<p>I've learned Annual disclosures should be provided</p> <p>Institutions should define how they use FERPA</p> <p>Non directory info: race/gender/ssn/grades/gps/religion/country of citizenship - made be used in commencement info</p> <p>Institution has to define what is personally identifiable info</p> <p>release guidelines for educational records</p> <p>Best practices should be in place: notify student of any info released/seek written permission/provide student ample time to submit request/don't release info until request is received</p>