Student Education Records and Privacy Policy (FERPA)

1. Purpose

The Family Educational Rights and Privacy Act of 1974 (“FERPA”), as amended, provides students with specific rights regarding the privacy, access and protection of their Education Records. This Policy outlines those rights and establishes the institutional requirements and compliance structure maintained by the University of Florida (“UF”) to meet its obligations under FERPA and applicable state laws and regulations governing Education Records.

2. Applicability

This Policy applies to UF faculty, staff, contractors, student workers, School Officials, direct support organizations, affiliated legal entities, and any other UF enterprise personnel who maintain, access, or otherwise use Education Records on behalf of UF.

3. Definitions

Attendance means participation in person or by paper correspondence, videoconference, satellite, internet, or other electronic information and telecommunications technologies, and includes the period during which a person is working under a work study program.

Dependent Student means a student who receives more than half of their financial support from a taxpayer. For the specific definition, refer to Section 152 of the Internal Revenue Code.

Directory Information means information available about a student that is not considered harmful or an invasion of privacy if disclosed. While FERPA and state law protect the privacy of Education Records, Directory Information is not treated as confidential and may be disclosed by UF without student consent unless the student requests a Privacy Hold. The most up-to-date list of Directory Information can be found in the UF FERPA Annual Notification. The Office of the University Registrar (“Registrar”) is responsible for publishing and maintaining UF’s Annual Notification, which is published in the UF Undergraduate Catalog. Information designated as Directory Information is subject to change based on determinations of the Registrar.

Disclosure means permitting access to, releasing, transferring, or otherwise communicating Personally Identifiable Information (PII) contained in Education Records to any party other than the party that provided or created the record, by any means, including oral, written, or electronic.

Education Records mean records that are directly related to a student and are maintained, recorded, or retained in any medium for use by UF or its personnel in the course of official business or in carrying out UF’s educational mission. This category includes records that identify a student by name, number, or other direct identifier, or where a student’s identity could reasonably be deduced from the information alone or in combination with other publicly available information.

Education Records include, but are not limited to:

• Biographical information, including date and place of birth, gender, nationality, information about race and ethnicity, and identification photographs
• Grades, test scores, evaluations, courses taken, academic specialization and activities, and official communications regarding a student’s status
• Coursework, including papers and exams, class schedules, as well as written email or recorded communications that are part of the academic process
• Disciplinary records
• Financial aid records
• Internship program records

Education Records do not include:

• Sole Possession Records that are used only as memory aids and not shared with others
• Law enforcement unit records
• Employment records, unless the employment is dependent on the employee’s status as a student (such as evaluations of graduate assistants)
• Treatment records, which are records made or maintained by a physician, psychiatrist, psychologist, or other recognized professional acting in a professional capacity, used only for treatment of the student, and disclosed only to individuals providing the treatment. If a student requests Disclosure to others, they become Education Records
• Records that only contain information about an individual after they are no longer a student at that agency or institution

Family Policy Compliance Office means the office within the U.S. Department of Education responsible for administering and enforcing FERPA at all levels of education. The Family Policy Compliance Office may be contacted at 400 Maryland Avenue SW, Washington, D.C. 20202; Phone: 1-800-872-5327; Email: studentprivacy@ed.gov.

FERPA means the Family Educational Rights and Privacy Act of 1974 (commonly known as the Buckley Amendment), a federal law that protects the privacy of student Education Records and provides students the right to access their own records. The privacy of student records is also governed by Section 1002.225, Florida Statutes.

Legitimate Educational Interest means a School Official’s need to access or review Education Records to fulfill their professional responsibilities at UF. Such responsibilities may include teaching, advising, providing services, conducting disciplinary functions, performing approved research, or carrying out audit and compliance activities in accordance with applicable policies.

Nondirectory Information means information contained in a student’s Education Record that generally cannot be released without the student’s consent. Examples include, but are not limited to:

• Birth date
• Citizenship
• Disciplinary status
• Ethnicity
• Gender
• Grades/exam scores
• GPA (grade point average)
• Marital status
• Religion
• Standardized test scores
• Student photographs or videos
• UFID or social security number

Parent means a natural Parent, a legal guardian, or an individual acting as a Parent in the absence of a Parent or a guardian.

Personally Identifiable Information (PII) means any information, whether Directory or Nondirectory Information, that is linked or linkable to a specific student and that, alone or in combination, would allow a reasonable person within the UF community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. PII includes, but is not limited to: the student’s name; the names of the student’s Parent or other family members; the address of the student or the student’s family; personal identifiers such as a Social Security number, UFID number, or biometric record; other indirect identifiers such as the student’s date of birth, place of birth, and mother’s maiden name; other information that, alone or in combination, is linked or linkable to a specific student and would allow a reasonable person within the UF community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; and information requested by a person who UF reasonably believes knows the identity of the student to whom the Education Record relates.

School Official means an individual acting as an agent of UF or the State University System of Florida in an administrative, supervisory, academic, research, or support staff position; a member of a UF committee, board, or council; a person under contract with UF to perform a specific task or service, such as an attorney or auditor; or a contractor, consultant, volunteer, or other outside party to whom UF has outsourced institutional services or functions, provided that the party is under UF’s direct control regarding the use and maintenance of Education Records and is subject to FERPA’s redisclosure limits.

Sole Possession Records means records kept in the sole possession of the maker that are used only as a personal memory aid and are not accessible or revealed to any other person. Such records are not considered Education Records.

4. Policy Statement

UF is committed to protecting the privacy and confidentiality of student Education Records in compliance with FERPA, as amended, and applicable state laws and regulations. This Policy supports UF’s mission of fostering a learning environment that upholds privacy, integrity, and compliance with governing legal and institutional requirements.

4.1. FERPA Student Rights

4.1.1. Access
a. Under FERPA, an eligible student has the right to inspect and review their Education Records within 45 days after UF receives the request for access.
b. The student must submit the request to the Registrar, UF Privacy Compliance Office (“UF Privacy”), Dean, or chair of the department that maintains the record(s) the student wishes to inspect. UF will make arrangements for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the School Official to whom the request was submitted, that School Official shall inform the student of the appropriate official to whom the request should be directed. The School Official to whom the request was submitted shall contact the Registrar or UF Privacy to help facilitate the process.

4.1.2. Amendment
a. Under FERPA, an eligible student has the right to request that inaccurate or misleading information in their Education Records be amended. The eligible student must submit a written request to UF Privacy, Registrar, Dean, or chair of the department that maintains the record(s) the student wishes to amend, identifying the information believed to be inaccurate or misleading, and explaining the reason for the requested amendment.
b. While UF is not required to amend Education Records in accordance with a student’s request, UF is required to consider the request. If UF decides not to amend a record, UF shall inform the student of their right to a hearing on the matter. Additional information regarding the hearing process will be provided when the student is notified of this right.
c. If UF decides not to amend the record after the hearing, the student has the right to place a statement in the record commenting on the contested information or explaining why they disagree with the decision. UF must maintain the statement as part of the record and disclose it whenever the record is released.
d. The FERPA amendment procedure may not be used to challenge substantive decisions made by UF about an eligible student. Substantive decisions include evaluations of performance or disability, academic or disciplinary judgments, or other such determinations made by UF.

4.1.3. Complaints
a. Individuals have the right to file a complaint with the U.S. Department of Education concerning alleged failures by UF to comply with the requirements of FERPA.
b. Students who suspect that a FERPA violation has occurred should contact the Vice President for Student Life, Registrar or UF Privacy. Complaints may also be submitted directly to the Family Policy Compliance Office within the U.S. Department of Education.

4.1.4. Consent for Disclosure of Education Records
a. Under FERPA, an eligible student has the right to consent to the Disclosure of PII contained in their Education Records, except where FERPA authorizes Disclosure without consent. Recipients of PII disclosed under FERPA exceptions may not redisclose the information without prior consent unless a FERPA exception permits it. UF will include this condition in its Disclosures where required.
b. Under FERPA, UF may not generally disclose PII from an eligible student’s Education Records to a third party unless the eligible student has provided written consent. Written consent must specify the records to be disclosed, the purpose of the Disclosure, and the party or class of parties to whom the Disclosure may be made. The consent must be signed and dated, and electronic signatures are permitted under the federal E-SIGN Act (Electronic Signatures in Global and National Commerce Act).
c. However, there are a number of exceptions to the consent requirement. The following provides general information regarding some of these exceptions. UF may disclose or allow access to Education Records without needing the student’s consent as follows:

i. School Officials, including teachers, provided UF Privacy determines that they have a Legitimate Educational Interest in the information.
ii. Another school in which the student seeks or intends to enroll.
iii. Authorized representatives of the U.S. Secretary of Education, the U.S. Comptroller General, the U.S. Attorney General, or state or local educational authorities for audit, evaluation, and enforcement purposes.
iv. In connection with financial aid for which the student has applied or which the student has received, if the information is necessary for such purposes.
v. Organizations conducting studies for, or on behalf of, UF under a written agreement.
vi. Accrediting organizations to carry out their accrediting functions.
vii. Parents of a Dependent Student as defined in Section 152 of the Internal Revenue Code. UF may require documentation of dependency (e.g., a tax return or signed attestation).
viii. UF must provide Education Records in response to a lawfully issued subpoena or similar legal process. When UF intends to release documents in response to a subpoena, UF will make a reasonable effort to notify the student in advance so the student may seek protective action, unless the subpoena or order is issued by a federal grand jury, is for a law enforcement purpose and orders nondisclosure, or is an ex parte order under applicable law.
ix. Appropriate parties, including Parents of an eligible student, in connection with a health or safety emergency. Disclosure occurs only if there is an articulable and significant threat to the health or safety of a student or other individuals, and only to parties whose knowledge is necessary to protect health or safety.
x. Information that has been appropriately designated as Directory Information.
xi. An alleged victim of a crime of violence or nonforcible sex offense, the results of disciplinary proceedings, and, in certain cases, final results when a student is the offender.
xii. For students under age 21, to the Parents regarding the student’s violation of any federal, state, or local law, or of any UF policy regarding use or possession of alcohol or a controlled substance.
xiii. UF must disclose information in compliance with federal sex-offender notification requirements.

4.2. Institutional FERPA Compliance

4.2.1. Directory Information
a. Directory Information refers to information available about a student that is not considered harmful or an invasion of privacy if disclosed. Directory Information is not treated as confidential and may be disclosed by UF without student consent unless the student requests a Privacy Hold.
b. At UF, the information linked in the Annual Notification has been designated by the Registrar as Directory Information.
c. A student who wishes to restrict release of their Directory Information must submit the Restriction of Directory Information form using the secure upload.

4.2.2. Annual Notification
a. UF shall annually notify students in Attendance of their rights under FERPA. The Registrar is responsible for publishing and maintaining UF’s Annual Notification, which is published in the UF Undergraduate Catalog.

i. The Annual Notification must include information regarding a student’s right to inspect and review their Education Records, the right to seek amendment of those records, the right to a hearing in certain circumstances, the right to consent to the Disclosure of PII from the records (except as otherwise permitted by FERPA), the procedure for opting out of the release of Directory Information, and the right to file a complaint with the Family Policy Compliance Office if the student feels their FERPA rights have been violated.
ii. The Annual Notification shall also inform eligible students of UF’s definitions of the terms School Official and Legitimate Educational Interest.

b. UF provides this Annual Notification in the undergraduate and graduate catalogs.

4.3. Policy Violations

Failure to comply with this Policy may result in disciplinary action in accordance with applicable UF regulations and policies.

5. References and Related Information

• Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g; 34 CFR Part 99.
• Electronic Signatures in Global and National Commerce Act (E-SIGN Act).
• Internal Revenue Code, Section 152.
• Florida Statutes, Section 1002.225.
• Family Policy Compliance Office: 400 Maryland Avenue SW, Washington, D.C. 20202 Phone: 1-800-872-5327; Email: studentprivacy@ed.gov.
• UF Privacy Webpage.
• FERPA Glossary and UF Annual Notification.
• Restriction of Directory Information Form and Secure Upload Portal.

History