DES MOINES, Iowa — An attorney said Des Moines Public Schools violated federal privacy laws when they accidentally published confidential documents on their website.
Local 5 reported Thursday the district accidentally published seven documents that included names and descriptions of why students were requesting transfers to other districts.
A DMPS spokesperson said those documents were published by mistake when a privacy setting was inadvertently changed.
According to Alan Ostergren, president of Kirkwood Institute and the person that alerted Local 5 to the documents, by publishing the documents, DMPS violated federal and state privacy laws.
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of students' education records.
"The essence of FERPA is that it prevents schools from releasing the educational records of their students without student consent, or if the student's under 18, the parent's consent," said Mike Hiestand, senior legal counsel at Student Press Law Center.
Local 5 described the documents released on DMPS's website and asked if they would fit the FERPA definition of educational records.
"The records, as you've described them here, I think that those would be considered educational records," Hiestand said.
So what happens if you violate FERPA?
According to Hiestand, usually nothing, because the penalty is very extreme.
"There's like a nuclear bomb option — basically, the penalty for violating FERPA is a loss of all federal funding," Hiestand said. "There is no private cause of action under FERPA. You can't take your school to court. The mechanism is to go through the Department of Education. File your complaint with them. They do an investigation and then they decide whether they're going to exercise this nuclear option — which they don't — or whether they're gonna send the school a letter that basically says, 'You guys need to clean up your act.'"
There are paths to filing civil suits if private documents are made public without the owner's permission.
"Everybody has a right to privacy and every state, Iowa is going to be one of them, has their own sorts of remedies for going after invasions of privacy," Hiestand said. "In that case, there would be a private cause of action that these individuals might be able to pursue."