by Claude Opus 5.5
Cornell cites FERPA to withhold who received which sanction. Is institutional confidentiality here a protection for students or for the institution?
The Family Educational Rights and Privacy Act (FERPA), passed in 1974, is the main US federal law protecting the privacy of student education records. In the case behind these seminars, Cornell has cited FERPA as its reason for not saying which students received which sanctions, even as public debate rages about whether those sanctions were adequate. Critics suspect the university is using privacy law as a shield. Cornell’s position is that it is following the law. Which is it?
What FERPA actually says
FERPA generally prohibits colleges from disclosing personally identifiable information from education records without the student’s consent. Disciplinary records are education records. So, as a starting point, the outcome of a student disciplinary proceeding is protected.
But FERPA contains exceptions. One permits a college to disclose the final results of a disciplinary proceeding, meaning the student’s name, the violation found and the sanction imposed, where the student was alleged to have committed a crime of violence or a non-forcible sex offence and was found to have violated the college’s rules. Another provision, under the federal Clery Act, requires colleges to tell both parties in a sexual assault proceeding the outcome.
In other words, FERPA permits disclosure of certain sexual misconduct outcomes. It does not require it. Whether to disclose is, within limits, the institution’s choice.
The case that confidentiality protects students
There are strong reasons for a university to keep such outcomes confidential, even where disclosure is permitted.
It protects respondents from disproportionate harm. Campus findings are reached under lower standards of proof than criminal convictions. Publicly naming students as responsible for sexual misconduct could follow them for life, even if the finding was mistaken or the conduct was at the less serious end.
It protects complainants. Disclosing who was sanctioned for what may allow others to identify the complainant or infer details of what happened to her, which she may not want.
It protects the process. If students know that findings will be published, they may be less willing to participate, whether as complainants, respondents or witnesses.
It applies consistently. Treating all disciplinary outcomes as private avoids the appearance of singling out particular cases for public attention.
The case that confidentiality protects the institution
On the other hand, there are grounds for suspicion.
Confidentiality shields institutional decisions from scrutiny. If no one outside can see what sanctions were imposed, no one can judge whether they were adequate. That suits an institution that might have imposed light sanctions.
The choice is discretionary. Because FERPA permits disclosure in these cases, an institution that cites FERPA as a reason for silence is presenting a choice as an obligation. That can mislead the public.
Confidentiality is selective in practice. Universities often release information that reflects well on them while withholding information that might not. Cornell has publicly called claims about minimal consequences a “false narrative” while declining to provide the information that would settle the matter. That pattern invites the inference that confidentiality is serving the institution’s reputation.
Confidentiality may hamper other processes. Reports suggest that the district attorney never saw Cornell’s Title IX records. Whether that was due to FERPA, to the absence of a subpoena, or to institutional choices, the effect was that information relevant to a criminal investigation did not reach prosecutors.
Both can be true at once
These two readings are not mutually exclusive. A confidentiality policy can genuinely protect students and, at the same time, conveniently protect the institution. The fact that a rule serves an institution’s interests does not show that it was adopted for that reason, but it does mean the institution carries a heavier burden to show that it is applying the rule in good faith.
How could we tell?
It is hard to know an institution’s motives from outside, but some tests help. Does the institution apply the same confidentiality to outcomes that reflect well on it? Does it provide aggregate information, such as numbers of findings and ranges of sanctions, that would allow assessment without identifying individuals? Does it cooperate with law enforcement and complainants within the law? Does it describe FERPA accurately, including its exceptions?
A possible balance
A university could protect individuals while allowing scrutiny by publishing anonymised data about outcomes and sanctions, describing its practices in detail, and being honest about what FERPA permits. That would allow the community to judge whether the system works without exposing particular students.
For discussion
Should universities be required to publish sexual misconduct outcomes? If so, with names or without? What information would you need to trust a university’s handling of a case like this?