Skip to main content

University Policy 72

Family Educational Rights and Privacy Act (FERPA or Buckley Amendment)

Initially approved: September 1, 2000
Revised: September 23, 2009
Revised: August 15, 2011
Revised: November 15, 2022

Policy Topic: Governance and Administration; Student Activities and Services
Administering Office: Registrar's Office, Office of Legal Counsel and Institutional Integrity

 

I. POLICY STATEMENT

Western Carolina University (“WCU” or the “University”) adheres to a policy of compliance with the Family Educational Rights and Privacy Act of 1974, also known as the Buckley Amendment or FERPA, which affords the following rights to students with regard to their education records:

  1. to inspect and review the student’s education records;
  2. to consent to disclosure of the student’s education records to third parties, except to the extent that FERPA authorizes disclosure without consent;
  3. to request amendment of the student’s education records to ensure that they are not inaccurate or misleading;
  4. to be notified of the student’s privacy rights under FERPA; and
  5. to file a complaint with the U.S. Department of Education concerning alleged failures by the University to comply with the requirements of FERPA.

II. DEFINITIONS

A "student" is defined as a person who (1) has applied, been accepted, and has registered for classes at the University, at either the graduate or undergraduate level; (2) is currently attending the University; or (3) has attended the University. “Student” does not include a person who has been admitted but did not attend the University.[1]

For purposes of this policy, the terms “attending” or “attended” means attendance in person or by paper correspondence, videoconference, satellite, Internet, or other electronic information and telecommunications technologies, as well as the period during which a student is working under a University work-study program. 

“Education records” are defined as those records directly related to a student and maintained by the University or by a party acting for the University. “Education records” do not include the following:

  1. Records of instructional, supervisory, administrative, and certain educational personnel that are in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other individual except a temporary substitute for the maker of the record (e.g., file notes of conversations);
  2. Records created and maintained by University Police for the purpose of law enforcement, including law enforcement records that are part of a student conduct investigation;
  3. Records relating to individuals who are employed by the University that are made and maintained in the normal course of business, relate exclusively to individuals in their capacity as employees, and are not available for use for any other purpose;
  4. Student medical and counseling records created, maintained, and used by a physician, psychologist or other professional that are used only in connection with the provision of medical treatment and/or counseling to the student and are not disclosed to anyone other than individuals providing such treatment/counseling;
  5. Records created or received by WCU after a student is no longer a student in attendance and are not directly related to the student’s attendance (i.e., alumni records); and
  6. Grades on peer-graded papers before they are collected and recorded by the instructor of record.

Records not considered “education records” under this Policy may still be confidential under State or Federal law or other University Policy. 

“Directory Information” means information contained in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed. At WCU, “Directory Information” is defined as:

  1. Student name
  2. Local and home address
  3. Telephone number
  4. Classification (i.e., freshman, sophomore, junior, senior, graduate student)
  5. The name of the student’s parent/guardian
  6. Home county
  7. Major field of study
  8. Photographs
  9. Dates of attendance
  10. Degrees awarded by the University
  11. Honors and awards received
  12. The most recent previous educational agency or institution attended by the student
  13. Participation in officially recognized activities and sports
  14. Weight and height of members of athletic teams
  15. University electronic mail (E-mail) address

“Directory Information” does not include a student’s Social Security number or a student’s WCU identification number (i.e., “92-number”).

“Personally Identifiable Information” includes, but is not limited to:

  1. the student’s name;
  2. the name of the student’s parent or other family members;
  3. the permanent address of the student or student’s family;
  4. a personal identifier such as a Social Security number, “92-number”, or biometric record;
  5. other indirect identifiers such as the student’s date of birth, place of birth, and mother’s maiden name;
  6. other information that, alone or in combination, is linked or linkable to a specific student, which would allow a person to identify the student with reasonable certainty; and
  7. information requested by a person whom the University reasonably believes knows the identity of the student to whom the education record relates.

III. DISCLOSURE OF EDUCATION RECORDS

FERPA provides students with the right to inspect and review information contained in their education records, except as provided below. University officials shall consult with the Office of Legal Counsel prior to providing copies of education records to students or third parties.

  1. Disclosure to the Student

    Students wishing to inspect their education records must make written requests (including by email) to the University official responsible for maintaining the records, listing the record(s) of interest. Student education records are generally maintained electronically unless otherwise noted. The student records maintained by the University are classified as follows:
    1. Official academic records are maintained by the Office of the Registrar and include admission applications, data, and associated documentation; the registration records for each semester in residence; and the records of grades and credits received in courses at this University or accepted here from another institution, including academic transcripts. 
    2. Other records directly relating to academic progress and status may be maintained by the Office of Student Retention. 
    3. Student support records, including academic advising records, are housed electronically in the Educational Advisory Board’s Navigate Student Success (“Navigate”) platform maintained by the Advising Center. 
    4. The Dean of each school/college is the official custodian of records for all school/college and departmental records regarding students that are not maintained by other departments. Deans will work with department heads and faculty in their school/college to gather all academic records for inspection by students, which includes advising, registration notes, and appointment summaries.
    5. disciplinary records are maintained under the authority of the Vice Chancellor for Student Affairs and include information about the investigation, adjudication, and imposition of sanctions by the University against a student for breach of the University’s Code of Student Conduct or other written policies.
    6. Financial records are maintained electronically by the Student Accounts Office. Financial aid application records, including tax forms, are maintained by the Financial Aid Office.
    7. Employment records of students receiving financial aid (such as work-study authorizations) are maintained by the Financial Aid Office. Non-work-study employment records of students are maintained electronically by Human Resources and Payroll. Graduate student teaching and research appointment records are maintained electronically by the Graduate School.

If a student is unsure as to the location of a particular record, a written request should be addressed to the Office of the Registrar, listing the item or items of interest. 

The requested records will be made available within forty-five (45) days of receipt of the request if they are covered by FERPA. Generally, students may have copies of their education records, subject to the fee and service charge provisions in this policy, if circumstances make on-site inspection impractical, and the student is in good standing (i.e., no financial, academic, or conduct “hold” has been placed on the record by a University official). 

Students may not inspect and review the following records/information:

    1. Financial information submitted by their parents;
    2. Confidential letters and recommendations associated with admissions, employment or job placement, or honors to which they have waived their rights of inspection and review;
    3. Education records containing information about more than one student, in which case the University will permit access only to that part of the record which pertains to the inquiring student;
    4. Admissions information and application materials related to applicants who were denied admission to the University; or
    5. Other records that are excluded from FERPA.

  2. Disclosure without Student Consent
    The University will not disclose any information from a student’s education records without the student’s prior written consent, except as provided below. The University will use reasonable methods to identify and authenticate the identity of parents, students, University officials, and other parties to whom Personally Identifiable Information is disclosed.

    Disclosure without student consent is permitted under the following circumstances:

    1. University Officials/Outsourcing. University officials with legitimate educational interests in the student’s education records are allowed access to student education records. For purposes of this policy, “legitimate educational interests” means the University official needs to review the education record in order to fulfill his/her professional responsibilities for the University. University officials who may have access to education records for legitimate educational interests include the following individuals:
      1. a person employed by the University in an administrative, supervisory, academic or research, or support staff position, including health, medical, and counseling staff;
      2. a member of the Board of Trustees;
      3. a person or entity engaged or employed by or under contract with the University to perform special services, such as an attorney, attorney’s agent, auditor, or contractor;
      4. a person who is employed by the University Police;
      5. a student serving on an official committee, such as a disciplinary or grievance committee, or who is assisting another University official in performing his/her tasks; and
      6. contractors, consultants, volunteers, and other outside service providers used by and under the direct control of the University to perform services that the University would otherwise provide with its own employees.

        Disclosure of education records to a University official having a legitimate educational interest does not authorize the official to subsequently re-release all or any part of the records to another party. An unauthorized disclosure of Personally Identifiable Information from the education records of the student is prohibited. Public posting of grades by instructors is strictly prohibited.

        The University will implement physical, technological access, and administrative controls to ensure that access to educational records is appropriately limited in compliance with the legitimate educational interest requirement of FERPA. Administrative controls include all applicable Division of Information Technology computing systems and devices policies and procedures, as well as policies adopted by the University Data Security and Stewardship Committee.

    2. Other Institutions. The University may release a student’s education records to officials of other educational institutions in which that student seeks or intends to enroll, or where the student is already enrolled so long as disclosure is related to the student’s enrollment or transfer. Additionally, the University may return records to the creator of the records to verify authenticity.
    3. State or Federal Supported Programs. The University may disclose records to the U.S. Comptroller General, U.S. Attorney General, the Secretary of the Department of Education, or State and local educational authorities, including the State auditor, in connection with an audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with those programs.
    4. Financial Aid. The University may disclose a student’s education records to persons or organizations in connection with that student’s application for or receipt of financial aid, but only to the extent necessary for such purposes as determining eligibility, amount, conditions, and enforcement of terms or conditions of such financial aid.
    5. Institutional Studies. The University may disclose education records under certain circumstances to organizations conducting studies for, or on behalf of, educational agencies or institutions to (i) develop, validate, or administer predictive tests; (ii) administer student aid programs; or (iii) improve instruction. Records disclosed under this provision: (i) must not permit identification of either a student or parent except to those having a legitimate interest in the information; (ii) must be destroyed when no longer needed; and (iii) must be disclosed pursuant to a written agreement that specifies the purpose, scope, and duration of the study, as well as addresses the limitation on the disclosure of Personally Identifying Information. Disclosures made pursuant to this exception must be made through the Office of Institutional Planning and Effectiveness, which will coordinate with the University Institutional Review Board and other units as necessary.
    6. Accreditation Agencies. The University may release a student’s education records to accreditation organizations or agencies for purposes necessary to carry out their accreditation functions.
    7. Court Orders/Ex Parte Orders. Information concerning a student shall be released in response to a judicial order or lawfully issued subpoena. The University will make reasonable efforts to notify the student of a subpoena before complying with it, except that the University shall not notify a student of a subpoena if it is from a federal grand jury or is for law enforcement purposes, and it provides that the University shall not disclose to any person the existence or contents of the subpoena or any information furnished in response to the subpoena. The University shall not notify a student of an ex parte court order is obtained by the U.S. Attorney General concerning Patriot Act investigations and prosecutions. Disclosures made under this section must be coordinated with the Office of Legal Counsel.
    8. Litigation. If the University initiates legal action against a parent or student, or if a parent or student initiates legal action against the University, the University may disclose to the court, without a court order or subpoena, the education records of the student that are relevant for the University to proceed with the legal action as plaintiff or to defend itself in such legal action.
    9. Health and Safety Emergencies. The University may disclose Personally Identifiable Information (“PII”) from an education record to appropriate parties, including parents, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals. This exception is limited to the period of the emergency and generally does not permit a blanket release of PII from a student’s education records. Disclosures made under this Section shall be coordinated with the Vice Chancellor for Student Affairs.
    10. Directory Information. At its discretion, the University may disclose Directory Information without student consent unless a student submits a written request to the Registrar to withhold such information from disclosure. Students may withhold Directory Information by notifying the Registrar's Office in writing within five working days from the first day of classes for any semester. Requests for non-disclosure of Directory Information will be honored indefinitely unless the student submits to the Registrar a written revocation of such request for non-disclosure. Students are warned, however, prior to making a decision to withhold Directory Information , that undesirable consequences frequently occur, such as names of students on the Dean's List are not published, names are not listed in commencement bulletins, and requests from prospective employers are denied. The University will continue to honor a former student’s opt-out request unless and until the request is revoked by the former student. Any opt-out request made under this Section shall not prohibit the disclosure of identifying information in class.
    11. Student Conduct Hearing Results
      1. Disclosure to Victims: When requested in writing, the University must disclose to an alleged victim (or if the victim is deceased as a result of such crime or offense, to the next-of-kin) of any crime of violence, or a non-forcible sex offense (as those terms are defined by the implementing regulations of FERPA), the final results of any student conduct proceeding conducted by the University against the alleged perpetrator or Respondent of such crime or offense, regardless of whether the alleged perpetrator was found responsible for violating the University’s rules or policies with respect to such crime or offense. There is no prohibition on re-disclosure.
      2. Disclosure to Third Parties: The University must disclose the final results of any student conduct proceeding against a student who is an alleged perpetrator of any crime of violence or non-forcible sex offense (as those terms are defined in the implementing regulations of FERPA), if the student is found responsible for violating the University's rules or policies with respect to such crime or offense.[2] Such disclosure shall include only the name of the student, the violation committed, and any sanction imposed by the University on that student. Such disclosure shall not include the name of any other student, such as a victim or witness, without the prior written consent of that student. 
    12. Alcohol and Drug Violations. The University may disclose to a parent or legal guardian of a student, information regarding any violation of any Federal, State, or local law, or of any rule or policy of the University, governing the use or possession of alcohol or a controlled substance, regardless of whether that information is contained in the student's education records, if the student is under the age of 21 at the time of disclosure to the parent, and the University determines that the student is responsible for a student conduct violation with respect to such use or possession.
    13. Sex Offenders. The University may disclose information concerning sex offenders and other individuals as required or permitted by applicable State law and the Violent Crime Control and Law Enforcement Act of 1994 if the information was provided to the University under applicable Federal guidelines.
    14. De-identified Records and Information. The University may disclose records or information without student consent after the removal of all Personally Identifiable Information, in compliance with FERPA implementing regulations.
  3. Disclosure with Student Consent

    In all other cases, the University will not disclose Personally Identifiable Information in education records or allow access to those records without signed and dated written consent of the student. Such consent must specify the records to be disclosed, the party to whom the records are to be disclosed, and the purpose of the disclosure. “Signed and dated written consent” may include a record and signature in electronic form that: (1) identifies and authenticates a particular person as the source of the electronic consent; and (2) indicates such person’s approval of the information contained in the electronic consent. A student may satisfy the consent requirement by establishing other individual(s) as a proxy, which may include phone and online disclosure options. Information on setting up proxy access can be found on the University’s FERPA webpage at http://ferpa.wcu.edu. 
  4. Record of Disclosures

    The Office of the Registrar shall maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student when required. A record is not required if the request was from, or the disclosure was to: 

    1. the student;
    2. a party with written consent from the student or the parent of a dependent student;
    3. University officials who have a legitimate educational interest;
    4. a party seeking Directory Information;
    5. a party seeking or receiving the records as directed by a Federal grand jury or other law enforcement subpoena when the issuing court or other issuing agency has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed; or
    6. a party seeking or receiving records in accordance with the U.S. Patriot Act.

      The Office of the Registrar will maintain a record of each request for access to and each disclosure of education records, as well as the names of State and local educational authorities and Federal officials and agencies referenced in Section III.B.3 above, and will maintain such records with the education records of the student as long as the records are maintained. For each such request or disclosure the record must include: (1) the parties who have requested or received Personally Identifiable Information from the education records; and (2) the legitimate interests the parties had in requesting or obtaining the information.

      The University must obtain a copy of a record of further disclosures made by State and local educational authorities and Federal officials and agencies referenced in Section III.B.3 above.  The Vice Chancellor for Student Affairs must record the following information in connection with the health and safety exception referenced in Section III.B.9 above: (i) the articulable and significant threat to the health or safety of a student or other individual; and (ii) the parties to whom the University disclosed information.

  5. Records of Deceased Students

    The University does not release educational records of a deceased student unless: (1) authorized by the executor/executrix of the deceased student's estate; (2) authorized by the deceased student's parents if no executor/executrix has been appointed; or (3) death is established by a certified copy of a death certificate.

IV. REQUESTS TO AMEND RECORDS

If a student believes his/her education record is inaccurate or misleading, the first step is to discuss the concern with the person who maintains the record. This does not apply to grade disputes (although it may be used to correct a clerical error in grades). If the record keeper does not agree with the student, the record keeper will inform the student of the right to a formal hearing.

A student must request a formal hearing within fifteen (15) business days from the date the student is informed by the record keeper of the right to a hearing. The request must be in writing, and must be delivered to the Vice Chancellor or Dean to whom the record keeper ultimately reports.

The University official who receives the formal hearing request shall either hear the case personally or designate a person or persons to hear it, provided that those who hear the case do not have a direct interest in the outcome of the hearing. Within a reasonable period of time after the request for hearing, the student shall be informed in writing of the date, place, and time of the hearing. The student may present evidence relevant to the issues raised and may be assisted at the hearing by one or more persons of his/her choice, and/or represented by an attorney at his/her expense.

The person(s) hearing the case shall decide it solely on the basis of the evidence presented at the hearing. The decision shall be in writing, delivered to all parties, and will summarize the evidence and state the reason(s) for the decision. If the decision is in favor of the student, the education records will be amended accordingly. If the decision is unsatisfactory to the student, he or she may place with the education record a statement commenting on the information in the records or setting forth any reasons for disagreement with the decision. Such statements will be maintained as part of the student’s education record and released with the record anytime it is disclosed to third parties.

The decision of the person(s) hearing the case is final. A student who believes that the outcome of a hearing to amend his or her education records was unfair or not in keeping with the provisions of FERPA may file a complaint in accordance with Section VI of this policy.

V. COMPLAINTS

Students who believe that the adjudication of their challenges were unfair or not in keeping with the provisions of FERPA or that their rights have been abridged, may file complaints with the Family Policy Compliance Office, US Department of Education, 400 Maryland Avenue, SW, Washington, D.C. 20202-5920 concerning the alleged failures of the University to comply with FERPA.

VI. NOTICE

The University provides official notice to students of their rights under FERPA by publishing such notice in the Graduate and Undergraduate Catalogs (http://catalog.wcu.edu), and in financial aid consumer disclosures sent annually by email.

 

VIII. POLICY REVIEW

This policy shall be reviewed and revised as necessary every four (4) years or as necessitated by amendments to FERPA or its implementing regulations.


 
[1] However, State law (G.S. 132-1.1(f)) provides that personally identifiable information from or about an applicant to a University of North Carolina constituent institution is confidential and not subject to disclosure. Any letter of recommendation or record containing a communication from an elected official to the University concerning an applicant for admission who has not enrolled as a student is a public record and is subject to disclosure.

[2] FERPA permits the disclosure of the information specified in this paragraph; however, the North Carolina Public Records Act (G.S. 132-1 et seq.) requires it. See DTH Media Corp. v. Folt, 259 N.C. App. 61, 816 S.E.2d 518 (2018), review allowed, writ allowed, 371 N.C. 570, 819 S.E.2d 376 (2018), and aff'd, 374 N.C. 292, 841 S.E.2d 251 (2020). 

Office of Web Services