FERPA for Students

Under FERPA, education records are defined as any personally identifiable information that is directly related to a student and maintained by an educational agency, institution, or party acting for the agency or institution. Education records can exist in any medium, including, but not limited to, typewritten, hand-written, computer-generated, videotape, audiotape, film, microfilm, microfiche, and email. 

Education records do not include: 

Sole possession records, i.e., records/notes in sole possession of the maker, used only as a personal memory aid and not revealed or accessible to any other person except a temporary substitute for the maker of the record.

1. Medical treatment records that include, but are not limited to, records maintained by physicians, psychiatrists, and psychologists.
2. Employment records, unless employment is based on student status, i.e. a graduate teaching assistant or work-study student.
3. Law enforcement records created and maintained by a law enforcement unit.
4. Post-attendance records, i.e., information about a person that was obtained when the person was no longer a student (alumni records) and not related to the person as a student.

Student education records are considered confidential and should not be released to any person without the written consent of the student, unless the disclosure meets one of the exceptions to signed consent found in FERPA. University officials are granted access to student information only for “legitimate educational interest” -- completion of job responsibilities. They have a responsibility to protect the confidentiality of education records in their possession, regardless of the medium in which the records are stored or presented. A school official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted as its agent to provide a service instead of using University employees or officials (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, or assisting another school official in performing his or her tasks (teaching assistant, research assistant, graduate assistant, workstudy). Unauthorized release of student record data without written consent of the student may trigger legal sanctions.

At KSU, examples of student record information that generally should not be disclosed without prior written consent of the student are:

Employees may not disclose information contained in education records without the student’s consent, except under certain limited conditions. For example, the University may disclose what is considered to be “directory” information unless the student has restricted disclosure of such information. Institutions are not required by FERPA to disclose directory information. When in doubt, do not release information.

If a student has restricted the disclosure of directory information, the word “CONFIDENTIAL” will appear in Banner and Owl Express. 

Postsecondary Institutions must have written permission from the parent or eligible student in order to release any information from a student's education record; however, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

• School officials with legitimate education interest;
• Other schools to which a student is transferring;
• Specified officials for audit or evaluation purposes;
• Appropriate parties in connection with financial aid to a student;
• Organizations conducting certain studies for or on behalf of the school;
• Accrediting organizations;
• To comply with a judicial order or lawfully issued subpoena; 
• Appropriate officials in cases of health and safety emergencies; and
• State and local authorities, within a juvenile justice system, pursuant to specific State law.

Even with consent, the rights of parents/third parties is limited only to access designated education records but does not act as a Power of Attorney or proxy for any parent or third party (including attorneys) to act on behalf of the student.

For students who do not give authorization to others, only directory information may be obtained. Directory information includes information such as name, field of study (major), advisor, dates of attendance, degrees awarded, participation in officially recognized activities or sports, and weight and height of athletic participants.

Please note that although not a FERPA violation, KSU is not required to release directory information.

Only currently active students can access the Student Consent to Disclosure Form in Owl Express. If you no longer have access to Owl Express, please contact the Office of the Registrar for assistance using the Student Consent for Disclosure-One Time Authorization form.

This form only grants access to disucss:

• Academic Records- grades/GPA, demographic, registration, student ID number, academic progress/status, immunizations, and/or enrollment information.
• Billing/Financial Records- billing statements and repayment history (including credit reporting history, and balances), University-maintained loan disbursements, charges, credits, payments, past due amounts, financial holds, collection activity, and meal plans.

For all other records, please contact the appropriate record custodian.

Under the provisions of the Family Education Rights and Privacy Act of 1974, as amended, students have the right to withhold the disclosure of the categories of "Directory Information."

Students who do not want their directory/public information released to third parties must complete the Kennesaw State University Release of Directory Information form. Students must submit the signed consent form in person with photo ID to the Office of the Registrar.

Students should be aware that submitting the Release of Directory Information form may result in undesirable repercussions such as denied enrollment and degree verification to persons, agencies, and institutions requesting this information for employment, insurance discounts, school transfer, or related purposes and publications such as the commencement program.

The non-disclosure can be removed by re-submitting the Release of Directory Information form, selecting "Remove Confidential Indicator."  Students must submit the signed consent form in person with a photo ID to the Registrar's Office.

DO know your rights as it pertains to your education records.

DO fill out the Student Consent to Disclosure form through the Office of the Registrar, or contact the appropriate offices that maintains other education records, if you want to grant access to specific individual(s).

DO issue a complaint if you believe KSU and/or your instructor has violated FERPA.

DO always contact the Office of the Registrar with any questions or concerns.

DON'T share your Owl Express login and KSU email login information.

DON'T leave your computer or phone unlocked and/or unattended, or physical papers in plain sight.

DON'T allow anyone to pressure you into signing consent and/or providing information you do not want to share. These are your education records and your decision who can access them.

• Scenario #1: Joe is upset that some of his information, including his dates of attendance and degree earned, was released to third parties without his consent.

Dates of attendance and degree earned are considered directory information; therefore, the school does not need consent from the student to release this information. However, Joe does have the choice to opt out from disclosing his information by notifying the Office of the Registrar. School officials also reserve the right to deny access to third parties if they feel there is not a legitimate need to release information.

• Scenario #2: Chris is a taking a psychology course this semester. His instructor informs the class that he uses the last six digits of the student’s KSU ID in his class as a unique, numbered identifier and will post test and paper grades for everyone to see. Chris does not want his grades posted.

It is a FERPA violation for an instructor to publicly post grades and identify students by either name, student ID number, or social security number. Posting location applies to websites, grade sheets, bulletin boards, walls and doors.

• Scenario #3: Erin is a student assistant working in the Office of the Registrar. Her friend and fellow student, Hannah, visits Erin at work one day. Hannah asks Erin if she can pull up the class roster of one of her courses so she can see others enrolled in her class.

It is a FERPA violation to share or allow access to class rosters to anyone other than school officials with a legitimate educational interest, as it contains personally identifiable information.  Hannah is not a school official and does not have a valid reason for viewing the roster. Therefore Erin should not allow her access.

• Be sure to know your rights and your options, as it pertains to your education records.
• Only fill out a Student Consent to Disclosure form if it is in your best interest. Only you can make this decision.
• Never hesitate to ask questions or report what you believe could be a FERPA violation. Contact the Office of the Registrar with any concerns.

 For more information, contact the Office of the Registrar.