Subject: FERPA Policy and Procedure

Organizational Area: Academic Affairs
Effective Date: August 1, 2023 
Revision Cycle: Five-year cycle
Corresponding BOT Policies: None 

Section 1: Purpose and Scope 

Under federal law, the Family Educational Rights and Privacy Act (FERPA) (External Site), students have specific rights regarding their personally identifiable information maintained by the University of Maine System (University). Records containing personally identifiable information about students are located in many offices and data systems, including, but not limited to, MaineStreet, Brightspace, EAB, registrar/student records, academic departments, residence life, student affairs, etc. The University will conform to fair information practices meaning that students who are subjects of data systems of the University) will: 

  • Be given assurances that such information is used only by University officials who need the information to perform a service or function of their job. 
  • Be given the opportunity to request an amendment or correction to their records that are inaccurate, misleading, or in violation of the student’s privacy. 
  • Be certain that those responsible for data systems take reasonable precautions to prevent misuse of the information. 
  • Know that the institution will reasonably respond when an alleged misuse of, or access to, information is brought to the attention of those responsible for data systems. 

This APL provides guidelines for following the requirements set forth by FERPA. 

Section 2: Definitions: 

  • Legitimate Educational Interest: The “need to know” of those University officials who need a student’s record or information to perform a function of their job. 
  • Personally Identifiable Information (PII): Data or information which includes, but is not limited to (a) the student’s name; (b) the name of the student’s parent or other family members; (c) the address of the student or student’s family; (d) a personal identifier, such as the student’s social security number, student number, or biometric record; (e) other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name; (f) other information that alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the University community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or (g) information requested by a person who the University reasonably believes knows the identity of the student to whom the education record relates. 
  • Directory Information: Information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. 
  • Record: Any information or data recorded in any medium (e.g. handwriting, print, tapes, film, microfilm, microfiche, database, or any form of electronic data storage, including emails). 
  • School Official: Those members of the University who perform a service or function for or on behalf of the University. These may include faculty, administration, clerical and professional employees, and other persons who manage or use student education record information, including student employees or agents. It also includes contractors, volunteers, and others performing institutional functions or services. 
  • Student: Any individual who has been in attendance at the University for whom the University maintains education records. An individual who is or has been a student in one component unit of the University and applies for admission to a second unit of the University has no right to inspect the records accumulated by the second unit until the student has been accepted and attended the second unit.

Section 3: FERPA Requirements 

1. The Application of FERPA 

a. FERPA applies to the education records of persons who are, or have been, in attendance at the University, including students in cooperative, Early College, and online study programs and in any non-traditional educational delivery processes, such as distance learning, regardless of age. 

b. FERPA does not apply to records of applicants for admission who are denied acceptance or, if accepted, never attend the University. 

c. The University has established dates by which a person is considered a “student” and at which time FERPA applies. 

i. For fall terms, any person enrolled on or after August 15 is considered a “student.” 

ii. For spring terms, any person enrolled on or after January 1 is considered a “student.” iii. For winter session, any person enrolled on or after December 15 is considered a “student.” iv. For summer terms, any person enrolled on or after May 1 is considered a “student.” 

2. Directory Information 

a. FERPA requires the University to give public notice to students in attendance of the categories of personally identifiable information which the institution has designated as Directory Information. The University has designated the information below as Directory Information for purposes of FERPA. FERPA allows the University to disclose Directory Information to the public unless a student has taken formal action to request confidentiality of their Directory Information from the University. 

Directory information includes: 

i. Name* 
ii. Mailing Address **
iii. University Email Address 
iv. Program of Study 
v. Dates of Attendance 
vi. Degrees and Awards received (including dates) 
vii. Most recent previous educational institution attended 
viii. Participation in sports and activities 
ix. Class Level 
x. Enrollment status (full/part-time) 
xi. Personal athletic statistical data 

* If a student provides a preferred/chosen name, that will be considered Directory Information instead of the legal name. The University will use/release the legal name in cases where the use of the legal name is required (e.g. State and Federal reporting, subpoenas, tax documents, etc.). 

** Each student’s home address recorded at the time of admission will be, by default, used as their “Mailing Address” for Directory Information purposes until/unless they provide a separate, specific “Mailing Address”. Once a student has done so, only that address will be used for Directory Information from that point forward.

3. Annual Notification 

The University is required to notify students in attendance annually of their FERPA rights. The University institutions shall all use the notification below as recommended by the American Association of Collegiate Registrars and Admissions Officers (AACRAO). 

Annual FERPA Notification to Students 

The Family Educational Rights and Privacy Act (FERPA) affords University students certain rights with respect to their education records. These rights include:

  1. The right to inspect and review the student’s education records within 45 days after the day the University receives a request for access. A student should submit to the registrar, dean, head of the academic department, or other appropriate official, a written request that identifies the record(s) the student wishes to inspect. The school official will make arrangements for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the school official to whom the request was submitted, that official shall advise the student of the correct official to whom the request should be addressed
  2. The right to request the amendment of the student’s education records that the student believes are inaccurate, misleading, or otherwise in violation of the student’s privacy rights under FERPA. A student who wishes to ask the University to amend a record should write the school official responsible for the record, clearly identify the part of the record the student wants to be changed, and specify why it should be changed. If the University decides not to amend the record as requested, the University will notify the student in writing of the decision and the student’s right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing. 
  3. The right to provide written consent before the University discloses personally identifiable information (PII) from the student’s education records, except to the extent that FERPA authorizes disclosure without consent. The University discloses education records without a student’s prior written consent under the FERPA exception for disclosure to school officials with legitimate educational interests. A school official typically includes a person employed by the University in an administrative, supervisory, academic, research, or support staff position (including law enforcement unit personnel and health staff); a person serving on the board of trustees; or a student serving on an official committee, such as a disciplinary or grievance committee. A school official also may include a volunteer or contractor outside of the University who performs an institutional service or function for which the University would otherwise use its own employees and who is under the direct control of the University with respect to the use and maintenance of PII from education records, such as an attorney, auditor, or collection agent or a student volunteering to assist another school official in performing their tasks. A school official typically has a legitimate educational interest if the official needs to review an education record in order to fulfill their professional responsibilities for the University. 
  4. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the University to comply with the requirements of FERPA. The name and address of the office that administers FERPA is: 

    Student Privacy Policy Office
    U.S. Department of Education 400 Maryland Avenue, SW 
    Washington, DC, 20202
  5. Students can make a request that their directory information not be released. Students must submit a Request to Suppress Directory Information form to the Registrar’s Office or through MaineStreet. The request will be honored until such time as the student requests otherwise in writing. In the event that such written notification is not filed, the University assumes that the student does not object to the release of directory information.

FERPA permits the disclosure of PII from students’ education records without the consent of the student if the disclosure meets certain conditions found in FERPA. In addition to disclosures to school officials, such disclosures without a student’s consent include, but are not limited to, disclosures related to judicial orders or lawfully issued subpoenas, disclosures of directory information, and disclosures to the student. FERPA requires the institution to record most such disclosures. Students have a right to inspect and review the record of disclosures. The University may disclose PII from education records without obtaining prior written consent of the student — 

  • To school officials, including teachers, within the University whom the school has determined to have legitimate educational interests. This includes contractors, consultants, volunteers, or other parties to whom the school has outsourced institutional services or functions.
  • To officials of another school where the student seeks or intends to enroll or where the student is already enrolled if the disclosure is for purposes related to the student’s enrollment or transfer.
  • To authorized representatives of the U. S. Comptroller General, the U.S. Attorney General, the U.S. Secretary of Education, or State and local educational authorities, such as a State postsecondary authority that is responsible for supervising the University’s State-supported education programs. Disclosures under this provision may be made in connection with an audit or evaluation of Federal- or State-supported education programs or for the enforcement of or compliance with Federal legal requirements that relate to those programs. These entities may make further disclosures of PII to outside entities that are designated by them as their authorized representatives to conduct any audit, evaluation, or enforcement or compliance activity on their behalf.
  • In connection with financial aid for which the student has applied or which the student has received, if the information is necessary to determine eligibility for the aid, determine the amount of the aid, determine the conditions of the aid, or enforce the terms and conditions of the aid.
  • To organizations conducting studies for, or on behalf of, the University, in order to: (a) develop, validate, or administer predictive tests; (b) administer student aid programs; or (c) improve instruction. ● To accrediting organizations to carry out their accrediting functions.
  • To parents of an eligible student if the student is a dependent for IRS tax purposes.
  • To comply with a judicial order or lawfully issued subpoena.
  • To appropriate parties, including a student’s parents, in connection with a health or safety emergency.Information the school has designated as “directory information.” 

    Directory information includes: 
  • Name* 
  • Mailing Address **
  • University Email Address 
  • Program of Study 
  • Dates of Attendance 
  • Degrees and Awards received (including dates) 
  • Most recent previous educational institution attended 
  • Participation in sports and activities 
  • Class Level 
  • Enrollment status (full/part-time)
  • Personal athletic statistical data 

    *If a student provides a preferred/chosen name, that will be considered Directory Information instead of the legal name. The University will use/release the legal name in cases where the use of the legal name is required (e.g. State and Federal reporting, subpoenas, tax documents, etc.). 

    ** Each student’s home address recorded at the time of admission will be, by default, used as their “Mailing Address” for Directory Information purposes until/unless they provide a separate, specific “Mailing Address”. Once a student has done so, only that address will be used for Directory Information from that point forward.
  • To a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense. The disclosure may only include the final results of the disciplinary proceeding conducted by the University with respect to that alleged crime or offense, regardless of the finding. 
  • To the student. 
  • To the general public, the final results of a disciplinary proceeding if the University determines the student is an alleged perpetrator of a crime of violence or non-forcible sex offense and the student has committed a violation of the University’s rules or policies with respect to the allegation made against them. 
  • To parents of a student regarding the student’s violation of any Federal, State, or local law or of any rule or policy of the University, governing the use or possession of alcohol or a controlled substance if the school determines the student committed a disciplinary violation and the student is under the age of 21. 

Annual FERPA Alternative Notification to Students 

To simplify the process for providing the annual FERPA notification, the University may use the following information for its annual notification: 

The Family Educational Rights and Privacy Act of 1974 (FERPA) helps protect the privacy of students’ education records. The Act provides students:

1. The right to inspect and review their education records 

a. A request to access a record shall be made in writing to the office which maintains the record 

2. The right to seek to amend those records that the student believes to be inaccurate, misleading, or otherwise in violation of the student’s privacy rights 

a. The student must submit the request in writing to the office where the records are maintained. 

3. The right to provide written consent to disclosures of personally identifiable information, except when released to school officials with a legitimate educational interest. 

a. School officials include: An employee of the University, a person or company contracted by the University, a Board of Trustees member, a University volunteer working under the supervision of another school official, and a student serving on an official committee. 

b. A school official has a legitimate educational interest if the official needs to review a record to fulfill professional responsibilities. 

4. The right to file a complaint with the U.S. Department of Education concerning alleged failures of the University to comply with FERPA. The name and address of the office that administers FERPA is: 

Student Privacy Policy Office
U.S. Department of Education 
400 Maryland Avenue, SW 
Washington, DC, 20202 

The University generally may not disclose FERPA-protected information from a student’s education record without the student’s consent, with some exceptions, including, but not limited to: Student’s Written Consent; Valid Subpoenas; Search Warrants; Ex Parte Order (Patriot Act); or Emergency/Crisis Situation. 

All information not listed in Directory Information (below) is considered Non-Directory and must remain confidential, with the above-noted exceptions. Only Directory Information may be released to non-University Officials without the student’s permission unless the student has requested suppression of their Directory Information. 

Directory information includes: 

  • Name* 
  • Mailing Address **
  • University Email Address 
  • Program of Study 
  • Dates of Attendance 
  • Degrees and Awards received (including dates) 
  • Most recent previous educational institution attended 
  • Participation in sports and activities 
  • Class Level 
  • Enrollment status (full/part-time) 
  • Personal athletic statistical data 

* If a student provides a preferred/chosen name, that will be considered Directory Information instead of the legal name. The University will use/release the legal name in cases where the use of the legal name is required (e.g. State and Federal reporting, subpoenas, tax documents, etc.).

** Each student’s home address recorded at the time of admission will be, by default, used as their “Mailing Address” for Directory Information purposes until/unless they provide a separate, specific “Mailing Address”. Once a student has done so, only that address will be used for Directory Information from that point forward.

Students can make a request that their directory information not be released. Students must modify their Privacy Settings through their MaineStreet Student Center or submit a Request to Suppress Directory Information form to the Registrar’s Office. Students also have the option to have all directory information released except address (for the purpose of this exclusion, address is defined as both physical and email address). 

Section 4: Revisions to this APL 

1. This APL provides guidelines for the consistent application of FERPA regulations and guidelines across the University of Maine System. Future modifications may be considered based on recommendations from the appropriate student service area (typically, Student Records) and supported by advice from the General Counsel to the UMS Vice Chancellor for Academic Affairs and the Council of Chief Academic Officers. The final authority for the approval of such modifications sits with the VCAA and the Council of Chief Academic Officers. Notification of changes to this APL should be distributed to all UMS employees. 

2. The Vice Chancellor of Academic Affairs will determine if revisions to this APL are substantive or non-substantive. Substantive changes are required to follow the APL creation and revision process outlined above. Non- substantive changes to this APL do not require any review beyond the Responsible Official. Non-substantive changes are minor changes that do not affect the overall purpose and instructions outlined by the document. Non-substantive changes may take many forms, including, but not limited to: grammar or spelling corrections, inclusive language, technical revisions, updated names and contacts of pertinent offices or departments, or reorganized APL sections. 

Section 5: Contacts

For questions regarding this APL, please contact the office of the Vice Chancellor of Academic Affairs 

Section 6: Resources

For more information regarding FERPA, please consult Protect Student Privacy (External Site).

Back to APL page.