Appendix G: Data Privacy (FERPA)

The Family Educational Rights and Privacy Act of 1974 (FERPA) as amended:  Sets forth requirements regarding the privacy of student records.  Specifically, FERPA governs:

• The disclosure of education records maintained by an educational institution; and
• Access to these records
• Notification by the institution to students of their FERPA rights
   

Further information can be found on the US Department of Education Family Policy Compliance Office website at http://www2.ed.gov/policy/gen/guid/fpco/index.html

Education Records:  Records, handwritten or in any media, (including conduct records) that are directly related to a student and maintained by Norwich University, or by a party acting for the institution.

Records NOT protected by FERPA include:

• records of instructional, administrative, and educational personnel which are the sole possession of the maker and are not accessible or revealed to any individual except a temporary substitute
• records maintained by Norwich University security/law enforcement unit
• records of employment which relate exclusively to individuals in their capacity as employees (records of students employed by Norwich University as a result of their status as students are education records, e.g. work-study)
• records created, or maintained by a physician, psychiatrist or other recognized professional acting in his or her professional capacity (including counseling and health records)
• alumni records which contain information about a student after s/he is no longer in attendance at Norwich University and which do not relate to the person as a student.

Student:  A person, who is enrolled in a Norwich University credit or non-credit course, regardless of age.

Directory Information:

      Norwich University considers the following Directory Information and WILL release this information WITHOUT the written consent of the student.

• Full Name
• Anticipated Graduation Date
• Athletic Achievements
• Athletic Height & Weight
• Awards and Honors Including Cadet Promotions
• Class Level (Freshman, Sophomore, Junior, Senior)
• Dates/Terms Attended
• Degrees/Certificates Awarded & Date Conferred
• Graduation Status
• Email Address
• Full or Part-Time Status
• Home Town
• Lifestyle
• Major or Program
• Norwich Mailbox Number
• Participation in Official Recognized Activities & Sports
• Photographs
• Previous Colleges Attended
• Withdrawal Date
   

The Solomon Amendment:

This law requires universities to release the information listed below regarding enrolled students to the military for recruitment purposes.  Students may restrict this disclosure to the military only by restricting all disclosure of Directory Information.

• Name
• Academic Major
• Address
• Date & Place of Birth
• Degrees Received
• Level of Education
• Most Recent Education Institution Enrolled in By the Student
• Telephone Listing
   

Non-Directory Information

Norwich University considers Non-Directory Information to include, but not to be limited to, the following and therefore will NOT release this personally identifiable information without the student’s written consent, or as specified in this policy. 

• Academic Standing
• Advisor
• Age
• Citizenship
• Class Schedule/Roster
• Credits Earned
• County of Origin
• Date of Birth
• Entrance Exam Results
• Financial Aid Information
• Gender
• Grade Point Average (Semester & Cumulative)
• Grades
• Parent Address(es) & Phone Number(s)
• Race/Ethnicity
• Social Security Number
• Student Financial Account Information
• Student Identification Number
• Student Local & Permanent Address & Phone Number
• Transcript
   

Upon request, Norwich University discloses education records, without consent, to officials of another institution that a student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for the purposes related to the student’s enrollment or transfer.

Student Restriction of Directory & Non-Directory Information:

Students may submit a “FERPA Hold” form to the Registrar’s Office to prevent directory and non-directory information from being released.  This means that NO information regarding this student will be released to any person or placed in any publications (this includes the Commencement program and Dean’s list recipients to local newspapers).  This form is valid until it is rescinded in writing by the student.

Student Release of Non-Directory Information:

Students may allow the release of non-directory information to anyone they so choose by electronically entering the person’s name and relationship to the student via the electronic Enrollment Verification form.  Students are allowed to add names throughout the term.  The releasee names are valid until rescinded in writing by the student.  In most cases, it should be the Registrar’s Office that releases non-directory information.

Disclosure of Non-Directory Information

Norwich University may disclose non-directory information from students’ education records, without student’s written consent, to school officials who have a legitimate educational interest in the records, or to certain other individuals or organizations, as specified below.  The release of information to those described below does not constitute authorization to those individuals or organizations to share that information with a third party without the student’s written consent. 

A school official is:
A person, organization, or company who is employed by, contracting with, or properly authorized by Norwich University, to perform administrative, supervisory, academic, research, or support functions for the University.

• This definition includes, but is not limited to:
  • law enforcement personnel;
  • health staff;
  • certain appropriate students;
  • field supervisors;
  • contractors, such as attorneys, auditors, or collection agents;
  • those properly authorized to serve as official board or committee members; or
  • any others (such as volunteers) properly authorized to assist another school officials in performing his or her professional responsibilities for Norwich University.
• A school official must abide by all applicable policies and procedures regarding confidentiality of education records.

A school official has a legitimate educational interest if:
The official needs to review an education record to fulfill his or her professional responsibility.  Those professional responsibilities may include, but are not limited to:

• Performing a task that is specified in his/her position description or by a contract agreement
• Performing a task related to a students’ education
• Performing a task related to the academic or behavioral conduct of a student
• Conducting research that benefits students and/or the University.

Other permissible recipients of such disclosures are:

• The US Department of Education, the Comptroller General, state or local educational authorities
• Organizations conducting certain studies for, or on behalf of Norwich University
• Organizations conducting research for educational agencies or institutions for developing, validating or administering predictive tests; administering student aid programs; and improving instruction.
• Accrediting organizations
• Comply with a judicial order or lawfully issued subpoena, including ex parte orders under the US Patriot Act.
• Appropriate parties in a health or safety emergency
• A victim of a crime of violence or nonforcible sex offense when the information is related to the final results of the disciplinary proceeding conducted by Norwich University
• Those who seek sex offender registry information from those required to register as sex offenders under state or federal law
• Officials at other institutions in which the student has already enrolled or seeks to enroll in
• International sponsors
• State and local officials to whom information is specifically required to be reported by a state law as permitted by FERPA.
• Parents of a dependent student, as identified on federal tax forms
• Parents of students, under the age of 18 at the time of the disclosure, who have violated any law or any institutional policy governing the use or possession of alcohol or a controlled substance.  

The Registrar shall decide the legitimacy of requests for permissible disclosures of student information. 

Valid Subpoenas:

If the Registrar is served with a valid subpoena requesting student information, the Registrar must comply with the request.  Before doing so, the Registrar shall attempt to notify the student of the subpoena in advance of compliance so the student may seek protective action, unless the disclosure is in compliance with a subpoena issued by an agency that has ordered the contents of the subpoena, or the information furnished in response to the subpoena, not be disclosed.

Deceased Students:

Information on deceased students may be made available to survivors or third parties via a request to the Registrar.  An individual student’s rights under FERPA are no longer valid upon death of that student.

Record of Requests for Disclosure

Norwich University must maintain a record of each request, with the exceptions listed below, for access to, and disclosure of, personally identifiable information from education records.  The record of each request for access and each disclosure must contain the name of the parties who have requested or receive information and the legitimate interest the parties had in requesting or obtaining the information.

A record does not have to be kept if the request was made by or disclosure was made to:

• An eligible student
• A school official who has been determined to have a legitimate educational interest
• A party with written consent from the eligible student
• A party seeking directory information only
• A student serving on an official committee or assisting another school official

Thus requests for, or disclosure of education record information without a student’s written consent, which Norwich University is required to record, would include, but is not limited to:

• Disclosure to the parent (either custodial or noncustodial) of an eligible student
• Disclosure in response to a lawfully issued court order or subpoena
• Disclosure for external research purposes where individual students have been identified
• Disclosure in response to an emergency

These records must be maintained with the education records of the student as long as the records are maintained by Norwich University.

Student Rights Under FERPA:

FERPA affords students certain rights with respect to their education records.  These rights include:

• The right to inspect and review educational records; requests will be complied with no later than 45 days from the date of the student’s written request, which is to be directed to the Registrar’s Office.  Students do not have the right to receive a copy of their record unless failure to do so would prevent them from inspecting and reviewing their record, such as when the student no longer lives within commuting distance.  The Registrar may arrange for these students to inspect the requested records at a college or university located closer to the student.
• The right to request the amendment of education records, which the student believes are inaccurate, misleading or otherwise in violation of the student’s rights of privacy.  If the Registrar does not agree with the student’s request to amend his/her education records, the student may submit a written request to the Dean of Students Office asking for a formal hearing on his/her request.  The Dean shall make the final decision regarding the student’s request.  If the student disagrees with the decision of the Dean, he/she may submit a written statement which will be placed in his/her official record commenting on the disputed information.
• The right to give or to withhold consent to disclosure of personally identifiable information contained in the student's education records, except to the extent that FERPA authorizes disclosure without consent;
• The right to file with the US Department of Education a complaint regarding Norwich University’s compliance with the requirements of FERPA;
• Records relating to individuals who apply for admission but are not admitted or do not enroll are not protected by FERPA; and
• The right to receive notification of rights granted by FERPA.
   

Student Notification

1. New and continuing students are notified of their FERPA rights each semester via the electronic Enrollment Verification process prior to each term.
2. Students are further notified of FERPA rights on the Registrar’s website  http://www.norwich.edu/registrar/
3. Everyone can access Norwich’s Student Data Privacy (FERPA) policy at http://www.norwich.edu/registrar/