STATE OF TENNESSEE Office of the Attorney General IIER,BERT ÌI. SLATERY III ATTORNEY GENERAL ANÞ REPORTER P.O. BOX 2O2O7, NASHVILLE, Tt-t 37202 TELEPHONE (615)741-3491 FACSTMTLE (615)74r-2OO9 September 13,2017 Dr. Candice McQueen Commissioner Tennessee Department of Education Andrew Johnson Tower, 9th Floor 710 James Robertson Parkway Nashville, TN 37243 Dear Commissioner McQueen: Enclosed is the attached opinion per your request. Please let us know questions. further As always, we appreciate your assistance and cooperation. if you have any Sincerely, 44n HERBERT H. SLATERY III Attorney General and Reporter Enclosure Ð_ STATE OF'TENNESSEE OFFICE OF THE ATTORNEY GENERAL September 13,2017 Opinion No. 17-39 Disclosure of Student Directory Information to Chartering Authorities and Public Charter Schools Ouestion I Under recently enacted legislation, upon receiving a request from "a chartering authority or a public charter school" approved to operate in the district, a local education agency must provide "a list of student names, ages, addresses, dates of attendance, and grade levels completed." 2017 Tenrt Pub. Acts, ch. 307, $ 20 (codified at Tenn. Code Ann. ç 49-13-132). May a school district refuse to provide this information to an approved chartering authority or public charter school on the basis of the Family Educational Rights and Privacy Act of 1974 (FERPA), 20 U.S.C. $ 12329? May a school district refuse to provide a chartering authority or public charter school with the directory information specified in Tenn. Code Ann. $ 49-13-132 if the school district has adopted a policy pursuant to FERPA that would otherwise bar the release of the information? Oninion 2 Yes, but only temporarily. Each school district or local education agency must promptly amend its policy to permit the release of the information specified in $ 49-13-132Io chartering authorities and public charter schools and must notify parents of the new policy and allow them a reasonable opportunity to opt out of the disclosure of student information. After providing this notice and opportunity to opt out, the school district must comply with ç 49-13-132. Ouestion 3 Does Tenn. Code Arur. $ 49-13-132 prohibit chartering authorities and public charter schools from using student contact information received from local education agencies to contact parents and provide them with additional public school options available to their children? ANALYSIS Together, federal, state, and local laws, regulations, and policies establish a framework that protects the privacy of student education records and the sensitive information they contain while also permitting, and in some circumstances mandating, the release of specific information. The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. $ 12329, and its implementing regulations establish the federal law framework governing access to and disclosure of student information and student records. See Gonzaga Univ. v. Doe, 536 U.5.273,278-79 (2002). FERPA protects the privacy of students' education records and personally identifiable information by conditioning the receipt of federal funds on compliance with the statute. See 20 U.S.C. $ 1232g(b); Tenn. Att'y Gen. Op. 15-55 (Iuly 2,2015). With limited exceptions, FERPA denies federal funds to any educational agency or institution that has a policy or practice of releasing educational records or personally identifiable information without prior written consent from parents. 20 U.S.C. $ 1232g(b)(1). FERPA provides several exceptions to the requirement of prior consent, including an exemption for a category of information called "directory information," which the statute defines to include: the student's name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended by the student. 20 u.S.C. $ 1232g(a)(sxA). "Directory information" may be disclosed without prior parental consent, id. 1232g(b)(1), but an educational agency or institution that intends to disclose directory $ information "shall give public notice of the categories of information which it has designated as such information with respect to each student attending the institution or agency and shall allow a reasonable period of time after such notice" for parents to inform the agency or institution that they do not want the information to be released without their prior consent, id. $ I232g(a)(5)(B). The U.S. Department of Education has issued regulations implementing FERPA that "set out requirements for the protection of privacy of parents and students," 34 C.F.R. ç 99.2, and these regulations provide further guidance about directory information and the procedures governing its disclosure. The regulations define "directory information" as "information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed," aîd indicate that "directory information includes, but is not limited to" a series of specific types of student information similar to the statutory list in $ 1232g(a)(5)(A), but also including, among other things, a student's "electronic mail address; photograph; [and] . . . grade level." 34 C.F.R. $ 99.3. The Department of Education has thus construed the statutory list of directory information in $ I232g(a)(5XA) not to be exhaustive and continually updates and supplements the examples provided in the regulatory definition. See Elec. Privacy Info. Ctr. v. U.S. Dep't of Educ.,48 F. Supp. 3d 1,6 (D.D.C. 2014). 2 Section 99.37 of the Department's FERPA regulations specifically addresses the disclosure of directory information. See 34 C.F.R. $ 99.31(aX11) (providing that the disclosure of personally identifiable information without prior consent is permissible if the "disclosure is information the educational agency or institution has designated as 'directory information,' under the conditions described in $ 99.37"). Under $ 99.37, an educational institution or agency "may disclose directory information if it has given public notice" to parents and eligible students of three things: (1) the "types of personally identifiable information that the agency or institution has designated as directory information"; (2) the parent's or student's "right to refuse to let the agency or institution designate any or all of those types of information about the student as directory information"; and (3) the period oftime the parent or student has "to notify the institution or agency in writing that he or she does not want any or all" of that information designated as directory information. Id. $99.37(aXl)-(3); see also 20 U.S.C. $1232g(a)(5XB) (imposing similar requirements). In the public notice to parents and eligible students required by $ 99.37(a), an educational agency or institution may also choose to "specify that disclosure of directory information will be limited to specific parties, for specific pulposes, or both." 34 C.F.R. $ 99.37(d). If an educational agency or institution chooses to limit its disclosures of directory information in this way and provides notice of these limitations, "the educational agency or institution must limit its directory information disclosures to those [parties or purposes] specified in its public notice." Id. Tennessee law also protects the privacy of the information contained in student education records with limited exceptions. See Tenn. Code Ann. $ 10-7-504(aX4). Although the Tennessee Public Records Act generally makes all "state, county, and municipal records" subject to inspection, id $ 10-7-503, the Code exempts the records of students in public educational institutions from this requirement, see id. $ 10-7-504(aXaXA) ("The records of students in public educational institutions shall be treated as confidential."). The Tennessee Public Records Act also "carves out exceptions to the exception," however, "thus allowing disclosure fof student information] in some instances." Tenn. Att'y Gen. Op. 03139 (Oct. 27,2003). Like FERPA, the Tennessee Code provides an exception for the disclosure of directory information relating to students. Tennessee Code Annotated $ l0-7-504(aX4XA) permits disclosure of "information relating only to an individual student's name, age, address, dates of attendance, grade levels completed, class placement and academic degrees awarded." This provision does not mandate the release of such information, but does give a public educational institution in Tennessee the "discretionary authority to release the information in question as may be consistent with the statutory purpose of maintaining confidentiality." Tenn. Att'y Gen. Op. 15- 55 (July 2,2015). Finally, school districts, local education agencies, and institutions of higher education in Tennessee have adopted policies that designate particular information as directory information and notify parents and students of their rights to inform the agency or institution that they do not want their information designated as directory information and released without prior consent. See, e.g., Metropolitan Nashville Public Schools, 2017-2018 Student-Parent Handbook, at 11 (designating particular information as "directory information" and notifying parents of their right to opt out of disclosure), available at www.mnps.orglparentstudent-handbook; Perry County Board of Education Notice, FERPA Rights (same), available ø/ www.perrycountyschools.us/ferpaa J rights.html; University of Tennessee Knoxville, FERPA and Student Privacy (same), available at ferpa. utk. edu/po added Ii cy. In the "Tennessee High-Quality Charter Schools Act" of 2017, the General Assembly to this existing framework a new provision requiring the disclosure to charter schools of specific information from student records. 2017 Tenn. Pub. Acts, ch. 307, $ 20 (codihed at Tenn. Code Ann. $ 49-13-132). Chapter 307 amended the Tennessee Public Charter Schools Act of 2002, Tenn. Code Ann. $ 49-13-107 et seq., to require a local education agency to provide "a list of student names, ages, addresses, dates of attendance, and grade levels completed" at no cost within thirty days of receiving a request for the information from "a chartering authority or a public charter school approved to operate one (1) or more schools in the district." Tenn. Code Ann. $ 4913-132. Section 49-13-I32 prohibits further disclosure of the information by the receiving entity "without prior written consent from the parent or eligible student," and mandates that the receiving entity "adopt and implement a policy allowing parents or eligible students to decline to receive further information from the charter school." The stated purpose of $ 49-13-132 is "[t]o effectuate $ 49-13-113," which provides that "fp]articipation in a public charter school shall be based on parentalchoice or the choice of the legal guardian or custodian." Tenn. Code Ann. $ 49-13-113(a). 1. A school district or local education agency in Tennessee must comply with the new disclosure mandate in $ 49- 13- I32, andnothing in FERPA prohibits that disclosure. The particular information that $ 49-13-132 requires to be provided parallels the types of information listed as "directory information" under FERPA and permitted to be disclosed under Tenn. Code Ann. $ 107-50a@)Ø)(A). And $ 49-13-132 specifically requires adherence to these two existing laws: "[A local education agency] shall provide at no cost a list ofstudent names, ages, addresses, dates of attendance, and grade levels completed in accordance with fTenn. Code Ann.] $ 10-7-504 and IFERPA] (20 U.S.C. $ 12329);' As noted, FERPA includes within its non-exhaustive list of "directory information," students' names, addresses, birth dates, and dates of attendance,20 U.S.C. $ 1232g(a)(5XA), and its implementing regulations additionally include "grade level," 34 C.F.R. $ 99.3. Each type of information required to be disclosed by $ 49-13-132 is thus expressly listed as an example of "directory information" either in FERPA or its implementing regulations. And the list of information required to be disclosed by $ 49-13-132 is identical to information included in Tenn. Code Ann. $ 10-7-504(aXaXA) for which disclosure is permissible. Accordingly, the disclosures mandated by $ 49-13-132 are consistent with both existing federal and state law. Each expressly allows the disclosure of the specific information listed in $ 49-13-132. Although federal law may preempt state-law requirements if the two conflict or if state law undermines a federal regulatory scheme or federal objectives, see Lake v. Memphis Landsmen, LLC,405 S.W.3d 47 ,55-57 (Tenn. 2013) (describing the types of preemption), no such conflict or preemption exists here. Section 49-I3-I32 mandates the disclosure of information to charter schools in order to effectuate state law governing enrollment in those schools, and federal law expressly permits the disclosure of that information. Nothing in FERPA or any other federal law or regulation prohibits the state from determining that a specific disclosure that was formerly discretionary under state law should now be mandatory. And the state's action in doing so does not undermine the conf,rdentiality scheme set up by FERPA but is instead entirely consistent with it. As a result, school districts and local education agencies in Tennessee can and must comply with both FERPA and $ 49-13-132. 4 2. Under the U.S. Department of Education's regulations implementing FERPA, however, a school district or local education agency may not be able to comply immediately with a request made pursuant to $ 49-13-132. A district or school system may have adopted limits on the disclosure of directory information that are more restrictive than expressly required by FERPA or may be limited in its disclosures by its failure to comply with the procedural requirements of 20 U.S.C. 5 1232e@)(5)(B) or 34 C.F.R. $ 99.37. See Elec. Privacy Inþ. Cfu.,48 F. Supp.3d at 6 ("[FERPA] leaves each educational agency or institution free to determine for itself what categories of directory information it will release and for what purposes."); Tenn. Att'y Gen. Op. l5-55 (JuLy 2,2015). An educational institution or agency may choose not to (or by neglect fail to) designate particular information as directory information or fail to provide parents and eligible students the notice required by 34 C.F.R. $ 99.37(a). In such cases, the disclosure of directory information-including information such as students' names that is expressly designated as directory information by FERPA and its implementing regulations-is not permissible. See Krauss v. Nassau Comm'y College,469 N.Y.S.2d 553,555 Cf.Y. Sup. Ct. 1983) (holding that an educational institution properly refused a request for information under FERPA because it had not designated the information as directory information); 34 C.F.R. $ 99.31(a)(1 1) (mandating that the disclosure of directory information without prior consent must comply with the "conditions" of $ 99.37); Ohio Att'y Gen. Op. 92-71 (Dec. 30, 1992) (noting that "if items are not so designated fas directory information], their disclosure without prior parental consent, or without a court order, will run counter to FERPA"). agency or institution to limit disclosure of directory information under FERPA by specifying in its public notice to parents and eligible students "that the disclosure of directory information will be limited to specific parties, for specific pu{poses, or both." 34 C.F.R. $ 99.37(d); see State ex rel. School Choice Ohio, Inc. v. Cincinnati Pub. School Dist.,63 N.E.3d I183, 1191 (Ohio 2016) ("Pursuant to this regulation, a school district has the power to adopt policies and use consent forms that limit the scope of disclosure to specific parties or for specific purposes."). If an educational agency or institution chooses to specify such limits on disclosures, "the educational agency or institution must limit its directory information disclosures to those specified in its public notice." 34 C.F.R. $ 99.37(d) (emphasis added). "fD]isclosing student-directory information to parties or for purposes that are outside the scope of the notice given to parents would violate FERPA." School Choice Ohio,63 N.E.3d at ll9l. In addition, 34 C.F.R. $ 99.37 permits an educational Accordingly, school districts and local education agencies in Tennessee that have not designated particular information as directory information or have not provided to parents and eligible students the notice and opportunity to opt out required by 20 U.S.C. $ 1232g(a)(5XB) and 34 C.F.R. $ 99.37(a) will be in violation of FERPA if they disclose that information without prior consent. And agencies or institutions that have restricted the disclosure of directory information to particular parties or for particular purposes pursuant to 34 C.F.R. $ 99.37(d) will be in violation of FERPA if they disclose directory information without prior consent to additional parties or for additional purposes. Under FERPA and $ 99.37, "parental notice and consent is the key factor." School Choice Ohio,63 N.E.3d at ll9l. If a school district or local education agency has not provided sufficient notice to parents of its policy regarding directory information and an opportunity to opt out of that policy, the agency or district may not release the information. 5 Under 34 C.F.R. $ 99.37, these local policies thus have the potential to conflict with the disclosures to chartering authorities and public charter schools required by $ 49-13-132. If a school district or local education agency has not designated "student names, ages, addresses, dates of attendance, and grade levels completed" as "directory information" and provided parents an opportunity to opt out of that designation, then $ 99.37(a) prohibits the agency or district from disclosing the information to chartering authorities or public charter schools. Further, if a school district or local education agency has restricted the disclosure of directory information to entities or for purposes that do not include the disclosures required by $ 49-13-132, then $ 99.37(d) prohibits the agency or district from disclosing the information to the requesting chartering authority or public charter school. Section 49-13-132 expressly provides that local educational agencies should provide the specified information "in accordance with" FERPA, and the failure to abide by FERPA's regulatory framework would not be consistent with that direction. This potential conflict is only a temporary one, however. The public education system in Tennessee "shall be govemed in accordance with laws enacted by the general assembly." Tenn. Code Ann. g 49-1-102(a). Such laws, including $ 49-13-132, must be adhered to by school districts and local education agencies. See Tenn. Code Ann. $ 49-3-353(b) ("Every local public school system shall meet the requirements of state law as to the operation of the system and of the rules, regulations, and minimum standards of the state board for the operation of schools."). Failure to meet the requirements of state law may result in the withholding of funds by the commissioner of education. Id. ç 49-3-353(a). Accordingly, the disclosure provision adopted in $ 49-13-132 requires school districts and local education agencies to adjust their policies to be in accordance with state law. If the current FERPA policy and procedures of a local school system do not permit the disclosure of the directory information specified by $ 49-13- 132 or bar its disclosure to chartering authorities or public charter schools-whether because of a decision not to designate the information as "directory information," a failure to provide parents and eligible students the required notice and opportunity to opt out, a specification that disclosure will be limited to specific parties or for specific purposes that do not include disclosure to charter schools, or any other reason-then the school district or local education agency must promptly amend its policy to bring it into compliance with state law. FERPA requires that parents and eligible students be given notice of any such amendments to an agency's or institution's policy regarding the disclosure of directory information and a "reasonable period of time after such notice has been given for a parent to inform the institution or agency that any or all of the information designated should not be released without the parent's prior consent;' 20 U.S.C. $ 1232g(a)(5XB); see also 34 C.F.R. $ 99.37(a). A school district or local education agency must comply with this mandate. But once a district or agency has met this requirement under FERPA and provided the mandatory notice and opportunity to opt out, it must comply with the disclosure provision in $49-13-132 and provide the specified information to chartering authorities and public charter schools upon their request. A school district or local education agency that does not act promptly to amend its policies to be in compliance with $ 49l3-I32 will be in violation of state law. 3. Once a chartering authority or public charter school receives student directory information from a local school district or education agency, it is not constrained by $ 49-13-132 in the purposes for which it uses the information. Section 49-13-132 restricts the chartering 6 authority or public charter school from disclosing the information to any outside parties without prior written consent from the parent or eligible student. And it directs the chartering authority or public charter school to adopt and implement a policy that will allow parents and eligible students to decline to receive information from the charter school. But nothing in $ 49-13-132 prohibits a chartering authority or public charter school from using the information received under $ 49-13I32 to contact parents and potential students to inform them of their option to attend a charter school. In fact, $ 49-13-132 appears designed to facilitate outreach efforts by charter schools and expressly contemplates that charter schools will use the information they receive pursuant to $ 4913-132 to contact parents. The first sentence states that its purpose is "[t]o effectuate $ 49-131 13," which addresses the enrollment of students in charter schools. Section 49-13-113 establishes the foundational principle that participation in a public charter school "shall be based on parental choice or the choice of the legal guardian or custodian," and the most reasonable interpretation of the stated purpose of $ 49- 1 3 - I 3 2 is that it was intended to provide directory information to charter schools so that they could contact students and parents and inform them of their choices. Furthermore, in providing that each charter school receiving information under $ 49-13-132 must establish a policy allowing parents to decline to receive "further information from the charter school," the provision necessarily contemplates that the parents will initially receive some information from the school. Otherwise, the word "further" would be meaningless. Accordingly, $ 49-13-l32doesnotprohibitcharteringauthoritiesorpubliccharterschools from contacting potential students and their parents using the information received pursuant to the provision. Instead, it is designed to facilitate that contact. ERT H. SLATER Attorney General and SO BLUMSTEIN Solicitor General ATHAN Assistant 7 SHAUB General Requested by: Dr. Candice McQueen Commissioner Tennessee Department of Education Andrew Johnson Tower, 9th Floor 710 James Robeftson Parkway Nashville, TN 37243 8