FERPA permits education records to be shared with school officials who have a "legitimate educational interest" in them. Examples of a "legitimate educational interest" include (via University of Northern Iowa):
- Performing appropriate tasks that are specified in his/her position description or by a contract agreement.
- Performing a task related to a student's education.
- Performing a task related to the discipline of a student.
- Providing services for the student or the student's family, such as health care, counseling, job placement, or financial aid.
Also, if the student is not personally identifiable from the anonymized exam paper, then the papers are not protected by FERPA at all. Via Wayne State University:
With specific exceptions, FERPA defines “an educational record” quite broadly and it is not limited to “academic” records. “Education records” include virtually all records maintained by an educational institution, in any format, that are “directly related” to one or more of its past or present students. A record is “directly related” to a student if it is “personally identifiable” to the student. A record is “personally identifiable” to a student if it expressly identifies the student on its face by name, address, ID number, or other such common identifier.
A record is also personally identifiable if it includes “other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty” – in other words, if it contains enough demographic or other information that it points to a single student.