Opinion
Opinion By: Jack Conway, Attorney General; Michelle D. Harrison, Assistant Attorney General
Open Records Decision
At issue in this appeal is whether the University of Louisville violated the Kentucky Open Records Act in denying Richard Donald Jones' request for "a copy of EVERY business plan submitted to the [Cardinal Challenge Business Plan Competition]" 1 for 2008 and 2009. Because the business plans that were submitted by U of L students were originally created "as course work as part of the regular activities of being enrolled in courses at U of L," those records qualify as "education records" within the meaning of 20 U.S.C. § 1232g(4)(A), disclosure of which is prohibited under the Family Educational Rights and Privacy Act of 1974, codified at 20 U.S.C. § 1232g and incorporated into the Open Records Act by operation of KRS 61.878(1)(k), without prior consent. Given the definition of "student" found at 20 U.S.C. § 1232g(a)(6), which "does not include a person who has not been in attendance at such agency or institution," business plans that were submitted by students not in attendance at U of L do not qualify for this protection. Although U of L did not cite this exception and has not satisfied its burden of proof under KRS 61.880(2)(c) thus far, 2 if U of L can establish that each plan submitted by a student from another college or university contains information that is "generally recognized as confidential or proprietary, " it may withhold the record(s) on the basis of KRS 61.878(1)(c)1. as the other two elements necessary for invocation of that exception are present.
In his April 23, 2010, letter of appeal, Mr. Jones argued that none of the statutory exceptions apply here with the possible exception of KRS 61.878(1)(c)1, which is not applicable in his view as "[b]usiness plans rarely if ever have confidential or proprietary information but generally references [sic] such information with a confidentiality agreement" and " NONE WAS OFFERED OR SIGNED BY UNIVERSITY OFFICIALS. " (Original emphasis.) Having quoted language from the Confidential and Intellectual Property Guidelines found on the Competition's website (indicating that information "discussed or divulged in public sessions by entrants should be considered information that will likely enter the public realm"), Mr. Jones asserted that FERPA "under even the broadest of interpretations does not imply an exemption that does not exist" and given the lack of "grades or evaluations" the records are not exempt.
Upon receiving notification of Mr. Jones' appeal from this office, Sherri Pawson, Records Officer and Office Manager, issued a response on behalf of U of L. In relevant part, Ms. Pawson advised that she withheld the "proposals/business plans submitted by University of Louisville students." According to Ms. Pawson, those plans "were submitted as course work as part of the regular activities of being enrolled in courses at U of L and as such are deemed education records." In the absence of the students' written consent, Ms. Pawson argued, U of L has "an obligation to protect such records in accordance with U of L's 'Guidelines to Protect the Privacy of Student Records' [sic] under the Family Educational Rights and Privacy Act of 1974 (FERPA)," pursuant to which "'No one, not even a U of L student's parent or legal guardian, will have access to a student's education records, nor will their contents be disclosed, without the written consent of the student, except as provided by the Act.'"
Ms. Pawson explained that U of L was "still working to determine access of the proposals submitted [by] non-U of L students" and was "attempting to verify that each of these proposals was also submitted as course work at their respective colleges." U of L had "received oral confirmation from the various advisors to this effect," but was "working to obtain written verification." Assuming that U of L received such verification, Ms. Pawson advised, those proposals would also be withheld "as they too are educational records." In her view, just as U of L "would not release transcripts from another institution, these proposals are protected in the same manner." In closing, Ms. Pawson explained that information found on "the Cardinal Challenge Confidentiality and Intellectual Property Guidelines web page," which indicated that the U of L College of Business "could make photocopies, photographs, videotapes and/or audiotapes of the presentations including the business plan . . . ," will be revised "to alleviate any confusion" as the organizers "feel the proposals should not be released." U of L verified that "none of the business proposals have been shared, released, or published. The confidentiality of these records has not been breached. Further, it was never the intention of the organizers to release such records[.]"
Pursuant to KRS 61.880(2)(c) and 40 KAR 1:030, Section 3, this office requested that U of L provide additional information to assist in resolution of the issues presented. By letter dated June 11, 2010, the undersigned counsel posed five questions to Ms. Pawson, which appear below along with her answers:
1. Was every business plan submitted by a U of L student as part of their course work also submitted to the Cardinal Challenge Business Plan Competition?
Every student participates in creating a business plan as part of the Entrepreneurship MBA curriculum. Additionally, an internal competition is held prior to Cardinal Challenge to determine which teams will compete in the many spring competitions outside the [U]niversity, as well as Cardinal Challenge. The team selected for the Cardinal Challenge then submits their business plan through the same medium as teams from other universities. Teams not selected, then submit their plans to other competitions.
2. Who are the judges for the Cardinal Challenge and what qualifications are required for a person to serve in that capacity?
We select judges that are experts in the field of business plan development. Throughout the region we look for angel investors, venture capitalists, entrepreneurs, and companies that work with start-up businesses on a daily basis. Judges have included persons from the Kentucky Science and Technology Corporation (Lexington, KY), UBS Financial Services, Chrysalis Ventures, Yearling Fund, BB & T, and [Mountjoy Chilton Medley LLP].
3. Did anyone other than judges have access to the business plans during the Cardinal Challenge?
The faculty member who oversees the Cardinal Challenge and one staff member who coordinates the Competition are the only persons other than the judges who have access to the plans.
4. Given the public nature of the Cardinal Challenge, please elaborate upon the position that the business plans are protected under FERPA. For instance, did the students who participated in the Cardinal Challenge execute a waiver of any kind prior to submitting their business plans?
While the team presentations are open to the public no materials other than the event programs are distributed at any time. The Cardinal Challenge is modeled from the Venture Labs Investments Competition- formerly Global Moot Corp, [and] it is commonly understood by all involved (faculty reps, judges, submitting teams) that the business plans will not be available outside the judges. Further, the students retain all rights to the plans which are submitted in this student competition, which rights include any intellectual property rights.
Without this understood rule of confidentiality, participation of students submitting their student work from their home universities would be seriously compromised. The spirit of the competition would be frustrated if the plans were made public. Because the business plans are not simply an academic exercise, but contain potentially proprietary information, making the plans available could expose the students and their business concepts to intellectual property thievery.
As enumerated by the Venture Labs Competition [R]ules, the spirit of the competition is to help students build skills and develop their businesses. To share their work with the public would be detrimental to the students' ability to do so. It is a given in these student driven competitions, the plans are confidential student records.
5. In light of the definition of "student" codified at 20 U.S.C. § 1232g[(a)](6), how does U of L defend its position that business plans submitted by students from other universities, if also submitted as part of their coursework, would qualify as "education records" within the meaning of FERPA?
We have verbally confirmed that every plan submitted in 2008 and 2009 [was] prepared as course work as part of the curriculum at their respective schools. We are waiting for written confirmation of same for the non-U of L plans. We have an obligation to protect student records. This obligation extends to any student records which come into our possession and is analogous to the obligation we have when in a medical clinic we receive medical records from a provider outside the university. The character of a student record is determined at the time of its creation and is not altered by the fact that the student competitors submitted their student records to the University of Louisville as part of this student competition. The Cardinal Challenge recognizes its obligation to maintain the confidentiality [of] these records.
The protection of student records is so engrained in our procedures it is very difficult for us to rationalize that a student record could be released based on who possess[es] the record. In our view the overarching intent of FERPA is to protect students' education records. Because a particular student may be in attendance at another university, their records are no less a student record. From our view the protection is of the record.
If the determination of release hinges on the enrollment status of the student whose record is in question (in light of the definition of student in 20 U.S.C. § 1232g[(a)(6)]) we offer an alternative basis for withholding these records, specifically, KRS 61.878(1)(a). [Based upon the reasoning found in 06-ORD-145 at p. 11 (quotation omitted), and] [g]iven the potential risks in releasing student course work and more specifically the nature of these records in that the students retain their rights to any intellectual property in the plans, we conclude the privacy interests of the students is superior to the public's right to know.
Based upon the following, this office finds that FERPA precludes U of L from disclosing the business plans that were submitted by U of L students, which are protected "education records" within the meaning of 20 U.S.C. § 1232g(4)(A); however, FERPA does not authorize U of L to withhold the business plans of those competitors who are not "student[s]" within the meaning of 20 U.S.C. § 1232g (a)(6) nor does KRS 61.878(1)(a), which extends protection to personally identifiable student information, 3 apply on the facts presented. Assuming that U of L establishes that all three of the elements identified at KRS 61.878(1)(c)1. are present relative to each of the business plans that were submitted by students not in attendance at U of L, it may withhold the plans on that basis though it has not successfully built such a case as of yet.
Among those records excluded from application of the Open Records Act in the absence of a court order are "[p]ublic records or information the disclosure of which is prohibited by federal law or regulation." KRS 61.878(1)(k). Both FERPA, codified at 20 U.S.C.A. § 1232g, and the implementing regulations codified at 34 C.F.R. § 99 et seq., are incorporated into the Open Records Act by the express language of this provision. FERPA regulates access to "education records" by conditioning receipt of federal funds on compliance with disclosure provisions contained in the Act. 20 U.S.C. § 1232g(b)(2). The term "education records" is broadly defined at 20 U.S.C. § 1232g(a)(4)(A) as "those records, files, documents, and other materials which - - (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution." Specifically, FERPA precludes the disclosure of "education records" or personally identifiable student information contained therein to third parties in the absence of a parent or eligible student's prior written consent, 4 and is also intended to ensure that parents of students, or students themselves, if over eighteen years of age, can access their education records. 5
In other words, the goal of this legislation was "'to end denial of access to parents and students, and to prevent violations of student and family privacy rights by the release of unscreened records to third parties without parental or student consent.'" 99-ORD-217, p. 5 (citation omitted). To that end, the term "education records" has been and was "intended to be broadly construed, and the exceptions . . . must be narrowly construed since the value of [the parents'] right of access and [students'] right of privacy "depreciates with every item that is excluded from the definition of 'education record.'" OAG 91-177, p. 4 (citation omitted); 98-ORD-162. With the exception of narrowly defined categories of records identified at 20 U.S.C. § 1232g(a)(4)(B)(i)-(iv), which are not relevant here, the term is expansively construed to include all information and records, in whatever form, which satisfy the two-part test described above. Both the Kentucky Supreme Court and this office have recognized that FERPA operates to bar disclosure of "education records," and that FERPA is incorporated into the Open Records Act by KRS 61.878(1)(k) .
Hardin County Schools v. Foster, 40 S.W.3d 865 (Ky. 2001); 99-ORD-217, inter alia.
Critical to resolution of the question presented is the longstanding recognition that in defining "education records," the "congressional intent was to fashion a broad definition."
Belanger v. Nashua, New Hampshire School District, 856 F.Supp. 40, 49 (D.N.H. 1994). Thus, records of students "do not have to be related to academic matters to be 'education records' under FERPA . . . ."
United States v. The Miami University, 91 F.Supp.2d 1132, 1149, n. 17 (S.D. Ohio, 2000)(emphasis added). It stands to reason that records which otherwise qualify, and which are related to academic matters, are "education records." The business plans that were submitted by U of L students would clearly fall within the parameters of the intentionally expansive definition of "education records" found in FERPA. "Inasmuch as they contain academic and educationally-related information, they qualify as education records in the traditional sense." 00-ORD-148, p. 7. Such records would necessarily contain information related to each student, and would be maintained by an educational agency institution, namely, U of L. Disclosure of the business plans could therefore result in forfeiture of federal funding. Here, the record contains neither proof that any of the students gave written consent nor facts that would justify ignoring the statutory prohibition on disclosure. The denial by U of L is affirmed in this regard.
Given this determination, the question becomes whether U of L properly denied access to business plans that were submitted by students not in attendance at U of L. Although U of L believes that the "character of a student record is determined at the time of its creation" and finds it "very difficult," with arguably valid reasons, "to rationalize that a student record could be released based on who possesses the record," it offers no legal authority that would enable this office to disregard the plain language of FERPA nor did our independent research uncover any binding precedent on this narrow issue. 20 U.S.C. § 1232g(a)(6) provides that "[f]or purposes of this section, the term 'student' includes any person with respect to whom an educational agency or institution maintains education records or personally identifiable information, but does not include a person who has not been in attendance at such agency or institution. " (Emphasis added.) See 34 C.F.R. § 99.3.
"A statute should be construed, if possible, so as to effectuate the plain meaning and unambiguous intent expressed in the law."
Bob Hook Chevrolet Isuzu, Inc. v. Commonwealth of Kentucky, Transportation Cabinet, 983 S.W.2d 488, 492 (Ky. 1998). When the words are clear, "there is no room for construction and the statute must be accepted as it is written."
Griffin v. City of Bowling Green, 458 S.W.2d 456, 457 (Ky. 1970). This office "cannot ignore the plain meaning of a statute simply because we might consider another interpretation to state a better policy."
Mondie v. Commonwealth of Kentucky, 158 S.W.3d 203 (Ky. 2005)(citation omitted). In light of the plain and unambiguous language of 20 U.S.C. § 1232g(a)(6) and 34 C.F.R. § 99.3, this office is compelled to conclude that FERPA protection does not extend to business plans that were submitted by student competitors not in attendance at U of L inasmuch as those competitors were not "students" in the legally relevant sense.
Although U of L belatedly invoked KRS 61.878(1)(a) as the alternative basis for denial, that argument is equally unpersuasive. In 06-ORD-145, upon which U of L relied, this office quoted the "'broadly worded definition of 'education records' found at 20 U.S.C. § 1232g(a)(4)(A)" in holding that "application materials submitted by successful candidates for admission to the Chase College of Law are shielded from disclosure by [FERPA] at the point at which [Northern Kentucky University], in the exercise of its discretion, elects to treat the successful candidates as students in attendance. " Id., p. 7 (original emphasis). Conversely, the Attorney General recognized that "records of applicants who were not selected for admission to [Chase] are not now, now will they ever be, entitled to protection under FERPA" as those individuals were not "students in attendance. " 6 Id., p. 10. Although this office found that applications of unsuccessful candidates (and successful candidates assuming that FERPA did not apply until the first day of class) for admission "enjoy absolute protection from disclosure pursuant to KRS 61.878(1)(a)," application materials are different in character than business plans or academic records generally insofar as they contain personal identifying information, the public disclosure of which would constitute a "clearly unwarranted invasion of personal privacy." The instant appeal is factually distinguishable in this critical respect. In short, neither FERPA nor KRS 61.878(1)(a) justifies the denial by U of L as to business plans of students from other educational institutions; however, a different statutory exception is potentially applicable, namely KRS 61.878(1)(c)1.
KRS 61.878(1)(c)1. excludes from application of the Open Records Act "records confidentially disclosed to an agency or required by an agency to be disclosed to it, generally recognized as confidential or proprietary, which if openly disclosed would permit an unfair commercial advantage to competitors of the entity that disclosed the records[.] To successfully invoke this exception, a public agency must establish that the public records in dispute satisfy all three of the required elements. 03-ORD-064, p. 5. In 04-ORD-175, the Attorney General engaged in a lengthy analysis of this issue, concluding that the Kentucky Labor Cabinet (then "Department of Labor") had not satisfied its burden of proof relative to KRS 61.878(1)(c)1. More specifically, this office held that an "unsupported allegation such as '[p]ictures and information involving the company's procedures for processing materials have been removed as they are considered 'trade secrets' does not constitute sufficient evidence to establish that the records qualified for exclusion." Id., p. 10. The analysis contained in 04-ORD-175 is controlling as to application of KRS 61.878(1)(c)1. generally; a copy of that decision is attached hereto for the parties' reference. Compare 06-ORD-172 (finding that evidence of record, including a copy of the letter sent by the company to Department requesting that all information released to OSHA remain confidential and explaining how disclosure would permit an unfair commercial advantage to competitors, justified invocation of KRS 61.878(1)(c)1.).
This office agrees that "the spirit of the competition would be frustrated if the plans were made public" as the plans "contain potentially proprietary information." Accordingly, "making the plans available could expose the students and their business concepts to intellectual property thievery." The plans were "confidentially disclosed" to U of L, and it has minimally demonstrated, though not for the purpose of invoking this exception, that disclosure of the plans would necessarily permit an unfair commercial advantage to competitors of the businesses proposed; 7 however, U of L must also establish that information contained in each individual plan is "generally recognized as confidential or proprietary" 8 in order to satisfy its burden of proof under KRS 61.880(2)(c). Assuming that U of L establishes that each plan contains protected information, and issues a written response explaining how KRS 61.878(1)(c)1. applies to the records withheld, this office finds that U of L may withhold the remaining business plans on that basis.
In light of this decision, and to avoid future disputes of this nature, U of L may wish to reevaluate the confidentiality guidelines for the Cardinal Challenge and institute a formalized process by which it can successfully ensure that business plans submitted by students not in attendance at U of L are protected from public disclosure by utilizing the exceptions to the Open Records Act.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Richard Donald JonesSherri PawsonAngela D. Koshewa
Footnotes
Footnotes
1 The Cardinal Challenge "is a qualifying competition for the Global Moot Corp Competition" and is "for student created, managed and owned ventures" according to the Official Rules and Submission Requirements.
2 U of L did not respond to Mr. Jones' April 13, 2010, request until April 23, 2010, nor does it offer any explanation for this delay on appeal. Its failure to respond within three business days constituted a violation of KRS 61.880(1). Although U of L could have required Mr. Jones to submit his request in writing per KRS 61.872(2), it waived this argument in responding to his e-mail without objection. U of L also violated KRS 61.880(1) in failing to cite and explain the application of KRS 61.878(1)(k) as well as the specific provisions of the federal statute upon which it relied (FERPA) in denying Mr. Jones' request. See 07-ORD-258, pp. 4-6.
3 "Personally Identifiable Information" is defined at 34 C.F.R. § 99.3 and includes, but is not limited to a student's name, the name of the student's parent or other family members, the address of the student or student's family, personal identifiers such as social security number, student number, or biometric number, and other indirect identifiers, such as the student's date and place of birth and mother's maiden name.
4 In reference to "eligible students," 20 U.S.C. § 1232g(d) provides:
For purposes of this section, whenever a student has attained eighteen years of age, or is attending an institution of postsecondary education, the permission or consent required of and the rights accorded to the parents of the student shall thereafter only be required of and accorded to the student.
5 § 1232g(a)(1)(A) thus provides:
No funds shall be made available under any applicable program to any educational agency or institution which has a policy of denying, or which effectively prevents, the parents of students who are or have been in attendance at a school of such agency or at such institution, as the case may be, the right to inspect and review the education records of their children.. . . Each educational agency or institution shall establish appropriate procedures for the granting of a request by parents for access to the education records of their children within a reasonable period of time, but in no case more than forty-five days after the request has been made.
Conversely, § 1232g(b)(1) provides:
No funds shall be made available under any applicable program to any educational agency or institution which has a policy or practice of permitting the release of education records (or personally identifiable information contained therein other than directory information, as defined in paragraph (5) of subsection (1) of this section) of students without the written consent of their parents to any individual, agency, or organization, other than to [specified individuals under specified conditions listed at (b)(1)(A)-(J)].
6 If anything, this reasoning further validates our holding today as it also effectuates the exclusionary language found in the definition of "student."
7 The Confidentiality and Intellectual Property Guidelines, which this office located in researching the issues presented, also indicate that "authors of the business plan will retain all rights to the plan regarding its use at all time prior to and following the competition" with limited exceptions.
8 In 09-ORD-010, this office recognized that "in some instances the details of the confidential and proprietary nature of documents may not be readily available or recognizable to a public agency. " Id., p. 6. Because the agency "is ultimately the party responsible for satisfying its burden of proof in excluding documents from inspection under KRS 61.878(1)(c)1.," in such instances "best practice would be for the agency to notify the entity most interesting in protecting the confidential nature of the document(s)." Id., pp. 6-7.