Family Educational Rights and Privacy Act (FERPA) and Research Implications

Printer-friendly version


The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools (i.e., elementary, secondary and higher education institutions) that receive funds under an applicable program of the U.S. Department of Education.

What Impact Does FERPA Have on Research?

FERPA impacts researchers in that data not included in the student directory information cannot be utilized in research without the permission of the IRB and the research participant. Keep in mind, however, that the IRB cannot overrule the institution’s decision to deny access, and if the IRB disapproves the proposed research, the institution may not approve disclosure of information associated with the research.

What Information is Protected by FERPA?

Certain kinds of student information fall under “directory-style information” (e.g., name, campus address, current credit load etc.) which means that this information can be obtained and used without IRB approval. Some kinds of student information (e.g., date of birth, GPA etc.) does not fall under student directory information and cannot be utilized in research without going through the proper channels. FERPA requires that students be given the option to “opt out” of allowing directly information to be shared, and if students choose to opt out, this information may not be disclosed.

Researchers need to receive consent from student research participants in order to utilize information that falls under FERPA’s definition of education records (for definitions of “education record” or “records” please refer to 34 CFR 99.2 and/or 1232g(b)(3),(b)(5)(a)(4)). This includes – but is not limited to – end-of-course grades or any other grades or assignments produced within a class. In other words, instructors cannot use information to which they might have natural access for purposes other than instruction and evaluation without informed consent. Course grades are considered part of the students’ official records and thus belong to the student, and permission of the student should be obtained through informed consent, along with permission of the Registrar. Other information not typically in a student directory could include race, gender, birthdate, GPA, country of citizenship, social security number, residency status, and financial aid (including PELL Grants or HOPE Scholarship) or academic status. This list, however, is not exhaustive.

How Can I Obtain or Access Existing Rutgers Records or Data About Rutgers Students?

Access to any Rutgers campus Registrar’s database for student records (known as SRDB) and/or access to Rutgers admission records (known as NJAS system) requires authorization from Rutgers’ Institutional Research & Academic Planning (IRAP). IRAP has been designated by the University as the administrative clearinghouse for various types of institutional and University-specific data including the following (not an exhaustive list): data dictionary, Human Resource (HR) data, SRDB, NJAS, SERU (Student Experience in the Research University), CIRP, registrar and admissions data. Please contact the Office of Institutional Research and Academic Planning (OIRAP) to obtain specific guidance.

It’s highly recommend that the University’s existing SERU tools be reviewed. You can obtain aggregate institutional SERU data for census information on RU undergraduates (instead of conducting additional surveys to gather the same information and to avoid survey fatigue on students). Your IRB application must contain a letter of authorization from IRAP granting permission to you for the release the requested dataset upon IRB approval (this is treated as a pending contract with the requested data and/or variables that will be stated in their authorization).

How Does FERPA Apply to Proposed Prekindergarten Through 12-Grade Research?

FERPA applies to all research projects conducted within local PK-12 schools and school districts. The PI is responsible for obtaining IRB approval from Rutgers and s/he also needs to comply with any additional safeguards that have been put into place by individual school districts. In addition to the Rutgers IRB’s requirement that require PIs to submit school district approvals with their IRB applications (i.e., site authorizations), PIs need to understand, meet, and gain approval of both the IRB and school signatory authority before their research can begin. Also, keep in mind that the IRB cannot override a school district’s decision to deny access to certain information to the researcher.

Are there research projects involving access to data not typically included in student directory information that do not require informed consent from participants?

Educational institutions may disclose, without consent, student data to those conducting studies for, or on behalf of, educational institutions to (1) develop, validate, or administer predictive tests; (2) administer student aid programs; or (3) improve instruction (34 CFR 99.31). Educational records may be released, as well, for institutional research; however, individuals proposing to publish or publicly disseminate such research would need IRB approval before proceeding.

Does this mean that I cannot use my students’ grades or coursework in my research without IRB approval?

Yes, FERPA regulations apply even when using your “own” records and/or your “department’s” student records. Unless you have received a waiver (see RU SOPs 5.10 Waiver of Informed Consent or consent process guidance), you must receive IRB approval and student consent in order to utilize any grades and/or work completed within your class, including assignments such as papers, journals, projects, and tests (34 CFR 99.2). In practical terms, this means that you will need to obtain student consent either by securing access to educational records contained in Rutgers’s directory or – if this is not possible – by obtaining consent via established informed consent procedures.

Irrespective of the consent route, however, student research participants need to be informed about the following three issues so they know what they are consenting to: (1) nature of records that will be disclosed/used, (2) the purpose of the disclosure, and (3) the identification of the part of class or parties to whom the disclosure may be made (34 CFR 99.30).

What if my study is large-scale and consent for release of data not included in student directory information is difficult to obtain?

For large-scale research projects where consent is difficult and/or impossible to obtain, you may want to consider applying for a waiver of informed consent. While the IRB will consider requests for waivers on a case-by-case basis, all requests should be made during the regular IRB application process. Keep in mind, however, that your ability to use this data will remain contingent upon IRB approval and student consent.

Note: If the IRB grants the waiver of informed consent, a designated school official (at Rutgers- IRAP) must strip any personally identifiable information (PII) before the dataset will be shared with you (for a definition of the term “PII” please see federal regulations 34 CFR 99.3 or 20 U.S. Code 1232g). Examples of PII include – but are not limited to – student names, student identification numbers, grade lists, place of birth, ethnicity, course schedules, academic status, and advisor names. The waiver, however, does not absolve you of the responsibility to notify the students of the possibility to opt out of research project. Students retain this right to their educational records even if they no longer attend Rutgers (34 CFR 99.37).

Additional source material for this policy guidance was adapted and used with permission by the University of North Georgia IRB.  The Rutgers IRB gratefully acknowledges this support.