FERPA and School Surveillance Video: What Schools Must Do When Parents Request CCTV Footage
A parent contacts the school. Their child was involved in a hallway incident, and they demand to see the security camera footage. It is a highly sensitive situation, and under the Family Educational Rights and Privacy Act (FERPA), the parent may well have a federal right to view it.
However, the footage also captures dozens of other students—some actively involved, others merely walking by. Handing over or showing an unedited video creates a compliance minefield. Schools often find themselves frozen between their obligation to grant parental access under 20 U.S.C. § 1232g and their duty to protect the privacy of the other children on screen.
This article explains how FERPA treats school surveillance video, when footage officially transitions into an education record, and what schools are required to do when a parent requests access to multi-student recordings.
Key Terms Defined
FERPA (Family Educational Rights and Privacy Act): A US federal law that grants parents and eligible students (those 18 or older) the right to inspect and review education records maintained by educational institutions receiving federal funding.
Education Record: Defined under 34 CFR § 99.3 as any record directly related to a student and maintained by an educational agency. Surveillance video does not automatically start as an education record; it only becomes one once it is single out and linked to a specific student's record.
When Does CCTV Footage Become an Education Record?
Standard school surveillance footage does not automatically constitute an education record. A camera continuously recording a cafeteria or a parking lot is simply capturing ambient data.
According to official Department of Education (DOE) guidance, a video transitions into a FERPA-protected education record only when it is directly related to a student. This threshold is met when:
The video is used by school officials for disciplinary action or an official investigation involving a specific student.
The clip depicts a student actively violating a law or school policy.
The video contains a student experiencing a distinct event, such as a medical emergency.
The Law Enforcement Exception: Under 20 U.S.C. 1232g(a)(4)(B)(ii), surveillance videos created and maintained strictly by a school’s internal law enforcement or security unit for a safety purpose are not education records. However, if that security unit hands a copy of the clip to a principal to discipline a student, that specific copy immediately becomes a FERPA education record.
Once a clip is pulled and placed into a student's file, FERPA rights attach to it. If the footage is never pulled, categorized, or used for an official purpose, it remains general administrative data and is eventually overwritten according to the school's standard IT retention policy (typically 30 to 60 days).
What Are Parents Entitled to Under FERPA?
Under 34 CFR § 99.10, parents have the right to inspect and review their child's education records. Schools have a maximum of 45 days to comply with this request.
Crucially, FERPA does not mandate that schools provide parents with a physical or digital copy of the video. The law only guarantees the right to view the record. Schools are only required to provide a physical copy if a failure to do so would effectively deny the parent the right to review it (for instance, if the parent lives in another state and cannot physically visit the school district office).
The Multi-Student Dilemma: The Impact of Letter to Wachter
The real challenge arises when a video is a joint education record—such as a hallway fight involving two or three students. Under 34 CFR § 99.12(b)(1), when a record contains information on multiple students, a parent has the right to inspect only the specific information relating to their own child.
In its landmark clarification (2017 Letter to Wachter), the DOE's Student Privacy Policy Office outlined two clear rules for this dilemma:
The Redaction Mandate: If a school can reasonably redact or blur out the faces and identifiable details of the other students without destroying the meaning of the record, it must do so before letting the requesting parent view it.
The Unredacted Exception: If redacting the video is technically impossible for the school, or if blurring the faces would completely destroy the context and meaning of the recording (making it impossible to see what occurred), the school must still allow the parent to view the entire, unredacted video, even though it exposes other students.
Why Automated Redaction is No Longer Optional
Historically, schools relied on the "unredacted exception" because they lacked the technical tools or budget to blur video files. However, the DOE explicitly rules that schools cannot charge parents for the administrative costs of redacting or blurring a video.
Because the school must absorb 100% of the labor costs, relying on manual, frame-by-frame editing in traditional software is a massive drain on district resources.
This is where automated solutions like Secure Redact shift from a luxury to a baseline necessity. By leveraging AI to instantly detect and obscure bystanders and third-party students, redaction becomes "reasonably achievable." It allows the district to robustly protect student privacy and avoid being legally forced to show parents raw, unredacted footage of other community children.
Compliance Checklist for School Administrators
When a video access request is initiated, school privacy teams should follow a documented protocol:
Verify the Record Status: Determine if the clip is maintained as part of an active disciplinary file. If it has not been pulled for an official purpose, it may not fall under FERPA, giving the school greater operational discretion.
Differentiate Bystanders from Subjects: Identify who needs to be obscured. Bystanders (students walking past a fight) should always be redacted. Co-participants may or may not be redacted depending on whether blurring alters the context of the incident.
Maintain an Audit Log: Document the request date, the names of administrators who reviewed the clip, the exact redactions applied, and the date the video was inspected by the parent.
What Schools Should Do Now
Schools should establish a clear, standardized workflow for surveillance requests before an incident occurs. Relying on directory information exceptions (34 CFR § 99.3) will not protect a district in a disciplinary video dispute; surveillance clips of school incidents are never considered directory information.
Pimloc’s Secure Redact automates face and identifier blurring across school CCTV feeds, drastically reducing the time required to prepare video files for parental inspection. By utilizing secure cloud automation, districts can satisfy their FERPA obligations, safeguard bystander privacy, and eliminate compliance bottlenecks. To review how the software integrates with K-12 and higher-education compliance frameworks, visit the Secure Redact website.
Build your FERPA video workflow before the next request lands.
Try Secure Redact for free.
Frequently Asked Questions
-
No. Continuous, unedited surveillance footage maintained solely for security purposes is not automatically an education record. It only becomes a FERPA record when it is pulled, reviewed, and directly linked to a specific student's file—such as being utilized as evidence in a suspension or expulsion hearing.
-
No. FERPA grants parents the right to inspect and review records, meaning they have a right to view the video in a secure school environment. It does not give them the right to receive a physical or digital copy of the file to take home, unless a severe constraint (like geographic distance) makes an in-person viewing impossible.
-
No. Under the DOE's Letter to Wachter precedent, if a video is directly related to a student but cannot be reasonably redacted without destroying its context, the school cannot use that as an excuse to deny access. The school must allow the requesting parent to inspect the unredacted footage.
-
No. While FERPA allows schools to charge reasonable fees for making physical copies of records, the Department of Education explicitly prohibits schools from charging parents for the time, labor, or software costs associated with redacting or segregating records.
-
While facial redaction is the primary technical step, schools must also ensure that other Personally Identifiable Information (PII) is addressed. If the audio track features students calling out a child's full name, or if a student has highly distinctive clothing or tattoos that make them immediately identifiable to the school community, additional audio or visual redaction may be required.