Brief: It's Time for States to Protect School Directory Information

• By Dian Schaffhauser
• 12/13/18

The National Association of School Boards of Education (NASBE) has released a two-page brief to bring members up to date on the protection of school directory information. According to author Amelia Vance, policy counsel at the Future of Privacy Forum, "a gap in federal law" is leaving directory information "vulnerable."

FERPA, the Family Educational Rights and Privacy Act, grants schools a "directory information exception," allowing them to share students' personal information with third parties when it wouldn't "generally be considered harmful or an invasion of privacy if disclosed." This ability comes with no limits. In fact, the third party can then "redisclose" that information to anybody. Where parents object, they can opt out of the directory information sharing, Vance wrote. Most of the time this information is used for harmless activities, such as compiling a program for a play that lists those who participated. If the parent opts his or her child out of the directory, that student's name won't appear in the program.

Now state boards of education are asked to consider whether to take a heavier hand in imposing limits on the directory information, especially now that many of those are available online instead of in paper form.

According to the U.S. Department of Education, which oversees FERPA, schools don't need to turn to an all-or-nothing decision. If they have the capacity, they can enable families to choose which data they consider directory information in the first place. But not every school has the kind of staff that enables that sort of tracking.

So, the states have acted. Ohio, for instance, has a law that prohibits schools from making directory information available to anybody or any group that intends to use it for a commercial purpose. Maryland has regulated disclosures of phone numbers and home addresses unless families have agreed.

In May 2018, NASBE adopted a resolution encouraging Congress to amend the FERPA regulation to exclude address, phone listing and data and place of birth. Until that happens, however, the brief pointed out, most states have the power to impose legal authority over student data as well. Currently, Vance wrote, 18 states boards are specifically charged with the job of writing their states' data collection policies. Where they lack that control, she suggested, state boards can still lead on raising awareness about the privacy issues and provide recommendations.

"Students do not have the right to attend school anonymously, but they do have a right to have their information protected and used responsibly by local and state education agencies," Vance stated.

The brief is openly available on the NASBE website.