ExamworthyExamworthy
Open the appStart free

CIPP-US - Limits on Private-Sector Collection and Use of Data - Section 2.4

Describe FERPA's protections for student education records, rights of access and correction, and permissible disclosures to third parties.

Describe FERPA's grant of parental rights - and their transfer to students at 18 - to inspect, correct, and control disclosure of education records held by federally funded institutions. Recognise when directory information may be released without consent, which categories of third parties may receive records without consent, and when the right transitions from parent to eligible student.

FERPAEducation recordsDirectory informationParental rights

Practice question for this objective

Free sampleLimits on Private-Sector Collection and Use of Datamedium

A public high school learns that a current student has posted a credible plan to bring a weapon to campus the next morning. The principal wants to alert local police and the student's parents at once, but the school has not obtained consent to share anything from the student's records. Under FERPA, what is the correct basis for the school to make this disclosure?

  • AThe school may disclose the necessary information to the police and the parents under FERPA's health or safety emergency exception, because the threat is articulable and significant. Correct
  • BThe school must first obtain the parents' written consent because all disclosures of education records require prior signed authorisation from a parent or eligible student.
  • CThe school may disclose the information only after the local police obtain a court order or subpoena directing release of the student's education records.
  • DThe school may disclose the information to the media and the public so the wider community can take protective steps before the next school day.
FERPA permits disclosure of education records without consent to appropriate parties in an articulable health or safety emergency. The health or safety emergency exception lets a school release record information to law enforcement, parents, and medical or public health officials when knowledge of it is necessary to address an articulable and significant threat, deferring to a school's rational judgement about the emergency and the appropriate recipients.

Why A is correct: Correct. Under 34 CFR 99.31(a)(10) and 99.36, a school may disclose personally identifiable information from education records, without consent, to appropriate parties such as law enforcement and parents when needed to protect the health or safety of the student or others in an emergency.

Why B is wrong: Tempting because written consent is FERPA's default rule for most disclosures, but the rule has codified exceptions, and the health or safety emergency provision lets the school act without prior consent when there is an articulable, significant threat.

Why C is wrong: Tempting because subpoenas and court orders are a recognised FERPA disclosure route, but requiring one would defeat the purpose of the emergency exception, which exists precisely so schools can act quickly without waiting for legal process.

Why D is wrong: Tempting because urgency invites broad warning, but the emergency exception limits disclosure to appropriate parties able to protect health or safety, and the Department of Education has stated the media is not such a party.

See more CIPP-US practice questions, answers explained.

More in this domain

Back to all Limits on Private-Sector Collection and Use of Data objectives, or the CIPP-US cert hub.

Examworthy is not affiliated with or endorsed by IAPP. Original, blueprint-aligned practice material only.