Does FERPA cover verbal disclosures as well as written?

Question

When I read FERPA, I don't see any clarification as to whether they are talking about written sharing of educational records, or whether they are also talking about verbal disclosures.

For example, here is their definition of disclosure:

Disclosure means to permit access to or the release, transfer, or other communication of personally identifiable information (PII) by any means (34 CFR §99.3). Disclosure can be Authorized, such as when a parent or an eligible student gives written consent to share education records with an authorized party (e.g., a researcher). Disclosure can also be Unauthorized or inadvertent (accidental). An unauthorized disclosure can happen due to a data breach or a loss, and an accidental disclosure can occur when data released in public aggregate reports are unintentionally presented in a manner that allows individual students to be identified.

"By any means" suggests that things that have not been disclosed in writing would also be included, but I'm not sure if I'm interpreting that correctly. For example, what about a student's counseling sessions with the school social worker? Does the parent need to be informed, and provide consent, for a university researcher sitting in on, and participating in, these sessions? What about verbal background information about the student's diagnoses shared by the school social worker with the professor? Is the answer different if the university and the high school have signed a memorandum of understanding? Is the answer different if information obtained through presence in the counseling sessions is used for the professor's research activities? The student is 15.

I'm aware that one can file a FERPA complaint in case of a violation. If there were a serious FERPA violation, is there also in theory some way of filing for legal damages in such a situation? This is New York, where human rights law does not apply to students in public schools.

Answer 1

I've never seen a case directly on point, but the wording of the statutory prohibition on disclosure (20 USC § 1232g(b)) suggests that FERPA prohibits unauthorized disclosures of personally identifiable information, regardless of whether the disclosure is written or oral:

No funds shall be made available under any applicable program to any educational agency or institution which has a policy or practice of permitting the release of education records ... or personally identifiable information contained therein...

So it explicitly prohibits the release of (1) "records," but it also prohibits disclosure of (2) PII from those records. PII taken from a record and put onto another piece of paper is still a record, so what is left that the (2) could be referring to? I can't think of anything besides oral disclosures.

But a violation -- serious or trivial -- would not be grounds for damages,as FERPA doesn't allow for a private cause of action. Gonzaga Univ. v. Doe, 536 U.S. 273, 289 (2002) ("FERPA's nondisclosure provisions fail to confer enforceable rights."). The only penalty for a FERPA violation is a loss of federal funding, which to my knowledge, has never actually been imposed.