REGucation

As regular REGucation readers and higher education practitioners know, the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99), commonly known as FERPA, is a federal law enacted in 1974 concerning the privacy of student “education records” and the related requirements of educational institutions that receive federal funds from the U.S. Department of Education. In particular, in the post-secondary education context, FERPA gives students the right to:

1. Control the disclosure of their “education records” to others;
2. Inspect and review their own “education records;” and
3. Seek amendment of their “education records.”

While higher education has changed significantly since 1974, FERPA, in many ways, has not. In practice, this means that institutions are required to apply law and regulations, sometimes several decades old, to modern technologies. Nowhere is this more apparent than the debate over whether institutional e-mails are considered “maintained by” an educational institution or “directly related” to a student, and therefore subject to FERPA.

What Does “Maintained” or “Directly Related” Mean?

FERPA protects “education records.” There are two essential criteria for a document to be considered part of an “education record” under FERPA. The record must be (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. 34 C.F.R. § 99.3.

While the term “record” is defined – meaning information recorded in any way, subject to several regulatory exceptions (see 34 C.F.R. § 99.3) – there is, frustratingly, no definition of “maintained” or “directly related.” The absence of a definition for the terms “maintained” or “directly related” has created issues for institutions implementing FERPA in a number of contexts, particularly with respect to student emails.

“Maintained”

Students attending an institution of higher education can send hundreds or thousands of emails during their time on campus. Presently, almost all institutions of higher education contract with a third-party vendor to handle student emails, such as Microsoft’s Outlook or Google’s Gmail. These vendors typically store emails on their servers or in the cloud.

Broadly speaking, if student emails are considered “maintained” by the institution, those “directly related” to a student may be subject to FERPA. This would mean that students might have a right to inspect such emails. On the other hand, if student emails are not considered “maintained” by the institution, they would not be subject to FERPA.

As noted above, there is no definition of “maintained” in the statute or regulations. One of the few Supreme Court decisions addressing FERPA, Owasso Independent School District v. Falvo, 534 U.S. 426 (2002), is instructive. In this case, the Supreme Court wrote that “FERPA implies that education records are institutional records kept by a single central custodian, such as a registrar” and that the word “maintain” “suggests FERPA records will be kept in a file in a school’s record room or on a secure database.” The Supreme Court’s explanation, while informative, is only dicta and not controlling.

Institutions and practitioners have taken different positions on this issue. Some argue student emails are “education records” that are “maintained by” the institution based on applicable regulations or the contractual nature of the relationship between the institution and a third-party email provider (in other words, making the provider a “school official” for purposes of FERPA).

Others, including several courts, have looked to Owasso to conclude that emails stored in an ordinary manner are not, without more, maintained by the institution. By way of example, in E.D. by & through T.D. v. Colonial Sch. Dist., 2017 WL 1207919 (E.D. Pa. Mar. 31, 2017), the court could not conclude that every email is an education record unless the institution kept copies of emails related to a student with the intention of maintaining them. Similarly, Mackinac Ctr. for Pub. Pol’y v. Michigan State Univ., 2023 WL 6939084 (Mich. Ct. App. Oct. 19, 2023) explained that the student emails in question were not maintained by the institution because it could not be shown that the institution purposefully preserved the emails and kept the emails in either a physical filing cabinet or a permanent secure database specifically related to the students. Lastly, Doe v. Rutgers, State Univ. of New Jersey, 2022 WL 1617581 (D.N.J. May 20, 2022) pointed out the transient nature of emails and noted that the emails kept on an email server from which they could be deleted by the senders and receivers are not education records under FERPA.

“Directly Related”

While, again, not defined in statute or regulation, the term “directly related” has generally been understood to be broad, but not without limits. The court in Rhea v. Dist. Bd. of Trs. of Santa Fe Coll. (Fla. Dist. Ct. App. 2013) explained that information is directly related to a student if it has “a close connection to that student.” In that case, an email containing a student complaint against a professor was “directly related” to that student because the email would identify the student and the student’s enrollment in the professor’s class, and because it describes the student’s personal impressions of the classroom environment.

However, other courts have also made clear that an “education record” does not encompass every document that relates to a student in any way; and records that include information about a student – but that primarily concern another person or another subject – are not considered directly related. In BRV, Inc. v. Superior Ct., 143 Cal. App. 4th 742 (2006), for example, the court found that a report investigating a school administrator was not directly related to particular students, even though the names and activities of those students were included in the report. Also instructive is J.O. v. Bd. of Educ. of Albuquerque Pub. Sch., No. 1:23-CV-01021-KG-JMR, 2025 WL 623543 (D.N.M. Feb. 26, 2025), where the court noted that the mere presence of student information in the teacher records does not render those records subject to FERPA.

The Nevada Supreme Court’s 2025 Decision in Clark County

In the recent case of Clark County School Dist. v. Eighth Jud. Dist. Ct. in & for Cnty. of Clark, 564 P.3d 863 (2025), the Supreme Court of Nevada specifically reviewed student emails in the context of FERPA.

In this case, the school district relied on Owasso to argue that the emails stored in Google Vault were not “maintained” by the school district because they were not “intentionally placed onto a specific, central file designated for [the student].” In other words, the school district argued that, because the emails at issue were not intentionally stored in the student’s permanent file, the emails were not “maintained” by the institution.

The Nevada Supreme Court did not find that argument persuasive, noting Owasso was decided in the early days of internet development when technologies such as Google Vault did not exist. The Court found that records are “maintained by” an educational institution when they are stored in a central, secure location or database, writing the following:

“…while some courts suggest that to maintain a record, the institution must display some level of intent to separate that record out, we do not find this to be a binding requirement under FERPA or Owasso. A record is maintained when it is stored on an educational institution’s secure database or storage system. We read ‘maintained’ broadly so as to accommodate any future unknowable storage format that would otherwise, by way of ever-evolving technology, undermine our determination today. We find that the records stored on [Clark County’s] Google Vault are maintained by [Clark County] and therefore satisfy the second prong of the education records definition under FERPA.”

The Court then required Clark County to assess the content of relevant emails to determine if they met the “directly related” prong of the definition of “education records.” The Court gave the following guidance for this determination:

• “Congress intended for the definition of ‘education records’ to be broad in scope.”
• “Despite being broadly defined, an education record ‘does not encompass every document that relates to a student in any way ….’”
• “Records that include information about a student, but are primarily about someone or something else, are not considered directly related.”
• “…courts have determined that education records need not be tied to academics to be directly related to a student’s education… These records may instead be focused on a student’s discipline, safety, or other school-related conditions.”

Clark Cnty. Sch. Dist. at 866 (internal citations omitted).

What’s Next for Institutions of Higher Education?

While the Nevada Supreme Court’s decision is not binding outside the state, it is a noteworthy development for the higher education regulated community. Institutions should closely monitor how courts continue to interpret FERPA in light of evolving technologies and data storage practices. Additionally, we recommend institutions of higher education should take proactive steps to:

• Review FERPA policies and procedures, particularly relating to student emails and other digital communications;
• Review vendor agreements (e.g., with Microsoft, Google) for terms potentially relevant to education records or digital communications;
• Train staff and faculty on the types of student emails or digital communications that may be considered education records; and
• Monitor ongoing federal regulatory activity, especially potential updates to the definitions of “education records” and their applicability to digital formats.

On the final point, we note that the Biden administration had planned to issue new regulations relating to FERPA, in part, to address “concerns about the lack of clarity regarding the definition of the term education records and the term’s applicability to digital records.” It remains unclear whether the Trump administration would continue this rulemaking.

Institutions that would like assistance with FERPA compliance are welcome to contact Scott Goldschmidt (sgoldschmidt@thompsoncoburn.com) or Joyce Lee (jlee@thompsoncoburn.com). We also invite institutions to visit our REGucation Higher Education Resources page, which includes links to our most recent webinars, training series, desk guides, whitepapers, litigation summaries, and blog posts.

Related People