Safeguarding Student Data: Arizona Law Puts Parents in Control

A new Goldwater Institute law empowering parents to safeguard their children’s private information passed an important first hurdle in the Arizona Legislature this week.  

Sponsored by Representative Justin Olson and approved by the House Education Committee in a unanimous, bipartisan 12-0 vote, HB2514 provides parents greater control over public school districts’ ability to release students’ personal information to third parties. 

Since 1974, the federal Family Educational Rights and Privacy Act (FERPA) has granted students and their parents certain rights regarding access to and control over educational records maintained by schools that receive federal funding. This includes control over the disclosure of those records: schools generally cannot release personally identifiable information from student records without written consent. 

However, the law includes a “carve-out” exception that doesn’t require written consent for the release of some personal information. FERPA allows the release of “directory information”—such a student’s name, mailing address, telephone number, e-mail address, date/place of birth, participation in sports, dates of attendance, etc.—without prior written consent, as long as the school has notified students and parents and given them the opportunity to opt out.   

Usually, a school will provide this opportunity in an annual notice to parents at the beginning of the school year—along with a firehose of other information such as calendars, school lunch details, student conduct expectations, and more. Due to this deluge, the FERPA notice is usually ignored, and very few parents take the steps to opt out of the release of their child’s personal information. As a result, the school can release the information for almost all of its students to third parties.   

This third-party release can lead to exploitation for targeted advertising, safety and security threats (including harassment and stalking), and even identity theft. That’s why HB2514 requires an opt-in process where parents must give prior written consent to a school’s release of their child’s mailing address, telephone number, or email address.  

It ought to be a no-brainer: public schools should obtain affirmative written consent from parents before releasing a child’s private information.  

HB2514 is now headed to the House floor.  

Christopher Thomas is Director of Legal Strategy for Education Policy at the Goldwater Institute.