http://blogs.edweek.org/edweek/DigitalEducation/2020/11/student_data_future_criminals_pasco_privacy.html

Using Student Data to Identify Future Criminals: A Privacy Debacle

Under the federal Family Educational Rights and Privacy Act (FERPA), schools can share student records with a contractor or outside party to whom the school has outsourced certain functions, if that outside party (like a designated school resource officer) meets all three of these conditions:

1. The outside party is performing a service that would otherwise be performed by school employees.
2. The outside party’s use of education records is under the direct control of the school.
3. The outside party does not use the education records for anything other than the reason they were originally shared, and does not share the education record with anyone else unless it secures written consent from the parent of the student.