Educational records are protected and cannot be released without consent except in narrow circumstances
The administrator is asserting an Institutional Ownership fallacy — the idea that because the school holds the records, it owns them and may do with them as it pleases. This confuses custody with ownership. The school maintains educational records as a custodian — it has legitimate operational reasons to hold this information, but that custody does not translate into the right to disclose that information to third parties at will. FERPA was enacted precisely to reject this institutional ownership model. Congress determined that students and parents have a cognizable interest in the accuracy and controlled disclosure of educational records, and that interest — not institutional administrative discretion — governs who may access them. A school is a data steward, not a data owner, and its stewardship obligations include obtaining consent before disclosures that FERPA does not specifically permit. The dismissive 'it's not your business' framing also underscores the power dynamic that FERPA was designed to correct: students and parents who challenge institutional data practices are often told to accept the institution's judgment. FERPA specifically empowers students and parents to be informed, to inspect records, to request corrections, and to file complaints — making it very much their business what the institution does with information about them.
After you respond, they may push back with these arguments. Members get the full rebuttal for each.