Update (Jan. 2026): In April 2025, REGucation published a post analyzing the Nevada Supreme Court’s initial decision in Clark County School Dist. v. Eighth Jud. Dist. Ct. in & for Cnty. of Clark, 564 P.3d 863 (2025). The Court withdrew that opinion in June 2025 and issued a new one in November 2025. This post has been updated to reflect the Court’s latest ruling.
As regular REGucation readers and higher education practitioners know, the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99), commonly known as FERPA, is a federal law enacted in 1974 concerning the privacy of student “education records” and the related requirements of educational institutions. In particular, in the post-secondary education context, FERPA gives students the right to:
- Control the disclosure of their “education records” to others;
- Inspect and review their own “education records;” and
- Seek amendment of their “education records.”
While higher education has changed significantly since 1974, FERPA, in many ways, has not. In practice, this means that institutions are required to apply laws and regulations, sometimes several decades old, to modern technologies. Nowhere is this more apparent than the debate over whether institutional e-mails are considered “maintained by” an educational institution or “directly related” to a student, and therefore subject to FERPA.
What Does “Maintained” or “Directly Related” Mean?
FERPA protects “education records.” There are two essential criteria for a document to be considered part of an “education record” under FERPA. The record must be (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution. 34 C.F.R. §99.3.
While the term “record” is defined – meaning information recorded in any way, subject to several regulatory exceptions (see 34 C.F.R. § 99.3) – there is, frustratingly, no definition of “maintained” or “directly related.” The absence of a definition for the terms “maintained” or “directly related” has created issues for institutions implementing FERPA in a number of contexts, particularly with respect to student emails.
“Maintained”
Students attending an institution of higher education can send hundreds or thousands of emails during their time on campus. Presently, almost all institutions of higher education contract with a third-party vendor to handle student emails, such as Microsoft’s Outlook or Google’s Gmail. These vendors typically store emails on their servers or in the cloud.
Broadly speaking, if student emails are considered “maintained” by the institution, those “directly related” to a student may be subject to FERPA. This would mean that students might have a right to inspect such emails. On the other hand, if an email is not considered “maintained” by the institution, it would not be subject to FERPA.
As noted above, there is no definition of “maintained” in the statute or regulations. One of the few Supreme Court decisions addressing FERPA, Owasso Independent School District v. Falvo, 534 U.S. 426 (2002) is instructive. In this case, the Supreme Court wrote that “FERPA implies that education records are institutional records kept by a single central custodian, such as a registrar” and that word “maintain” “suggests FERPA records will be kept in a file in a school’s record room or on a secure database.”
The Supreme Court’s explanation, while informative, is only dicta and not controlling. Some institutions and practitioners take the position that student emails are “education records” that are “maintained by” the institution.
Others, including several courts, have looked to Owasso to conclude that emails stored in an ordinary manner are not, without more, maintained by the institution. By way of example, in E.D. by & through T.D. v. Colonial Sch. Dist., No. CV 09-4837, 2017 WL 1207919 (E.D. Pa. Mar. 31, 2017), the court concluded that not every email is an education record unless the institution kept copies of emails related to a student with the intention of maintaining them.[1] Similarly, Mackinac Ctr. for Pub. Pol’y v. Michigan State Univ., No. 364244, 2023 WL 6939084 (Mich. Ct. App. Oct. 19, 2023) explained that the student emails in question were not maintained by the institution because it could not be shown that the institution purposefully preserved the emails and kept the emails in either a physical filing cabinet or a permanent secure database specifically related to the students.[2] Lastly, Doe v. Rutgers, State Univ. of New Jersey, No. CV2117811KMAME, 2022 WL 1617581 (D.N.J. May 20, 2022) pointed out the transient nature of emails and noted that the emails kept on an email server from which they could be deleted by the senders and receivers are not education records under FERPA.[3]
“Directly Related”
While, again, not defined in statute or regulation, the term “directly related” has generally been understood to be broad, but not without limits. The court in Rhea v. Dist. Bd. of Trs. of Santa Fe Coll. (Fla. Dist. Ct. App. 2013) explained that information is directly related to a student if it has “a close connection to that student.” In that case, an email containing a student complaint against a professor was “directly related” to that student because the email would identify the student and the student’s enrollment in the professor’s class, and because it describes the student’s personal impressions of the classroom environment.
However, other courts have also made clear that an “education record” does not encompass every document that relates to a student in any way; and records that include information about a student – but that primarily concern another person or another subject – are not considered directly related. In BRV, Inc. v. Superior Ct., 143 Cal. App. 4th 742 (2006), for example, the court found that a report investigating a school administrator was not directly related to particular students, despite that the names and activities of those students were included in the report.[4] Also instructive is J.O. v. Bd. of Educ. of Albuquerque Pub. Sch., No. 1:23-CV-01021-KG-JMR, 2025 WL 623543 (D.N.M. Feb. 26, 2025), where the court noted that the mere presence of student information in the teacher records does not render those records subject to FERPA.[5]
The Nevada Supreme Court’s March 2025 Decision in Clark County
In March 2025, the Nevada Supreme Court initially held in Clark County School Dist. v. Eighth Jud. Dist. Ct. in & for Cnty. of Clark, 564 P.3d 863 (2025), that student emails were “maintained” under FERPA and therefore qualified as protected education records.
In this case, the school district relied on Owasso to argue that the emails stored in Google Vault were not “maintained” by the school district because they were not “intentionally placed onto a specific, central file designated for [the student].” In other words, the school district argued that, since the emails at issue were not intentionally stored in the student’s permanent file, the emails were not “maintained” by the institution.
The Nevada Supreme Court, in its March 2025 decision, did not find that argument persuasive, noting that Owasso was decided in the earlier days of internet technology when technologies such as Google Vault did not exist. The Court wrote:
“…while some courts suggest that to maintain a record, the institution must display some level of intent to separate that record out, we do not find this to be a binding requirement under FERPA or Owasso. A record is maintained when it is stored on an educational institution’s secure database or storage system. We read “maintained” broadly so as to accommodate any future unknowable storage format that would otherwise, by way of ever-evolving technology, undermine our determination today. We find that the records stored on [Clark County’s] Google Vault are maintained by [Clark County] and therefore satisfy the second prong of the education records definition under FERPA.”
The Court then required Clark County to assess the content of relevant emails to determine if they met the “directly related” prong of the definition of “education records.” The Court gave the following guidance for this determination:
- “Congress intended for the definition of ‘education records’ to be broad in scope.”
- “Despite being broadly defined, an education record ‘does not encompass every document that relates to a student in any way ….’”
- “Records that include information about a student, but are primarily about someone or something else, are not considered directly related.”
- “…courts have determined that education records need not be tied to academics to be directly related to a student’s education… These records may instead be focused on a student’s discipline, safety, or other school-related conditions.”
Clark Cnty. Sch. Dist. at 866 (internal citations omitted).
Update Following the Nevada Supreme Court’s November 2025 Opinion
In June 2025, the Court vacated its March opinion and, in November, issued a new ruling that significantly narrowed the scope of FERPA’s application to student emails. In reconsidering the matter, the Court explained:
“An individual email may become part of a student’s education records when the school district or its agent takes affirmative and intentional steps to treat the email as an institutional record and stores it with a designated individual in a designated place.” Clark Cnty. Sch. Dist. v. Eighth Jud. Dist. Ct. in & for Cnty. of Clark, 141 Nev. Adv. Op. 58, (2025), at *1 (emphasis added).
As in Owasso, the en banc Nevada Supreme Court in November reasoned that “maintained” connotes “permanence and deliberate storage,” cautioning that an overbroad interpretation of “education records” – so as to encompass all emails that mention a student – would be contrary to congressional intent in enacting FERPA. Because many email exchanges are informal conversations lacking the intentionality that characterizes the type of information formally designated as an education record, the Court concluded that such emails “sent in the ordinary course of business” are not education records.
With respect to the “directly related” prong, the Court offered guidance consistent with the earlier opinion. The requirement that emails be “directly related” to a student naturally excludes records that only incidentally relate (e.g., emails that merely mention a student’s name while primarily addressing something else). To directly relate to a student, the information contained in the emails must have a close connection to that student. Id. at *4.
In sum, the Nevada Supreme Court’s revised November 2025 opinion narrowed its earlier expansive interpretation, making clear that only emails deliberately preserved as institutional records and closely connected to a student qualify as “education records” under FERPA.
What’s Next for Institutions of Higher Education?
We offer two key takeaways for institutions of higher education:
1. FERPA Has Not Kept up with the Times
Enacted in 1974, FERPA was designed for an era of paper records and in-person instruction. In the absence of clear direction, courts are left to interpret FERPA’s requirements and apply them to an educational environment where the majority of records are electronic. Even the relevant Supreme Court opinion, Owasso, is over twenty years old.
Courts have tried to pick up the slack, but they have reached different conclusions as to how to apply FERPA in a digital era. This interpretive gap increases the risk of uneven compliance expectations and places institutions in the difficult position of adopting new technologies amid uncertain and conflicting legal standards. Indeed, an institution with campuses across multiple states could be subject to different interpretations of FERPA based on campus location.
That these tensions were evident within the Nevada Supreme Court itself is a perfect example. In its November 2025 opinion, the dissent – echoing concerns raised in the Court’s earlier March opinion – urged a broader interpretation of FERPA, noting that Owasso, the only binding precedent, was decided in a far different technological context. As the dissent explained, modern cloud-based systems allow emails to be “intentionally tethered to a specific student without the need to place them into a designated folder,” effectively building “intentionality” into the system itself.
The Court’s shift toward the majority view may be driven, at least in part, by the “public policy consequences” identified in the school district’s petition for en banc reconsideration. The school district noted that the prior decision had already begun to generate new, burdensome email requests for Nevada school districts. It also argued that the earlier ruling was not in the public interest because it risked encouraging costly litigation and straining limited judicial resources.
Such practical concerns are further reflected in a footnote to the majority opinion. Beyond aligning with other jurisdictions that require the element of intentionality for emails, the Court expressed concerns that a broad definition of “education records” could sweep in everyday communications made in other digital applications – primarily, workplace chat applications such as Slack or Microsoft Teams.
All in all, this change in course suggests a reconsideration informed by the operational realities of modern institutions, as well as a recognition that extending FERPA too broadly in digital environments may produce unintended consequences.
2. New FERPA Regulations May Be on the Horizon
The U.S. Department of Education (“ED”), across multiple administrations, has suggested that new regulations are forthcoming.
While in office, the Biden Administration had planned to issue new regulations relating to FERPA, in part, to address “concerns about the lack of clarity regarding the definition of the term education records and the term’s applicability to digital records.” The Biden Administration, however, did not issue any FERPA regulations.
Currently, on the Office of Information and Regulatory Affairs’ website, the Spring 2025 Unified Agenda of Regulatory and Deregulatory Actions again lists new FERPA regulations as part of the agenda. Although the Unified Agenda is not a guarantee (and often inaccurate), the website lists the Notice of Proposed Rulemaking to be issued in January 2026 and a final rule to be issued in May 2026.[6] The abstract for the proposed rule is as follows:
“The Department intends to amend the Family Educational Rights and Privacy Act (FERPA) regulations, 34 CFR part 99, to update, clarify, and improve the current regulations by clarifying the definition of education record, the provisions governing non-consensual disclosure of personally identifiable information in education records to third parties (including commercial vendors), disclosures in response to law enforcement warrants or judicial subpoenas, and the complaint and investigation procedures and remedies that apply to the Department’s enforcement of FERPA.”
Interestingly, the current abstract does not specifically mention the applicability of FERPA to digital records unlike the abstract written by the Biden administration. That is not to say that the rule will not address digital issues, but it is something to watch.
The current abstract also expressly references amendments to FERPA’s complaint and investigation procedures and the remedies available in ED’s enforcement efforts. That language did not appear in the Biden Administration’s version. Its inclusion now may signal an interest in strengthening ED’s enforcement posture under FERPA, making this an area worth monitoring as any rulemaking process moves forward.
For inquiries regarding FERPA or FERPA compliance, institutions are welcome to contact Scott Goldschmidt or Joyce Lee.
[1] “Unless Defendant kept copies of e-mails related to E.D. as part of its record filing system with the intention of maintaining them, we cannot reach the conclusion that every e-mail which mentions E.D. is a bona fide education record within the statutory definition. These e-mails appear to be casual discussions, not records maintained by Defendant.” E.D. by & through T.D.,2017 WL 1207919, at *10.
[2] “Moreover, even if directly related to the students, defendant has continually presented no information establishing that defendant “maintained” this information as is required by FERPA. Plaintiff failed to show that defendant purposefully kept this information in existence or continuance, preserved it, or retained it. Plaintiff failed to show that defendant kept such information in either a physical filing cabinet or a permanent secure database specifically related to the students.” Mackinac Ctr., 2023 WL 6939084 at *6.
[3] “Here, Doe has not alleged that the emails were maintained in a centralized database by the university. Rather, it appears that the emails were kept on an email server from which they could be deleted by the professors who sent and received them. I therefore find that the emails requested by Doe in OPRA 2 are not education records under FERPA. It follows that FERPA’s prohibition on charging fees does not apply. Rutgers,2022 WL 1617581, at *4 (note: was affirmed in 3d Cir.).
[4] “[The report] identifies students by name and details acts taken by them and against them, some of which violated school policy and subjected them to discipline. However, the report was not directly related to the private educational interests of the student.” BRV, Inc.,143 Cal. App. 4th at 754–55.
[5] “Essentially, FERPA protects the disclosure of student records, not teacher records. Klein Indep. Sch. Dist. v. Mattox, 830 F.2d 576, 579 (5th Cir. 1987). Information about students is sometimes contained in teacher records, but the mere presence of student information in teacher records does render those records subject to FERPA… In the instant case, the Court similarly concludes that the investigatory notes and student statements related to Mr. Aldaz are not “education records” that are subject to FERPA. While these records clearly involve students as alleged victims and witnesses, the records themselves are directly related to the activities and behaviors of the teachers themselves.” J.O, 2025 WL 623543 at *2-3.
[6] Negotiated rulemaking is required only for regulations that govern Title IV student aid programs. FERPA is not a Title IV program, and therefore negotiated rulemaking is not required.
