This policy applies to education records maintained by SUNY Purchase or by a party acting for the College, regardless of format.

Student - An individual who is or has been in attendance at SUNY Purchase and about whom the College maintains education records. FERPA rights belong to the student upon attendance at the College, regardless of age. FERPA generally does not apply to records of an applicant who never attends SUNY Purchase.

Education records - Records that are directly related to a student and maintained by SUNY Purchase or by a party acting for the College.

Personally identifiable information - Information that identifies a student directly or indirectly, including information that, alone or in combination, would allow a reasonable person in the College community to identify the student with reasonable certainty.

Disclosure - Permitting access to, or releasing, transferring, or otherwise communicating, personally identifiable information from education records by oral, written, electronic, or other means.

Education records do not include records excluded by FERPA, including qualifying sole-possession notes, qualifying law enforcement unit records, employment records unrelated to student status, qualifying treatment records, records created after attendance that are unrelated to the individual’s attendance, and peer graded papers before collection and recording.

Subject to FERPA’s conditions and exceptions, a student has the right to:

• Inspect and review the student’s education records;
• Request amendment of records the student believes are inaccurate, misleading, or otherwise in violation of the student’s privacy rights;
• Provide written consent before disclosure of personally identifiable information, except when FERPA authorizes disclosure without consent;
• Inspect the record of certain requests for and disclosures of education records; and
• File a complaint with the U.S. Department of Education concerning an alleged failure by SUNY Purchase to comply with FERPA.

A student must submit a written request to the College office that maintains the requested records and identify the records with sufficient detail. If the student does not know which office maintains the records, the student may contact the Office of the Registrar for assistance. The College will arrange access within a reasonable time, but no later than 45 calendar days after receiving the request. The College may verify the student’s identity and supervise the inspection.

FERPA provides a right to inspect and review records, not an unconditional right to receive copies. The College will provide copies or other arrangements when failure to do so would effectively prevent the student from exercising the right of access. A reasonable copying fee may be charged unless it would prevent access. No search or retrieval fee will be charged.

A student may inspect only the portion of a record that relates to that student. The College may redact information concerning other students. The right of inspection does not include parents’ financial records, qualifying confidential recommendations for which access was validly waived, or records excluded from the FERPA definition of education records.

A student who believes an education record is inaccurate, misleading, or otherwise violates the student’s privacy rights may submit a written request to the office that created or maintains the record. The request must identify the information at issue, state the requested amendment, and explain the basis for the request.

If the College declines to amend the record, it will notify the student in writing and advise the student of the right to a hearing. If requested by the student, the hearing will be held within a reasonable time, after reasonable advance notice. The hearing officer will be appointed by the appropriate Vice President or designee and may not have a direct interest in the outcome. The student will have a full and fair opportunity to present relevant evidence and may be assisted by another person, including an attorney, at the student’s expense. The College will issue a written decision based solely on the evidence presented at the hearing. The decision will include a summary of the evidence and the reasons for the decision.

If the record is not amended after the hearing, the student may place a statement with the contested information explaining the student’s disagreement. The statement will be maintained and disclosed with the contested information. This process may address whether a grade or other decision was recorded accurately, but it may not be used to challenge the academic judgment underlying the decision.

Except as permitted by FERPA or another applicable law, the College will not disclose personally identifiable information from education records without the student’s signed and dated consent. The consent must identify the records, state the purpose of disclosure, and identify the party or class of parties to whom disclosure may be made. A valid authenticated electronic consent may be accepted.

FERPA permits disclosure without consent in specified circumstances, including:

• To school officials with legitimate educational interests;
• To another institution where the student seeks or intends to enroll, or is already enrolled, when related to enrollment or transfer;
• For authorized audits, evaluations, studies, financial aid, or accreditation functions, subject to applicable safeguards;
• To comply with a judicial order or lawfully issued subpoena, subject to applicable notice requirements;
• To appropriate parties in connection with an articulable and significant health or safety threat;
• To a parent of an IRS-dependent student, when the College determines disclosure is appropriate;
• Concerning certain disciplinary results or alcohol or controlled-substance violations, as permitted by law;
• In connection with legal action between the student and the College;
• When the information is directory information and the student has not restricted disclosure; or
• As otherwise permitted or required by law.

Each disclosure must satisfy the specific legal conditions applicable to the exception used.

A school official includes a person employed by SUNY Purchase in an administrative, supervisory, academic, research, support, health, law-enforcement, technical, or other staff position; a member of the SUNY Board of Trustees or SUNY SUNY Purchase Council; an authorized SUNY System Administration official; a student serving on an official committee or assisting another official; or a contractor, consultant, volunteer, or other outside party performing an institutional service or function for which the College would otherwise use employees.

An outside party must be under the College’s direct control concerning the use and maintenance of education records and subject to FERPA’s use and redisclosure requirements. Outside parties handling education records on behalf of the College must be subject to applicable contractual or other written requirements governing privacy, security, authorized use, access, redisclosure, incident reporting, return, and destruction of education record information.

A school official has a legitimate educational interest when access to particular education records is reasonably necessary to perform an assigned responsibility for SUNY Purchase. Access based on curiosity, personal interest, or an unofficial purpose is prohibited.

SUNY Purchase designates the following as directory information:

• Name
• Photographs
• Home address, phone number, and email address
• Dates of attendance, graduation, and matriculation status
• Major fields of study, degrees, class level, and full-time or part-time status
• Participation in recognized College activities and awards
• Athletes’ height and weight

The College may disclose directory information without prior written consent unless the student has submitted a valid request to restrict disclosure. A student may request suppression of all directory information at any time while the student is in attendance at SUNY Purchase by submitting the Suppression of Directory Information form to the Office of the Registrar. The restriction applies prospectively after the request is processed and remains in effect until revoked in writing. It does not prevent disclosures otherwise permitted by FERPA or other applicable law. Designation as directory information permits disclosure but does not require the College to disclose it.

The College will maintain a record of requests for and disclosures of personally identifiable information when FERPA requires it. A disclosure record is generally not required for disclosures to the student, pursuant to the student’s valid written consent, to a school official with a legitimate educational interest, for directory information, or when another FERPA provision expressly exempts the disclosure from recordkeeping.

A recipient may use personally identifiable information from education records only for the purpose for which the disclosure was made and may not redisclose it except as permitted by FERPA or other applicable law.

School officials must access and use only the education records needed for authorized duties, use reasonable methods to authenticate persons requesting records, and protect records from unauthorized access or disclosure.

Employees, student employees, and other school officials with access to education records must complete FERPA and privacy training as required by the College.

Suspected loss, misdirection, unauthorized access, or unauthorized disclosure must be reported immediately to the Office of the Registrar and through any applicable College privacy or information security process.

Education records will be retained and disposed of according to applicable SUNY and College records retention requirements and legal holds. No record may be destroyed while a request to inspect it is outstanding or while the record is subject to a legal hold or other applicable preservation requirement.

SUNY Purchase will annually notify students in attendance of their FERPA rights through official College email or by another method reasonably likely to inform them of those rights.

Questions and requests: Office of the Registrar, Student Services Building, First Floor, 735 Anderson Hill Road, Purchase, NY 10577; 914-251-6361; registrar@purchase.edu.

Federal complaints: A student may file a complaint concerning an alleged failure to comply with FERPA with the U.S. Department of Education’s Student Privacy Policy Office. Current instructions are available at https://studentprivacy.ed.gov/file-a-complaint.

The Office of the Registrar administers this policy and coordinates the College’s FERPA compliance activities.

College offices that maintain education records are responsible for protecting those records, responding to requests, maintaining required records of disclosure, and consulting the Office of the Registrar or counsel when a proposed disclosure is uncertain or presents an elevated privacy or legal risk.

The College may issue forms, procedures, and guidance consistent with FERPA, applicable SUNY requirements, and this policy.