October 22, 1998

Ms. Doris Dixon
National Collegiate Athletic Association
One Dupont Circle, NW
Suite 400
Washington, D.C. 20036

Dear Ms. Dixon:

This is in response to your May 13, 1997, letter. In your letter, you mentioned several issues that we had previously discussed in a February meeting with you and the President of the National Collegiate Athletic Association (NCAA), Mr. Cedric Dempsey. Using different scenarios as examples, your letter raises additional questions to this Office regarding whether the NCAA can disclose education records of student-athletes in compliance with the redisclosure provisions of the Family Educational Rights and Privacy Act (FERPA).

Scenario One

Actions by student-athletes have been brought against the NCAA in administrative or court proceedings on both state and federal levels. In the federal regulations effective December 23, 1996, prior consent is not required when the disclosure is to comply with a judicial order or lawfully issued subpoena or when the educational agency or institution initiates legal action against a parent or student.

Question (a)

Is prior consent of the student required when the NCAA discloses the student's education records for purposes of defending itself against a lawsuit or in an administrative proceeding brought by the student-athlete or his or her parents?

Response

No, if the disclosure is necessary for the NCAA to defend itself. In the preamble to the Department's final rule amending FERPA on November 21, 1996, we stated:

...the Department interprets FERPA to allow an educational agency or institution to infer the parent's or student's implied waiver of the right to consent to the disclosure of information from the student's education records if the parent or student has sued the institution.

61 Fed. Reg. 59,292, 59,294 (November 21, 1996).

As the preamble states, we have determined that an educational institution may infer a student's implied waiver of the right to consent to the release of information from his or her education records when the student has sued the institution. We believe that if a student sues a school, the school must be allowed to redisclose information to the extent necessary to defend itself.

We further believe that the same principle of implied consent that applies to educational institutions should apply to third parties that receive information from education records, like the NCAA. In short, the NCAA may also assume the implied consent of a student-athlete that sues the NCAA, and may redisclose the student's education records in court in order to defend itself -- whether a student or a parent of the student is the plaintiff¹.

As to whether the same rationale would apply to a situation where a student or parent has initiated an administrative proceeding against the NCAA, it depends on the nature of the proceeding. While we believe that a law suit and an administrative proceeding to which you refer are comparable, we would need additional information about the types of administrative proceedings that the NCAA is involved in order to answer this question.

Question (b)

If a student refers to other students in such cases and argues that he/she is being treated differently from the other students, is it permissible for the NCAA to defend itself against such accusations by referring to personally identifiable information pertaining to other students.

Response

No. There is no exception in FERPA, or previous interpretation by this Office, that would allow the NCAA to redisclose the education records of other students who have been named in a lawsuit without the other students' prior written consent. However, redaction of all personally identifiable information from an education record may be acceptable, as long as the students' identities would not be easily traceable. In addition, FERPA would not prevent the NCAA from disclosing education records of another student if it received a subpoena for such records.

Scenario Two

State and federal government officials have requested the student files and/or information in the student files. Also, some officials want to discuss personally identifiable information in student's files with NCAA staff persons. There are specific inquiries as well as general inquiries.

Questions (a)(i) and (ii)

For instance, a student-athlete has contacted the governor of her state complaining the NCAA denied her eligibility. The governor's office has contacted an NCAA official or staff person to discuss the individual's case.

i. Is it permissible for the NCAA to discuss or disclose personally identifiable information from a student's file without first requiring a written consent from the student-athlete?

ii. By contacting the government official for assistance, does the student-athlete implicitly authorize the NCAA to disclose personally identifiable information from the student-athlete's education records with the government official?

Response

As noted above, we have determined that there are instances where an educational institution must be allowed to defend itself if a student takes an adversarial position against an institution -- such as initiating a law suit or administrative hearing. We believe that the implied waiver of the right to consent extends to situations where a parent or student attempts to enlist the assistance of an entity that will possibly intervene in the matter against the school.

In other words, if the student or parent asks a third party, in writing², to take action against a school, we believe that the institution must be allowed to defend itself, and that it may release a student's education records without the consent of the student. Because the student has asked a third party to take action against the institution, the student has attempted to use a "special relationship" to his or her advantage, and common sense dictates that the school must be allowed to respond. In sum, the "special relationship" test applies if the student has taken an adversarial position against the school, the allegations of wrongdoing are in writing, and the allegations have been shared with the entity whose assistance is being sought.

We have determined that this same principle also applies to the NCAA. In short, the NCAA, like any postsecondary institution, must be able to defend itself if a student-athlete has taken an adversarial position, written the governor of his or her State, complained that the NCAA denied him or her eligibility and asked the governor to intervene.

Questions (b)(i)(ii)(iii) and (iv)

Another instance, which the Department of Education's Family Policy Compliance Office may be aware of, is that the Department of Justice has informally requested that NCAA produce to them entire student files for all disabled student-athletes who applied for a waiver of the initial eligibility requirements of the 1996-1997 school year. The Department of Justice will allow NCAA to redact the names and addresses of the student. These files may include other personally identifiable information including the high school attended by the student, the university the student attended, the type of sport the student participates in, the name of the student's treating physicians and other similar information.

I. In this situation, does the NCAA or the government agency make the determination as to what information is personally identifiable?

ii. Does personally identifiable information have to be determined on a case-by-case review of each student's file? That is, in some high-profile cases, even a description of the type of disability might make the student-athlete easily traceable or personally identifiable. In these situations, how much discretion does NCAA have to redact this information?

iii. Does the NCAA need to obtain a written consent from and/or provide notification to each student-athlete whose file is sent to a government agency in response to a formal or informal inquiry or investigation?

[iv.] If the NCAA releases student files to the government agency under the good faith belief that it does not contain personally identifiable information, what is the extent of NCAA's liability?

Response

It is our understanding that Congress has introduced legislation to amend FERPA to allow for the nonconsensual disclosure of information from student education records maintained by postsecondary institutions, or third parties that maintain education records, such as the NCAA, to authorized representatives of the Attorney General for law enforcement purposes. Assuming that this language is enacted into law, the NCAA would be able to rerelease personally identifiable information from a student's education record in response to a Department of Justice investigation without violating FERPA. This proposed change is currently found in section 951 of the Higher Education Amendments of 1998, and we would be happy to provide a copy of the provision to you once the bill becomes law.

Scenario/question Three

Can the NCAA release information to an eligible student-athlete's parents or attorney without first obtaining written consent from the student-athlete?

Response

The NCAA may redisclose information from a student's education records to the student's attorney because an attorney would be acting as a legal representative for the student. We recommend that you obtain a written designation of the attorney by the student in these circumstances. However, this is not necessarily the case with the student's parents.

When a student reaches the age of 18 or attends an institution of postsecondary education, that student is deemed "eligible" and all of the rights afforded by FERPA transfer from the parents to the student. The statute provides:

For the purposes of this section, whenever a student has attained eighteen years of age, or is attending an institution of postsecondary education the permission or consent required of and the rights accorded to the parents of the student shall thereafter only be required of and accorded to the student.

20 U.S.C. § 1232g(d). Accordingly, the rights afforded by FERPA transfer to students in attendance at a college or university, whether or not they have reached the age of 18. However, FERPA states that a school can disclose an eligible student's education records to his or her parents without prior written consent if:

The disclosure is to parents of a dependent student, as defined in section 152 of the Internal Revenue Code of 1954.

34 CFR § 99.31(a)(8). Therefore, the NCAA may not redisclose education records to a student-athlete's parents without written consent of the eligible student unless the redisclosure is to parents of a "dependent student" and the redisclosure is made on behalf of the postsecondary institution. See 34 CFR § 99.33(a)(2)(b).

Scenario Four

There are many instances where a student-athlete or her parents publicly disclose personally identifiable information such as grades or test scores to the media as well as to state and federal government officials usually in whole or in part. For instance, a student-athlete who does not meet the NCAA core course requirement for eligibility may publicize to the media that he/she had a 3.9 grade point average and was denied eligibility. Often, the student-athlete or the parents do not reveal the entire story or may even provide false or misleading information. The result is that the media publishes a story that is not true or is misleading and the NCAA bears the wrath of the public.

Question (a)

In these situations, to what extent may the NCAA publicly disclose personally identifiable information from a student's education records in order to correct or to clarify information provided by the student-athlete or the parents?

Response

As you are aware, FERPA generally protects students' privacy interests in "education records" by generally prohibiting the disclosure of education records absent the student's prior written consent. The term "education records" is defined as:

[T]hose records, files, documents, and other materials, which (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution, or by a person acting for such agency or institution.

20 U.S.C. § 1232g(a)(4). See also 34 CFR § 99.3 "Education records." In addition, the general prohibition on the disclosure of information from education records extends to the third party maintaining the records. Consequently, FERPA restricts the "redisclosure" of education records or information from education records by third parties, except under certain conditions.

FERPA provides that education records, or personally identifiable information from such records, may be disclosed by institutions of postsecondary education to third parties only after the student has provided his or her prior written consent. 20 U.S.C. § 1232g(b)(1) and (b)(2)(A); 34 CFR § 99.30. In the case of the NCAA, postsecondary institutions may disclose information from the education records of student-athletes to the NCAA if the student has signed a copy of the NCAA's Student Athlete Statement. This Office has previously determined that the Student Athlete Statement meets FERPA's prior written consent requirement.

Because FERPA limits the redisclosure of information from education records by third parties, information from an education record that the NCAA receives from an institution cannot generally be redisclosed without the student's prior written consent. See 34 CFR § 99.33(a). In this regard, the FERPA regulations state that officers, employees, and agents of a party that receives information from education records may use the information, but only for the purposes for which the disclosure was made. Section 99.33(a)(2)(b) further states:

Paragraph (a) of this section does not prevent an educational agency or institution from disclosing personally identifiable information with the understanding that the party receiving the information may make further disclosures of the information on behalf of the educational agency or institution if:

(1) The disclosures meet the requirements of § 99.31; and

(2) The educational agency or institution has complied with the requirements of § 99.32(b).

(Emphasis added.) Section 99.31 lists the 13 exceptions under which schools may disclose education records absent prior written consent of the student. Section 99.32(b) requires that schools keep a record of disclosure of information from education records that includes the name of the party receiving the information and the legitimate interest of the requesting party.

Further, the statute states:

If a third party outside the educational agency or institution permits access to information in violation of paragraph (2) (A), or fails to destroy information in violation of paragraph (1) (F), the educational agency or institution shall be prohibited from permitting access to information from education records to that third party for a period of not less than five years.

20 U.S.C. § 1232g(b)(4)(B); See 34 CFR § 99.31(a)(6)(iii).

Therefore, if the NCAA improperly redisclosed information from a student's education record that it received from a particular institution, that institution could be precluded by FERPA from making further disclosures to the NCAA for a minimum of five years. We also note that the institution has the initial responsibility of notifying a party (i.e., the NCAA) receiving education records under §§ 99.30 and 99.31 of the FERPA requirements relating to any rerelease of information from those records. See 34 CFR § 99.33(d). This requirement does not apply if the disclosure of education records is to an eligible student, a disclosure of directory information, or to disclosures made pursuant to lawfully issued subpoenas or to comply with a judicial order. 34 CFR § 99.33(c).

Turning to your question regarding whether the NCAA can redisclose "inaccurate" or "incomplete" information from education records, this Office has determined that the NCAA cannot make a statement concerning inaccurate or incomplete information because the NCAA would have to rely on information from education records. For example, if the media claims that a student-athlete has a 3.5 Grade Point Average (GPA) and the student's education records indicate a 3.0 GPA, a statement from the NCAA that the 3.5 GPA is inaccurate would be based on information derived from the student's education record.

While you have expressed to this Office the need for the NCAA to be able to correct inaccurate information, the only way in which the NCAA could do so without violating FERPA would be to have the student-athlete provide his or her written consent for the NCAA to redisclose publicly information from his or her education records. Accordingly, in a situation where the NCAA wishes to correct inaccurate information, the NCAA should indicate that FERPA restricts the redisclosure of information from education records, and in order to discuss any details from such records, the student would have to provide his or her prior written consent. The NCAA may want to add that it would be free to discuss information in education records³ after it receives the student's written consent to do so.

Furthermore, information created by the NCAA that does not contain information from education records is not protected by FERPA. For example, an NCAA decision to investigate a student-athlete for an NCAA rules violation that is created and maintained by the NCAA, and not derived from education records, would not be protected by FERPA⁴.

Question (b)

Does the student-athlete (or parents) waive the privacy protections of the Buckley Amendment by either the filing of a lawsuit contesting the NCAA's eligibility determination or by discussing personally identifiable information with the media?

Response

As discussed above in scenario one, question (a), the NCAA may disclose information from an education record for the limited purpose of defending itself in a lawsuit. The student-athlete, however, does not waive his or her privacy rights by talking to the media. Even if a lawsuit is brought against the NCAA by a student-athlete, the NCAA cannot redisclose education records to the media regarding the case. Rather, the NCAA could direct the media to certain information from education records revealed in court documents filings.

Question (c)

Are there situations, other than the written consent, when the student or the parents can waive their rights under the Buckley Amendment with regards to disclosure of personally identifiable information?

Response

Those situations are discussed above.

Scenario Five

There is a common question among many NCAA staffers with regards to dealing with the media in light of the Buckley Amendment. NCAA actions and decisions receive wide media attention. Some of these actions and decisions are made upon personally identifiable information in a student's education records. Staff members are contacted on a daily basis by members of the media concerning high profile cases involving individual student athletes. NCAA staff members have been instructed to inform the media and other interested persons that they cannot discuss individual cases because of the Buckley Amendment's requirements. However, rather than asking about a case, the creative media people pose hypotheticals that have one or two key facts similar to the individual cases. Our policy at this point is to explain the NCAA bylaws and rules applicable to the situation and NCAA's interpretation of these rules based on precedent. Of course, some members of the media may take this explanation out of context.

Question (a)

Is the NCAA's policy in conformance with the requirements of the Buckley Amendment?

Response

As long as information from education records is not redisclosed or relied upon during discussions with the media about how NCAA bylaws and rules apply to a particular situation, these types of discussions would not violate FERPA regardless whether members of the media take the explanation out of context. The NCAA could also explain that if the media wants facts about a particular student's education records, it simply needs to provide the NCAA with a written consent from the student allowing for the redisclosure of information from education records to the media. FERPA neither prevents the NCAA from discussing its own rules and bylaws with the public, nor does it address conclusions drawn by the media as a result of these discussions.

Question (b)

Can we confirm or deny reports or rumors if the information is provided by the member of the media, e.g. can you confirm that John Doe is ineligible because he did not have the requisite minimum grade point average?

Response

No. In order to confirm or deny a student-athlete's status, an NCAA staff member would have to generally rely on information from an education record. As such, we believe an improper disclosure would take place, even if the NCAA does not release the student's exact GPA. Therefore, we suggest that the NCAA explain that it cannot comment unless it receives the student's prior written consent to do so.

Question (c)

Do you have other suggestions for dealing with the media given the nature of the NCAA and its functions?

Response

Because FERPA does not allow for the redisclosure of a student- athlete's education records to the media, we again suggest that the NCAA rely on FERPA's prior written consent provision that would allow the redisclosure of such information. The NCAA should indicate to the media that if it receives prior written consent of the student, it would be free to comment on information from education records.

As an essential part of the investigation and enforcement proceedings, NCAA needs to share information such as transcripts, test results and other data from a student's educational records with involved individuals who may be named in an allegation. As part of the due process measure set forth in the Enforcement Procedure, any individual against whom an allegation has been alleged has the right to review all pertinent evidentiary materials involving him/her. We may also need to discuss personally identifiable information with relatives or friends of the student-athlete for purposes of investigating the validity of allegations.

Question (a)

Is the NCAA required to obtain a written consent from the student-athlete prior to disclosing and/or discussing this information with such individuals in its investigation of violations?

Response

Yes, except for information that is not obtained from education records.

Question (b)

If so, is it possible to use a standard consent form such that the student consents to the disclosure of this information during the infraction investigation to the above-described individuals? Can we incorporate this type of consent into the student-athlete statement without affecting the enforceability of said consent?

Response

FERPA requires that specific written consent be provided prior to disclosure of education records. The consent must be signed and dated. In addition, the written consent must specify the records that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom the disclosure may be made. 34 CFR § 99.30.

As we discussed at our meeting, one possibility would be for the NCAA to provide a form to student-athletes that includes a waiver allowing for the redisclosure of information from education records in certain situations. The NCAA could determine in what particular situations redisclosure may be important or necessary. For example, the NCAA could draft a consent form allowing for the redisclosure of education records to specified individuals during an infraction investigation. The NCAA must ensure that the consent form meets the above outlined requirements. Additionally, the NCAA could incorporate such a prior written consent into its Student Athlete Disclosure form. This Office would be glad to review any proposed disclosure form.

Scenario Seven

The NCAA publishes information regarding its infraction cases and certain eligibility appeals in the NCAA News Register. This release excludes the student-athlete's name and the name of the member institution. The categories reported include: 1) how reported; 2) the type of sport(s); 3) citation to the NCAA bylaws and rules; 4) description of the facts; 5) description of the action taken by the member institution; 6) description of the action taken by the NCAA. The purpose of publishing this information is to inform and educate member institutions, institutional staff members and student-athletes of NCAA rules and their application to certain facts.

Question (a)

Does this type of information constitute personally identifiable information when the student's name and the name of the member institution is not revealed?

Response

FERPA defines "personally identifiable information" as including, but not limited to, the following:

1. The student's name;
2. The name of the student's parent or other family member;
3. The address of the student or student's family;
4. A personal identifier, such as the student's social security number or student number;
5. A list of personal characteristics that would make the student's identity easily traceable;
6. Other information that would make the student's identity easily traceable.

34 CFR § 99.3 ("Personally identifiable information"). Therefore, information would be considered easily traceable if sufficient details are disclosed to allow a reasonable person to determine the identity of the student-athlete and thus easily trace the record to that individual. Based on the categories you have mentioned above, we do not believe that the information disclosed in the NCAA News Register would constitute personally identifiable information under FERPA as long as the NCAA did not mention the name of the student-athlete, the name of institution, and the factual description was brief and non-specific. We note that in high profile cases, the description of facts in nonpersonally identifiable form may be such that reasonable persons could determine the identity of the student-athlete. In such cases, a detailed listing of the facts may need to be omitted.

Question (b)

Is this type of release acceptable under the Buckley Amendment?

Response

If the information from education records is not easily traceable to a student-athlete, then FERPA would permit this type of release. Of course, if challenged each disclosure would have to be examined on a case-by-case basis.

Question (c)

After the Committee on Infractions' hearings, the Committee's report is released to the media with the names of individuals deleted. Is this permissible?

Response

See answers to questions (a) and (b), and the discussion of "easily traceable."

Scenario/question Eight

The NCAA often recognizes student-athletes who excel in the areas of academics, intercollegiate competition and extracurricular activities. Would the Department of Education consider it a violation of the Buckley Amendment if the NCAA publishes the grade-point average, i.e. 3.9 GPA, of an outstanding academic All-American student-athlete without first obtaining the student's written consent?

Response

As mentioned previously, there are 13 exceptions that permit a school to disclose personally identifiable information from a student's education records without the prior consent of the student. One exception allows for the disclosure of "directory information" -- information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed.

More specifically, directory information includes, but is not limited to, information such as: "a student's name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most previous educational agency or institution attended." 34 CFR § 99.3 ("directory information"). FERPA further provides that prior consent before disclosure is not required if the information to be disclosed is information the educational agency or institution has designated as "directory information" under the conditions described in § 99.37⁵. 34 CFR § 99.31(a)(11).

We have previously determined that the type of information you describe is information that postsecondary institutions may designate as "directory information." For example, schools may publish as directory information "top 10% of the class" because it is similar to receiving an award or honor. Please note, however, that schools could not disclose the actual grades or GPA of a student who was in the top 10% of his or her class. We believe that -- provided the disclosing institution has appropriately designated "degrees and awards received" in its directory information -- the NCAA could redisclose this type of information under FERPA's directory information exception without the student's prior consent.

I trust that this letter is helpful in responding to your questions. We apologize for the amount of time it took to respond. Please do not hesitate to contact this Office again if you have further questions or need additional clarification for any of the answers in this letter.

Sincerely,

LeRoy S. Rooker

Director

Family Policy Compliance Office

[1]When a student reaches 18 years of age or attends a postsecondary institution, the student becomes an "eligible student" and all FERPA rights transfer from the parent to the student. 34 CFR § 99.3 ("Eligible student").

[2]FERPA provides that in order to be valid, any consent given by the parent or eligible student must be in writing. 20 U.S.C. § 1232g(b)(1); 34 CFR § 99.30(a). We have concluded that in order for the implied waiver of consent to apply, the initial request by the parent or eligible student must also be in writing.

[3]FERPA only protects information contained in education records. FERPA does not protect the confidentiality of information in general, and, therefore, does not apply to the disclosure of information derived from a source other than education records, even if education records exist which contain such information. As a general rule, information that is obtained through personal knowledge or observation, and not from an education record, is not protected from disclosure under FERPA. Cf. Kline v. Department of Health & Human Services, 927 F.2d 522 (10th Cir. 1991) (Privacy Act); Thomas v. Department of Energy, 719 F.2d 342 (10th Cir. 1983) (Privacy Act); Savarese v. Harris, 620 F.2d 298 (5th Cir. 1980)(Privacy Act), cert. denied, 449 U.S. 1078 (1982).

[4]For the record, we do not believe that the NCAA is a recipient of federal funds as provided for by FERPA. FERPA applies to any "educational agency or institution to which funds have been made available under any program administered by the Secretary..." 34 CFR § 99.1(a). We are not aware of any Department program that provides federal funding directly to the NCAA. Therefore, we have concluded that the 3rd Circuit's recent holding that the NCAA is a "recipient" for purposes of Title IX is distinguishable because FERPA's regulatory framework for determining who is a recipient is much narrower than Title IX's. See Smith v. NCAA, 139F.3d 180, 189 (3rd. Cir. 1998), cert. granted, 67 U.S.L.W. 3187 (U.S. Sept. 29, 1998)(No. 98-84) (Title IX definition of recipient includes entities that benefit indirectly from receipt of federal funds.)

[5]Section 99.37 requires postsecondary institutions to give public notice of the types of information it has designated as directory information, allow students the opportunity to opt out of the disclosure of this type of information, and provide students a time period in which they must submit in writing to the institution the fact that they does not want their directory information disclosed.