Privacy Cases

EPIC v. The U.S. Department of Education

US District Court for the District of Columbia

DOWNLOAD EPIC-FERPA-Complaint pdf 301.8KB

Challenging the Department of Education’s Family Educational Rights and Privacy Act (FERPA) 2011 Regulations

Background

In April 2011, the U.S. Department of Education(ED) issued a notice of proposed rulemaking (NPRM), inviting public comments on its proposed regulations amending the Family and Educational Rights and Privacy Act of 1974 (FERPA). The proposed regulations removed limitations prohibiting educational institutions and agencies from disclosing student personally identifiable information, without first obtaining student or parental consent. For example, the proposed FERPA regulations reinterpreted FERPA statutory terms “authorized representative,” “education program,” and “directory information.” This reinterpretation gives non-governmental actors increased access to student personal data.

On May 23, 2011, EPIC filed comments with the ED, noting the illegality of the agency’s amendments, including the illegality of the agency’s reinterpretation of the statutory terms “authorized representative,” “education program,” and “directory information.” EPIC’s comments stated that “the ED’s proposals expand a number of FERPA’s exemptions, reinterpreting the statutory terms ‘authorized representative,’ ‘education program,’ and ‘directory information.’ These proposals remove affirmative legal duties for state and local educational facilities to protect private student data.” EPIC also noted that the proposed regulations ignored the FERPA’s purpose and relied on a “fundamental misreading of appropriations legislation.” EPIC’s comments stated that by designating non-governmental actors as “authorized representatives” of state educational institutions, the ED would perform an “unauthorized, unlawful sub-delegation of its own authority.” EPIC’s comments further stated that by expanding the definition of “educational programs,” the ED would expose “troves of sensitive, non-academic data.” EPIC’s comments stated that the proposed regulations permitting schools to “disclose publicly student ID numbers that are displayed on individuals cards or badges . . . insufficiently safeguard[] students from the risks of re-identification.” EPIC recommended to the ED that the proposed regulations should be withdrawn because they were contrary to law and exceeded the scope of the agency’s rulemaking authority.

On December 2, 2011, the ED issued final regulations implementing its proposed amendments, despite the agency’s admission that “numerous commenters . . . stated that they believe the Department lacks the statutory authority to promulgate the proposed regulations contained in the NPRM.” The final regulations’ definitions for statutory terms “authorized representative,” “education program,” and “directory information” did not differ from the proposed regulations.

On February 29, 2012, EPIC filed a lawsuit under the Administrative Procedure Act against the ED. EPIC’s lawsuit argues that the agency’s December 2011 regulations amending the Family Educational Rights and Privacy Act exceed the agency’s statutory authority, and are contrary to law. EPIC is joined in the lawsuit by co-plaintiffs Grayson Barber, Pablo Garcia Molina, Peter G. Neumann, and Dr. Deborah Peel. The Education Department filed its answer to EPIC’s complaint on May 4, 2012, requesting that the Court dismiss EPIC’s complaint.

On July 23, 2012, EPIC filed a Motion to Supplement the Administrative Record and Consider Extra-record evidence with the Court. In its motion, EPIC requested the Court to order the Education Department to supplement the administrative record to include four document sets that were before the Education Department at the time of its decision, and were considered by the agency when it issued its NPRM and subsequent final regulations. Additionally, EPIC requested that the Court consider extra-record evidence that is highly relevant to the final regulations and necessary for effective judicial review. For example, at the time that the agency issued the final regulations, it had not offered guidelines on student data and cloud computing. After the Education Department issued its regulations, the agency created a document which provided cloud computing guidance. Importantly, this document explains that even though “outsourcing information technology (IT) functions” would not “traditionally be considered and audit or evaluation,” the Education Department will consider outsourcing IT functions as “auditing” or “evaluating” under FERPA regulations. FERPA permits nonconsensual disclosure of education records to “authorized representatives” for audits and evaluation of federal and state education programs.

In response to EPIC’s motion, the Education Department filed a Consent Motion for Extension of Time Regarding the Dispositive Motion Briefing Schedule that was previously issued by the Court. On July 24, 2012, the Court vacated the briefing schedule and announced that a new briefing schedule would be re-established upon the Court’s resolution of EPIC’s motion.

On October 26, 2012, the Court issued a Memorandum Opinion and Order granting in part and denying in part EPIC’s Motion to Supplement the Administrative Record and Consider Extra-record evidence. The Court granted EPIC’s motion to supplement the record with two documents concerning “directory information” that were before the agency at the time of the final regulations. The Court denied EPIC’s motion to supplement the record with documents that support the agency’s definition of “education program,” because the agency admitted that it did not rely on concrete, factual knowledge to support the new definition, and therefore the requested documents do not exist. Finally, the Court denied EPIC’s motion requesting that the Court consider extra-record evidence.

Following the resolution of EPIC’s Motion to Supplement the Administrative Record and Consider Extra-record evidence, the Court established the following briefing schedule: the Education Department’s Dispositive Motion is due by November 30, 2012; EPIC’s Opposition and Cross Motion is due by January 18, 2013; the Education Department’s Reply and Cross Opposition is due by February 1, 2013; and EPIC’s Reply to the Cross Motion is due by February 15, 2013.

On November 30, 2012, the Education Department filed a Motion to Dismiss or, in the alternative, a Motion for Summary Judgment, arguing that: (1) EPIC and its individual co-plaintiffs lack standing to challenge the final regulations; (2) the final rule is entitled to Chevron Deference; (3) none of the challenged definitions (“directory information”, “authorized representatives”, and “education programs”) exceed statutory authority; and (4) the challenged definitions are in accordance with law because they are the product of reasoned decision-making.

On December 19, 2012, EPIC filed a consent motion seeking additional time to coordinate each plaintiff’s declaration to support standing.

On January 18, 2013, EPIC filed its Cross-Motion for Summary Judgment and Memorandum Opposing Defendant’s Motion to Dismiss and Motion for Summary Judgment. EPIC’s motion argued that the individual plaintiffs have standing because there is an imminent risk that their private education records will be disclosed. EPIC also argued that EPIC has standing on its own because EPIC has suffered a concrete and demonstrable injury to its activities, and that EPIC has standing to bring suit on behalf of the members of the Advisory Board and Board of Directors. Concerning the merits, EPIC argued that that: (1) each of the challenged definitions exceeds statutory authority and is therefore not entitled to Chevron deference; and (2) the disputed definitions are not in accordance with law because they are contrary to the FERPA’s plain meaning and are not a permissible construction of the statute. EPIC also argued that the definitions are arbitrary and capricious because they are not the product of reasoned decisionmaking. Finally, EPIC requested that the Court hear oral argument on the motion.

On February 1, 2013, the Education Department filed its Opposition to Plaintiffs’ Cross-Motion for Summary Judgment and Reply in Support of its Motion to Dismiss or, in the Alternative, for Summary Judgment, reiterating its initial arguments and responding to EPIC’s Cross-Motion for Summary Judgment and Opposition to Defendant’s Motion to Dismiss.

The Court held oral arguments on July 24, 2013.

On September 26, 2013, the Court dismissed EPIC’s lawsuit, holding that neither EPIC nor any of its Board of Director co-plaintiffs “have standing to bring the claims asserted in the complaint.” The Court did not reach EPIC’s substantive claims asserted in the complaint. The Court further held that its order was a “final appealable order.”

Resources

EPIC v. U.S. Department of Education, Civ. Action No. 12-00327(ABJ) (D.D.C.)

News

EPIC Applauds Critical Updates to COPPA Rule, Strengthening FTC’s Ability to Protect Kids’ Privacy

January 16, 2025

Google and CEO Sundar Pichai Under Fire for Sending Americans’ Data to Foreign Adversaries in New National Security Complaint

January 16, 2025

EPIC Commends the Prohibition on the Collection and Sale of Location Information in Invasive Real Time Bidding System in FTC’s Mobilewalla Settlement

January 13, 2025

See All News

EPIC Applauds Critical Updates to COPPA Rule, Strengthening FTC’s Ability to Protect Kids’ Privacy

January 16, 2025

See All News

Support Our Work

EPIC's work is funded by the support of individuals like you, who allow us to continue to protect privacy, open government, and democratic values in the information age.

Donate