Confidentiality of Student Records and Student Data Privacy

The Family Educational Rights and Privacy Act (FERPA) is a federal law that governs access to and disclosure of student education records. 20 U.S.C. 1232g. FERPA applies to all educational organizations that receive funding under any program administered by the U.S. Department of Education, including school districts. FERPA generally prohibits districts from disclosing students’ personally identifiable information from education records without students’ written consent.

Colorado also has several state statutes that address the protection of student records. These laws reinforce school districts’ obligations to comply with FERPA. C.R.S. 22-1-123 and 24-72-204(3)(e).

Colorado’s “Student Data Transparency and Security Act,” C.R.S. 22-16-101 et seq. (the Act), imposes numerous obligations on school districts and BOCES regarding student data privacy. Most importantly, the Act prohibits districts and BOCES from entering into or renewing a contract with a school service contract provider that refuses to accept the terms required by the Act or that has substantially failed to comply with the Act’s student data privacy requirements. C.R.S. 22-16-107(2)(b).

As a benefit of CASB membership, CASB’s Member Legal Resources Team developed legal memos regarding the confidentiality of student records and Colorado's Student Data Transparency and Security Act (the Act). In addition, the Colorado Council of School Board Attorneys has approved a sample data privacy addendum (DPA) that meets the Act's contract requirements. To access these memos and sample DPA, please sign in with your CASB username and password. Click here to access. Members Area

• Colorado's Student Data Transparency and Security Act memo
• Confidentiality of Student Records memo
• Transferring Student Records memo
• Sharing of Student Records with other Agencies memo
• Data Sharing for Research Purposes memo
• Sample DPA

Additional resources

• United States Department of Education’s (USDOE) FERPA webpage
• USDOE's Privacy Technical Assistance Center's Guidance, "School Resource Officers, School Law Enforcement Units, and FERPA"
• Colorado Attorney General Opinion No. 18-01 regarding FERPA and student safety concerns (January 11, 2018)
• Colorado Department of Education’s (CDE’s) Data Privacy and Security webpage
• CDE’s FERPA webpage
• NSBA's Data Security for Schools: A Legal and Policy Guide for School Boards Members Area