̽��¥

Hello, Professor FERPA!  I have a technical question.

We are currently using Microsoft’s Office 365 and one of the options allows students to share documents with other students. The option allows students to type in a name, or at least 3 letters of the name, to share the document with other students.  For example if they type in “McC” all of the students with the letters “McC” will display their internal email address.

Is this a potential FERPA conflict for students who have opted out of Directory Information?  Microsoft provides an option to remove students who have opted out to not be displayed when searched via the Exchange/Outlook groups functions.

However, we’ve discovered that when a student begins the process of sharing a document in OneDrive (Office 365’s version of Dropbox, limited to the institution), that the name is displayed as described above (with the email address). We turned off the option for those students to appear in address lists under Exchange options, but their names are still auto-filled when a document is shared in OneDrive, and we are unable to block students who have opted out of Directory Information.

Our IT department’s research has indicated that this is not an option that can be changed in the Office 365 environment, and is simply being accepted as a “legitimate business use” at other institutions. My concern is that the decision should/would need to be made by the student receiving the document, not by the student wishing to share the document.

I hope this makes sense, because it certainly is all new to me in this ever evolving electronic age!

Thank you for any help.

Colin Alcars

________________________________________

Dear Colin,

You are correct to have a concern about the process you describe below.  If a student has opted out of directory information, the student's name or other information should not be accessible to other than school officials or otherwise disclosed by the institution unless with a consent or by meeting the specific requirements of another of the exceptions to signed consent listed in the regulations under §99.31. There is no such thing in FERPA as "legitimate business use."  It is probably easier to fix the problem now rather than waiting for a complaint and being required to make the change.

I hope this is helpful to you.

The FERPA Professor