FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT:             Obligations of school or school district under the Family Educational Rights 
                                                                                                                   and Privacy Act pertaining to photographs and video of students             

Photographs or video recordings of students participating in school activities will qualify as education records for purposes of the Family Educational Rights and Privacy Act, 20 USC 1232g, and that Act's prohibition on the release of such records, if they contain information directly related to a student, and are maintained by the school or district.

A school or district may designate photographs and video recordings of students engaged in school activities as a category of "directory information" that may be disclosed without written consent under the Family Educational Rights and Privacy Act, 20 USC 1232g, as long as the school or district provides the required notice to parents that such media will be considered directory information, and further provides parents with a reasonable opportunity to opt out or deny consent to the release of such information.

A school or district has no legal responsibility under the Family Educational Rights and Privacy Act, 20 USC 1232g, with respect to photographs or video recordings of students participating in school activities taken by a person not acting on behalf of the school or district, unless the photographs and video recordings are "maintained" by the school or district under 20 USC 1232g(a)(4)(A)(ii).

Opinion No. 7245

March 29, 2010

Honorable Sarah Roberts
State Representative
The Capitol
Lansing, MI 48909

You have asked several questions regarding the requirements that a school district must comply with in the creation and use of photographs and visual recordings of students in the district. These questions may be condensed and restated as follows:

          (1) Is a photograph or video recording taken by a person acting for the school or school district of a student participating in a school activity an education
          record for purposes of the Family Educational Rights and Privacy Act (FERPA), 20 USC 1232g?

          (2) If so, may a school designate such photographs or video recordings as directory information subject to disclosure under FERPA without written consent?

          (3) What obligations may a school have under FERPA if a photograph or video recording is taken of a student participating in a school activity by a person not
          acting on behalf of the school?

As background, you indicate that a certain school district takes photographs and creates video recordings of students participating in various school activities, and that such photographs or video recordings may appear in newspapers, in school publications, on the school website, on community access cable television, or on digital video discs (DVDs). You also indicate that the DVDs may occasionally be sold by various school groups as part of fundraising efforts. Your questions arise from a school district's inquiry as to its legal obligations under the Family Educational Rights and Privacy Act, 20 USC 1232g, commonly known as FERPA.¹

You first ask whether a photograph or video recording taken by a person acting for the school or district of a student participating in a school activity is an education record for purposes of FERPA.

FERPA is a federal law that protects the privacy of student education records. Although the statute lacks a statement of purpose, its dual purpose has been explained as:

          (1) to create a right of access to student records for parents and students; and (2) to protect the privacy of those records by preventing unauthorized access by
          third parties. See 120 Cong. Rec. 39,858, 39,862-39,863 (December 13, 1974); 121 Cong. Rec. 7974 (May 13, 1975). [United States v Miami Univ, 91 F Supp 2d 1132,
          1140 (SD Ohio, 2000).]

The law applies to all educational agencies or institutions meaning "any public or private agency or institution," including kindergarten through grade 12 (K-12) schools, which receives funds under an applicable program of the United States Department of Education. 20 USC 1232g(a)(3).²

The requirements FERPA imposes on schools as conditions of funding focus on "education records." FERPA first requires that schools allow parents "the right to inspect and review the education records of their children." 20 USC 1232g(a)(1)(A). FERPA next requires that a school allow parents to challenge the contents of their children's education records by providing an opportunity for a hearing. 20 USC 1232g(a)(2). Finally, FERPA prohibits schools from having "a policy or practice of permitting the release of educational records (or personally identifiable information contained therein . . .) of students without the written consent of their parents." 20 USC 1232g(b)(1).

FERPA defines "education records" as:

          [T]hose records, files, documents, and other materials which –

               (i) contain information directly related to a student; and

               (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution. [20 USC 1232g(a)(4)(A); emphasis added.]³

The term "education records" is thus not limited to records related to academic matters, but broadly includes information "directly related" to a student and "maintained" by the school or district. United States v Miami Univ, 91 F Supp 2d at 1149.⁴ Neither FERPA nor case law interpreting the statute defines or describes how information qualifies as "directly related" to a student, and therefore qualifies as an education record. FERPA, however, links the prohibition of disclosure of education records to "personally identifiable information contained therein." 20 USC 1232g(b)(1).

Rules adopted by the United States Department of Education provide that the term "personally identifiable information" "includes, but is not limited to": 

          (a) The student's name;

          (b) The name of the student's parent or other family members;

          (c) The address of the student or student's family;

          (d) A personal identifier, such as the student's social security number, student number, or biometric record;

          (e) Other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name;

          (f) Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community,
          who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or

          (g) Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education
          record relates. [34 CFR 99.3; emphasis added.]

Photographs or video recordings of students participating in school activities, alone or in combination with other information, may be linked or linkable to a specific student, and could allow a reasonable person in the school community without personal knowledge of the relevant circumstances, to identify the student. 34 CFR 99.3(f). Under those circumstances, such media would fall within the definition of "personally identifiable information."

Because FERPA creates a link between the disclosure of "personally identifiable information" and "education records" – defined to mean "information directly related to a student" – it is a fair conclusion that if information qualifies as "personally identifiable information," it will also qualify as "information directly related to a student," and thus an "education record." Accordingly, photographs and video recordings that qualify as "personally identifiable information" under 34 CFR 99.3, may qualify as "information directly related to a student," and therefore an "education record" under 20 USC 1232g(a)(4)(A)(i), as long as one additional requirement is met.

As noted above, to come within the statutory definition of "education records" the information must not only be directly related to a student, but be "maintained by an educational agency or institution or by a person acting for such agency or institution." 20 USC 1232g(a)(4)(A)(ii). Owasso Independent School Dist No I-011 v Falvo, 534 US 426, 433-435; 122 S Ct 934; 151 L Ed 2d 896 (2002). FERPA does not define the word "maintained." The United States Supreme Court, however, addressed its meaning in conjunction with determining whether student- or peer-graded assignments were educations records "maintained" by a school:

          The ordinary meaning of the word "maintain" is "to keep in existence or continuance; preserve; retain." Random House Dictionary of the English Language
          1160 (2d ed. 1987). . . . The word "maintain" suggests FERPA records will be kept in a filing cabinet in a records room at the school or on a permanent secure
          database, perhaps even after the student is no longer enrolled. The student graders only handle assignments for a few moments as the teacher calls out the
          answers. It is fanciful to say they maintain the papers in the same way the registrar maintains a student's folder in a permanent file. [Owasso Independent
          School Dist No I-011, 534 US at 433.]

Following the Supreme Court's guidance in Owasso, if photographs or video recordings of students participating in school activities are kept, preserved, or retained by the school or district they fit the definition of education records set forth in 20 USC 1232g(a)(4)(A)(i)-(ii). Conversely, if a school or district does not keep or preserve such photographs or video recordings, they are not education records for purposes of FERPA.

It is my opinion, therefore, in answer to your first question, that photographs or video recordings of students participating in school activities will qualify as education records for purposes of the Family Educational Rights and Privacy Act, 20 USC 1232g, and that Act's prohibition on the release of such records, if they contain information directly related to a student, and are maintained by the school or district.

You next ask whether photographs and video recordings that qualify as education records may be designated as "directory information," and therefore subject to disclosure under FERPA without written consent.

FERPA prohibits schools from having a policy of releasing "educational records (or personally identifiable information contained therein other than directory information . . .) of students" without written consent. 20 USC 1232g(b)(1) (emphasis added). Thus, the act contains an exception to the general prohibition on release without written consent for information that qualifies as "directory information."
FERPA defines "directory information" relating to a student to "include[ ] the following":
 
          T]he student's name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight
          and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution
          attended by the student. [20 USC 1232g(a)(5)(A).]

As an initial matter, this exception for "directory information" is only relevant if photographs and video recordings of students participating in school activities indeed qualify as directory information. The statute does not expressly identify a student's image as captured by a photograph or video recording as "directory information." However, this list of information is non-exclusive as it is preceded by the word "includes." See Burgess v United States, 553 US 124; 128 S Ct 1572, 1578 n 3; 170 L Ed 2d 478 (2008) ("[T]he word 'includes' is usually a term of enlargement, and not of limitation." 2A Singer § 47:7, p 305 (some internal quotation marks omitted)). The United States Department of Education has interpreted the section similarly, defining "[d]irectory information" to "mean[ ] information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed," and:

          [It] includes, but is not limited to, the student's name, address, telephone listing; electronic mail address; photograph; date and place of birth; major field of
          study; grade level; enrollment status (e.g., undergraduate or graduate, full-time or part-time); dates of attendance; participation in officially recognized activities
          and sports; weight and height of members of athletic teams; degrees, honors and awards received; and the most recent educational agency or institution attended.
          [34 CFR 99.3; emphasis added.]⁶

While the Department did not identify video recordings as "directory information," since this list too is non-exclusive, and videos are similar in nature to photographs in that they capture a student's image, it is reasonable to conclude that video recordings of students engaged in school activities may be considered "directory information" for purposes of 20 USC 1232g(a)(5)(A).

Accordingly, photographs and video recordings of students engaged in school activities may be considered "directory information," and thus disclosed without written consent. However, before a school or district discloses directory information, it must comply with certain requirements. FERPA provides that a school or district must identify the categories of information that it will consider directory information; publish its version of directory information; and allow parents a reasonable opportunity to opt out – in other words, to deny consent to the release of such information as it pertains to their children:

               Any educational agency or institution making public directory information shall give public notice of the categories of information which it has designated as
          such information with respect to each student attending the institution or agency and shall allow a reasonable period of time after such notice has been given for
          a parent to inform the institution or agency that any or all of the information designated should not be released without the parent's prior consent. [20 USC 1232g(a)(5)(B).]
 
Notably, FERPA does not specify what information must be designated as directory information. Rather, it gives a school or district discretion to determine which categories, if any, will be considered directory information by the school or district.⁷

With respect to the notice requirement, FERPA further requires that educational agencies or institutions provide parents of students annual notification of their rights under FERPA. 20 USC 1232g(e). The means of notification is left to the discretion of each school under 34 CFR 99.7(b), which requires only that the notice be by means "that are reasonably likely to inform the parents or eligible students of their rights."⁸

It is my opinion, therefore, in answer to your second question, that a school or district may designate photographs and video recordings of students engaged in school activities as a category of "directory information" that may be disclosed without written consent under the Family Educational Rights and Privacy Act, 20 USC 1232g, as long as the school or district provides the required notice to parents that such media will be considered directory information, and further provides parents with a reasonable opportunity to opt out or deny consent to the release of such information.

You next ask what obligations a school or district may have under FERPA if a photograph or video recording is taken of a student participating in a school activity by a person not acting on behalf of the school or district.

FERPA imposes obligations on schools, identified in the statute as "educational agencies or institutions." The obligations are specific to education records. A record need not be created by the school itself in order to be an "education record" subject to FERPA. The record need only contain information "directly related" to a student, and be "maintained by an educational agency or institution or by a person acting for such agency or institution" to come under the protections of FERPA. 20 USC 1232g(a)(4)(A)(i)-(ii).

As discussed above, photographs or video recordings of students participating in school activities, including those taken by persons not acting on behalf of a school or district, will likely contain information "directly related" to a student, and thus meet the first prong of the definition of "education record." However, if the photograph or video recording is not also "maintained" by the school or district, it does not meet the second prong of the definition and therefore is not an "education record," and thus not addressed by FERPA.

It is my opinion, therefore, in answer to your third question, that a school or district has no legal responsibility under the Family Educational Rights and Privacy Act, 20 USC 1232g,
with respect to photographs or video recordings of students participating in school activities taken by a person not acting on behalf of the school or district, unless the photographs and video recordings are "maintained" by the school or district under 20 USC 1232g(a)(4)(A)(ii).