The U.S. Supreme Court has already decided that there is no “private cause of action” authorized by FERPA (Family Educational Rights and Privacy Act). For you lawyers and lawyer wannabes, that happened in Gonzaga University v. Doe, 536 U.S. 273 (2002). That means that even if you violate FERPA by improperly disclosing confidential student information, no one will be able to sue you over the FERPA violation. The court would dismiss any suit like that.
But lawyers are a creative lot. A lawyer in New York has figured out a way around the Gonzaga case. The lawyer took a routine FERPA violation and called it a violation of the constitutional right of privacy, protected by the Due Process Clause. So far, this has worked. The federal district court in New York held that the Director of Pupil Services could be held personally liable for violating the Due Process Clause.
How did this happen? The IEP Team had already agreed that the student needed to be served in an out-of-district program. The Team identified five programs that could possibly serve the student, and asked the parents for consent to send information to these programs. The parents did not give consent. Instead, they asked for more information about the five programs before they would give consent.
The director sent the referral packets anyway, albeit with a lot of personally identifiable information redacted. The court was not convinced that the redactions went far enough.
Thus the allegation in the lawsuit is that the Director sent out referral packets containing confidential medical and educational records without parental consent and against specific parental direction. The court held that this allegation, if proven true, would be a constitutional violation. Moreover, 2nd Circuit authority made it a violation of a legal principle that was “clearly established,” thus opening the door to personal liability for the director. Key Quote:
Thus, in alleging “the disclosure of confidential educational and medical records without consent and against the express identification of the lack of consent from [the student’s] parents,” Plaintiffs have plausibly pleaded a violation of a constitutionally protected interest.
What about the fact that information was redacted? Tune in to tomorrow’s Dawg for more on that.
The case is W.A. v. Hendrick Hudson Central School District. We found it at 67 IDELR 178 (S.D.N.Y. 2016)
DAWG BONE: FERPA VIOLATION MAY BE MORE THAN A FERPA VIOLATION. IT MIGHT BE A CONSTITUTIONAL PROBLEM
File this one under: LIABILITY
Tomorrow: did we redact enough?