In 2008 and 2011, the Education Department issued Final Rules amending key FERPA provisions. The 2008 and 2011 regulations expanded the narrow exceptions under which educational agencies and institutions could disclose student information without first obtaining written student consent. For example, pursuant to the 2008 regulations, schools may disclose education records to a "contractor, consultant, volunteer, or other party" performing "an institutional service or function for which the agency or institution would otherwise use employees." These outside contractors and consultants must be under the "direct control" of the school. The 2011 regulations further expanded the circumstances under which schools may disclose education records without obtaining student written consent. In 2012, EPIC sued the Education Department for promulgating the 2011 regulations and changing FERPA without Congressional authorization. The Court ruled on procedural grounds, and therefore did not determine whether the Education Department had the legal authority to amend FERPA in the manner that it did.
https://epic.org/foia/ed/ferpa/