A recent study by Pew Research Center found that 64% of Americans have personally experienced a major data breach and 49% feel their personal information is less secure than it was five years ago. It’s not surprising, then, that here at SimpsonScarborough, we’ve noticed an uptick in the number of questions we receive from clients about data security and regulations that affect what data they can share with our firm for the purposes of the research projects we conduct on their behalf. Since we’re finding ourselves answering these questions more frequently, we thought it might help to do a short primer on FERPA and the precautions we take to make sure we (and our clients) are fully compliant.
First of all, what is FERPA?
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.
FERPA serves an important role in protecting the privacy of student records. How does it apply to the work we do at SimpsonScarborough? You can read all about FERPA here, but here’s the section that’s most relevant to our work (emphasis ours):
Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions:School officials with legitimate educational interest;
- Other schools to which a student is transferring;
- Specified officials for audit or evaluation purposes;
- Appropriate parties in connection with financial aid to a student;
- Organizations conducting certain studies for or on behalf of the school
Schools may disclose, without consent, ‘directory’ information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance.
FERPA does allow schools to disclose records, without consent, to organizations conducting studies on behalf of the school – that’s us! When we partner with a college or university to do marketing, branding, or creative work, many times that work includes some type of qualitative or quantitative research conducted with students, faculty, staff, and alumni. In order to reach these audiences, we request directory information from our client schools to be used to invite their audiences to participate in our research. The data we request also includes some additional information (for example, year of graduation, degree type, major, etc.) that allows us to look at survey responses based on key demographic information.
All the data our client institutions share with us falls under the umbrella of “directory information.” This is not considered highly sensitive information. We don’t get—or ask for—passwords or social security numbers, and we don’t know if Joe Schmoe failed calculus or was referred for an honors violation. What’s more, all the data we collect is shared via a secure, firewall-protected cloud server, and our staff follows strict security measures when handling the data. The data is only used for the purposes of collecting and analyzing survey data to help the institution with its marketing, branding, and creative efforts.
Data security is always at the top of our minds here at SimpsonScarborough, and we take every precaution to keep our clients’ data and their stakeholders’ directory information secure, regardless of whether it is deemed “sensitive.” Rest assured, if you are working with us and giving us access to directory information for your students, you are in compliance with FERPA regulations.
One last thing: I would be remiss if I didn’t mention the second question we get after the FERPA one: “Is this survey going to have a negative impact on our recruitment cycle?” It’s a fair concern. While we don’t have a research study to prove any connection or lack thereof, we do know that in a decade of conducting 50-odd research studies a year, we’ve never had a client report any negative fallout. And anecdotally, we have actually had clients tell us that the surveys seem to increase prospects’ knowledge of and interest in their institutions.
