VIRGINIA FREEDOM OF INFORMATION ADVISORY COUNCIL COMMONWEALTH OF VIRGINIA

AO-33-01

June 14, 2001

Mr. William Murphy
Fairfax, Virginia

The staff of the Freedom of Information Advisory Council is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the information presented in your emails of May 3 and June 9, 2001.

Dear Mr. Murphy:

You have asked whether you may obtain an electronic list of the email addresses of students at George Mason University under the Virginia Freedom of Information Act (FOIA). You indicate that when you requested this record, the university refused to supply it on the grounds that the school does not disclose email addresses pursuant to the federal Family Educational Rights and Privacy Act (FERPA). Upon further investigation of the denial, you indicate that the university designates email addresses as directory information for purposes of FERPA, and makes this information available to the public in both a printed student directory and through a searchable electronic database. You ask whether FERPA excludes student email addresses from the scope of FOIA, or whether you may access these records.

Subsection A of § 2.1-342 of the Code of Virginia requires that all public records must be open for inspection [e]xcept as otherwise specifically provided by law. Exceptions to this general rule of access can be found in both state and federal law. One such federal law that limits access to certain records is FERPA,¹ as was cited in the university's denial of your request for the email addresses.

FERPA applies to all educational agencies or institutions that participate in grant programs administered by the United States Department of Education. As such, FERPA includes within its scope virtually all public educational institutions, such as state universities, as well as many private educational institutions. The focal point of FERPA is the protection of the privacy of students. Generally, FERPA prohibits access to the education records of any student that contain personally identifiable information about that student, unless the parent of the student, or the student if over the age of 18, consents to the disclosure. FERPA does allow an educational institution to disclose "directory information" about a student, which is information contained in an education record of a student which would not generally be considered harmful or an invasion of privacy if disclosed.² This would include, but is not limited to, information such as a student's name, telephone listing and address. Prior to disclosing directory information, the educational institution must provide notice of which items it considers directory information, and give the parents, or students if over 18, a chance to prohibit any or all of those items from being made available to the public.

In your inquiry, you indicate that the university has designated student email addresses as directory information, and make these addresses available to the public through various avenues. For example, the printed student directory includes email addresses, and a search engine available on the university website allows a user to enter a student's name and retrieve that individual's email address. Your question becomes whether the university may deny you access to the email list in the electronic format that you have requested, since it has designated the information as directory information and makes it available through other means and in other formats.

Generally, subsection H of § 2.1-342 of FOIA requires that if a public body maintains nonexempt records in an electronic format, it must produce these records in any tangible medium identified by the requestor, so long as that medium is used by the public body in the ordinary course of business. However, it is unclear whether such a provision would operate to compel the university to produce the records that are otherwise governed by FERPA. The Virginia Freedom of Information Advisory Council only has the authority to issue opinions relating to the interpretation of FOIA, and thus cannot offer an interpretation of the application of FERPA to your present inquiry. However, having contacted the Family Policy Compliance Office, the entity within the federal Department of Education that oversees FERPA, it appears that the university is within its rights to withhold the information that you requested. The Family Policy Compliance Office advised that the dissemination of directory information is left to the discretion of the educational institution, and that such institution may release directory information under some circumstances but deny it in others. It was noted that the federal regulations relating to the release of directory information state that an educational agency or institution may disclose directory information if it has given public notice to parents of students in attendance and eligible students in attendance of the types of information designated as directory information and the right to refuse the release of such information.³ (Emphasis added) Under this interpretation, even if the university has designated student email addresses as directory information, it is not required to disclose this information to the public, and it may exercise its discretion as to when and how to release it. If you have further questions about the application of FERPA, I would suggest that you contact the Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Avenue, S.W., Washington, D.C. 20202-4605. That office may also be reached by phone at (202) 260-3887.

Thank you for contacting this office. I hope that I have been of assistance.

Sincerely,

Maria J.K. Everett
Executive Director

¹ 20 U.S.C.A. §1232g (1998).

² 34 Code of Federal Regulations 99.3.

³ 34 C.F.R. 99.37(a).