While the Federal Trade Commission has recently (August 15, 2012) taken a keen interest in helping parents safeguard their child’s personally identifiable information, the Department of Education has done the opposite in its final regulations under the Family Educational Rights and Privacy Act (FERPA). Indeed, earlier in the year the Electronic Privacy Information Center (EPIC) filed a lawsuit against the Department challenging the final FERPA rules of December 2, 2011.
EPIC alleges the final regulations violate the Administrative Procedure Act: (1) they are not in accordance with law; and (2) they represent Departmental action in excess of the authority of the FERPA statute. In simple terms, the regulations turn the law on its head–skirting the privacy protections of student education records, or at a minimum making it easier for records to be released to third parties without the consent of the parent or student.
Meanwhile, no dispositive decision has been issued by the court. At the moment, EPIC and the Department are skirmishing over what goes in the administrative record.