FERPA Primer

How Summit maintains FERPA-compliance

Summit is very serious about protecting the privacy of teachers, parents, and students. We partner with privacy experts to ensure Summit is always fully compliant with all federal privacy legislation (like FERPA and COPPA) as well as state legislation. This primer shares more details about how Summit’s practices help schools stay compliant with FERPA. Below is a guide we hope you’ll find useful. This is not legal advice, nor are we in a position to provide legal advice.

What is FERPA?

FERPA is ‘The Family Educational Rights and Privacy Act’ that applies to all educational institutions that receive federal funding from the Department of Education. It protects personally identifiable information (PII) in students’ “educational records” from unauthorized disclosure.  FERPA also affords parents the right to access their child's education records, the right to seek to have the records amended, and the right to have some control over the disclosure of PII from education records.

Basically, FERPA says that schools cannot share PII contained in “education records”  without parent’s written consent. Without that written consent, FERPA only allows a school to share PII from an
“education record”  if an ‘exception’ to FERPA is met. The two most common exceptions using by schools that engage third-party service providers such as Summit are the “School Official” and “Directory Information”  exceptions.

What is the “School Official” exception to FERPA?

The “School Official” exception allows schools to disclose PII from students’ “education records” to a “School Official” (i.e. Summit) as long as the “School Official”:  

  1. Performs an institutional service or function for which the school or district would otherwise use its own employees;

  2. Has been determined to meet the criteria set forth in the school’s or district’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records;

  3. Is under the direct control of the school or district with regard to the use and maintenance of education records; and

  4. Uses education records only for authorized purposes and may not re-disclose PII from education records to other parties (unless the provider has specific authorization from the school or district to do so and it is otherwise permitted by FERPA).

What is an education record?

“education records” are those records, files, documents, and other materials which (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution. It is important to remember, however, that student information that is shared under the “Directory Information” exception (such as student name and class year), is not subject to FERPA’s use and re-disclosure limitations. 

Additionally, education records do not include records which are in the sole possession of the maker and which are not accessible or revealed to any other person except a substitute.

Is anything submitted by teachers on Summit an “educational record”?

Some of the information teachers disclose to Summit may likely be “Directory Information” (such as student name and grade) and not an “education record”.  Additionally, some of the information collected through the Platform such as classwork, Project submissions, assessment responses, and academic goals; communications with teachers and mentors; and non-academic information could be deemed to be an “education record”.  FERPA isn’t clear about whether the communications with teachers and mentors and non-academic information would legally be considered an educational record. So, it’s really up to each school to decide if it is (we know, not very helpful from FERPA!).

However, regardless of that distinction, and whether schools obtain parental consent, or rely on the “School Official” and/or “Directory Information” exceptions, we want to assist schools in complying with their FERPA obligations so our Terms of Service, Data Protection Addendum and Privacy Policy are written to make it easy for schools to support either approach. This includes drafting our Terms of Service to follow the best practice guidance of the U.S. Department of Education’s Model Terms of Service for Online Educational Services).

Does Summit help schools stay  FERPA-compliant?

Yes, Summit helps schools stay fully FERPA-compliant. Here’s  how:

Under FERPA, schools can use the “School Official” or “Directory Information”  exception to share PII from “education records” with third-parties that provide a legitimate educational function. This is the approach used by many districts with well- known education technologies, such as Google Apps for Education. Summit’s Terms of Service and Privacy Policy are written to support this approach, including following the best practice guidance of the U.S. Department of Education’s Model Terms of Service for Online Educational Services.

Alternatively, some schools or districts may instead choose not to rely on the “School Official” or “Directory Information” exemption, and instead get parental consent for each technology they use. Summit’s Terms of Service and Data Protection Addendum supports this approach, too, for complying with FERPA.

Finally, our policies prohibit us from sharing PII  from “education records” with any other third-parties unless they aid in providing the Summit service. For your reference, we provide a list of our service providers on our website.

Summit is always working with top privacy advocates and experts in education to protect teachers, parents, and students, and to ensure all privacy obligations are met, including FERPA.

Additional Resources:

For additional questions

If you have any questions about this Primer or our practices, please contact privacy@summitlearning.org

You can also reach us by calling (650) 257-9878 or writing to:

Summit Public Schools
780 Broadway Street
Redwood City, CA 94063
Attn: Summit Learning Program

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request.



Article is closed for comments.