While students cannot file a private lawsuit for FERPA violations, they may still pursue a legal case under common law principles for violation of their privacy rights, though this would not be based on FERPA provisions specifically. Is this fair, or should this be changed to allow students a more accessible way to address violations directly? please answer with intext citation and references thanks.