Publishing student information online to showcase students' success—or for any other reason—raises privacy issues.

Students' rights to privacy are defined in the Family Educational Rights and Privacy Act (FERPA) and regulations that flow from this federal law. Some states also have created additional laws, and you should check with your state legislature.

FERPA allows schools to publish or release to other institutions a student's education record in only two circumstances: as "directory information" or by a parent's written consent. "Directory information" means anything that generally wouldn't be considered an invasion of privacy if released, and FERPA specifies the following examples:

1. Name

2. Address

3. Phone, eMail

4. Date and place of birth

5. Photograph

6. Major field of study

7. Dates of attendance

8. Grade level

9. Enrollment status

10. Participation in official school activities

11. Height and weight of athletes

12. Honors and awards

Even these data elements cannot be disclosed unless the school completes a formal procedure designed to ensure parental consent. This procedure should include the following three elements:

• Identifying the information that is considered part of a standard directory listing about each student;

• Informing parents that this directory information will be published online; and

• Giving parents the right to restrict publication and ample time to ask for the restriction.

This type of notification to parents does not need to be done individually; a public notice at the beginning of the school year is sufficient. It is also important to note that students' academic work usually cannot be published by a school without a separate, direct parental consent, because it often can be linked directly to the individual student.

As stated above, FERPA recognizes student photos as directory information, as long as you've notified parents that you intend to consider photos this way; likewise, students' eMail addresses can be considered directory information. But make sure you've followed the procedures outlined above, and when in doubt, it's best to get separate written consent from parents for each posting.