PII (Personally Identifiable Information) is any data that can be used to identify an individual, such as name, address, or social security number. Under FERPA (Family Educational Rights and Privacy Act), schools must protect PII in students’ education records by requiring student consent for disclosure, except in specific circumstances like emergencies or when shared with school officials with a “legitimate educational interest”.
PII includes direct identifiers and indirect identifiers that can be linked to a student.
Examples include:
Student’s name
Address
Social Security number
DOB – Date of Birth
Photos
Phone Numbers
Medical Records
Family member’s name
Any other information that can identify a student within the school community
How FERPA protects PII:
Student consent: Schools must generally obtain a student’s written consent before disclosing their PII from education records to a third party.
Exceptions: There are exceptions to the consent requirement, such as:
Disclosing information to other school officials with a “legitimate educational interest,” meaning they need the information to perform their professional responsibilities.
Responding to a judicial order or subpoena.
Sharing information in a health or safety emergency.
Student rights: Eligible students have the right to inspect and review their education records, seek to amend any inaccurate information, and consent to the disclosure of their PII, with the exceptions noted above.
Third-party disclosures: Schools can disclose PII to third parties, such as service providers, but they must ensure those parties comply with FERPA and do not disclose the information further.