Privacy

There are numerous federal laws that control the release of student data, and these laws impact the Office of Student Financial Aid’s (OSFA) use of this information in different ways—depending on the source of data and whether personally identifiable information (PII) has been properly de‑identified. PII refers to information that can be used to identify an individual (for example: name, address, Social Security Number, date of birth, place of birth, or any information that—alone or in combination—is linked or linkable to a specific student such that a reasonable person in the school community, without personal knowledge of the circumstances, could identify the student with reasonable certainty).

1. Section 483(a)(3)(E) of the Higher Education Act (HEA) as amended specifically restricts the use of Free Application for Federal Student Aid (FAFSA) data (including Award, estimated Cost of Attendance (COA), Expected Family Contribution (EFC), Student Aid Index (SAI), or financial need). It states that data collected on the FAFSA form shall be used only for the application, award, and administration of aid awarded under:
   • federal student aid programs,
   • state aid programs,
   • aid awarded by eligible institutions, and
   • such entities as the U.S. Department of Education (ED) may designate.
   The only permissible method for most third parties to receive FAFSA information under HEA is directly from the student; OSFA cannot provide this information even with the student’s written permission. However, appropriations legislation in 2018 and 2019 ^[1] included amendments to this section of the HEA to allow institutions to share a student’s FAFSA data with scholarship‑granting organizations and tribal organizations to assist with the application, awarding, or administration of scholarship programs (or for assisting the student in applying for assistance that would pay for items in a student’s official Title IV cost of attendance), but only if the student provides explicit written consent authorizing the release of such data.
2. Section 485B(d)(2) of the HEA as amended also prohibits the use of National Student Loan Data System (NSLDS) data for non‑governmental research and marketing purposes.
3. The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g and 34 CFR Part 99 protects the privacy of students, in part by prohibiting postsecondary institutions from disclosing PII contained in education records to any third party—including the student’s parents—without the student’s written permission.
4. The Privacy Act, 5 U.S.C. Section 552 governs the collection, maintenance, and use of records maintained by federal agencies and generally prohibits agencies from disclosing data contained in those records. The Privacy Act imposes restrictions on the University when a federal agency lawfully provides the University access to records.
5. The Student Aid Internet Gateway (SAIG) Enrollment Agreement requires the University to:
   • ensure that all users are aware of and comply with all requirements to protect and secure data from ED sources using SAIG; and
   • report any suspected or actual data breaches.
6. The Gramm‑Leach‑Bliley Act (GLBA), 15 U.S.C. Section 6801, as well as the University’s Program Participation Agreement (PPA) states institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of administering the Federal Student Aid (FSA) programs authorized under Title IV of the HEA, as amended.
7. National Institute of Standards and Technology (NIST) Special Publication 800‑171 identifies recommended requirements for ensuring the appropriate long‑term security of certain Federal Controlled Unclassified Information (CUI) in the possession of institutions.
8. ED’s Privacy Technical Assistance Center’s (PTAC) “Guidance on the Use of Financial Aid Information for Program Evaluation and Research” discusses the legal requirements and restrictions under the various federal statutes and regulations referenced above.