Gonzaga University v. Doe: Can Students Sue for FERPA Violations?
Meta description: Learn what Gonzaga University v. Doe decided, why FERPA generally does not allow students to sue for damages, and what options may remain after an alleged privacy violation.
When a college shares a student’s education records without permission, the consequences can be serious. But the federal Family Educational Rights and Privacy Act (FERPA) does not give students a general right to sue schools for money damages. In Gonzaga University v. Doe, the U.S. Supreme Court held that FERPA’s privacy provisions do not create individual rights enforceable through a federal civil-rights lawsuit under 42 U.S.C. § 1983. The decision remains central to understanding FERPA violations, available complaints, and the limits of private lawsuits.
What Gonzaga University v. Doe Decided
In Gonzaga University v. Doe, 536 U.S. 273 (2002), the Supreme Court considered whether a student could use 42 U.S.C. § 1983 to sue a university employee over an alleged disclosure of education-record information. The Court concluded that FERPA’s nondisclosure provisions do not create personal rights that an individual can enforce through that federal statute.
The ruling did not erase FERPA or make unauthorized disclosures lawful. It addressed a narrower question: whether FERPA gives individuals a federal right to sue under § 1983. The Court said it does not. FERPA instead directs the federal government to enforce the law through its funding relationship with covered educational institutions.
This distinction matters. A school may still face federal oversight or other consequences for failing to comply with FERPA, but a student generally cannot rely on FERPA itself as the basis for a private federal damages lawsuit. The decision also does not automatically resolve whether separate state-law claims may be available in a particular case.
The Background of the Case
The dispute began after a Gonzaga University student, referred to in court papers as John Doe, sought certification to teach in Washington state. A university employee who handled teacher-certification matters contacted the state agency responsible for issuing teaching credentials. The employee shared information related to an investigation into allegations involving Doe and suggested that he might not meet the character requirements for certification.
Doe claimed that the university disclosed information from his education records without his consent and that the statements harmed his ability to obtain certification. He brought claims that included a federal civil-rights claim under § 1983. The legal question eventually reaching the Supreme Court was not simply whether the information had been shared improperly. It was whether FERPA’s provisions gave Doe a personal federal right he could enforce through § 1983.
The Supreme Court ruled that FERPA did not create such an enforceable individual right. The case is therefore often cited for the broader principle that not every federal statute creates rights that private parties may enforce in court through § 1983.
What FERPA Protects
FERPA is a federal law governing access to and disclosure of certain student education records. It generally applies to educational agencies and institutions that receive funds through programs administered by the U.S. Department of Education. Covered schools include many public and private colleges, universities, and K–12 institutions, although the law’s application depends on the institution and the records involved.
Under FERPA, a parent generally has rights concerning a student’s education records while the student is under 18 or attends a covered postsecondary institution. Those rights transfer to the student when the student turns 18 or attends a postsecondary institution, whichever comes first. A student with transferred rights is commonly called an “eligible student.”
Eligible students generally have the right to inspect and review their education records, request correction of information they believe is inaccurate or misleading, and exercise control over disclosure of personally identifiable information, subject to exceptions in the law and regulations. FERPA’s rules are not a blanket promise that no information will ever be shared. The circumstances, type of record, and applicable exception matter.
FERPA defines education records broadly as records that are directly related to a student and maintained by an educational agency or institution, or by a party acting for it. Some records are excluded from the definition, including certain law-enforcement-unit records, qualifying employment records, and certain treatment records. Whether a particular document or communication qualifies can depend on how and why it was created and maintained.
Why FERPA Usually Does Not Support a Private Lawsuit
FERPA is commonly understood as a federal funding statute. It conditions certain federal education funds on an institution’s compliance with privacy requirements and provides for federal administrative enforcement. The Supreme Court in Gonzaga found that the relevant provisions focus on institutional obligations and federal oversight rather than clearly giving each student a personal right enforceable in court.
That conclusion blocks a specific route: using § 1983 to enforce FERPA’s nondisclosure provisions as individual federal rights. Section 1983 allows people to sue state actors for certain violations of rights secured by federal law, but a statute must create an individual right for that method to apply. The Court held that FERPA’s provisions did not meet that standard.
As a practical matter, a student generally cannot obtain damages simply by alleging, “The school violated FERPA.” The Department of Education may investigate a complaint and require corrective action, but that process is different from a private lawsuit seeking compensation. FERPA does not itself provide a general private right of action for damages.
Important: The decision does not mean that every school disclosure is permitted, nor does it establish that no lawsuit could ever arise from the same events. A claim based on a separate legal duty—such as a state privacy law, contract, or another applicable statute—must be assessed independently. Whether such a claim is available depends on the facts, jurisdiction, and other legal requirements.
How FERPA Complaints Are Handled
Students and parents with FERPA rights can submit complaints to the U.S. Department of Education’s Student Privacy Policy Office (SPPO). The complaint process is administrative, not a private court action. It allows the federal agency to review alleged violations and determine whether a school is complying with FERPA.
Under federal regulations, a complaint generally must be filed within 180 days of the alleged violation or within 180 days after the complainant knew or reasonably should have known about it. The Department may extend the deadline for good cause. Complaints should identify the school, describe the alleged violation, and include relevant supporting information. The SPPO’s current guidance should be checked for filing instructions and any updates.
If the Department determines that a school has violated FERPA, the regulations provide for steps aimed at bringing the institution into compliance. These may include voluntary compliance measures and, in limited circumstances, formal enforcement actions related to federal funding. The statutory framework does not make an individual student’s compensation the ordinary remedy in this process.
Before filing, a student may also consider contacting the school’s registrar, privacy officer, or designated FERPA contact. A written request can help establish what information was disclosed, when it was shared, who received it, and whether the school believes an exception applied. Keeping copies of emails, notices, and responses can make a complaint more focused.
Common FERPA Disclosure Exceptions
FERPA allows schools to disclose certain information without consent in specified circumstances. An exception does not automatically excuse every disclosure; the school must meet the requirements for the particular exception it relies on. Common examples include:
- School officials with legitimate educational interests: A school may share records with qualifying officials, including certain contractors, when they have a legitimate educational interest and the school’s criteria are met.
- Another school: Records may be sent to a school where the student seeks or intends to enroll, subject to applicable requirements.
- Financial aid: Information may be disclosed when necessary to determine eligibility, amount, conditions, or enforcement of aid.
- Health or safety emergencies: Information may be shared with appropriate parties when a qualifying emergency exists and the disclosure is necessary to protect health or safety.
- Directory information: A school may disclose designated information, such as a student’s name or enrollment status, if it has provided required notice and the student has not opted out.
- Judicial orders and subpoenas: Disclosure may be permitted under specified legal processes, often with notice to the student unless an exception applies.
These examples are not exhaustive. FERPA regulations, institutional policies, and the details of the disclosure affect the analysis. A school’s description of a disclosure as “directory information” or an “emergency” does not alone establish that the legal requirements were satisfied.
What Students Can Do After a Suspected Disclosure
A practical response starts with gathering facts. The student can ask the school to identify the record at issue, the information disclosed, the date and recipient, the purpose, and the legal basis for disclosure. The student can also review the institution’s annual FERPA notice, privacy policy, and procedures for requesting access to education records.
If the issue involves inaccurate information, the student may use FERPA’s amendment procedure. That process allows a request to amend records believed to be inaccurate, misleading, or otherwise in violation of the student’s privacy rights. If the school declines the request, FERPA provides an opportunity for a hearing. The procedure does not generally let a student challenge a grade or a substantive decision simply because the student disagrees with it.
For an alleged unauthorized disclosure, a student may submit a complaint to the SPPO within the applicable timeframe. The complaint should be specific and supported by documents where possible. A clear timeline can help distinguish a FERPA education record from information that may fall outside the law’s coverage.
Where the disclosure caused significant harm, legal advice may be useful. An attorney can assess whether facts support a separate claim under state law or another federal law, whether the defendant is a state actor, and whether deadlines or immunity doctrines apply. The Gonzaga ruling makes it especially important not to assume that citing FERPA alone creates a viable damages claim.
FERPA and Other Potential Legal Claims
Although FERPA does not itself provide a general private damages action, the same conduct may raise questions under other laws. State privacy statutes, state constitutional protections, contract obligations, or other legal rules may apply depending on the school, the person who disclosed information, the type of record, and the harm alleged. These possibilities vary substantially across states and institutions.
A separate claim cannot simply repackage a FERPA allegation and assume that the federal ruling no longer matters. Courts may consider whether the claim genuinely rests on an independent legal duty, whether the law recognizes the claimed injury, and whether the defendant can be held liable. Public and private institutions may also be subject to different rules.
For that reason, the most accurate summary is limited but useful: FERPA protects student-record privacy through institutional duties and federal oversight, but Gonzaga University v. Doe forecloses using FERPA’s nondisclosure provisions as individual rights enforceable under § 1983. Students can still seek administrative review and may have other legal options, but those options depend on facts beyond the FERPA claim itself.