| The Family Educational Rights and Privacy Act of 1974 (FERPA) is a federal law that applies to most students and parents of those students in the US. It applies to all public schools and by accepting educational funding from the federal government, most private colleges and universities.
FERPA protects student records from being released to unauthorized persons. With only a few exceptions, a university cannot release a student's educational record without consent. In addition, any student has the right to review his record, with the exception of certain items that were part of the admissions process (like letters of recommendation, etc.) He also has the right to contest any information therein that he does not feel is accurate. If, after a hearing, the school chooses not to make the appropriate change then the student then has the right to write his side of the story. This account must be included in the official record.
Universities are allowed to release "directory information", meaning a student's name, address, phone number, date and place of birth, and other such information, so long as they notify students and/or parents ahead of time and give the option to opt-out.
Many schools have and continue to violate this law because they will rarely have to face serious consequences. The university that I attend released the list of all their students and their social security numbers to a bank, who then went and spammed everyone (with their social security number in the e-mail). It was a PR nightmare for the university. They claimed it was an "transmission error" and nothing ever came of it.
Another slightly less well-known clause in FERPA is that students have the right to not have their Social Security Number used as identification. The school must still know the number for tax and financial aid reasons, but for other reasons the school can be compelled to use an alternate number.
For more information on FERPA, please see their website at http://www.ed.gov/offices/OM/fpco/ferpa/ or call (202) 260-3887. | 
