FERPA and Research

The information below is considered by the SUNY Delhi to be Directory Information. This information may be used for research purposes without obtaining written consent from students:

1. Full Name
2. Telephone Number
3. Local Address
4. Permanent Address
5. E-mail address
6. Major
7. Dates of attendance
8. Full-time/part-time status
9. Date(s) of graduation
10. Degree(s) awarded
11. Honors/Awards
12. Age of student
13. Participation in official activities, including athletics
14. For intercollegiate athletes, directory information also includes the athlete’s weight and height.

SUNY Delhi’s current FERPA policy is published here.

The information below is FERPA-protected Personally Identifiable Information (PII) and cannot be used for research purposes without obtaining written student consent. This list is not exhaustive, and any education records that are not considered Directory Information are FERPA-protected even if they are not specifically listed below:

1. Social Security Number
2. Student ID Number
3. Grades
4. GPA (term or cumulative)
5. Emails containing information about a student
6. Online discussion forums (e.g., from Online Delhi/Brightspace/D2L or Moodle)
7. Student Schedule
8. Academic History
9. Academic Standing
10. Graded Papers
11. Exams
12. Student Transcripts
13. Class roster(s)
14. Recordings of class discussions (audio and/or video) that contain student images or voices

N.B.: Directory Information of a student who has requested a confidentiality block on their record is FERPA-protected even though it is not generally defined as PII.

IMPORTANT NOTE ABOUT TRANSMISSION OF ANY AND ALL STUDENT INFORMATION:
In accordance with SUNY Delhi data governance policy, student information, both Directory Information and Personally Identifiable Information shall NOT be transmitted via e-mail. Employees should utilize share drives on the network. For assistance with this or to request a new share drive (if necessary), please contact Computer Information Services/Help Desk.

When is consent not required for the disclosure of PII?
FERPA allows the disclosure of personally identifiable information without student consent in a limited number of circumstances, including (1) When the data is being used by a SUNY Delhi official with legitimate educational interests; and (2) When the data is being used by an organization conducting institutional services or functions on behalf of SUNY Delhi. (Additional information is published here.

What is a legitimate educational interest?
“Legitimate educational interest” is defined as the need to review an education record in order for a College employee to carry out their responsibilities on behalf of the College, such as performing an administrative task outlined in the official’s duties, performing a supervisory or instructional task directly related to the student’s education, or providing a service or benefit relating to the student.

May I use FERPA-protected information for research purposes if it is de-identified?
Yes. A school official (who is not the researcher) with legitimate access to the FERPA-protected data may strip the records of any identifying information and provide the data to the researcher. The official who de-identifies the data cannot be involved in the research.

May I use my own students' data for research without obtaining consent?
It depends on the purpose of the research. You may use your own students’ data for research without obtaining written consent if you are conducting research into the effectiveness of the educational programs you provide and if only College faculty and staff who have professional responsibility to conduct the research will have access to the records. If your research has another purpose, you must obtain student written consent or use de-identified data. Your own students’ data must be de-identified by a school official with legitimate educational access to the data and then be provided back to you in the de-identified format for research purposes.

What information must be included in a written consent for the use of FERPA-protected information for research?
The written release must: (1) specify the records that may be disclosed, (2) state the purpose of the disclosure, and (3) identify the party or class of parties to whom the disclosure may be made. This information can be included in the informed consent presented to participants for participation in the research study.

Does written consent have to be collected on paper?
No. “Written consent” can be collected electronically under some circumstances. Students may sign a paper consent form and then scan it and return it via email or fax. Consent may also be considered “written” at SUNY Delhi if students enter their College Single Sign On (SSO) login credentials online to indicate consent (e.g., via a web form that requires SSO access or via their SUNY Delhi-issued email account).