As emails, texts, and tweets have proliferated on college campuses, courts have struggled to determine how these digital communications interact with student privacy laws such as the Family Educational Rights and Privacy Act (FERPA). A pre-digital age statute, FERPA requires schools to provide students with access to their own “education records” that the school “maintain[s],” and to safeguard those records from disclosure. In the hardcopy era, the statute was easy to apply. If a document was related to a student, and kept by the school, it was an “education record.” But the spread of digital communications has made this question less straightforward. In determining whether these communications are “education records,” the central issue is whether a school “maintains” them. Courts have struggled to answer this question, which has created uncertainty for both litigants and institutions of higher education.
The consequences of this uncertainty has reverberated through all levels of litigation, and caused unpredictability for institutions of higher education. In the courts, the issue has affected everything from newsworthy cases to lower-profile discovery disputes. For instance, students suing institutions for discrimination often seek production of digital communications about themselves. If FERPA applies, the student will have a greater entitlement to see the documents, and the school will have a duty to protect other students’ information that may appear. And even outside the education law sphere, cases ranging from family disputes to tort claims may involve discovery of digital communications to, from, or about students. Moreover, outside of litigation, if digital communications are education records, schools responding to a student’s request to review his own education records may have to undertake the burdensome task of combing through thousands of emails to satisfy their disclosure obligations under FERPA.
This article explores whether emails concerning students are “education records” under FERPA, and proposes a few principles that attorneys (and schools) should keep in mind when a dispute over student emails arises.
Scope of FERPA
Congress enacted FERPA, 20 U.S.C. § 1232g, as a new section within the General Education Provisions Act in 1974. FERPA provides that the government must withhold education funding from “any educational agency or institution” that has a “policy of denying, or which effectively prevents,” students from inspecting and reviewing their “education records” upon request. The government must also withhold education funds from schools with a “policy or practice of permitting the release of education records…of students without the written consent of their parents,” with some listed exceptions. In other words, the government must withhold funds from schools with a “policy” of withholding “education records,” or with a “policy or practice” of improperly releasing them to others. While in practice the Department of Education has issued fines rather than withholding all federal funding—which would include federal student loans—this is still a serious penalty for even inadvertent disclosures.
Whether a document must be produced to students or parents, and withheld from others, depends on whether it’s an “education record.” FERPA defines “education records” as “those records, files, documents, and other materials which (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution.” 20 U.S.C. § 1232g(a)(4)(A). Other than those two fairly vague elements—”directly related to a student” and “maintained”—and listed exceptions, neither FERPA nor its regulations, offers any guidance on whether a “record, file, document, [or] other material” is an “education record.” See 34 C.F.R. part 99.
Where digital communications are concerned, the central issue is whether the school “maintains” such documents. There is no federal appellate precedent on the issue, and state courts and federal district courts have split on the question.
Owasso and the “Central Custodian” Standard
The confusion over the meaning of “maintained” traces back to a sixteen-year-old U.S. Supreme Court decision. The Court has only once spoken on the meaning of “maintained,” and it did so in a different context. In Owasso Independent School District No. I-011 v. Falvo, 534 U.S. 426 (2002), a parent sued her children’s school district, challenging a teacher’s practice of having students grade each other’s assignments and then announcing the grades in front of the class so that the teacher could record them. The parent in Owasso believed that this “peer grading” violated FERPA because the process gave students access to each other’s grades, which the parent believed were “education records.”
The Court disagreed. It concluded that the school did not “maintain” the records because Congress meant for FERPA to reach records that are “kept in a filing cabinet in a records room at the school or on a permanent secure database, perhaps even after the student is no longer enrolled.” Id. at 433. In the Court’s view, the statute “implies that education records are institutional records kept by a single central custodian, such as a registrar.” Id. at 435 (emphasis added). Under this rubric, the school had not “maintained” the students’ grades. The Court acknowledged that a teacher’s grade book might be an education record (an issue it declined to decide), however, the student graders “only handle assignments for a few moments as the teacher calls out the answers,” and it would be “fanciful to say they maintain the papers in the same way the registrar maintains a student’s folder in a permanent file.” Id. at 433.
Not all of the Justices agreed with the Court’s “central custodian” theory. Justice Scalia called the majority’s new standard “incurably confusing.” Id. at 437 (Scalia, J., concurring). He noted that the theory apparently conflicted with FERPA’s plain text, and accused the majority of injecting uncertainty where express exemptions could apply. Id. (noting the tension between the majority’s statements about the teacher’s grade book and § 1232g(a)(4)(B)(i), which exempts a teachers’ own records).
Justice Scalia’s concurrence highlighted the tension between the “central custodian” theory and FERPA’s text, foreshadowing the difficulty that courts have had in applying this standard to digital communications. While a majority of courts have applied Owasso’s “central custodian” rule to find that schools do not “maintain” digital communications, a sizeable minority have disagreed, concluding that emails are “maintained.”
Emails Not “Maintained”
The majority of courts have found that a school does not “maintain” student emails. In perhaps the most cited case on the issue, S.A. ex rel. L.A. v. Tulare Cnty. Office of Educ., No. CV-F-08-1215, 2009 WL 3126322, at *1 (E.D. Cal. Sept. 24, 2009), astudent claimed that his school district had violated the Individuals with Disabilities Education Act (IDEA) by purging electronically stored emails relating to him. IDEA requires schools to maintain “education records” of children with disabilities, borrowing the definition of “education records” from FERPA. The student argued that the school district “maintained” every email that was “kept in a central email server or that exist[s] in the individual email inboxes of TCOE staff,” id. at *6, and thus was required to retain those emails.
The court disagreed, reasoning that, like the students’ grades in Owasso, emails “have a fleeting nature” and observing that “[a]n email may be sent, received, read, and deleted within moments,” and “may appear in the inboxes of many individuals at the educational institution.” Id. at *7. The court believed it would be “fanciful” to require the school to maintain all of those emails. Id. Such a requirement, the court reasoned, would ignore the clear purpose of FERPA, which “does not contemplate that education records are maintained in numerous places.” Id. The court dismissed—somewhat breezily—the student’s argument that the school “maintained” emails electronically on its servers, concluding that that argument was “unsubstantiated.” Id.
Subsequent courts have embraced this view that emails are “fleeting” and not “permanent,” and thus not “maintained.” One noteworthy example came out of discovery related to a high profile mass shooting in Arizona. Certain newspapers sought documents from the community college attended by Jared Loughner, the perpetrator of the shooting that targeted Rep. Gabby Giffords. The Arizona court held that the college could not withhold emails among college staff about Loughner under FERPA. Phoenix Newspapers, Inc. v. Pima Community Coll., No. C20111954 (Ariz. Super. Ct. May 17, 2011). Extending the Tulare court’s rationale, the Arizona court reasoned that “[d]ocuments are not ‘maintained’ by an educational institution under FERPA unless the institution has control over the access and retention of the record.” Slip op. 3. The fact that individual users can delete the emails in their inboxes, notwithstanding that an email “happen[s] to remain on the server by no action of the educational institution,” means that emails are not “maintained.” Id. In the court’s view, the fact that the college had to conduct a “system wide database search for a word or name indicates these documents were not saved in a central location on a permanent database which could easily be accessed after a request,” and a “key-word search that returns an unknown quantity and quality of documents does not comport with the idea of records kept by a central custodian or database, and does not conform to the idea of records kept in a filing cabinet in the records room.” Id. Therefore, FERPA did not prevent disclosure of the documents. Other courts have embraced this rationale, including in cases against secondary school districts.
However, a sizable minority of courts have held that emails are “maintained” for FERPA purposes. One example is the Ohio Supreme Court’s decision in the wake of the football scandal at the Ohio State University. See State ex rel. ESPN, Inc., 132 Ohio St.3d 212 (2012). In March of 2011, Ohio State football coach, Jim Tressel, admitted that he received emails showing a number of Ohio State players had violated NCAA rules by exchanging memorabilia for free tattoos. Under Ohio’s public record laws, sports network ESPN asked Ohio State to disclose those emails, and others between the NCAA and Ohio State athletic department about the violations. Ohio State refused, arguing that the emails were “education records.” The Ohio Supreme Court sided with the college, finding that Ohio State’s athletics department “retains copies of all e-mails and attachments sent to or by any person in the department” and that “the emails cannot be deleted.” Id. at 219. Thus, unlike the “transient” records in Owasso, the athletics department emails were “maintained” for FERPA purposes. Id.
This rationale has been embraced by a number of other courts across the country. See, e.g. President of Bates Coll. v. Cong. Beth Abraham, No. CV-01-21, 2001 WL 1671588, at *1 (Me. Super. Ct. Feb. 13, 2001) (students’ emails to their Bates college professor using their school email addresses were “education records”); E.D. v. Colonial Sch. Dist., No. No. 09-cv-4837, 2017 WL 1207919, at*10 (E.D. Pa. Mar. 31, 2017) (emails may be “education records” if school “kept copies of e-mails related to E.D. as part of its record filing system with the intention of maintaining them”).
The variance between the two lines of cases comes down to how the courts have viewed the processes of sending, receiving, and storing emails. From the perspective of the individual student, teacher, or administrator sending or receiving an email, emails might well be considered “fleeting.” A user can save an email to her hard drive, file it to a folder on a network account, or print it out, but can as easily press “delete” and never see it again. This view of emails as “fleeting” might reflect the user’s experience, but is it correct as a matter of fact?
The Ohio Supreme Court in ESPN touched on an important point about the nature of email systems, indirectly challenging the assumptions made by the majority of courts. As the court recognized, many email systems retain emails forever on a central server. Even if an individual user can “delete” an email from his or her inbox, it remains on the server for a period of time set by the system’s administrators (for a number of years, or even indefinitely). All it takes to retrieve that email is a keyword search. And even if an email is “deleted” from the server, as some courts have correctly observed:
“‘Deleting’ a file does not actually erase that data from the computer’s storage devices. Rather, it simply finds the data’s entry in the disk directory and changes it to a ‘not used’ status–thus permitting the computer to write over the ‘deleted’ data. Until the computer writes over the ‘deleted’ data, however, it may be recovered by searching the disk itself rather than the disk’s directory. Accordingly, many files are recoverable long after they have been deleted–even if neither the computer user nor the computer itself is aware of their existence. Such data is referred to as ‘residual data.’” Deleted data may also exist because it was back [sic] up before it was deleted. Thus it may reside on backup tapes or similar media.
Young v. Pleasant Valley Sch. Dist., No. 3:07-cv-854, 2008 WL 11336157, at *5 n.3 (M.D. Pa. June 26, 2008) (quoting Zubulake v. UBS Warburg LLC, 217 F.R.D. 309, 313 n.19 (S.D.N.Y. 2003).
Because schools’ emails are commonly stored forever on servers and, even if deleted, may be stored on backup tapes, those emails are arguably just components of a much larger “permanent file,” not merely “fleeting” or ephemeral. Parties have a reasonable argument that the “central custodian” is no longer the records person at the school who files away students’ report cards into the dusty file cabinet; now, the custodian is the school’s IT administrator who causes emails and other documents to be retained on the school’s servers.
On the other hand, the purpose of FERPA is to get access to the educational records of the students, not simply every document tangentially associated with the student. In that regard, courts may adopt the position advanced by some commentators that a record is “maintained” only when an employee or agent of the institution has made a conscious decision to “maintain” the record for the institution’s own purpose; for example, if an administrator forwards a student email to a student conduct officer for an investigation or maintains the digital correspondence specifically for a school file.
As courts become more technologically literate, attorneys for schools, students, and other parties should expect the debate about FERPA’s application to digital communications to become more nuanced and sophisticated. Parties should be prepared to inquire and argue about whether school emails are “maintained” based on the facts of the particular emails and email system involved. For instance, does the school have its own email servers or does it use a cloud-based system? Does the school have a policy of retaining sent and received emails indefinitely? For a particular number of years? Are students’ emails in their school account deleted once they graduate? Are the emails easily searchable using keywords, such as a student’s name? For the particular emails in question, did a teacher or administrator save them locally to their computer, or did they only reside on the server? Are the emails filed into folders within the teacher’s or administrator’s inbox?
Until appellate courts provide guidance on the issue, answers to these questions will help parties cure this “incurably confusing” standard.
 Pub.L. 90-247, Title IV, § 444, formerly § 438, as added Pub.L. 93-380, Title V, § 513(a), Aug. 21, 1974, 88 Stat. 571.
 FERPA’s rights and protections apply equally to parents of minor students and to students themselves who are over eighteen years of age or attending “an institution of postsecondary education.” 20 U.S.C. § 1232g(d).
 Exceptions include releasing records to other school officials with legitimate educational interests in them, to other schools where a student intends to enroll, for certain law enforcement purposes, and in connection with financial aid applications. 20 U.S.C. § 1232g(b)(1)(A)-(L).
 “Education records” do not include, for instance, “records of instructional, supervisory, and administrative personnel and educational personnel ancillary thereto which are in the sole possession of the maker thereof,” or “records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purposes of law enforcement.” Id. § 1232g(a)(4)(B)(i)-(iv).
 Slip opinion available at http://s3.amazonaws.com/cdn.getsnworks.com/spl/pdf/PimaCollegeFERPA.pdf.
 See, e.g. S.B. v. San Mateo Foster City Sch. Dist., No. 16-cv-01789, 2017 WL 4856868, at *18 (N.D. Cal. Apr. 11, 2017) (plaintiffs did not show emails were “‘collected, maintained, or used by’ the school district, whether in a centralized hard copy file or electronic repository like a database.”); Pollack v. Reg. School Unit 75, No. 2:13-cv-109, 2015 WL 1947315, at *8 (D. Me. Apr. 29, 2015)(describing FERPA as protecting “the integrity and privacy of the central record that follows all students from grade to grade and school to school”).
[*] Mr. Daniels is counsel in the Litigation Department of TerraLex member Wiggin and Dana LLP, and a member of the firm’s Education Practice Group and its Appellate and Complex Legal Issues Practice Group. His practice includes representing colleges and universities in complex compliance and litigation matters. He can be reached at firstname.lastname@example.org. Mr. Gasser is an associate in the Litigation Department whose practice includes representing colleges and universities in litigation. He can be reached at email@example.com.