclosure may be made. Even if it could be argued that [the Student's] January 2 letter to Dr. Sack (asking for a meeting to review her exam grade) was in fact written consent from [the Student] allowing the University to disclose her exam grade to him, Dr. Sack gained access to more information from [the Student's] education records than just the exam grade.

In light of the above, this Office has determined that the implied waiver of consent does not apply in this situation. We wish to emphasize that before an educational agency or institution releases any education records conditions on an implied waiver of the right to consent, the educational agency or institution should contact this Office for guidance based on the details of the particular situation.

While the University believes that [the Student's] records could have been disclosed to Professor Sack in compliance with FERPA based on the fact that her education records were already a matter of public record because of her lawsuit, this Office considers the source of an alleged disclosure of information from education records. The definition of education records under FERPA includes information directly related to a student that is maintained by an educational agency or institution or by a party acting for the agency or institution. See 34 CFR § 99.3 "Education records." A record does not lose its status as an education record because the information contained therein appears in a public record. Furthermore, there is no exception in FERPA that exempts information in public records from the definition of education records. In

this case, Professor Sack gained access to [the Student's] education records from the University, not from the court. Therefore, notwithstanding the fact that the records were available to the public at the court, we find that a disclosure of information from [the Student's] education records by the University occurred.

In conclusion, based on our above analysis, the implied waiver to consent to the release of [the Student's] education records would not apply in her case nor would the argument that her education records could be disclosed by the University to Dr. Sack because they were already a matter of public record. Therefore, our original finding stands. However, because

Ms. Tarlow provided the requested assurances to this Office as requested in our February 28 letter, we are closing this complaint. We will so inform [the Student] by copy of this letter. Thank you for your cooperation with regard to this matter.

Sincerely,

LeRoy S. Rooker
Director
Family Policy Compliance Office

Enclosures

cc: Student
Ms. Wendy Tarlow