Schools Responsibility For Ferpa

Summary

Under FERPA, schools are responsible for protecting student education records, even if disclosed to third-party websites. Schools must take corrective actions to address any improper disclosures. The relevant citation is 34 CFR § 99.33, which mandates that schools ensure data disclosed to third parties is protected and not re-disclosed without consent. For further assistance, consider contacting the California Department of Education or filing a formal complaint.

Full Conversation

In California under FERPA if a school improperly discloses student records that are considered confidential and the student finds out and request the records to be removed from these websites that are mostly third-party website is it the schools responsibility to take action to remove the content and what happens if the website is a third party
Under FERPA (Family Educational Rights and Privacy Act):
- Schools must protect the privacy of student education records.
- If a school improperly discloses such records, they must take action to rectify the situation.
- Schools should contact third-party websites to request removal of the information.
For further assistance, what is your specific location in California?
okay just making sure because when i requested the registrar who is new asked the prncipal for guidance and the principal suggested I contact the websites because they dont control the or maintain the 3rd party websites
Under FERPA, schools are responsible for protecting the privacy of student education records. If a school improperly discloses such records:
- The school must take action to rectify the situation.
- They should request third-party websites to remove the information.
Have you tried contacting the California Department of Education for further assistance?
i have not I was going to respond with the info you just stated in an email but want to cite where it states that. then see if they respond positively. because i thought i read that you wouldnt file a complain or contact unless if youve attempted to solve the situation by all methods
Under FERPA, the U.S. Department of Education states the following:
- Schools must protect the privacy of student education records.
- In case of improper disclosure, schools are responsible for correcting the situation.
- Schools should contact third-party websites to request removal of the information disclosed.
For further assistance, you might want to contact the California Department of Education.

California Department of Education


Phone: *-*-*
Address: * N Street, Sacramento, CA *
Website: www.cde.ca.gov

Have you considered filing a formal complaint with the California Department of Education?
but what is the number or citation of the section
Under FERPA, the relevant citation is:
- *** CFR Part ***: This is the Code of Federal Regulations (CFR) part that implements FERPA.
For your specific query about improper disclosure and third-party websites:
- *** CFR § *.*** outlines the conditions under which schools can disclose student records.
- *** CFR § *.*** details enforcement procedures, including the requirement for schools to correct violations.
Would you like more detailed information on filing a formal complaint with the California Department of Education?
i dont think i could find this but so the regulation states the personal identifiable info may be disclosed under the stated reasons. And that would be inclusive of confidential records
Under FERPA, personal identifiable information (PII) from education records can only be disclosed under specific conditions:
- *** CFR § *.***: Lists the circumstances where PII can be disclosed without consent.
- *** CFR § *.***: Details enforcement procedures for violations.
Would you like guidance on the steps to file a formal complaint?
but i am asking if pii includes confidential records?
Yes, under FERPA, personally identifiable information (PII) includes confidential records. PII encompasses any information that can be used to identify a student, such as:
- Names
- Addresses
- Social Security numbers
- Student ID numbers
Would you like more information on the specific measures a school must take to protect these records?
yes
Under FERPA, schools must take the following measures to protect personally identifiable information (PII) and confidential records:
- **Access Control**: Limit access to student records to authorized personnel only.
- **Training**: Ensure staff are trained on privacy policies and procedures.
- **Contracts**: Include privacy clauses in contracts with third-party vendors.
Would you like more information on how to file a formal complaint if these measures are not followed?
yes and please cite them too
Under FERPA, schools must take specific measures to protect personally identifiable information (PII) and confidential records. The relevant regulations include:
- **Access Control**: Schools should ensure that only authorized personnel have access to student records. This is outlined in *** CFR § *.***.
- **Training**: Schools must ensure their staff are trained on privacy policies and procedures. This is supported by *** CFR § *.***.
- **Contracts**: Schools should include privacy clauses in contracts with third-party vendors. This is reinforced by *** CFR § *.***.
Would you like more detailed information on how to file a formal complaint if these measures are not followed?
Would i Be able to get compensation from the school?
To provide a more accurate response, could you please specify the nature of your issue with the school? For example, is it related to an injury, discrimination, or another matter?
improper disclosure of pii student records
To help you better, could you specify if the improper disclosure was intentional or accidental, and how it has impacted you or your student? This will help determine the potential for compensation.
unintentional by the staff member. The effect of the improper disclosure holds less of an impact then the lack of support and misinformation that led to the unfortunate result of not joining the mens team after my transition. The changed name, photos, and videos from both pre and post transition that can be found by typing either name which reveal my transender status is still harmful nevertheless as i fear my past identity being outed in the private school i work at which ive already seen how they treated someone and outed them and led to them not returning the next year. Also knowing that anyone can find this information gives me great distress because my entire world and life around me thus far sees me for who i am and it just takes one person that doxes someone for that information to spread and damage a persons reputation and opportunities
I'm sorry to hear about your situation. Given the sensitive nature of your issue, here are some steps and legal points to consider in California:
- **Privacy Rights**: California has strong privacy laws under the California Consumer Privacy Act (CCPA) and the California Constitution which might be relevant.
- **FERPA**: If this involves educational records, the Family Educational Rights and Privacy Act (FERPA) might apply.
- **Employment Rights**: California's Fair Employment and Housing Act (FEHA) protects employees from discrimination based on gender identity and expression.

California Department of Fair Employment and Housing (DFEH)


Phone: (*) *-*
Address: * Kausen Drive, Suite *, Elk Grove, CA *
Website: www.dfeh.ca.gov

Would you like more information on how to file a complaint or seek legal recourse?
yes but also while i know a lawyer is going to provide the best answer is this something that i could get money from?
Given your situation, here are some potential avenues for compensation:
- **Privacy Violation**: Under California's CCPA and FERPA, you might have grounds for a claim if your privacy rights were violated.
- **Emotional Distress**: If the disclosure and subsequent events have caused severe emotional distress, you could potentially seek damages.
Would you like more details on filing a complaint or potential legal actions?
can you tell me more about what ccpa is
Certainly! Here are some key points about the California Consumer Privacy Act (CCPA):
- **Rights Provided**: Gives California residents rights to know what personal data is being collected, to whom it is sold, and the ability to access, delete, and opt-out of the sale of their personal information.
- **Scope**: Applies to businesses that collect personal data from California residents and meet certain criteria (e.g., annual gross revenues over $* million).
- **Enforcement**: Violations can lead to penalties by the California Attorney General and private lawsuits in cases of data breaches.
Would you like more details on how to file a complaint under CCPA?
would a school be considered a business?
In the context of the California Consumer Privacy Act (CCPA), a school is generally not considered a business. The CCPA primarily targets for-profit entities. However, schools must comply with other privacy laws such as FERPA.
Would you like more information on FERPA or other applicable laws?
under ferpa can i get money?
Under FERPA, individuals generally cannot receive monetary compensation directly. However, FERPA allows you to file a complaint with the U.S. Department of Education. If the school is found in violation, they could face penalties and be required to take corrective actions.
Would you like guidance on how to file a FERPA complaint?
which part says 3rd party websites included again?
The California Consumer Privacy Act (CCPA) grants certain rights concerning personal data for California residents, which include:
- **Rights Provided**:
- Right to know what personal data is being collected.
- Right to know to whom it is sold.
- Right to access, delete, and opt-out of the sale of their personal information.
- **Scope**:
- The CCPA applies to businesses that collect personal data from California residents and meet specific criteria (e.g., annual gross revenues over $* million).
- **Enforcement**:
- Violations can result in penalties by the California Attorney General and private lawsuits in cases of data breaches.
Would you like more details on how to file a complaint under CCPA?
no about ferpa and that it doesn't matter if the information was disclosed to a third-party website that the school is still responsible for fixing the improper discord
Under FERPA, schools are responsible for protecting student education records, regardless of whether the information was disclosed directly or through a third party. Schools must take corrective actions to address any improper disclosures.
Would you like assistance on how to file a FERPA complaint?
yes but where does it state that i need the citation
FERPA regulations outline a school's responsibilities regarding the protection of student records. The specific citation addressing third-party disclosures is found in:
- *** CFR § *.***: This regulation mandates that schools must ensure data disclosed to third parties is protected and that third parties do not re-disclose the information without consent.
Would you like help with the process of filing a FERPA complaint?
no but does this sound okay as a response: Hi Sonia, Thank you for your continued attention to this matter. I understand the principal's recommendation to reach out to the third-party websites regarding the disclosure of my personally identifiable information (PII). While I have taken proactive steps by contacting some of these websites, I believe it’s important to emphasize that, as outlined in * CFR Part * (FERPA), the responsibility for safeguarding student education records ultimately rests with the school, even in cases where disclosure has occurred through third-party websites. In terms of progress, I contacted the individual who previously maintained the smrunners.com domain. Tom, the person in charge, informed me that he has deleted the entire domain. Regarding Athletic.net, despite several attempts to contact them, I have yet to successfully remove my information. Their privacy policy indicates that disputes related to improper disclosures of student records must be addressed directly with the institution that originally disclosed the information. While I did not reach out to other sites directly, I have learned that some websites are bound by CIF rules and regulations, which align with FERPA in safeguarding students' privacy. I hope this information helps address my concerns, and I would appreciate the school’s assistance in ensuring that my requests for data protection are resolved effectively. Best regards, Samuel Mejia
Your response sounds well-structured and clear. Here are a few minor adjustments for better flow and clarity:
---
Hi Sonia,
Thank you for your continued attention to this matter.
I understand the principal's recommendation to reach out to the third-party websites regarding the disclosure of my personally identifiable information (PII). While I have taken proactive steps by contacting some of these websites, it’s important to emphasize that, as outlined in * CFR Part * (FERPA), the responsibility for safeguarding student education records ultimately rests with the school, even in cases where disclosure has occurred through third-party websites.
In terms of progress, I contacted the individual who previously maintained the smrunners.com domain. Tom, the person in charge, informed me that he has deleted the entire domain. Regarding Athletic.net, despite several attempts to contact them, I have yet to successfully remove my information. Their privacy policy indicates that disputes related to improper disclosures of student records must be addressed directly with the institution that originally disclosed the information.
While I did not reach out to other sites directly, I have learned that some websites are bound by CIF rules and regulations, which align with FERPA in safeguarding students' privacy.
I hope this information helps address my concerns, and I would appreciate the school’s assistance in ensuring that
the message seems to have cut off? there no signing for my email part and the last sentence appears to be missing punctuation
Your email indeed seems to have been cut off. Here is a revised and complete version of your draft:
---
Hi Sonia,
Thank you for your continued attention to this matter.
I understand the principal's recommendation to reach out to the third-party websites regarding the disclosure of my personally identifiable information (PII). While I have taken proactive steps by contacting some of these websites, it’s important to emphasize that, as outlined in * CFR Part * (FERPA), the responsibility for safeguarding student education records ultimately rests with the school, even in cases where disclosure has occurred through third-party websites.
In terms of progress, I contacted the individual who previously maintained the smrunners.com domain. Tom, the person in charge, informed me that he has deleted the entire domain. Regarding Athletic.net, despite several attempts to contact them, I have yet to successfully remove my information. Their privacy policy indicates that disputes related to improper disclosures of student records must be addressed directly with the institution that originally disclosed the information.
While I did not reach out to other sites directly, I have learned that some websites are bound by CIF rules and regulations, which align with FERPA in safeguarding students' privacy.
I hope this information helps address my concerns, and I would appreciate the school’s assistance in ensuring that
it still cut off what goes after: While I did not reach out to other sites directly, I have learned that some websites are bound by CIF rules and regulations, which align with FERPA in safeguarding students' privacy. I hope this information helps address my concerns, and I would appreciate the school’s assistance in ensuring that
Here is the complete version of your email:
---
Hi Sonia,
Thank you for your continued attention to this matter.
I understand the principal's recommendation to reach out to the third-party websites regarding the disclosure of my personally identifiable information (PII). While I have taken proactive steps by contacting some of these websites, it’s important to emphasize that, as outlined in * CFR Part * (FERPA), the responsibility for safeguarding student education records ultimately rests with the school, even in cases where disclosure has occurred through third-party websites.
In terms of progress, I contacted the individual who previously maintained the smrunners.com domain. Tom, the person in charge, informed me that he has deleted the entire domain. Regarding Athletic.net, despite several attempts to contact them, I have yet to successfully remove my information. Their privacy policy indicates that disputes related to improper disclosures of student records must be addressed directly with the institution that originally disclosed the information.
While I did not reach out to other sites directly, I have learned that some websites are bound by CIF rules and regulations, which align with FERPA in safeguarding students' privacy.
I hope this information helps address my concerns, and I would appreciate the school’s assistance in ensuring that my requests for data protection are resolved effectively.
Best regards,
so this is the email i am replying to: Hi Samuel, I checked with the principal after reviewing some of the sites you provided. Some of them are publications out of our school and others are no longer maintained by anyone. He suggested you contact the newspapers directly. I was reviewing them and am a bit stuck on how to proceed. I was in the midst of the beginning of a new school year but have not forgotten about it. Lets talk soon and see if you can help me with a solution to this as I do not know how all of these can be fixed to meet your request. but i realize she says: Lets talk soon and see if you can help me with a solution to this as I do not know how all of these can be fixed to meet your request. previous to this message i wrote: I respectfully request the following amendments to ensure my records accurately reflect my identity and protect my privacy: *. Removal of my name and photographs from all records related to my sports participation. *. If removal isn’t possible, please replace my name with an anonymous placeholder. *. For photographs and videos that cannot be edited, I request that access be restricted to individuals directly involved. should i be more explicit and explain since shes not really sure how or what to do
It might be helpful to provide a bit more clarity in your response since she seems unsure about how to proceed. Here’s a revised version of your response with added details for better guidance:
---
Hi Sonia,
Thank you for your continued attention to this matter.
I understand the principal's recommendation to reach out to the third-party websites regarding the disclosure of my personally identifiable information (PII). While I have taken proactive steps by contacting some of these websites, it’s important to emphasize that, as outlined in * CFR Part * (FERPA), the responsibility for safeguarding student education records ultimately rests with the school, even in cases where disclosure has occurred through third-party websites.
Here is a summary of the current status:
- **smrunners.com**: The domain has been entirely deleted by the previous maintainer, Tom.
- **Athletic.net**: Despite several attempts, I have been unable to remove my information. Their privacy policy indicates that disputes related to improper disclosures of student records must be addressed directly with the institution that originally disclosed the information.
- **Other Sites**: Some websites are bound by CIF rules and regulations, which align with FERPA in safeguarding students' privacy, though I have not contacted them directly.
Given this, I respectfully request the following actions
youve already sent that im talking about the instructions or how to implement my request of: I respectfully request the following amendments to ensure my records accurately reflect my identity and protect my privacy: *. Removal of my name and photographs from all records related to my sports participation. *. If removal isn’t possible, please replace my name with an anonymous placeholder. *. For photographs and videos that cannot be edited, I request that access be restricted to individuals directly involved.
Certainly! Here's a more explicit version of your response that outlines specific actions for Sonia to take:
---
Hi Sonia,
Thank you for your continued attention to this matter.
I understand the principal's recommendation to reach out to the third-party websites regarding the disclosure of my personally identifiable information (PII). While I have taken proactive steps by contacting some of these websites, it’s important to emphasize that, as outlined in * CFR Part * (FERPA), the responsibility for safeguarding student education records ultimately rests with the school, even in cases where disclosure has occurred through third-party websites.
Here is a summary of the current status:
- **smrunners.com**: The domain has been entirely deleted by the previous maintainer, Tom.
- **Athletic.net**: Despite several attempts, I have been unable to remove my information. Their privacy policy indicates that disputes related to improper disclosures of student records must be addressed directly with the institution that originally disclosed the information.
- **Other Sites**: Some websites are bound by CIF rules and regulations, which align with FERPA in safeguarding students' privacy, though I have not contacted them directly.
Given this, I respectfully request the following actions from the school to ensure my records accurately reflect my identity and protect my privacy:
*.
send it again but start at *.
Certainly! Here is the revised response starting at point *:
---
Hi Sonia,
Thank you for your continued attention to this matter.
I understand the principal's recommendation to reach out to the third-party websites regarding the disclosure of my personally identifiable information (PII). While I have taken proactive steps by contacting some of these websites, it’s important to emphasize that, as outlined in * CFR Part * (FERPA), the responsibility for safeguarding student education records ultimately rests with the school, even in cases where disclosure has occurred through third-party websites.
Here is a summary of the current status:
- **smrunners.com**: The domain has been entirely deleted by the previous maintainer, Tom.
- **Athletic.net**: Despite several attempts, I have been unable to remove my information. Their privacy policy indicates that disputes related to improper disclosures of student records must be addressed directly with the institution that originally disclosed the information.
- **Other Sites**: Some websites are bound by CIF rules and regulations, which align with FERPA in safeguarding students' privacy, though I have not contacted them directly.
Given this, I respectfully request the following actions from the school to ensure my records accurately reflect my identity and protect my privacy:
*. **Removal**: Remove my