This question was the issue in the Supreme Court case Gonzaga University v. Doe, 536 U.S. 273 (2002). In the 7-2 ruling, Chief Justice William H. Rehnquist wrote for the majority that a student may not sue a private university for damages under any provision of FERPA, the Family Educational Rights and Privacy Act.
Gonzaga University v. Doe involved a student, John Doe, who intended to apply to become a teacher upon graduating from Gonzaga. In order to become a public school teacher in Washington state, an individual must file an affidavit of good moral character from his or her graduating university. But a Gonzaga teacher-certification specialist overheard another student describing sexual misconduct by Doe, the student who became the plaintiff in this lawsuit. The specialist contacted the Washington state agency responsible for teacher certification, identified Doe and discussed the allegations of sexual misconduct. Subsequently, Doe, who had no knowledge of the investigation at the time, was denied the certification affidavit. Doe sued Gonzaga University on the grounds of a FERPA violation. The trial court awarded Doe both compensatory and punitive damages. On appeal, the Washington Court of Appeals held that FERPA does not create enforceable rights under 42 U.S.C. §1983. The Washington Supreme Court expanded on the appeals court's ruling, reasoning that although FERPA does not give rise to private causes of action, its non-disclosure provision does create an enforceable right under 42 U.S.C. §1983. The U.S. Supreme Court reversed the decision of the Washington Supreme Court and held that students and parents may not sue for damages under FERPA because FERPA’s nondisclosure provisions “contain no rights-creating language … they serve primarily to direct the Secretary of Education’s distribution of public funds to educate institutions.”