FERPA Redisclosure Notice to Third Parties

Third parties acting as agents of the University of San Francisco are required to comply with the federal Family Educational Rights and Privacy Act (FERPA). Furthermore, third parties to whom personally identifiable information is given are not permitted to disclose that information to others without the written consent of the student and that the information is to be used only for the purpose(s) intended. However, third parties to whom personally identifiable information is given may make further disclosures of the information if they are acting on behalf of the University and as directed by the University. The names of the additional parties to which third parties, acting on behalf of the University, may disclose the information and the legitimate interests of each of these additional parties must be provided as part of the request process. If a third party outside the University permits access to personally identifiable information in violation of University policy, the University shall not permit access to information from education records to that third party for a period of not less than five (5) years. Once the third party that is acting on behalf of the University has finished the project or contract under which personally identifiable information is utilized, the third party shall be required to return the information to the University, or if directed by the University, to securely destroy and/or wipe systems containing such data.