Under FERPA, a school may not generally disclose personally identifiable information from an eligible student's education records to a third party unless the eligible student has provided written consent.