(1) A college shall maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student:
- (a) The college shall maintain the record with the education records of the student as long as the records are maintained;
(b) For each request or disclosure the record must include:
- (A) The parties who have requested or received personally identifiable information from the education records; and
- (B) The legitimate interests the parties had in requesting or obtaining the information;
- (c) Colleges that maintain electronic records may flag those records to refer to disclosure information which applies to all students;
- (d) For purpose of ongoing submission of records to OCCURS, a single record or electronic flag referring to OCCURS policy on data elements collected and transmitted shall constitute appropriate recordkeeping.
(2) If a college discloses personally identifiable information from an education record with the understanding authorized under section (1) of this rule, the record of disclosure required under this section must include:
- (a) The names of the additional parties to which the receiving party may disclose the information on behalf of the college; and
- (b) The legitimate interests under OAR 589-004-0500 which each of the additional parties has in requesting or obtaining the information.
(3) A college is not required to keep records of disclosures when the disclosure is to:
- (a) The student who is the subject of the record;
- (b) A college official with a legitimate educational reason under OAR 589-004-0500(1);
- (c) A party with written consent from the student; or
- (d) A party seeking directory information.
Statutory/Other Authority
ORS 326.051, 341.015 & 341.290(17)
Statutes/Other Implemented
ORS 341.290, 20 U.S.C. Sec 1232g(b)(5) & 34 CFR Sec. 9932(a)
History
DCCWD 5-2015, f. & cert. ef. 10-30-15
DCCWD 1-2001, f. & cert. ef. 3-21-01, Renumbered from 581-041-0530
EB 7-1994, f. & cert. ef. 4-29-94