34 CFR 99.1 applicability + 99.3 definitions. APPLICABILITY: FERPA applies to any educational agency or institution receiving funds from any program administered by the Secretary of Education (including all US K-12 + nearly all postsecondary institutions accepting federal funding incl. Pell grants). KEY DEFINITIONS: EDUCATION RECORDS = records directly related to a student + maintained by the institution + excluding sole-possession notes + law enforcement unit records under §99.8 + alumni-only records + employment-not-as-student records + medical-treatment records of postsecondary adult students (Buckley Amendment); PERSONALLY IDENTIFIABLE INFORMATION (PII) = direct identifiers (student name + parent name + address + SSN + ID number + biometric) + indirect identifiers (date of birth + place of birth + mother maiden name) + other information linked or linkable to a specific student + information that targeted person who does not have personal knowledge of relevant circumstances could use to identify the student with reasonable certainty + information requested with reasonable certainty of identifying a specific student; DIRECTORY INFORMATION = information not generally considered harmful or an invasion of privacy if disclosed (name + address + phone + email + photo + DOB + attendance dates + grade level + enrollment status + degrees + honors + sports participation + height/weight of athletes); ELIGIBLE STUDENT = student who has reached 18 years of age or is attending a postsecondary institution at any age; SCHOOL OFFICIAL = institution employee + contractor + consultant + volunteer + or other party (e.g. attorney + auditor + collection agent + student employed by the institution) performing institutional services or functions for which the institution would otherwise use its employees + under the direct control of the institution with respect to PII use and maintenance + subject to institutional FERPA training and confidentiality requirements (the 2008 amendments + 2011 clarifications expanded contractor/vendor coverage).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.