A student’s SSN: it cannot be the identification number

It is the twin of the law protecting an employee’s Social Security Number, but for education, from elementary through postgraduate level. Its statement of motives grounds the prohibition in two federal laws it names: **FERPA** — the "Family Educational Rights and Privacy Act of 1974", known as the Buckley Amendment — which requires prior written consent before disclosing educational records or information related to identifying any person, and where the statement of motives notes that **courts have held that the Social Security Number is covered** by that federal law; and the **"Privacy Act of 1974"**, which the same statement says requires educational institutions requesting the number to issue a statement to students about how it will be used. **We reproduce those mentions as the law makes them and do not describe the federal laws, which we did not read for this guide.**

Any student at an educational institution in Puerto Rico, public or private. The law names the full universe: elementary, middle and secondary schools, universities, colleges, technological schools and every entity authorized, licensed or accredited as an educational institution. Who may waive the protection depends on age: students of legal age or legally emancipated on their own behalf, and parents with custody and patria potestad in the case of minors. In both cases, through written authorization.

• Being a student at an educational institution in Puerto Rico, public or private, from elementary through postgraduate level. The prohibition falls on the institution and applies by law.Verified against the official source
• To validly waive the protection: being a student of legal age or legally emancipated, or a parent with custody and patria potestad of the minor, and doing so through written authorization.Verified against the official source

• The list, directory, card or document where the number appears. The law requires no form from the student to invoke the protection: the obligation is the institution’s.

1. 1

   Step 1: The forbidden uses, one by one

   Article 1 does not speak in the abstract: it names the scenes. No educational institution may show or display a student’s Social Security Number **in a place or object visible to the general public for the purpose of identifying them**; nor to **post or publish grade lists**; nor in **lists of students enrolled in courses**; nor in **any other list handed to teachers**; nor include it in **student directories or any similar list**, except for internal confidential use; nor **make it accessible to anyone who has no need or authority of access to this data**. It is worth noting the fourth: "any other list handed to teachers" does not require the list be public, it suffices that it circulate.

2. 2

   Step 2: The waiver: who may give it and what may not be conditioned

   The law separates two things often confused. First, **who** may waive: **these protections may be waived, voluntarily, by students of legal age or legally emancipated or by parents with custody and patria potestad of minors through written authorization**. Second, **what may not be demanded in exchange**, and here the law gives a list of four worth knowing in full: **that waiver may not be imposed as a condition of enrollment, graduation, transcript of grades or credits, or provision of services**. If an institution conditions releasing a transcript of credits on your signing the waiver, that list of four is the exact text to cite.

3. 3

   Step 3: When the number may be used

   Article 1 closes with the exceptions, and they differ from the employment ones, so they are worth reading as they stand: the prohibition **shall not apply to the use of the Social Security Number in those cases where it is required or authorized by federal law or regulation**, nor to its use **for internal purposes of identity verification, credit convalidations, employment, taxes or financial assistance**, subject to the institution or institutions involved **maintaining its confidentiality**. The word "convalidaciones" is in the law and covers credit transfers between institutions; "financial assistance" covers financial aid processes. In all those cases the use is internal and confidentiality remains mandatory.

4. 4

   Step 4: Redacting the number is not altering the document

   The rule is the same as in the employment sphere, but with its own phrasing worth reading: **when a document containing a Social Security Number must be made public, outside the context of academic confidentiality, it shall be edited so that the data is partly or fully illegible, without that being considered an alteration of the document’s content**. The phrase "outside the context of academic confidentiality" sets the trigger: if the document leaves that protected sphere, the number must be redacted, and doing so is not tampering with the document.

5. 5

   Step 5: The fine and who imposes it

   Article 2 provides that **violation of this Act’s provisions, including failing to protect the Social Security Number’s confidentiality, shall carry an administrative fine of not less than five hundred (500) up to five thousand (5,000) dollars, to be imposed by the institution’s regulating entity**. And it adds an express power: **the Puerto Rico Council on Education is empowered to impose administrative fines for non-compliance with these provisions**. Here an OGP annotation must be reproduced and not exceeded: the compilation notes, in this same article and also in Article 1, that the Puerto Rico Council on Education was **substituted by the "Junta de Instituciones Postsecundarias" attached to the Department of State by Act 212-2018, the "Educational Institutions Registration and Licensing Act"**. We reproduce the note as OGP gives it; **we do not describe Act 212-2018, which we did not read**. Note also that the article directs the fine to "the institution’s regulating entity", which is not the same for a public elementary school as for a private university.

6. 6

   Step 6: The deadline they were given to comply

   Article 4 set the transition: **the agencies, in this case the Puerto Rico Council on Education, as well as educational institutions at all levels, public or private, shall have six (6) months after this Act takes effect to certify to their respective regulating entity the implementation of these provisions or of a work plan to achieve it by the start of the following academic year**. And Article 5 provided that the law take effect ninety (90) days after its approval. These are start-up dates, long since passed; we cite them because they explain the "certify to the regulating entity" structure Article 2 uses for fines.

Before the institution’s regulating entity, which is who Article 2 empowers to impose the administrative fine, and which is not the same for a public school as for a private university. The law expressly empowers the Puerto Rico Council on Education, and OGP notes that this Council was substituted by the Junta de Instituciones Postsecundarias attached to the Department of State by Act 212-2018; we reproduce that note without describing the substituting law. What we do not publish: the complaint form, address, phone, resolution deadline or any of those entities’ regulations, because Act 186-2006 does not set them. That is why processing time stays unverified.

• Signing the waiver in order to enroll or get a transcript: the law prohibits imposing it as a condition of enrollment, graduation, transcript of grades or credits, or provision of services.
• Believing a minor may waive on their own: the waiver comes from parents with custody and patria potestad, in writing.
• Thinking the prohibition covers only what is posted on a board: it also reaches any list handed to teachers and student directories.
• Accepting the number as the student’s routine identification: the statement of motives recalls it was never designed as a universal identification number.
• Accepting "it is for credit convalidations" without more: that exception is for internal use and subject to maintaining confidentiality.
• Accepting that the number cannot be redacted in a document leaving the academic confidentiality context: editing it is not considered altering the content.
• Looking for the fine at a single agency: it is imposed by the institution’s regulating entity, which varies by institution type.

These are the government pages this guide is based on.

• Departamento de Estado de Puerto Rico

  Departamento de Estado

  bvirtualogp.pr.gov

• Puerto Rico Department of State

  Estado

  www.estado.pr.gov

• Puerto Rico Department of Education

  Educación

  de.pr.gov