Institutes of Higher Education, Safety Swords, and Privacy Shields: Reconciling FERPA and the Common Law

In light of the Virginia Tech shootings, this Note argues that both FERPA and the common law contain internal tensions regarding safety and privacy that neither Congress nor the courts have adequately reconciled, and that important discrepancies regarding information sharing exist between IHEs' practices, the common law's demands, and FERPA's limitations. Part I provides background on FERPA and argues that FERPA's emergency exception is too narrow and confusing, so that IHEs default to the nondisclosure option rather than disclosing information to third parties, such as parents, when students threaten to harm themselves or others. At the same time, FERPA's tax dependent exception operates as an overly broad bright-line rule that, coupled with FERPA's lax enforcement mechanism, fails to adequately protect the privacy of students' education records. Thus, FERPA's emergency exception fails to ensure safety, while the tax dependent exception eviscerates the statute's privacy protection. Part II points out that, at the common law, courts have traditionally relied upon three competing strands of tort doctrines, each of which emphasizes either safety or privacy to the exclusion of the other. Thus, while the "duty" strand of premises liability uses safety as a sword and emphasizes foreseeability, the "no duty" strand of custodial relations and in loco parentis uses privacy as a liability shield. In the past, as the common law shifted from using safety as a sword to using privacy as a shield, FERPA responded. For example, as societal attitudes and the common law changed regarding alcohol use, Congress created a tailored exception allowing IHEs to notify parents when students violate laws or policies regarding the possession or use of controlled substances. Currently, another such shift is occurring, and courts are beginning to develop a concept of "duty-based-on-the-facts" as part of the special relationship between IHEs and students. As IHEs adopt public health models to address mental health issues on campuses, courts are using the safety sword to impose a duty on IHEs to use reasonable care to prevent foreseeable acts of harm to and by students, including suicide. However, FERPA has yet to respond to these increasing demands that the common law places on IHEs to share and disclose information about students' mental health. Part III proposes ways to resolve the tensions within the common law and FERPA regarding safety and privacy, as well as ways to align the duties the common law imposes on IHEs with the limits on disclosure that FERPA requires of IHEs. In reference to the common law, this Note argues that courts should create a coherent foreseeability framework specific to the mental health and IHE context, acknowledging the limits of foreseeability-especially for college and university personnel who are not mental health professionals-while balancing safety and privacy concerns. Part III also argues that Congress should amend FERPA to appropriately balance safety and privacy, specifically by broadening and clarifying FERPA's emergency exception while eliminating the tax dependent exception. Meanwhile, as these tensions within and between the common law and FERPA are resolved, the U.S. Department of Education should make several changes regarding the guidance it provides. This Note does not predict how future litigation related to the Virginia Tech shootings might proceed, attempt to assess fault, or argue that such tragic events are preventable. Rather, it highlights doctrinal and statutory developments that might impact where courts draw the line between safety and privacy within the context of questions related to the Virginia Tech shootings. In exploring these questions, this Note suggests how safety and privacy, as well as the common law and FERPA, might be reconciled, thereby charting a clearer course going forward. Note: This article first appeared in substantially similar form in 35 J.C. & U.L. 145 (2008).