Does obscuring personally identifiable and directory information avoid potential FERPA violations?

Question

Say I have a database of students, each with a unique ID, GPA, placement test scores, and some demographic information (nothing personally identifiable). The ID is generated using a one-way cryptographic hash function that produces a string based on personally identifiable information. With this function, it is theoretically* impossible to figure out the original data, but it still preserves uniqueness. This is typically how passwords are stored; industry standard stuff.

Does FERPA protect the release of educational records completely, or only when in combination with personally identifiable information?

* theoretically. the development of quantum computing notwithstanding, the Sun will die long before anyone can figure the original data by testing every possible combination of letters and punctuation of unknown length. See: https://en.wikipedia.org/wiki/Cryptographic_hash_function

[snip detailed example]

Answer 1

FERPA does not protect the release of educational records completely. §99.31 of the regulations spells out circumstances where disclosure of personally identifiable information can be made without consent (a very long and complicated list). Para (b) also states that the institution

may release the records or information without the consent required by §99.30 after the removal of all personally identifiable information provided that the educational agency or institution or other party has made a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information.

An name or ID number is a clear example of PII. An anonymized set of grades from a transcript is not, and does not have the characteristics of

Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty;

That is, the law is not stated in terms of "could theoretically be traced back to the student" (since transcripts are under lock and key).

Answer 2

No

The problem with your dataset is that the sequence of grades for each individual are almost certainly unique (or nearly so). Someone who possessed a student’s educational history could most likely identify that person in your dataset.

Now, you may argue that that does not give the ‘hacker’ more information than they already had, however, that’s beside the point. The regulations identify personally identifiable information as:

(f) Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty;