Ranking Member Cassidy Demands Transparency for Education Department’s Delays in Addressing Student Privacy Complaints

WASHINGTON – U.S. Senator Bill Cassidy, M.D. (R-LA), ranking member of the Senate Health, Education, Labor, and Pensions (HELP) Committee, is seeking information from the Department of Education (DeptEd) on its processing of Family Education Rights and Privacy Act (FERPA) complaints, which may involve the unauthorized release of highly sensitive student information.   

Under FERPA, parents or students can file a complaint with DeptEd if they believe that a school or local education agency has violated their rights to control the release of sensitive information in their student’s education records. In 2018, the DeptEd Office of Inspector General (OIG) found that the Department had an extensive backlog of complaints, and had placed some of those complaints into “indefinite inactive status” because they dealt with unresolved policy questions. A 2022 follow-up report found that DeptEd is still working to resolve the outstanding issues that were holding up some of its investigations. 

In May of this year, DeptEd announced in an audit report that it is working on regulations that will address the issues impeding its investigations, but those regulations are not due to be finalized until 2027. Cassidy is seeking information from DeptEd on its efforts to reduce the backlog of unresolved FERPA complaints and how DeptEd is currently assisting students and families whose sensitive information may have been released without authorization. 

“It is concerning to hear of DeptEd’s delays in processing privacy complaints, especially since these complaints may involve the unauthorized release of students’ highly sensitive information,” wrote Dr. Cassidy. “Congress needs complete knowledge of DeptEd’s FERPA efforts to ensure that the law is working as intended and privacy concerns are addressed in a timely manner.” 

Read the full letter here or below. 

Dear Secretary Cardona:

In May, the U.S. Department of Education (DeptEd) informed Congress that it is working on a notice of proposed rulemaking (NPRM) to address “outstanding policy issues” that have impeded its ability to resolve privacy complaints filed by parents and students under the Family Educational Rights and Privacy Act (FERPA).^[1] FERPA gives parents of minors, and students age 18 or older, certain rights to access, amend, and control the disclosure of personally identifiable information in their confidential education records.^[2] According to DeptEd, the final rule that will address outstanding policy issues is not slated for completion until March 31, 2027.^[3] Accordingly, I write to request additional information on DeptEd’s efforts to administer and enforce FERPA, including the nature of the policy issues that DeptEd is seeking to address through its NPRM and the size and age of DeptEd’s backlog of unresolved FERPA complaints.

It is concerning to hear of DeptEd’s delays in processing privacy complaints, especially since these complaints may involve the unauthorized release of students’ highly sensitive information. Under FERPA, if parents or students age 18 or older believe that a school or local education agency has violated their rights to control the release of confidential information in their student records, they can file a complaint with DeptEd’s Student Privacy Policy Office (SPPO). Upon receiving a complaint, the SPPO is supposed to make a case-by-case determination to initiate either a formal investigation or take another appropriation action, such as acting as an intermediary between the local education agency and the parent or student to resolve the situation described in the complaint.^[4] Currently, the SPPO’s website does not appear to include information on the number or substance of complaints that DeptEd is receiving, the manner in which it is processing the complaints, or the size of its backlog.^[5] Further, it is unclear how many cases DeptEd is failing to resolve due to “outstanding policy issues” that it plans to address through negotiated rulemaking.

Government watchdog reports suggest that these are longstanding issues. More than five years ago, in a November 26, 2018 report, the Department of Education Office of Inspector General (DeptEd OIG) raised concerns that the SPPO had an extensive backlog of unaddressed FERPA complaints that it said may have been “significantly greater than 2 years.”^[6] At that time, DeptEd OIG found that there were “[u]nresolved FERPA policy questions . . . [that] affected the Privacy Office’s ability to resolve certain complaints.”^[7] The OIG also noted that “[t]he Privacy Office placed many of these complaints into an indefinite inactive status as a result.”^[8] At that time, DeptEd OIG raised many additional concerns regarding the SPPO, including that it “did not have controls to ensure that it timely and effectively processed FERPA complaints.”^[9]

In July 2022, in response to a request from then-Chairman of the House Committee on Education and Labor, Congressman Robert C. Scott, DeptEd OIG issued a follow-up report of SPPO’s FERPA enforcement activities. In that report, DeptED OIG found that SPPO had developed a corrective action plan for responding to the recommendations in its 2018 report and had “significantly reduc[ed]” its backlog of complaints.^[10] However, at that time, DeptEd had not “resolve[d] outstanding policy issues that impede[d] the investigation of certain complaints.”^[11] It had “identified policy issues that impede complaint investigations” and was “preparing a notice of proposed rulemaking that [would] be followed by issuance of a final rule providing needed clarification regarding those issues.”^[12]

In its 2022 report, DeptEd OIG did not specify how large SPPO’s case backlog remained at that time, nor did it state how many cases continued to be unresolved due to outstanding policy issues. According to DeptEd’s notice to Congress, it appears that outstanding issues impeding SPPO investigations will not be resolved until 2027. By that point, it will have been nearly nine years since DeptEd OIG first identified the issue. While these concerns predate the Biden administration, it is important for this Committee to understand the reasons for this extended delay. It remains unclear exactly what issues DeptEd is trying to resolve, how many complaints remain unresolved, how long they have been pending, and what, if anything, SPPO is currently doing to assist parents and students who have unaddressed privacy complaints.

It is also unclear what steps DeptEd has taken since 2022 to address DeptEd OIG’s outstanding concerns regarding the SPPO. In DeptEd OIG’s 2022 report, the OIG stated that the SPPO’s efforts to address its 2018 recommendations were ongoing and that the SPPO was preparing to update its “standard operating procedures” once other improvements, including a new Case Management Tracking System designed to “automate aspects of its enforcement operation,” were operational.^[13]

Congress needs complete knowledge of DeptEd’s FERPA efforts to ensure that the law is working as intended and privacy concerns are addressed in a timely manner. Accordingly, please respond to the following, on a question-by-question basis, no later than July 30, 2024.

1. Please provide a list of all FERPA complaints received and/or addressed by DeptEd since January 1, 2018, including the nature and type of complaint, the date that the complaint was originally received by DeptEd, and, if applicable, the date that the complaint was resolved.

2. Please provide a list of all unresolved FERPA complaints currently awaiting a decision by DeptEd not otherwise mentioned in response to question 1, including the nature and type of complaint and the date that the complaint was originally received.

3. How many complaints are currently on hold or awaiting decision due to unresolved FERPA policy questions? Please provide the full text of these complaints and all other related records.

4. Please provide all records related to DeptEd’s effort to develop list of “policy issues that impede [FERPA] complaint investigations.”

5. Please explain how the final rule that DeptEd plans to issue in 2027 will resolve issues in outstanding FERPA complaints filed with the SPPO. In addition, please explain the reasons why DeptEd does not believe a final rule will be ready until 2027.

6. Is the case management tracking system described in DeptEd OIG’s 2022 report now fully operational? If yes, please explain how it has improved SPPO operations. If not, why not.

7. Has SPPO updated its “standard operating procedures” as described in DeptEd OIG’s 2022 report? If yes, please explain the changes that have been made. If not, why not.

Thank you for your attention to this important matter.

For all news and updates from HELP Republicans, visit our website or Twitter at @GOPHELP. Click here to unsubscribe.