Family Educational Rights and Privacy Act (FERPA or Buckley Amendment)
Initially approved: September 1, 2000
Revised: September 23, 2009
Revised: August 15, 2011
Revised: November 15, 2022
Policy Topic: Governance and Administration
Administering Office: Registrar's Office, Office of Legal Counsel and Institutional
I. POLICY STATEMENT
Western Carolina University (“WCU” or the “University”) adheres to a policy of compliance
with the Family Educational Rights and Privacy Act of 1974, also known as the Buckley
Amendment or FERPA, which affords the following rights to students with regard to
their education records:
- to inspect and review the student’s education records;
- to consent to disclosure of the student’s education records to third parties, except
to the extent that FERPA authorizes disclosure without consent;
- to request amendment of the student’s education records to ensure that they are not
inaccurate or misleading;
- to be notified of the student’s privacy rights under FERPA; and
- to file a complaint with the U.S. Department of Education concerning alleged failures
by the University to comply with the requirements of FERPA.
A "student" is defined as a person who (1) has applied, been accepted, and has registered for
classes at the University, at either the graduate or undergraduate level; (2) is currently
attending the University; or (3) has attended the University. “Student” does not include a person who has been admitted but did not attend the University.
For purposes of this policy, the terms “attending” or “attended” means attendance in person or by paper correspondence, videoconference, satellite,
Internet, or other electronic information and telecommunications technologies, as
well as the period during which a student is working under a University work-study
“Education records” are defined as those records directly related to a student and maintained by the
University or by a party acting for the University. “Education records” do not include the following:
- Records of instructional, supervisory, administrative, and certain educational personnel
that are in the sole possession of the maker, are used only as a personal memory aid,
and are not accessible or revealed to any other individual except a temporary substitute
for the maker of the record (e.g., file notes of conversations);
- Records created and maintained by University Police for the purpose of law enforcement,
including law enforcement records that are part of a student conduct investigation;
- Records relating to individuals who are employed by the University that are made and
maintained in the normal course of business, relate exclusively to individuals in
their capacity as employees, and are not available for use for any other purpose;
- Student medical and counseling records created, maintained, and used by a physician,
psychologist or other professional that are used only in connection with the provision
of medical treatment and/or counseling to the student and are not disclosed to anyone
other than individuals providing such treatment/counseling;
- Records created or received by WCU after a student is no longer a student in attendance
and are not directly related to the student’s attendance (i.e., alumni records); and
- Grades on peer-graded papers before they are collected and recorded by the instructor
Records not considered “education records” under this Policy may still be confidential under State or Federal law or other
“Directory Information” means information contained in a student’s education record that would not generally
be considered harmful or an invasion of privacy if disclosed. At WCU, “Directory Information” is defined as:
- Student name
- Local and home address
- Telephone number
- Classification (i.e., freshman, sophomore, junior, senior, graduate student)
- The name of the student’s parent/guardian
- Home county
- Major field of study
- Dates of attendance
- Degrees awarded by the University
- Honors and awards received
- The most recent previous educational agency or institution attended by the student
- Participation in officially recognized activities and sports
- Weight and height of members of athletic teams
- University electronic mail (E-mail) address
“Directory Information” does not include a student’s Social Security number or a student’s WCU identification
number (i.e., “92-number”).
“Personally Identifiable Information” includes, but is not limited to:
- the student’s name;
- the name of the student’s parent or other family members;
- the permanent address of the student or student’s family;
- a personal identifier such as a Social Security number, “92-number”, or biometric
- other indirect identifiers such as the student’s date of birth, place of birth, and
mother’s maiden name;
- other information that, alone or in combination, is linked or linkable to a specific
student, which would allow a person to identify the student with reasonable certainty;
- information requested by a person whom the University reasonably believes knows the
identity of the student to whom the education record relates.
III. DISCLOSURE OF EDUCATION RECORDS
FERPA provides students with the right to inspect and review information contained
in their education records, except as provided below. University officials shall consult
with the Office of Legal Counsel prior to providing copies of education records to
students or third parties.
- Disclosure to the Student
Students wishing to inspect their education records must make written requests (including
by email) to the University official responsible for maintaining the records, listing
the record(s) of interest. Student education records are generally maintained electronically
unless otherwise noted. The student records maintained by the University are classified
- Official academic records are maintained by the Office of the Registrar and include
admission applications, data, and associated documentation; the registration records
for each semester in residence; and the records of grades and credits received in
courses at this University or accepted here from another institution, including academic
- Other records directly relating to academic progress and status may be maintained
by the Office of Student Retention.
- Student support records, including academic advising records, are housed electronically
in the Educational Advisory Board’s Navigate Student Success (“Navigate”) platform
maintained by the Advising Center.
- The Dean of each school/college is the official custodian of records for all school/college
and departmental records regarding students that are not maintained by other departments.
Deans will work with department heads and faculty in their school/college to gather
all academic records for inspection by students, which includes advising, registration
notes, and appointment summaries.
- disciplinary records are maintained under the authority of the Vice Chancellor for
Student Affairs and include information about the investigation, adjudication, and
imposition of sanctions by the University against a student for breach of the University’s
Code of Student Conduct or other written policies.
- Financial records are maintained electronically by the Student Accounts Office. Financial
aid application records, including tax forms, are maintained by the Financial Aid
- Employment records of students receiving financial aid (such as work-study authorizations)
are maintained by the Financial Aid Office. Non-work-study employment records of students
are maintained electronically by Human Resources and Payroll. Graduate student teaching
and research appointment records are maintained electronically by the Graduate School.
If a student is unsure as to the location of a particular record, a written request
should be addressed to the Office of the Registrar, listing the item or items of interest.
The requested records will be made available within forty-five (45) days of receipt
of the request if they are covered by FERPA. Generally, students may have copies of
their education records, subject to the fee and service charge provisions in this
policy, if circumstances make on-site inspection impractical, and the student is in
good standing (i.e., no financial, academic, or conduct “hold” has been placed on
the record by a University official).
Students may not inspect and review the following records/information:
- Financial information submitted by their parents;
- Confidential letters and recommendations associated with admissions, employment or
job placement, or honors to which they have waived their rights of inspection and
- Education records containing information about more than one student, in which case
the University will permit access only to that part of the record which pertains to
the inquiring student;
- Admissions information and application materials related to applicants who were denied
admission to the University; or
- Other records that are excluded from FERPA.
- Disclosure without Student Consent
The University will not disclose any information from a student’s education records
without the student’s prior written consent, except as provided below. The University
will use reasonable methods to identify and authenticate the identity of parents,
students, University officials, and other parties to whom Personally Identifiable
Information is disclosed.
Disclosure without student consent is permitted under the following circumstances:
- University Officials/Outsourcing. University officials with legitimate educational
interests in the student’s education records are allowed access to student education
records. For purposes of this policy, “legitimate educational interests” means the
University official needs to review the education record in order to fulfill his/her
professional responsibilities for the University. University officials who may have
access to education records for legitimate educational interests include the following
- a person employed by the University in an administrative, supervisory, academic or
research, or support staff position, including health, medical, and counseling staff;
- a member of the Board of Trustees;
- a person or entity engaged or employed by or under contract with the University to
perform special services, such as an attorney, attorney’s agent, auditor, or contractor;
- a person who is employed by the University Police;
- a student serving on an official committee, such as a disciplinary or grievance committee,
or who is assisting another University official in performing his/her tasks; and
- contractors, consultants, volunteers, and other outside service providers used by
and under the direct control of the University to perform services that the University
would otherwise provide with its own employees.
Disclosure of education records to a University official having a legitimate educational
interest does not authorize the official to subsequently re-release all or any part
of the records to another party. An unauthorized disclosure of Personally Identifiable
Information from the education records of the student is prohibited. Public posting
of grades by instructors is strictly prohibited.
The University will implement physical, technological access, and administrative controls
to ensure that access to educational records is appropriately limited in compliance
with the legitimate educational interest requirement of FERPA. Administrative controls
include all applicable Division of Information Technology computing systems and devices
policies and procedures, as well as policies adopted by the University Data Security
and Stewardship Committee.
- Other Institutions. The University may release a student’s education records to officials of other educational
institutions in which that student seeks or intends to enroll, or where the student
is already enrolled so long as disclosure is related to the student’s enrollment or
transfer. Additionally, the University may return records to the creator of the records
to verify authenticity.
- State or Federal Supported Programs. The University may disclose records to the U.S. Comptroller General, U.S. Attorney
General, the Secretary of the Department of Education, or State and local educational
authorities, including the State auditor, in connection with an audit or evaluation
of Federal or State supported education programs, or for the enforcement of or compliance
with those programs.
- Financial Aid. The University may disclose a student’s education records to persons or organizations
in connection with that student’s application for or receipt of financial aid, but
only to the extent necessary for such purposes as determining eligibility, amount,
conditions, and enforcement of terms or conditions of such financial aid.
- Institutional Studies. The University may disclose education records under certain circumstances to organizations
conducting studies for, or on behalf of, educational agencies or institutions to (i)
develop, validate, or administer predictive tests; (ii) administer student aid programs;
or (iii) improve instruction. Records disclosed under this provision: (i) must not
permit identification of either a student or parent except to those having a legitimate
interest in the information; (ii) must be destroyed when no longer needed; and (iii)
must be disclosed pursuant to a written agreement that specifies the purpose, scope,
and duration of the study, as well as addresses the limitation on the disclosure of
Personally Identifying Information. Disclosures made pursuant to this exception must
be made through the Office of Institutional Planning and Effectiveness, which will
coordinate with the University Institutional Review Board and other units as necessary.
- Accreditation Agencies. The University may release a student’s education records to accreditation organizations
or agencies for purposes necessary to carry out their accreditation functions.
- Court Orders/Ex Parte Orders. Information concerning a student shall be released in response to a judicial order
or lawfully issued subpoena. The University will make reasonable efforts to notify
the student of a subpoena before complying with it, except that the University shall
not notify a student of a subpoena if it is from a federal grand jury or is for law
enforcement purposes, and it provides that the University shall not disclose to any
person the existence or contents of the subpoena or any information furnished in response
to the subpoena. The University shall not notify a student of an ex parte court order
is obtained by the U.S. Attorney General concerning Patriot Act investigations and
prosecutions. Disclosures made under this section must be coordinated with the Office
of Legal Counsel.
- Litigation. If the University initiates legal action against a parent or student, or if a parent
or student initiates legal action against the University, the University may disclose
to the court, without a court order or subpoena, the education records of the student
that are relevant for the University to proceed with the legal action as plaintiff
or to defend itself in such legal action.
- Health and Safety Emergencies. The University may disclose Personally Identifiable Information (“PII”) from an
education record to appropriate parties, including parents, in connection with an
emergency if knowledge of the information is necessary to protect the health or safety
of the student or other individuals. This exception is limited to the period of the
emergency and generally does not permit a blanket release of PII from a student’s
education records. Disclosures made under this Section shall be coordinated with the
Vice Chancellor for Student Affairs.
- Directory Information. At its discretion, the University may disclose Directory Information without student
consent unless a student submits a written request to the Registrar to withhold such
information from disclosure. Students may withhold Directory Information by notifying
the Registrar's Office in writing within five working days from the first day of classes
for any semester. Requests for non-disclosure of Directory Information will be honored
indefinitely unless the student submits to the Registrar a written revocation of such
request for non-disclosure. Students are warned, however, prior to making a decision
to withhold Directory Information , that undesirable consequences frequently occur,
such as names of students on the Dean's List are not published, names are not listed
in commencement bulletins, and requests from prospective employers are denied. The
University will continue to honor a former student’s opt-out request unless and until
the request is revoked by the former student. Any opt-out request made under this
Section shall not prohibit the disclosure of identifying information in class.
- Student Conduct Hearing Results
- Disclosure to Victims: When requested in writing, the University must disclose to an alleged victim (or
if the victim is deceased as a result of such crime or offense, to the next-of-kin)
of any crime of violence, or a non-forcible sex offense (as those terms are defined
by the implementing regulations of FERPA), the final results of any student conduct
proceeding conducted by the University against the alleged perpetrator or Respondent
of such crime or offense, regardless of whether the alleged perpetrator was found
responsible for violating the University’s rules or policies with respect to such
crime or offense. There is no prohibition on re-disclosure.
- Disclosure to Third Parties: The University must disclose the final results of any student conduct proceeding
against a student who is an alleged perpetrator of any crime of violence or non-forcible
sex offense (as those terms are defined in the implementing regulations of FERPA),
if the student is found responsible for violating the University's rules or policies
with respect to such crime or offense. Such disclosure shall include only the name
of the student, the violation committed, and any sanction imposed by the University
on that student. Such disclosure shall not include the name of any other student,
such as a victim or witness, without the prior written consent of that student.
- Alcohol and Drug Violations. The University may disclose to a parent or legal guardian of a student, information
regarding any violation of any Federal, State, or local law, or of any rule or policy
of the University, governing the use or possession of alcohol or a controlled substance,
regardless of whether that information is contained in the student's education records,
if the student is under the age of 21 at the time of disclosure to the parent, and
the University determines that the student is responsible for a student conduct violation
with respect to such use or possession.
- Sex Offenders. The University may disclose information concerning sex offenders and other individuals
as required or permitted by applicable State law and the Violent Crime Control and
Law Enforcement Act of 1994 if the information was provided to the University under
applicable Federal guidelines.
- De-identified Records and Information. The University may disclose records or information without student consent after
the removal of all Personally Identifiable Information, in compliance with FERPA implementing
- Disclosure with Student Consent
In all other cases, the University will not disclose Personally Identifiable Information
in education records or allow access to those records without signed and dated written
consent of the student. Such consent must specify the records to be disclosed, the
party to whom the records are to be disclosed, and the purpose of the disclosure.
“Signed and dated written consent” may include a record and signature in electronic
form that: (1) identifies and authenticates a particular person as the source of the
electronic consent; and (2) indicates such person’s approval of the information contained
in the electronic consent. A student may satisfy the consent requirement by establishing
other individual(s) as a proxy, which may include phone and online disclosure options.
Information on setting up proxy access can be found on the University’s FERPA webpage
- Record of Disclosures
The Office of the Registrar shall maintain a record of each request for access to
and each disclosure of personally identifiable information from the education records
of each student when required. A record is not required if the request was from, or
the disclosure was to:
- the student;
- a party with written consent from the student or the parent of a dependent student;
- University officials who have a legitimate educational interest;
- a party seeking Directory Information;
- a party seeking or receiving the records as directed by a Federal grand jury or other
law enforcement subpoena when the issuing court or other issuing agency has ordered
that the existence or the contents of the subpoena or the information furnished in
response to the subpoena not be disclosed; or
- a party seeking or receiving records in accordance with the U.S. Patriot Act.
The Office of the Registrar will maintain a record of each request for access to and
each disclosure of education records, as well as the names of State and local educational
authorities and Federal officials and agencies referenced in Section III.B.3 above,
and will maintain such records with the education records of the student as long as
the records are maintained. For each such request or disclosure the record must include:
(1) the parties who have requested or received Personally Identifiable Information
from the education records; and (2) the legitimate interests the parties had in requesting
or obtaining the information.
The University must obtain a copy of a record of further disclosures made by State
and local educational authorities and Federal officials and agencies referenced in
Section III.B.3 above. The Vice Chancellor for Student Affairs must record the following
information in connection with the health and safety exception referenced in Section
III.B.9 above: (i) the articulable and significant threat to the health or safety
of a student or other individual; and (ii) the parties to whom the University disclosed
- Records of Deceased Students
The University does not release educational records of a deceased student unless:
(1) authorized by the executor/executrix of the deceased student's estate; (2) authorized
by the deceased student's parents if no executor/executrix has been appointed; or
(3) death is established by a certified copy of a death certificate.
IV. REQUESTS TO AMEND RECORDS
If a student believes his/her education record is inaccurate or misleading, the first
step is to discuss the concern with the person who maintains the record. This does
not apply to grade disputes (although it may be used to correct a clerical error in
grades). If the record keeper does not agree with the student, the record keeper will
inform the student of the right to a formal hearing.
A student must request a formal hearing within fifteen (15) business days from the
date the student is informed by the record keeper of the right to a hearing. The request
must be in writing, and must be delivered to the Vice Chancellor or Dean to whom the
record keeper ultimately reports.
The University official who receives the formal hearing request shall either hear
the case personally or designate a person or persons to hear it, provided that those
who hear the case do not have a direct interest in the outcome of the hearing. Within
a reasonable period of time after the request for hearing, the student shall be informed
in writing of the date, place, and time of the hearing. The student may present evidence
relevant to the issues raised and may be assisted at the hearing by one or more persons
of his/her choice, and/or represented by an attorney at his/her expense.
The person(s) hearing the case shall decide it solely on the basis of the evidence
presented at the hearing. The decision shall be in writing, delivered to all parties,
and will summarize the evidence and state the reason(s) for the decision. If the decision
is in favor of the student, the education records will be amended accordingly. If
the decision is unsatisfactory to the student, he or she may place with the education
record a statement commenting on the information in the records or setting forth any
reasons for disagreement with the decision. Such statements will be maintained as
part of the student’s education record and released with the record anytime it is
disclosed to third parties.
The decision of the person(s) hearing the case is final. A student who believes that
the outcome of a hearing to amend his or her education records was unfair or not in
keeping with the provisions of FERPA may file a complaint in accordance with Section
VI of this policy.
Students who believe that the adjudication of their challenges were unfair or not
in keeping with the provisions of FERPA or that their rights have been abridged, may
file complaints with the Family Policy Compliance Office, US Department of Education,
400 Maryland Avenue, SW, Washington, D.C. 20202-5920 concerning the alleged failures
of the University to comply with FERPA.
The University provides official notice to students of their rights under FERPA by
publishing such notice in the Graduate and Undergraduate Catalogs (http://catalog.wcu.edu),
and in financial aid consumer disclosures sent annually by email.
VIII. POLICY REVIEW
This policy shall be reviewed and revised as necessary every four (4) years or as
necessitated by amendments to FERPA or its implementing regulations.
 However, State law (G.S. 132-1.1(f)) provides that personally identifiable information
from or about an applicant to a University of North Carolina constituent institution
is confidential and not subject to disclosure. Any letter of recommendation or record
containing a communication from an elected official to the University concerning an
applicant for admission who has not enrolled as a student is a public record and is
subject to disclosure.
 FERPA permits the disclosure of the information specified in this paragraph; however,
the North Carolina Public Records Act (G.S. 132-1 et seq.) requires it. See DTH Media
Corp. v. Folt, 259 N.C. App. 61, 816 S.E.2d 518 (2018), review allowed, writ allowed,
371 N.C. 570, 819 S.E.2d 376 (2018), and aff'd, 374 N.C. 292, 841 S.E.2d 251 (2020).