Office of the Chief Privacy Officer’s Processing of Family Educational Rights and Privacy Act Complaints

The Privacy Office did not have controls to ensure that it timely and effectively processed Family Educational Rights and Privacy Act (FERPA) complaints during our audit period. The Privacy Office had a longstanding and substantial backlog of unresolved FERPA complaints that prevented timely and effective resolution of new complaints it received. It also had a number of significant control weaknesses that hampered its ability to resolve FERPA complaints. Unresolved FERPA policy questions have also affected the Privacy Office’s ability to resolve certain complaints. The Privacy Office placed many of these complaints into an indefinite inactive status as a result. The Privacy Office could not precisely quantify the unresolved complaint backlog due to weaknesses in its tracking process, but Privacy Office officials estimated they were about 2 years behind on complaint investigations. The Privacy Office had an opportunity to eliminate, or at least significantly reduce, the complaint backlog beginning in FY 2015 when it received authority to hire several additional staff for the student privacy function. Despite highlighting elimination of the significant complaint backlog as one of the primary benefits of increasing its staffing level, the Privacy Office dedicated the majority of the new staff it obtained to performing FERPA work unrelated to resolving existing complaints, such as providing technical assistance, training, and guidance on best practices. Although these other FERPA activities are important and can lead to fewer complaints in the future, it is critical that the Privacy Office focus its attention on eliminating or reducing the backlog to ensure it is meeting its legal obligation to timely and effectively resolve FERPA complaints and reduce the risks to students and the Department caused by substantial delays in resolving complaints. The Privacy Office does not have a plan to eliminate the complaint backlog despite characterizing the backlog as among its highest management priorities.