Receiving private info about someone else's kid...how to correct

May 15, 2022 7:52 AM

I am receiving email, including private information about a student at a school part of a major charter-school network in the U.S. Besides containing private info the emails allow me to (without entering any password or anything) set up meetings, consent to medical procedures for this student. It makes me very angry that this school is so careless with its students privacy, not to mention my ability to set things up for this student. Obviously a FERPA violation. How/to whom do I report this?

I have called the school multiple times and reported this. It has not been corrected. I have pointed out to them that this is a FERPA violation. It has not been corrected. I have pointed out that I can consent to medical procedures for this child. I still can.

My email is [e-mail]. One time when I called the school and told them my email they repeated back to confirm firstname.lastnameNUMBER? And I said no, just firstname.lastname . SO sent an email to firstname.lastnameNUMBER and this is indeed the parent of the child. She said "Oh, is your kid, OtherStudentName? I get the emails for you. I called the school but they didn't fix it" No. I don't have a kid in the school or even live in that country.

This makes me very angry on behalf of this child. I want to report it to whomever would be the FERPA enforcer here. How do I do this?

posted by If only I had a penguin... to Law & Government (6 answers total)

I work in education. You need to send an email to the principal of the school, the superintendent/executive director (if you can find who that is), and the parent of the affected student. Tell them very directly that you have received information about a student that is FERPA protected and that you've contacted the school and asked them to remedy it with no result. At this point, you can either threaten them with reporting or actually do it or whatever you decide. If you do want to report, the US Department of Education is who you want to contact. They have a page about reporting FERPA violations for your own student but I'd bet you could file a report and note somewhere that it isn't your student but that you are the person erroroneously receiving the protected information.

What they are doing is super unprofessional and anyone in that organization that has even the smallest understanding of legal exposure should realize this could go very badly for them if the wrong people got bent about it, especially the parent of the student you are getting info about. I hope you can clear this up - this is not right and the fact they aren't fixing it immediately is appalling.
posted by _DB_ at 8:15 AM on May 15, 2022 [10 favorites]

From some googling it looks like the US Department of Education enforces FERPA, and there is a page here for making complaints. But, it looks like the complaint system is geared for people making complaint about their own privacy rights being violated, not members of the public making complaints about someone else's privacy rights being violated, so I'm not sure how far this will get you.

If the school you are talking about is a major business (as it sounds), then you might be able to google up the name of a General Counsel-type, and you could send that person an email.
posted by Mid at 8:15 AM on May 15, 2022 [1 favorite]

Even if the charter school is run by some national network it is still a part of the public school district in which it is located, as far as I know. So, google the name of the town and "superintendent of schools" and then write to them. They should be able to sort this out and, we'd hope, somehow penalize the school official responsible for this.
posted by mareli at 8:32 AM on May 15, 2022 [3 favorites]

If the Principal doesn't fix it, contact the school board/ board of directors. I have [e-mail]. The initials are not terribly unique and I get misdirected mail. I send 1 response.
posted by theora55 at 9:14 AM on May 15, 2022 [1 favorite]

i had a similar situation resolved by email with the principal. much easier and more satisfying result than misaddressed bank and medical information.
posted by 20 year lurk at 10:17 AM on May 15, 2022

If going up the ladder doesn't fix anything, I would even consider getting in touch with the local news, because it's surely newsworthy when a school endangers students' privacy.
posted by trig at 4:38 AM on May 16, 2022