The Family Educational Rights and Privacy Act (FERPA) requires school districts to maintain the confidentiality of all personally identifiable information in education records related to students. 20 U.S.C. §1232g; 34 CFR § Part 99.
Any and all records, including emails, student files, and personnel information, are generally exempt from disclosure, absent parental consent or consent from an eligible student (age 18 years or older).
In some circumstances, schools can release student information without parent consent. These circumstances include the following:
Under FERPA schools may (but are not required to) disclose “directory information” without parent consent. Directory information is information that is generally not considered harmful if disclosed and can include items such as: name, address, phone number, birthday, and the like.
Schools must inform parents or eligible students what they designate to be “directory information” and allow parents or eligible students an opportunity to “opt out” of having their directory information authorized to be disclosed without consent. This is typically done in the student handbook. Parents and eligible student may choose to “opt out” of directory information at any time. If a parent or eligible student opts out, then a school must obtain consent prior to directory information being disclosed to a third party.