March 12, 1999

Ms. Doris Dixon
National Collegiate Athletic Association
One Dupont Circle, NW
Suite 400
Washington, D.C. 20036

Dear Ms. Dixon:

This letter is written in follow-up to our meeting of January 13, 1999, in which you and other participants expressed concern on behalf of the National Collegiate Athletic Association (NCAA) regarding the limitations that the Family Educational Rights and Privacy Act (FERPA) places on certain disclosures of education records. Also, this responds to a February 4, 1999, letter from Mr. John Morris relative to our meeting. In particular, the NCAA is concerned about the "easily traceable" aspect of FERPA as it applies to the release of NCAA investigative reports, waivers, and denial decisions.

While we are considering the scope of "easily traceable" information within the definition of "personally identifiable information," we wanted to provide to you, in writing, our suggestion that a prospective student-athlete provide to the NCAA prior written consent to disclose education records. Specifically, we suggest that if the NCAA added the following language to its Student Athlete Statement, it would permit the NCAA to release the investigative reports and respond to any subsequent questions regarding those reports in compliance with FERPA:

I allow the NCAA to disclose personally identifiable information from my education records to any third party, including but not limited to the media, for the purpose of reporting or verifying compliance/accuracies with regard to the NCAA Constitution and Bylaws, to investigate alleged violations of the Constitution and Bylaws, and/or to issue student infraction reports.

Additionally, we suggest that if the NCAA added the following language to its Student Athlete Statement, it would permit the NCAA to release waiver and denial decisions and respond to any subsequent questions regarding those waivers or decisions:

I allow the NCAA to disclose personally identifiable information from my education records to any third party, including but not limited to the media, for the purpose of reporting or verifying compliance/accuracies with regard to a waiver or denial decision.

As we have previously informed you, FERPA requires that specific written consent be provided prior to disclosure of education records. The consent must be signed and dated. In addition, the written consent must specify the records that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom the disclosure may be made. 34 CFR § 99.30. The above statements meet the prior written consent requirement for the purpose of FERPA.

Also, even if a student-athlete were to sign the above consent, the NCAA would be under no obligation to change its policy of disclosing information from education records in nonpersonally identifiable form. Rather, the NCAA could continue its disclosure in the same manner but the signed consent would alleviate any FERPA implications where a student's identity might be easily traceable.

Although we have typically advised schools that an easily traceable analysis must be made, at least in part, by the school on a case-by-case basis, we have concluded that if a reasonable person in the community can identify the subject of the report based on the information provided, then that release will violate FERPA. While we recognize that this conclusion may cause some difficulty for current NCAA reporting procedures, we believe that the legislative history and purpose of FERPA require the balance be struck in favor of the protection of privacy of a student-athlete's identity. We also have concluded that the caselaw in a non-privacy context (Freedom of Information Act) supports this decision as well. Whitehouse v. United States Dep't of Labor, 997 F. Supp. 172 (D. Mass. 1998).

We enjoyed meeting with you and would be interested in having the NCAA's thoughts regarding such a modification of your consent agreement. Please do not hesitate to contact this Office if you have any questions.

Sincerely,

LeRoy S. Rooker
Director
Family Policy Compliance Office