How to File a Privacy Violation Complaint

Imagine your school or someone in the school division violates the privacy of your child. 

Can you file a complaint? If yes, how?

Parents and/or students who believe a student's privacy has been violated under the Family Educational Rights and Privacy Act (FERPA), have a right to file a complaint.

FERPA applies to all students. However, students who have IEPs have additional protection under Individuals with Disabilities Education Act (IDEA). Let's explore both below.

What is FERPA?

FERPA protects the confidentiality of student records and provides rights to parents and students to access those records.

Under IDEA there are additional confidentiality and access protections. (Check out the U.S. Department of Education’s document “IDEA and FERPA Confidentiality Provisions” for more information comparing the two.)

File a Complaint with U.S. Department of Education Student Privacy Policy Office

Parents and/or students can file a complaint with U.S. Department of Education’s Student Privacy Policy Office (SPPO). They don't have to have a 504 Plan or an IEP to do this. However, for a parent to file a complaint on behalf of the student, the student must be under 18 years old. At 18, rights transfer to the student.

SPPO's complaint form can be accessed at this link: SPPO Complaint Form

After completing the form, you have the option of emailing or mailing it to SPPO. As of the writing of this article (November 2, 2023), you can email the completed form to FERPA.Complaints@ed.gov or email the completed form to the following address:

U.S. Department of Education
Student Privacy Policy Office
400 Maryland Ave, SW
Washington, DC 20202-8520

File a State Complaint

Students who have IEPs receive additional protection under IDEA and complaints on their behalf can be filed with the state education agency.

Below is the format for a state complaint I filed previously with Virginia Department of Education (VDOE). Although VDOE did rule in my favor in response to the complaint, I can't guarantee the same will happen for you. This isn't legal advice, but it is an example of something that has worked previously.

Each state has its own set of regulations, so you’ll want to double check yours to ensure you include all required components before filing. As of today (11.2.23), the following are the requirements in Virginia:

A complaint may be filed with the Virginia Department of Education by any individual, organization, or an individual from another state and shall:

1. Be in writing and submitted via postal mail, delivery service, facsimile, by hand, or email.

2. Include the signature and contact information of the complainant. Complaints received via email will be considered as received with an electronic signature.

3. Contain a statement that the local educational agency (LEA) or the VDOE has violated a requirement of federal and/or state law(s) and/or regulations that apply to special education.

4. Include the facts on which the complaint is based.

5. Address an action that occurred not more than one year prior to the date the complaint is received by ODRAS.

6. Contain all relevant information and supporting documentation

7. Be provided simultaneously, by the complainant, to the LEA at the same time the complaint is submitted to the VDOE.

8. If alleging violations with respect to a specific child include:

a. The name of the child;

b. The address of residence for the child;

c. The name of the local educational agency (school division) the child is enrolled in;

d. The name of the school the child is attending;

e. In the case of a homeless child or youth (within the meaning of § 725(2) of the McKinney-Vento Homeless Assistance Act (42 U.S.C. 11434a(2)), available contact information for the child, and the name of the school the child is attending;

f. A description of the nature of the child’s problem, including the facts relating to the problem; and

g. A proposed resolution of the problem to the extent known and available to the party at the time the complaint is filed.

B. All relevant documents must be submitted to ODRAS, Virginia Department of Education, P.O. Box 2120, Richmond, VA 23218-2120; emailed to ODRAS@doe.virginia.gov; or faxed to the same office at (804) 786-8520. If being submitted by hand or delivery service, the physical address is: 101 N. 14th Street, James Monroe Building, ODRAS - 20th Floor, Richmond, VA 23219.

C. The LEA is responsible for providing the parent with a copy of the procedural safeguards notice upon receipt of the first state complaint in a school year.

[INSERT DATE]

[INSERT STATE DIVISION],

This is a state complaint. It is being filed on behalf of my child, [INSERT STUDENT’S NAME], who resides with me at [INSERT ADDRESS], and who is enrolled at [INSERT SCHOOL], in [INSERT SCHOOL DIVISION]. 

Complaint:

[INSERT SCHOOL/SCHOOL DIVISION] failed to ensure the protection of confidentiality of [INSERT STUDENT'S NAME].

On [INSERT DATE/S] the following occurred: 

[INSERT DETAILS ABOUT WHAT WAS RELEASED, WHO RELEASED IT, WHO IT WAS RELEASED TO, AND ANY OTHER INFORMATION YOU HAVE.] 

Additional Information:

Applicable Regulations:

  • Special education laws and regulations state that parental consent shall be obtained before personally identifiable information is disclosed to anyone other than officials of the local educational agency unless the information is contained in the education records, and the disclosure is authorized under the Family Education Rights and Privacy Act. Each local educational agency shall protect the confidentiality of personally identifiable information at collection, storage, disclosure, and destruction stages. *[This language is straight from the Virginia Department of Education. VDOE used it in response to a previous complaint I submitted. Given this was their stance previously—and this was the same issue as previously—the same should apply. So . . . I presented their own words to them.]
  • Personally identifiable information to mean information that contains the following: (i) the name of the child, the child’s parent, or other family member; (ii) the address of the child; (iii) a personal identifier, such as the child’s social security number or student number; or (iv) a list of personal characteristics or other information that would make it possible to identify the child with reasonable certainty. *[This language is straight from the Virginia Department of Education. VDOE used it in response to a previous complaint I submitted. Given this was their stance previously—and this was the same issue as previously—the same should apply. So . . . I presented their own words to them.]

Resolution

[THIS IS AN INDIVIDUAL DECISION. THE BELOW IS SIMPLY AN EXAMPLE OF SOMETHING I WOULD REQUEST.]

As a resolution, I request that [INSERT SCHOOL DIVISION] be required to establish practices to ensure that students' records are always secured, that [INSERT STATE EDUCATION AGENCY] be required to approve [INSERT SCHOOL DIVISION] new practices in advance of implementation, and that [INSERT STATE EDUCATION AGENCY] monitor [INSERT SCHOOL DIVISION] monthly for at least one year and/or until the noncompliance stops. In addition, I request training in records maintenance and FERPA be provided to staff divisionwide and that this training be provided yearly to all staff, even if they've received it previously. If other students' information was released, I request all parents not yet made aware of the breach be immediately made aware.

Privacy Policy