Educational records are created and maintained by University offices to facilitate the educational development of students. These records are kept confidential in accordance with the Family Educational Rights and Privacy Act (FERPA) of 1974. Faculty and staff members may also keep informal records relating to their functional responsibilities with individual students that are not classified as “education records.”

FERPA identifies the rights of students and their families with respect to student educational records maintained by institutions. The following information provides operational procedures for certain aspects of FERPA-related policies at Golden Gate University.

What is FERPA?

FERPA is the Family Educational Rights and Privacy Act and is a federal law that protects the privacy of student education records. All educational institutions that receive federal funding must comply with FERPA.

Why should FERPA be important to me?

If you’re a student, it’s important for you to understand your rights under FERPA. If you’re a parent, you’ll need to understand how the law changes once your student enters a post-secondary institution. If you’re an employee of GGU with access to student education records, you’re obligated to comply with FERPA and to protect those records according to the law.

What are students’ rights under FERPA?

FERPA gives students four basic rights with respect to their education record:

• The right to control disclosure of their education record
• The right to review their education record
• The right to request amendment of inaccurate or misleading portions of their education record.
• The right to file a complaint regarding non-compliance of FERPA with the Family Policy Compliance Office of the U.S. Department of Education

What are “education records”?

Education records are defined as records, files, documents, and other materials that contain information directly related to a student and are maintained by GGU or by a person acting for the University. Education records take many forms, including paper and electronic. Education records include:

• Names, date of birth, GGU ID number, Social Security number
• Courses enrolled and grades earned
• Student schedules
• Degrees, certificates, and honors awarded
• Disciplinary records (both academic and code of conduct)
• Student financial records
• Payroll records for employees who are employed as a direct result of their status as students (e.g. work study, teaching assistants)

Why does GGU request my Social Security number?

GGU is committed to maintaining the privacy and confidentiality of the student’s Social Security number. The Social Security number is requested at the time of application to the University, but is used in a very limited and controlled manner, primarily to certify students for Federal Student Aid or to assist in the deferment or pre-existing federal student loans. The primary student identification number used to conduct University business is the GGU ID, which is assigned at the time the student first applies to GGU.

Are there any records that are not considered education records?

The following records are excluded from the definition of education records:

• “Sole possession” records made by faculty and staff for their own use as reference or memory aids and not shared with others
• Personal observations
• Mental health records used only for the treatment of the student
• Alumni records
• Peer graded papers and exams prior to the grade being recorded in the instructor’s grade book

Are student-related comments and notes covered by FERPA?

There are many offices at GGU that record comments and notes regarding students. These may be kept in the student file in a department or college. It is important for anyone recording notes regarding an interaction with a student to understand that unless these notes fall into the category of “sole possession” records (see definition above), then they are part of the student’s education record and subject to FERPA. Since FERPA gives the student the right to review any or all of his/her education record, these notes could be included in that review. Therefore, it is important that notes or comments be factual and objective and that University employees who are recording notes or comments avoid making value judgments or using inappropriate language.

What does the law mean when it says that students have the right to control disclosure of their education records?

It means that a student’s education records may be disclosed only with the student’s prior written consent. The prior written consent must:

• Specify the records to be released
• State the purpose of the disclosure
• Identify the party(ies) to whom disclosure may be made
• Be signed and dated by the student

Does “written consent” have to be collected on paper?

No. In recent years, the U.S. Department of Education has clarified that an electronic signature may substitute for a written one. In order to qualify as an electronic signature, appropriate authentication must occur. GGU’s myGGU Portal satisfies the requirements for an electronic signature. Since students must log in to GGU’s email system using their myGGU Portal account, an email message from a student’s @ggu.edu email address satisfies FERPA’s written consent requirement. However because security measures for other email systems are not as strict, an email received from a Gmail, Yahoo mail, or AOL email account would NOT qualify as written consent.

Are there any conditions under which student education records may be disclosed without the student’s consent?

Yes, FERPA does contain some exceptions to the written consent rule. Those exceptions allow disclosure without consent:

• To University officials (including third parties under contract) with legitimate educational interests
• To comply with a judicial order or lawfully issued subpoena
• To appropriate parties in a health or safety emergency in order to protect the student or others
• To parents in cases of drug or alcohol violation when the student is under the age of 21
• To the provider or creator of a record to verify the validity of that record (e.g. in cases of suspected fraud)
• To organizations conducting research studies on behalf of the University, provided there is a written agreement between the University and the research organization
• To officials at an institution in which the student seeks or intends to enroll or is currently enrolled

Who are “University officials”?

“University officials” are Uuniversity employees with general or specific responsibility for promoting the educational objectives of the University or third parties under contract with the University to provide professional, business and similar administrative services related to the University’s educational mission. Individuals whose responsibilities place them within this category include instructors; faculty advisers; admissions counselors; academic advisers; counselors; employment placement personnel; deans, department chairpersons, directors, and other administrative officials responsible for some part of the academic enterprise or one of the supporting activities; development officers; staff in Alumni Relations; administrative and faculty sponsors of officially recognized clubs, organizations, etc.; members, including students and alumni, of official college (or University) committees; staff personnel employed to assist University officials in discharging professional responsibilities; and persons or entities under contract to the University to provide a specific task or service related to the University’s educational mission.

What constitutes “legitimate educational interest”?

FERPA permits university employees to have access to student education records in which they have “legitimate educational interest.” Such access does not require prior written consent of the student. What constitutes “legitimate educational interest”? Essentially, legitimate educational interest is necessary for employees to carry out their responsibilities in support of GGU’s educational mission. Employees can also think of legitimate educational interest as a “need to know” that is essential to carrying out their job responsibilities related to education.

It is important to understand several points related to “legitimate educational interest”

• Curiosity is not a legitimate educational interest. Just because an employee has access to the student information system, and is able to view the record of a colleague’s child, does not mean that they have a legitimate educational interest in his/her education records.
• Simply the fact that one is a university employee does not constitute legitimate educational interest. An employee’s need to know must be related to their job responsibilities in support of the university’s educational mission. In other words, records should be used only in the context of official business in conjunction with the educational success of the student.
• An employee’s legitimate educational interest is limited to the school or academic unit where she/he works. Access to information does not authorize unrestricted use.

Is there any student information that can be released without the student’s permission?

FERPA permits each institution to define a class of information as “directory information.” FERPA permits public disclosure of directory information without the student’s consent. You may view a list of GGU’s directory information items below.

What is directory information?

Directory information is information contained in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed. You may view a list of GGU’s directory information items below.

Is the University required to release a student’s directory information?

No. The only required disclosure of education records is to the student. All other disclosures, including those with student consent and disclosures of directory information, are at the discretion of the institution. The University does not provide mailing lists to any third party for either commercial use or for solicitation of any product or service.

Can a student prevent the release of their directory information?

FERPA requires each institution to allow students to prohibit disclosure of their directory information. At GGU, we refer to this action as a “privacy” hold. The following are consequences of a student placing a privacy hold on their record:

• Student name will not appear in the commencement program
• Verification of enrollment, graduation, or degrees/certificates awarded will not be provided to third parties, including potential employers and insurance companies
• No information will be released to any person over the telephone or via email.

Requests for confidentiality are permanent until removed in writing by the student.

When do student’s FERPA rights begin?

According to the law, a person becomes a student for purposes of FERPA when they are “in attendance” at an institution. This includes attendance in person or remotely by web conference, Internet, or other electronic and telecommunications technologies. At GGU, we define a student as someone currently or previously enrolled in any academic offering (e.g., course section or class) of the University. This does not include prospective students or applicants to any academic program of the University.
According to GGU policy, FERPA becomes effective on the first day of classes for those newly admitted students who have registered for at least one course. A student who accepted an admission offer but did not register for at least one course, or a newly admitted student who canceled his/her registration either before or after the semester begins, is not covered by FERPA.

What is the Solomon Amendment and how does it relate to FERPA?

Solomon Amendment is a federal law that allows military recruiters to access some address, biographical and academic program information on students age 17 and older who have not filed FERPA requests to withhold directory information. The U.S. Department of Education has determined the Solomon Amendment supersedes most elements of FERPA. An institution is therefore obligated to release data included in the list of “student recruiting infor­mation,” which may or may not match GGU’s FERPA directory information list. Information is released for students who are native, naturalized, or permanent residents of the US only. Information is release for students who are enrolled in the current semester, or the previous semester, depending on the instructions provided by the requestor.

“Student Recruitment Information” or “Solomon Information” Items:

• Name
• Address
• Telephone number
• myGGU Email Address
• Age
• Career (e.g., undergraduate, graduate, professional)
• Class Level (e.g., freshman, first-year law)
• Academic major

Do parents have any rights under FERPA?

In primary and secondary educational institutions (i.e. K-12), all FERPA rights belong to the parent. However, when the student reaches the age of 18 or begins to attend a post-secondary institution regardless of age, all FERPA rights transfer to the student. For GGU students, the FERPA rights belong to the students, not the parents.

The Family Education Rights and Privacy Act (FERPA) defines “directory information” as the information contained in students’ education records that would not generally be considered harmful or an invasion of privacy if disclosed to third parties without the students’ written consent. Directory information can never include the following: social security number, birth date, gender, citizenship, race/ethnicity, grades or grade-point-average (GPA), or class schedule. The law requires institutions to give public notice to students of the categories of information it has designated as directory information.

Golden Gate University does not typically disclose students’ directory information to outside organizations or persons. However, the university has designated the following categories of student records as “directory information” and at its discretion may release this information to third parties without students’ written consent:

• Full legal names
• Chosen names
• Preferred pronouns
• Address
• Telephone number
• Email address
• Dates of attendance
• Enrollment status
• Program of study and concentration(s)
• Anticipated completion date
• Participation in officially recognized activities
• Awards
• Honors (including dean’s list)
• Degree(s) earned and date(s) conferred
• ID card photograph

As required by Section 99.37 of the FERPA regulations, this serves as annual public notice of which student records Golden Gate University classifies as “directory information.” Students have the right to withhold all “directory information,” but must notify the registrar in writing by completion and submission of the Request to Withhold Directory Information form. Once a withhold request is placed on a student’s record, it will remain in effect until and unless the student removes it by submission of a written request to the registrar.

I’ve found an interesting new online tool that I’d like to use as part of my class. Is it permissible to upload my class roster to the vendor’s website so that students can login to the site?

There are many vendors offering services to streamline and improve instruction. But, if a university is providing non-directory information to these vendors (and since class enrollment is not directory information and uploading a class roster constitutes a release of non-directory information), then FERPA applies. Compliance with FERPA requires either the consent of every student prior to releasing his/her non-directory information to the vendor, or that a contract is in place between GGU and the vendor. If an instructor is considering using any vendor product that requires student information, then the instructor must first check with ITS at itservicedesk@ggu.edu to see if an appropriate contract is in place between GGU and the vendor.

Do University employees have to obtain the student’s permission before reviewing a student’s education record?

“University officials” are permitted access to student education records without student consent as long as those officials have a “legitimate educational interest” in that student’s record. See above for definitions of these terms.

The Family Educational Rights and Privacy Act (FERPA) and the California Education Code afford “eligible students” certain rights with respect to their education records. Eligible students are those who are or have been in attendance at Golden Gate University. These rights include:

1. The right to inspect and review the student’s education records within 45 days of the date the university receives a request for access. A student should submit to the registrar, dean, head of the academic department, or other appropriate official, a written request that identifies the record(s) the student wishes to inspect. The school official will make arrangements for access and will notify the student of the time and place where the records may be inspected. If the records are not maintained by the school official to whom the request was submitted, the official shall advise the student of the correct official to whom the request should be addressed. If the student cannot inspect the records at Golden Gate University’s San Francisco campus, copies of the records will be made available by regular mail at the cost of $0.25 per page, upon satisfactory proof of the student’s identity.
2. The right to request the amendment of a student’s education records that the student believes is inaccurate, misleading, or otherwise in violation of the student’s privacy rights under FERPA. A student who wishes to ask the school to amend a record should write the school official responsible for the record, clearly identify the part of the record the student wants changed, and specify why it should be changed. If the University decides not to amend the record as requested, the University will notify the student in writing of the decision and the student’s right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing.
3. The right to provide written consent before the University discloses personally identifiable information (PII) from students’ education records, except to the extent that FERPA authorizes disclosure without consent FERPA contains various exceptions to the general rule that the University should not disclose education records without seeking the prior written consent of the student. The following circumstances are representative of those in which education records may be disclosed without the student’s prior written consent:
   1. The University may release directory information upon request. Directory information is information that is not generally considered harmful or an invasion of privacy if disclosed. See the Directory Information section of this page for more information.
   2. School officials who have a legitimate educational interest in a student’s education record may review it. A school official is a person employed by Golden Gate University in an administrative, supervisory, academic, research, or support staff position; a person serving on the board of trustees; or a student serving on an official committee, such as a disciplinary or grievance committee. A school official also may include a volunteer or contractor outside the University who performs an institutional service or function for which the University would otherwise use its own employees and who is under the direct control of the University with respect to the use and maintenance of PII from education records, such as an attorney, auditor, or collection agency or a student volunteering to assist another school official in preforming his or her duties. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the University.
   3. The University discloses education records without consent to officials of another school, in which a student seeks or intends to enroll, upon request of officials at that other school.
   4. The University may inform persons including either parent(s) or guardian(s) when disclosure of the information is necessary to protect the health or safety of the student or other persons.
   5. The University must provide records in response to lawfully issued subpoenas, or as otherwise compelled by legal process.
4. The right to file a complaint with the US Department of Education concerning alleged failures by the University to comply with the requirements of FERPA. The name and address of the office that administers FERPA is:

Family Policy Compliance Office
US Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-5920

• Request to Withhold Directory Information
• Student Information Release Authorization