Under FERPA, when is disclosure of personally identifiable information without consent allowed?

• A. To school officials with legitimate educational interests
• B. When permitted by law and with legitimate educational interests, such as to school officials or FERPA exceptions or health/safety emergencies
• C. For marketing purposes
• D. To the general public upon request

Answer: (B)

FERPA allows certain disclosures of education records without parental consent only in narrowly defined circumstances—when there is a legitimate educational interest or when a specific legal exception applies. A school official who has a legitimate educational interest—meaning they need the information to perform their job duties, such as teachers, administrators, or contractors providing services to the school—may access the records. Beyond that, FERPA provides explicit exceptions or situations (permitted by law or required by health or safety concerns) where disclosure is allowed without consent, or disclosures to other schools the student may enroll in, or to authorized entities for audits or enforcement. These conditions are in place to balance privacy with the need to support the student’s education and to comply with legal responsibilities. Disclosures for marketing or to the general public, without consent, do not fit these criteria.