The Family Educational Rights and Privacy Act of 1974 (FERPA) affords students certain rights with respect to their educational records.

• Notification of Rights Under FERPA & Directory Information
• Re-disclosure of Non-directory Student Information
• Destruction/Disposal of Eductional Records
• FERPA Guidelines for Faculty & Staff

The Family Educational Rights and Privacy Act of 1974 (FERPA) affords students certain rights with respect to their educational records. They are as follows:

1. The right to inspect and review the student's education records within 45 days of the day the University receives a request for access.
   • Students should submit to the registrar, dean, head of the academic department, or other appropriate official, written requests that identify the record(s) they wish to inspect. The University official will make arrangements for access and notify the student of the time and place where the records may be inspected.
      
2. The right to request the amendment of the student's education records that the student believes are inaccurate, misleading, or otherwise in violation of the student's privacy rights.
   • Students may ask the University to amend a record and specify why it is inaccurate or misleading. If the University decides not to amend the record as requested by the student, the University will notify the student of the decision and advise the student of his or her right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing.
      
3. The right to consent to disclosures of personally identifiable information contained in the student's education records, except to the extent that FERPA authorizes disclosure without consent.
   • One exception which permits disclosure without consent is disclosure to University officials with a legitimate educational interest. A University official is a person employed by the University or the North Dakota University System in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff); a person or company supervising an educational experience (student teaching, clinical experience, practicum, internship, etc.); a person or organization related to credentialing or licensing a student; a person or company with whom the University or North Dakota University System has contracted (such as an attorney, auditor, or collection agent); employees of the North Dakota Attorney General's Office providing legal representation to NDSU; a person serving on the Board of Higher Education; or a student serving on an official committee, such as a disciplinary or grievance Committee, or assisting another University or University System official in performing his or her tasks. A University official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.
      
   • Upon request, the University discloses education records without a student's consent to officials of another school in which a student seeks or intends to enroll.
      
   • As of January 3, 2012, the U.S. Department of Education’s FERPA regulations expand the circumstances under which students' education records and personally identifiable information (PII) contained in such records—including Social Security Number, grades, or other private information—may be accessed without student consent. First, the U.S. Comptroller General, the U.S. Attorney General, the U.S. Secretary of Education, or state and local education authorities ("Federal and State Authorities") may allow access to education records and PII without student consent to any third party designated by a Federal or State Authority to evaluate a federal- or state-supported education program. The evaluation may relate to any program that is "principally engaged in the provision of education," such as early childhood education and job training, as well as any program that is administered by an education agency or institution. Second, Federal and State Authorities may allow access to education records and PII without student consent to researchers performing certain types of studies, in certain cases even when the university objects to or does not request such research. Federal and State Authorities must obtain certain use-restriction and data security promises from the entities that they authorize to receive student personally identifiable information, but the Authorities need not maintain direct control over such entities. In addition, in connection with Statewide Longitudinal Data Systems (SLDS), State Authorities may collect, compile, permanently retain, and share without student consent personally identifiable information from education records, and they may track student participation in education and other programs by linking such personally identifiable information to other personal information about students that they obtain from other Federal or State data sources, including workforce development, unemployment insurance, child welfare, juvenile justice, military service, and migrant student records systems.
      
4. The right to request the following categories of personally identifiable information, or 'directory information', not be made public:

   Any student wishing to exercise this right must inform the Office of Registration and Records, 110 Ceres Hall, in writing.

   Under the Family Educational Rights and Privacy Act, students have the right to request directory information not be made public by contacting the Registration and Records Office. NDSU will honor student requests to withhold directory information until the student makes the request in writing to lift the restriction. NDSU receives inquiries for "directory information" from a variety of sources including, but not limited to, prospective employers, government agencies, news media, parents, other colleges and universities, licensing agencies, etc. NDSU has no responsibility to contact students for subsequent permission to release directory information after it is restricted.
   
   Furthermore, students may provide consent to release non-directory information (financial and academic records) to designated third parties by completing a FERPA Release Form available online. The release remains in effect until the consent is revoked in writing and the revocation is delivered to NDSU.

   • Student Name *
   • Hometown (city, state)
   • Campus E-mail address **
   • Height, weight and photos of athletic team members
   • Major field of study (all declared majors)
   • Minor field of study (all declared minors)
   • Class level
   • Dates of attendance
   • Enrollment status (withdrawn, less than half-time, half-time, three-quarter-time, full time)
   • Names of previous institutions attended
   • Participation in officially recognized activities and sports
   • Honors/awards received
   • Degree earned (all degrees earned)
   • Date degree earned (dates of all degrees earned)
   • Directory photos, photographs and video recordings of student in public or non-classroom settings (photographs from classrooms or class-related activities are NOT directory information)
     
     *If a student provides a preferred name, NDSU tries to use it when communicating directly with the student. The preferred name is also used in class/grade rosters, academic requirement reports, email addresses, etc. Preferred name is a supported business practice, unless there is a documented business or legal reason to use the student's legal name.  When communicating with outside third parties, including parents, NDSU generally uses a student's legal name.
     
     **Campus email addresses are only disclosed to requestors who agree not to use them for solicitation.
      

5. The right to file a complaint with the U.S. Department of Education concerning alleged failure by NDSU to comply with the requirements of FERPA:
   
   U.S. Department of Education
   Student Privacy Policy Office
   400 Maryland Ave. SW
   Washington, DC 20202

Under FERPA (Family Educational Rights and Privacy Act of 1974), third parties that have appropriately received non-directory information cannot disclose any data to another third party unless that other third party would have had initial eligibility to have received the information directly. Any such re-disclosure must be done on behalf of the institution and  must be recorded with the name of the party to whom data was re-disclosed and the legitimate interest that party had to the data.

Per the Family Educational Rights and Privacy Act (FERPA), NDSU is responsible for maintaining a record of each request for access for personally identifiable information from education records. Furthermore, any personally identifiable student data that is released to authorized individuals, including state educational authorities, whether in electronic or hard-copy format, must be protected to ensure the confidentiality of the student information. FERPA also requires the proper destruction of information once it is no longer needed for its original purpose.

The disposal of Student Records must occur in accord with NDSU and state retention schedules. Any document (paper, form, microfilm, report, etc.) that contains personally identifiable student information, even if it is not considered to be an official student record, must be destroyed in a secure manner. Such documents include but are not limited to computer-generated files, microfilm/fiche, notes, letters/memos, and forms. See Disposal Resources.

Notes:

• Paper records containing confidential information should be shredded, burned and/or pulped, not simply thrown out with other classes of records or with miscellaneous trash. The use of university-contracted secure document destruction vendors is highly recommended.
   
• Electronic records containing confidential information require confidential destruction. Deletion of the contents of digital files and emptying of the desktop "trash" is the first step. It also is recommended that commercially available software applications be utilized to remove all data from the hard drive storage. It is recommended that disks and back-up tapes containing sensitive information be physically destroyed.
   
• Film, audio and videotapes containing confidential information should also be physically destroyed, not simply thrown away.