Privacy Rights of Students in Education Records

The federal Family Educational Rights and Privacy Act of 1974 (20 U.S.C. 1232g) (FERPA) and regulations adopted thereunder (34 C.F.R. 99) set out requirements designed to protect students' privacy in their educational records maintained by the university. The statute and regulations govern access to certain student records maintained by the university and the release of those records. FERPA provides that the university must give a student access to most records directly related to the student and must also provide an opportunity to correct the records if the student believes the records are inaccurate, misleading, or otherwise inappropriate. The right to petition to correct a record under FERPA does not include the right to challenge the appropriateness of a grade determined by the instructor. In addition, FERPA generally requires the university obtain a student's written consent before releasing personally identifiable data pertaining to the student. The university has adopted a set of policies and procedures governing the implementation of FERPA and its regulations. Copies of these policies and procedures may be obtained on the web at https://registrar.sfsu.edu/privacy or in the Registrar's Office, Student Services Building Room 303. Among the information included in the university statement of policies and procedures is:

1. The student records maintained and the information they contain;
2. The university official responsible for maintaining each record;
3. The location of access lists identifying persons requesting or receiving information from the record;
4. Policies for reviewing and expunging records;
5. Student access rights to their records;
6. Procedure for challenging the content of student records; and
7. The student's right to file a complaint with the Department of Education, which enforces FERPA. The Department of Education has established an office and review board to investigate complaints and adjudicate potential FERPA violations. The designated office is: Student Privacy Policy Office, U.S. Department of Education, 400 Maryland Avenue, SW, Washington, D.C. 20202-5920.

FERPA authorizes the university to provide access to student records without prior student consent to university officials, employees and others who have legitimate educational interests in such access. These persons include those with legitimate reasons to access student records to perform the university's academic, administrative or service functions, and those with a reason for accessing student records associated with their university or other related academic responsibilities. Student records will also be disclosed to the CSU Chancellor's Office to conduct research, to analyze trends, or to provide other administrative services. Student records may also be disclosed without prior student consent to other persons or organizations under certain conditions (e.g., as part of the accreditation or program evaluation, in response to a court order or subpoena, in connection with financial aid, or to other institutions to which the student is transferring).

At SF State

SF State's "directory information" also includes: class or student level (including freshman, sophomore, etc., as well as undergraduate, graduate, etc.); enrollment status details (full-time, part-time, withdrawn, not enrolled); anticipated completion date; photographs of students taken at public University events or in the context of student and campus life; and SFSU ID (Note: Unauthorized users cannot access non-directory information solely with the SFSU ID number). Effective September 2005, "directory information" for student employees in CSU Collective Bargaining Unit 11 also includes: department employed and student employee's status (i.e., TA, GA, ISA, etc.).

Students may also submit a withhold directory information form to prevent the release of any and all "directory information" to any third party. Written objections or withhold directory information forms must be sent to the Registrar's Office, Email: registrar@sfsu.edu.

FERPA does not require release of "directory information." It may be released at the University's discretion. Requests for addresses, telephone numbers, and email addresses may be released for non-commercial use by individuals or organizations outside the University provided the requests have been reviewed and approved by the appropriate University personnel.