How to File a Privacy Violation Complaint
Imagine your school or someone in the school division violates the privacy of your child. How do you file a complaint?
Students and/or their parents have a right to file a complaint with U.S. Department of Education’s Student Privacy Policy Office (SPPO), alleging noncompliance with Family Educational Rights and Privacy Act (FERPA). SPPO is U.S. Department of Education’s office charged with ensuring compliance with federal privacy laws, regulations, and policies. This includes investigating FERPA and Protection of Pupil Rights Amendment (PPRA) complaints filed by parents and students. This includes violations related to privacy, access to records, amendment of records, and disclosure of records.
Students who have Individual Education Programs (IEPs) have additional protections, and thus a few options:
- Complaint may be filed with SPPO alleging noncompliance with FERPA
- Complaint may be filed with the state education agency and/or a due process complaint may be filed, alleging noncompliance with IDEA.
What is FERPA?
FERPA applies to schools receiving funding by U.S. Department of Education and protects the confidentiality of student records. In addition, it provides rights to parents and/or students to access, inspect and review, and/or request amendment of those records.
How to File FERPA Complaints
Parents may file complaints on behalf of students who are under 18 years old. When a student turns 18, the right to file a complaint transfers to the student.
Complaints must be filed within 180 days of the dates of the alleged violations.
Complaints must provide specific facts detailing the allegations.
SPPO's complaint form can be accessed at this link: SPPO Complaint Form
After completing the form, you have the option of emailing or mailing it to SPPO. As of the publishing of this article, you can email the completed form to FERPA.Complaints@ed.gov or email the completed form to the following address:
U.S. Department of Education
Student Privacy Policy Office
400 Maryland Ave, SW
Washington, DC 20202-8520
What Additional Protections Exist Under IDEA?
While FERPA and IDEA overlap, IDEA provides additional protections.
For example, under IDEA, a state complaint could be filed in addition to a complaint with SPPO. For parents who have power of attorney for their over-18-years-old students, they may request access to records under IDEA. FERPA does not recognize power of attorneys in the same manner as IDEA.
Another example: Outside of the privacy arena, if parents request access to records, access must be provided prior to the next IEP meeting. However, under FERPA, schools have up to 45 days to provide access.
Check out the U.S. Department of Education’s document IDEA and FERPA Crosswalk for more information comparing the two.
How to File a State Complaint?
IDEA outlines minimum state complaint procedures, so you’ll need to check with your state education agency for specifics on filing a state complaint within your state.
At a minimum, each state education agency must adhere to the following pursuant to 300.152 of IDEA:
“(a) Time limit; minimum procedures. Each SEA must include in its complaint procedures a time limit of 60 days after a complaint is filed under §300.153 to—(1) Carry out an independent on-site investigation, if the SEA determines that an investigation is necessary; (2) Give the complainant the opportunity to submit additional information, either orally or in writing, about the allegations in the complaint; (3) Provide the public agency with the opportunity to respond to the complaint, including, at a minimum—(i) At the discretion of the public agency, a proposal to resolve the complaint; and (ii) An opportunity for a parent who has filed a complaint and the public agency to voluntarily engage in mediation consistent with §300.506; (4) Review all relevant information and make an independent determination as to whether the public agency is violating a requirement of Part B of the Act or of this part; and (5) Issue a written decision to the complainant that addresses each allegation in the complaint and contains—(i) Findings of fact and conclusions; and (ii) The reasons for the SEA’s final decision.
“(b) Time extension; final decision; implementation. The SEA’s procedures described in paragraph (a) of this section also must—(1) Permit an extension of the time limit under paragraph (a) of this section only if—(i) Exceptional circumstances exist with respect to a particular complaint; or (ii) The parent (or individual or organization, if mediation or other alternative means of dispute resolution is available to the individual or organization under State procedures) and the public agency involved agree to extend the time to engage in mediation pursuant to paragraph (a)(3)(ii) of this section, or to engage in other alternative means of dispute resolution, if available in the State; and (2) Include procedures for effective implementation of the SEA’s final decision, if needed, including—(i) Technical assistance activities; (ii) Negotiations; and (iii) Corrective actions to achieve compliance.
“(c) Complaints filed under this section and due process hearings under §300.507 and §§300.530 through 300.532. (1) If a written complaint is received that is also the subject of a due process hearing under §300.507 or §§300.530 through 300.532, or contains multiple issues of which one or more are part of that hearing, the State must set aside any part of the complaint that is being addressed in the due process hearing until the conclusion of the hearing. However, any issue in the complaint that is not a part of the due process action must be resolved using the time limit and procedures described in paragraphs (a) and (b) of this section. (2) If an issue raised in a complaint filed under this section has previously been decided in a due process hearing involving the same parties—(i) The due process hearing decision is binding on that issue; and (ii) The SEA must inform the complainant to that effect. (3) A complaint alleging a public agency’s failure to implement a due process hearing decision must be resolved by the SEA.”
Below is the format for a state complaint I filed previously with Virginia Department of Education (VDOE). Although VDOE did rule in my favor in response to the complaint, I can't guarantee the same will happen for you. This isn't legal advice, but it is an example of something that has worked previously.
[INSERT DATE]
[INSERT STATE DIVISION],
This is a state complaint. It is being filed on behalf of my child, [INSERT STUDENT’S NAME], who resides with me at [INSERT ADDRESS], and who is enrolled at [INSERT SCHOOL], in [INSERT SCHOOL DIVISION].Â
Complaint:
[INSERT SCHOOL/SCHOOL DIVISION] failed to ensure the protection of confidentiality of [INSERT STUDENT'S NAME].
On [INSERT DATE/S] the following occurred:Â
[INSERT DETAILS ABOUT WHAT WAS RELEASED, WHO RELEASED IT, WHO IT WAS RELEASED TO, AND ANY OTHER INFORMATION YOU HAVE.]Â
Additional Information:
Applicable Regulations:
- 34 C.F.R. 300.613
- 34 C.F.R. 300.623
- 34 C.F.R. 300.32
- Family Education Rights and Privacy Act (20 USC 1232g)
- 8 VAC 20-81-170.G [THIS IS SPECIFIC TO VIRGINIA, SO IF YOU'RE IN ANOTHER STATE, YOU'LL WANT TO LOOK TO YOUR OWN STATE'S REGULATIONS)
- Special education laws and regulations state that parental consent shall be obtained before personally identifiable information is disclosed to anyone other than officials of the local educational agency unless the information is contained in the education records, and the disclosure is authorized under the Family Education Rights and Privacy Act. Each local educational agency shall protect the confidentiality of personally identifiable information at collection, storage, disclosure, and destruction stages. *[This language is straight from the Virginia Department of Education. VDOE used it in response to a previous complaint I submitted. Given this was their stance previously—and this was the same issue as previously—the same should apply. So . . . I presented their own words to them.]
- Personally identifiable information to mean information that contains the following: (i) the name of the child, the child’s parent, or other family member; (ii) the address of the child; (iii) a personal identifier, such as the child’s social security number or student number; or (iv) a list of personal characteristics or other information that would make it possible to identify the child with reasonable certainty. *[This language is straight from the Virginia Department of Education. VDOE used it in response to a previous complaint I submitted. Given this was their stance previously—and this was the same issue as previously—the same should apply. So . . . I presented their own words to them.]
Resolution
[THIS IS AN INDIVIDUAL DECISION. THE BELOW IS SIMPLY AN EXAMPLE OF SOMETHING I WOULD REQUEST.]As a resolution, I request that [INSERT SCHOOL DIVISION] be required to establish practices to ensure that students' records are always secured, that [INSERT STATE EDUCATION AGENCY] be required to approve [INSERT SCHOOL DIVISION] new practices in advance of implementation, and that [INSERT STATE EDUCATION AGENCY] monitor [INSERT SCHOOL DIVISION] monthly for at least one year and/or until the noncompliance stops. In addition, I request training in records maintenance and FERPA be provided to staff divisionwide and that this training be provided yearly to all staff, even if they've received it previously. If other students' information was released, I request all parents not yet made aware of the breach be immediately made aware.