U.S. Supreme Court:
Students Cannot Sue Institutions
Over FERPA Violations

College officials concerned about increased exposure to liability from lawsuits received some good news this past summer from the US Supreme Court.

In Gonzaga University v. Doe, the Court ruled that a student may not use federal civil rights law to sue an institution for damages over the unauthorized release of that student's education records.

Gonzaga arose from disclosures by a university official who had learned that a student was alleged to have engaged in sexual misconduct while attending the institution.

The student planned to become certified to teach school in the state of Washington. When the student learned, however, that the Gonzaga official had disclosed information regarding the sexual misconduct allegations to state teacher certification officials, he filed suit against the university.

Under the Family Educational Rights and Privacy Act (FERPA)-the federal privacy statute to which most schools, colleges and universities are subject-an institution typically may not disclose information from a student's education records without that student's prior consent.

The term "education records" generally includes records directly related to a student and maintained by an institution. The facts that the Gonzaga official disclosed no doubt were education records, and subject to release only with the student's consent.

An institution's compliance with FERPA, however, is a condition of receiving federal funds. Should an institution ignore the requirements of the statute, it risks losing any federal funding it receives.

The US Supreme Court ruled that FERPA does not authorize a student to sue an institution over FERPA violations pursuant to 42 USC §1983, a federal statute commonly used to enforce rights guaranteed by law. The Court based the holding on its determination that FERPA is merely a funding statute.

Through Chief Justice Rehnquist, the Court held that "FERPA's nondisclosure provisions fail to confer enforceable rights" under §1983, and that those provisions "further speak only in terms of institutional policy and practice, not individual instances of disclosure."

The Court also noted that in enacting FERPA, Congress created the Family Policy Compliance Office, a unit of the US Department of Education charged with hearing administrative complaints by students over institutions alleged to have violated the students' privacy interests.

Under FERPA, the Office may investigate such complaints; if the charges are justified, the Office may instruct an institution to rectify its violations.

It is implausible to presume," wrote the Chief Justice, "that the same Congress nonetheless intended private suits to be brought before thousands of federal- and state-court judges, which could only result in the sort of 'multiple interpretations' the Act explicitly sought to avoid."

In his dissent, Justice Stevens doubted the majority's claim that Congress did not intend FERPA to create a right, and suggested that the name of the statute itself might indicate otherwise.

Nevertheless, while the Gonzaga decision may protect a college or university against lawsuits over FERPA violations, it in no way diminishes an institution's obligations under the Act.

Notably, the law requires that an institution publish an annual notification statement informing students of how FERPA protects their education records.

The notification must advise students of their prerogative-as the Gonzaga court noted-to lodge a complaint with the Family Policy Compliance Office.

Published in the Fall 2002 Edition of In Brief