February 12, 1999

Mr. Thomas C. Anderson
Assistant Attorney General
Education Division
Office of the Attorney General
P.O. Box 140853
Salt Lake City, Utah 84114-0863

Dear Mr. Anderson:

This is in response to your January 13, 1999, letter, addressed to Mr. David Berthiaume of the U.S. Department of Education's Office of General Counsel concerning the Family Educational Rights and Privacy Act (FERPA). 20 U.S.C. § 1232g; 34 CFR Part 99. Your letter enclosed correspondence between you and Ms. Cecelia Foxley, Commissioner of Higher Education (Utah State Board of Regents), and correspondence between Ms. Foxley and Mr. Auston Johnson, Utah State Auditor. You also enclosed a letter from Mr. Terry Livingston, Assistant Regional Inspector General for Audit, U.S. Department of Education, addressed to Mr. Johnson, in which he provided Mr. Johnson's office with some guidance on FERPA. Your letter was referred to this Office for response because we administer FERPA.

The Utah State Auditor has requested disclosure of information from the education records of all Utah postsecondary students for the 1997-98 school year for the purpose of "performing single-audit testwork relating to the Unemployment Insurance Program at the Department of Workforce Services." The information requested includes the following: the student's first and last name; social security number; date of birth; address; full/part-time status; and institution attended. You ask whether FERPA would permit the Utah Board of Regents to disclose the requested information to the State Auditor.

As you are aware, FERPA is a Federal law that protects an eligible students⁽¹⁾ privacy interest in his or her "education records." In particular, FERPA affords eligible students the right to inspect and review their education records, the right to seek to have the records amended, and the right to have some control over the disclosure of information from the records. The term "education records" is broadly defined as:

[T]hose records, files, documents, and other materials, which (I) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution.

20 U.S.C. § 1232g(a)(4). See also 34 CFR § 99.3 "Education records." FERPA provides that education records, or personally identifiable information from such records, may be disclosed by educational agencies and institutions only after an eligible student provides prior written consent, except in statutorily specified circumstances. 20 U.S.C. § 1232g(b)(1) and (d). See also 34 CFR § 99.30.

FERPA generally prohibits the nonconsensual disclosure of information derived from education records, except in certain circumstances. 20 U.S.C. § 1232g(b); 34 CFR § 99.31. Accordingly, if one or more of the exceptions are met, an educational agency or institution may disclose education records, or personally identifiably information from education records, without prior written consent. However, from the information you have provided, and as explained more fully below, it does not appear that any of FERPA's exceptions to the prior written consent provisions would permit the nonconsensual disclosure by the Utah State Board of Regents of personally identifiable information from education records to the State Auditor.

Under one of the exceptions to the prior consent rule, an institution of postsecondary education may disclose information without consent if:

(3) The disclosure is, subject to the requirements of ? 99.35, to authorized representatives of --

(iii) State and local educational authorities.

34 CFR § 99.31(a)(3)(iii); see also 20 U.S.C. a§ 1232g(b)(1)(C). According to the requirements of 20 U.S.C. § 1232g(b)(3) and (5) and of 34 CFR § 99.35, paragraph (a), the above representatives may have access to education records in connection with an audit or evaluation of Federal- or State-supported education programs, or for the enforcement of or compliance with Federal legal requirements which relate to those programs.

This Office has previously determined that State auditors may be considered "authorized representatives of State and local educational authorities," but only for the purpose of conducting an audit of an education program. Thus, personally identifiable information from student education records can be disclosed to State auditors for such purposes under § 99.31(a)(3) of the FERPA regulations, which implements 20 U.S.C. § 1232g(b)(3) and (5). The Utah State Auditor may have access to personally identifiable information from education records if the information is in connection with the audit of State or federally supported education programs. However, the provision in FERPA does not permit the State auditor to have access to personally identifiable information from education records for the purpose of auditing a program that is not an educational one, such as the Unemployment Insurance Program.

Please note that in a February 10, 1999, telephone conversation with Mr. Livingston, Assistant Regional Inspector General at the U.S. Department of Education, Mr. Livingston explained that he had clarified his December 2 advice. Mr. Livingston stated that his letter should have specified that nonconsensual disclosures under FERPA may be made in conjunction with an audit or evaluation of a Federal or State supported education program, rather than "Federal or State supported programs." Moreover, please be advised that the Secretary has designated the Family Policy Compliance Office as the office to administer FERPA. If you have any questions about complying with FERPA, they should be addressed to this Office and we will provide you with a definitive response.

I trust that the above information sufficiently responds to your inquiry. Should you have additional questions regarding this matter, please do not hesitate to contact this Office again. The address and telephone number are as follows:

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, S.W.
Washington, D.C. 20202-4605
(202) 260-3887

Sincerely,

LeRoy S. Rooker
Director
Family Policy Compliance Office

cc:
Mr. Auston Johnson
Utah State Auditor

Mr. Ray Lazorchak, Director
National External Audit Review Center
Department of Health and Human Services

Ms. Cecelia Foxley
Commissioner of Higher Education

Mr. Terry Livingston
Assistant Regional Inspector General for Audit
Department of Education

Footnotes:

1. The rights under FERPA belong to the parents of a student until the student becomes 18 years of age or enters a postsecondary institution (eligible student).