CIPP-US - Limits on Private-Sector Collection and Use of Data (31% of the exam) - Section 2.4

Describe FERPA's protections for student education records, rights of access and correction, and permissible disclosures to third parties.

Describe FERPA's grant of parental rights - and their transfer to students at 18 - to inspect, correct, and control disclosure of education records held by federally funded institutions. Recognise when directory information may be released without consent, which categories of third parties may receive records without consent, and when the right transitions from parent to eligible student.

FERPAEducation recordsDirectory informationParental rights

Practice question for this objective

Free sampleLimits on Private-Sector Collection and Use of Datamedium

A public high school learns that a current student has posted a credible plan to bring a weapon to campus the next morning. The principal wants to alert local police and the student's parents at once, but the school has not obtained consent to share anything from the student's records. Under FERPA, what is the correct basis for the school to make this disclosure?

AThe school may disclose the necessary information to the police and the parents under FERPA's health or safety emergency exception, because the threat is articulable and significant. Correct
BThe school must first obtain the parents' written consent because all disclosures of education records require prior signed authorisation from a parent or eligible student.
CThe school may disclose the information only after the local police obtain a court order or subpoena directing release of the student's education records.
DThe school may disclose the information to the media and the public so the wider community can take protective steps before the next school day.

FERPA permits disclosure of education records without consent to appropriate parties in an articulable health or safety emergency. The health or safety emergency exception lets a school release record information to law enforcement, parents, and medical or public health officials when knowledge of it is necessary to address an articulable and significant threat, deferring to a school's rational judgement about the emergency and the appropriate recipients.

Why A is correct: Correct. Under 34 CFR 99.31(a)(10) and 99.36, a school may disclose personally identifiable information from education records, without consent, to appropriate parties such as law enforcement and parents when needed to protect the health or safety of the student or others in an emergency.

Why B is wrong: Tempting because written consent is FERPA's default rule for most disclosures, but the rule has codified exceptions, and the health or safety emergency provision lets the school act without prior consent when there is an articulable, significant threat.

Why C is wrong: Tempting because subpoenas and court orders are a recognised FERPA disclosure route, but requiring one would defeat the purpose of the emergency exception, which exists precisely so schools can act quickly without waiting for legal process.

Why D is wrong: Tempting because urgency invites broad warning, but the emergency exception limits disclosure to appropriate parties able to protect health or safety, and the Department of Education has stated the media is not such a party.

See more CIPP-US practice questions, answers explained.

Exam traps in Limits on Private-Sector Collection and Use of Data

Answers that look right on this material and are not. Each one is a distractor from a different question in the CIPP-US bank for this domain.

The rights transfer only when the student turns twenty-one, the age at which FERPA treats a student as fully independent of parental control.
Why it is wrong: Tempting because twenty-one marks majority for some purposes, but FERPA fixes the transfer at age eighteen or postsecondary enrolment, so twenty-one overstates the trigger age.
The former school may disclose the records only after the parents sign a written consent form specifically authorising the transfer to the new school.
Why it is wrong: Tempting because consent is FERPA's default, but the regulations create a specific no-consent route for disclosures to a school where the student seeks or intends to enrol, so signed consent is not required here.
Cumulative academic transcripts that the registrar maintains and shares among instructors for grading and advising purposes.
Why it is wrong: Tempting because transcripts feel like core sensitive data, but records maintained by the institution that are directly related to a student are the heart of what FERPA covers, so transcripts are squarely education records.

Examworthy is not affiliated with or endorsed by IAPP. Original, blueprint-aligned practice material only.