The expansive definitions of “education records” and “record” could potentially make almost any
document in any type of media covered by FERPA. “ ‘Record’ means any information recorded in any
way, including, but not limited to, hand writing, print, computer media, video or audio tape, film,
microfilm, and microfiche.” 34 C.F.R. § 99.3. As long as the records are “directly related to a student
and … are maintained by an educational agency or institution or a party acting for the agency or
institution,” 34 C.F.R. § 99.3, the document would be covered by FERPA. Accordingly, there is nothing
about the medium of e-mail that would exempt it from FERPA coverage. However, a particular dispute
concerning e-mails may be whether or not such e-mails are “maintained” by an educational agency or
institution. In Owasso Indep. Sch. Dist. v. Falvo, 534 U.S. 426 (2002), the Supreme Court discussed
maintenance of education records and stated: “The word ‘maintain’ suggests FERPA records will be kept
in a filing cabinet in a records room at the school or on a permanent secure database, perhaps even after
the student is no longer enrolled.” Owasso, 534 U.S. at 433. If indeed the meaning of the word
“maintain” is that limited, there could be a substantial question as to whether or not schools maintain emails to the degree that they are covered under FERPA.
There are, of course, conflicting court decisions on this question. In S.A. v. Tulare Cnty. Office of
Educ., 2009 WL 3296653, 2009 U.S. Dist. LEXIS 88007 (E.D. Cal. Sept. 24, 2009), the court held that the
school district did not “maintain” e-mails sought by parents unless they were printed out and placed in a
student’s permanent file. Relying on the Falvo decision, the court noted that e-mails, like assignments
passing through the hands of students, have a fleeting nature and can be sent, received, read, and deleted
easily. Because there was no maintenance of all e-mails on a central district server (or at least no
evidence of such maintenance), the school district had not violated FERPA by failing to produce all e-mails
which might name the student. In contrast, in State ex rel. ESPN, Inc. v. Ohio State University, 970 N.E.2d
939 (Ohio 2012), the Ohio Supreme Court found that the school’s e-mails were protected by FERPA if
they contained information directly related to a student and were maintained by the university. Ohio
State retained all e-mails sent by its staff on a central server. Once a staff person sent an e-mail, it could
not be deleted. It also maintained all e-mails in two secure files. Therefore, the Ohio State e-mails were
protected by FERPA, although the university was required to provide access to the e-mails after
redaction of personally identifiable information.
Such conflicting decisions, without any guidance from your state’s controlling courts, leave
schools with some options for how they treat e-mails. Whichever option(s) a school chooses, the
school must comply with state law, which may have retention requirements separate and apart from
FERPA. If a school “maintains” all e-mails, its records are covered by FERPA, and schools must comply
Your Top Ten FERPA Questions - Asked and (Hopefully) Answered
Copyright 2014 © National School Boards Association. All Rights Reserved. 5
with its administrative requirements. If the school does not maintain such e-mails, the documents, even if
retrievable from a school’s computer system, may have lost the protections of FERPA and production
may be required under other laws.2 It is doubtful FPCO would agree with that position if asked.
Until further guidance is available from FPCO or the courts, it is best to realize that e-mails are
not categorically excluded under the definition of “records” under FERPA, but such records must still be
directly related to a student and maintained by the school in order to covered under FERPA.
One additional resource in the e-mail question which makes for interesting reading is Letter to
Anonymous, 113 LRP 35711, 16 FAB 41 (FPCO 06/11/13). FPCO was asked to review an allegation of a
FERPA violation raised by a school board member. During a Board meeting, Board Member No. 1 (the
alleged violator) made comments to a fellow Board Member No. 2 (the complainant) during the open
session of a Board meeting. Board Member No. 1 made a comment concerning Board Member No. 2’s
e-mails to Board Member No. 1 when Board Member No. 2’s son was a student in Board Member No.
1’s class. (Apparently Board Member No. 2 was a teacher at the time of the alleged conduct, and was a
Board member at the time of the alleged FERPA violation). Violator said “ … and [you] when your son, [
] was in my class you wrote a very negative e-mail about [ ] situation on the bike trip because there were
no bathrooms for him.”
The Complainant took offense to this comment and complained to FPCO about this alleged
violation of FERPA. However, FPCO stated that if a school official disclosed information that was a result
of the official’s personal knowledge or observation, such information was not protected under FERPA.
Accordingly, FPCO would not take further action on the complaint. We suppose that FPCO could not
determine if the stated information came from personal knowledge or from the e-mail. However, since
we are not sure yet if e-mails are protected by FERPA, this interesting letter might be used to argue that
the e-mail was not an education record.
It is worth remembering that FERPA is intended to prohibit the unauthorized disclosure of
personally identifiable information from education records. This principle will apply without regard to the
format of the record. If your school is communicating about students through e-mail or any other form
of electronic media, appropriate care must be taken not to make an unauthorized disclosure of such
information. If e-mails are maintained in a central server, there is little question that they are being
“maintained” by the school, and that the school must protect against unauthorized disclosures. If e-mails
are printed out and placed in a student file, FERPA’s protection and regulations will apply. If the school
chooses not to maintain its e-mails in a centralized database, it must still be concerned with the
disclosure, or deletion, of important educational information about students without supervision,
limitation, or control.