Opinion
Opinion By: Jack Conway, Attorney General; Michelle D. Harrison, Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the Pulaski County Schools violated the Kentucky Open Records Act in denying Dan Thompson's undated request for "a copy of the inbox, sent box, and deleted folder for [Superintendent] Steve Butcher, [and Assistant Superintendents] Pat Richardson, and Sonya Wilds," 1 a copy of "individual emails with content to and from and all email in the trash bin or deleted file for Steve Butcher from July 1, 2010, to present," and a copy of "individual emails with content to and from" Pat Richardson and Sonya Wilds from July 1, 2011, to present. 2 By letter dated September 27, 2011, Larry G. Bryson, agency counsel, responded on behalf of his client, initially advising with regard to Item 1 of the request that such records "do not exist in the form that you have requested" nor is a public agency required "to compile information or create a document" in order to comply with a request. Mr. Bryson further advised that many of the e-mails would have to be redacted because they relate to "ongoing investigations (as you are aware), personnel issues, litigation matters (one of which you are involved [with] directly, representing a party), student information involving the identification of students and other issues involving individuals['] rights or privacy." In addressing the remainder of the request, Mr. Bryson explained that the District Technology Coordinator has estimated that approximately 8500 responsive e-mails currently exist, all of which must be reviewed by the named individuals and Mr. Bryson for the purpose of determining whether any information contained therein is protected under the Family Educational Rights and Privacy Act of 1974 (FERPA), 3 20 U.S.C. § 1232g, and/or the Kentucky Family Education Rights and Privacy Act (KyFERPA), KRS 160.700, et seq., incorporated into the Open Records Act by operation of KRS 61.878(1)(k) and (l), respectively, 4 and thus must be redacted. "Given the 'mandatory confidentiality provisions applicable to much of the information [as opposed to potentially applicable discretionary exceptions codified at KRS 61.878(1)]' contained in the e-mails requested, ' and the volume of records implicated by the request,'" this office finds that the agency has "adduced sufficient evidence to warrant a finding that honoring the request would place an unreasonable burden on the agency [within the meaning of KRS 61.872(6)]." 08-ORD-060, p. 10, quoting 97-ORD-88, p. 4.
Upon receiving notification of Mr. Thompson's September 28, 2011, appeal challenging his client's denial, Mr. Bryson supplemented his initial response. Mr. Bryson first advised that complying with Mr. Thompson's request for a copy of the inbox, sent box, and deleted folder of each named individual "will require taking a picture of each screen and downloading the picture of each screen to a disc or zip drive; these documents do not exist in such a form that the screens for all of these can simply be printed or saved to a disc." Mr. Bryson explained that information contained on these pictures would have to be redacted, since Mr. Thompson asked for the subject matter and that would include student names, disciplinary issues, etc. protected under FERPA and KyFERPA (in addition to discretionary exceptions, including KRS 61.878(1)(a), (h), (i) and (j)), but reiterated that such information "does not exist in ASCII format. " 5 Quoting KRS 61.874, the agency maintained that Mr. Thompson's request "is a nonstandardized request" for this reason.
KRS 61.874(2)(a) provides that "[n]onexempt public records used for noncommercial purposes shall be available for copying in either standard electronic or hard copy format, as designated by the party requested the records, where the agency currently maintains the records in electronic format. " The General Assembly has established that "a flat file electronic American Standard Code for Information Interchange (ASCII) format" is the "standard electronic format" in which public agencies must produce any existing nonexempt public records under the Act upon receipt of a request for same in electronic format. KRS 61.874(2)(b). While ASCII format is perhaps no longer the most convenient or practical, this office is not at liberty to ignore the plain and unambiguous language of the statute, 6 pursuant to which ASCII is the standard electronic format into which data maintained electronically must be converted if the agency opts to maintain it using a different format.
Mr. Thompson initially asked for the subject e-mails in "a digital format on CD." He later clarified that he did not intend to "request any specific format for the records" nor is he asking the agency to "compile or create a new record." He is "just asking that they be removed to a CD or portable storage device." Alternatively, he suggested that the agency could either grant him access in order to "have an individual access the records and save them at my own expense" or "forward them to me at my email address as they exist." In light of this clarification, and our conclusion that complying with his request would otherwise be unreasonably burdensome, further discussion of the agency's existing duty to convert data into ASCII format or the logistical obstacles associated therewith is unnecessary.
Having detailed its position regarding the format of the subject e-mails, the agency explained that some of the e-mails responsive to Mr. Thompson's request do not still exist because they would have been deleted in accordance with relevant provisions of the "KETS agreement" between the Pulaski County Board of Education and the Kentucky Department of Education, pursuant to which "all deleted or trash emails leave the Pulaski School system after a maximum of 14 days (unless the personal settings are made for a shorter time) and are retained in the system by the [KDE] for an additional number of days, but in any event, no longer than a total of thirty (30) days, even by KDE." 7 In addition, the agency noted, "each employee user within the school district is encouraged to delete or 'purge' 'sent' items to prevent slowing their system." Because Mr. Thompson requested all of these e-mails, Mr. Bryson explained, "some of those do not exist and this is why we stated 'these documents do not exist for the time period requested.'" 8 The fact remains that an extremely high number of responsive e-mails do currently exist.
As Mr. Bryson initially explained:
The District Technology Coordinator has estimated the number of emails that exist which are requested in your undated letter to Pat Richardson, Steve Butcher and Sonya Wilds to be approximately 8500. In response to the sheer number and volume of the emails, which would require each of these superintendents to devote their undivided attention to review each separate e-mail and its contents for matters relating to individual[s'] privacy, ongoing investigations, preliminary opinions, student and employee disciplinary issues, attorney-client work product, invasions of personal privacy issues, confidential correspondences with investigative agencies, and the possible disclosure of other records (HIPPA, FERPA, and those under [KyFERPA] and other privacy records [sic]) 9 that are prohibited from such disclosure by federal and/or state law and regulations[, complying] would require literally days or weeks of review by each of these superintendents of their own email.
Citing KRS 61.872(6), Mr. Bryson argued that complying with Mr. Thompson's request would place an unreasonable burden on the agency.
Acknowledging that in order to satisfy its burden of proof under KRS 61.872(6), a public agency must provide "clear and convincing evidence, " Mr. Bryson further asserted that "each of these individuals would be taken from all of their duties and responsibilities for days or weeks in reviewing, devoting their entire time and attention to reviewing [sic] these thousands of emails. " Such reviews "cannot be delegated to other personnel," Mr. Bryson further observed, "since only these personnel would know the nature and content of these emails. " In the agency's view, this would require "more than the simple exercise of patience and long suffering; this is extremely disruptive to the function of the Pulaski County Schools" because the request involves the records of the only three superintendents. On appeal, the agency confirmed that existing responsive e-mails "number more than 8500, but do not exist in ASCII format. " Even if downloaded into another format or printed, Mr. Bryson reiterated, "it would be necessary for Butcher, Wilds, and Richardson, and the undersigned, as counsel, to review all of these to prevent" disclosure of information protected under state and/or federal law(s) and/or regulations, incorporated into the Open Records Act by operation of KRS 61.878(1)(k) and (l), respectively, in addition to KRS 61.878(1)(a),(h),(i), and (j). "The number and review required of these, over 8500 emails, by three superintendents and undersigned counsel," the agency concluded, "would be so time consuming and burdensome that it is not required under the" Open Records Act. This office agrees. As in 11-ORD-144, this office finds that "the scope of the request at issue in [Commonwealth v. Chestnut, 250 S.W.2d 655 (Ky. 2008)] [is] far less expansive than the scope" of the subject request "and that the case is therefore distinguishable." 11-ORD-144, p. 2. Because the agency has presented clear and convincing evidence that reviewing a minimum of 8500 e-mails to avoid inadvertent disclosure of information protected under FERPA (violation of which results in forfeiture of federal funding) 10 would be unreasonably burdensome, its denial is affirmed.
Resolution of this appeal turns on KRS 61.872(6), pursuant to which:
If the application places an unreasonable burden in producing public records or if the custodian has reason to believe that repeated requests are intended to disrupt other essential functions of the public agency, the official custodian may refuse to permit inspection of the public records or mail copies thereof. However, refusal under this section shall be sustained by clear and convincing evidence.
In construing this provision, the Attorney General has consistently noted that KRS 61.872(6) "'is intended to afford relief to public agencies where there is a pattern of harassing records requests aimed at disrupting essential agency functions or, alternatively, where a single records request is such that production of those records would place an unreasonable burden on the agency.'" 00-ORD-72, p. 2 (citation omitted). To prevent agencies from exploiting this provision as a means of circumventing the requirements of the Open Records Act, the General Assembly has provided that refusal under this section be sustained by clear and convincing evidence, prompting this office to observe that every request "causes some inconvenience to the staff of the public agency. No doubt some state, county and local agencies have found it necessary to employ additional staff since the enactment of the Open Records Law in order to comply with the provisions of the law. . . . [Nevertheless, we] believe it is the legislative intent that public employees exercise patience and long-suffering in making public records available for public inspection." Id., p. 3 (citation omitted). However, this office has also recognized that public agencies and employees "are the servants of the people as stated in the Preamble to the Open Records Act, but they are the servants of all the people and not only of persons who may make extreme and unreasonable demands on their time." Id., p. 3, citing OAG 76-375, p. 4. In determining whether an open records request is unreasonably burdensome, and thus warrants invocation of KRS 61.872(6), this office "must weigh two competing interests: that of the public in securing access to agency records, and that of the agency in effectively executing its public function." Id., citing 96-ORD-155, p. 3.
Prior to Commonwealth v. Chestnut , above, this office rarely concluded that the burden imposed on a public agency in complying with a request was sufficiently unreasonable to justify invocation of KRS 61.872(6). 11-ORD-144, p. 5. The Court validated the longstanding position of this office in Chestnut , recognizing that a public agency "faces a high proof threshold [in denying a request based on KRS 61.872(6) since the agency must show the existence of the unreasonable burden by clear and convincing evidence, " Chestnut at 664, and that it cannot rely on "inefficiency in its own internal recordkeeping system to thwart an otherwise proper open records request." Id. at 665. Further, the "obvious fact that complying with an open records request will consume both time and manpower," the Court observed, "is, standing alone, not sufficiently clear and convincing evidence of an unreasonable burden. " Nor does the "winnowing process" required of the agency "to separate excepted materials and make nonexcepted materials available" per KRS 61.878(4) "rise to the level of an unreasonable burden under KRS 61.872(6) because that is an existing statutory obligation. Id. at 664.
The Attorney General recently distinguished the facts of Chestnut in upholding the denial by the Kentucky State Police of a voluminous request for copies of records "'pertaining to the ability of law enforcement officers to obtain records from cell phone companies that reveal the past or present travels of cell phone users. " 11-ORD-144, p. 1. While the specific number and type of records implicated there may differ from those currently in dispute, this office nevertheless finds the reasoning contained therein applicable on these facts:
Although not wholly dispositive of the issue presented on appeal, Chestnut involved an inmate's request to inspect a single institutional file, his own, which consisted of "numerous 'files,' . . . physically located at more than one spot across the Commonwealth." Id. Mr. Sharp's [like Mr. Thompson's] request is vast in scope, encompassing in excess of 52,000 investigative files, [or a minimum of 8500 e-mails here] many of which remain open. Thus, while the Court in Chestnut was dealing with a single potentially voluminous file, Mr. Sharp's request implicates over 52,000 potentially voluminous files [8500 e-mails] . In Chestnut , the Court rejected the agency's claim that its method of organizing inmate files exacerbated the burden in fulfilling the request, declaring that it "should not be able to rely on any inefficiency in its own internal recordkeeping system to thwart an otherwise proper open records request." Id. at 666. KSP [Pulaski County Schools] amply demonstrates that its recordkeeping system is not inefficient but is instead properly suited to its investigative/enforcement goals. The potential for inadvertent disclosure of protected matter , specifically, information to be used in prospective law enforcement action the premature disclosure of which would harm ongoing investigations and enforcement actions, [footnote omitted] [information protected under FERPA] is multiplied many times over in the context of a request of this magnitude.
(Emphasis added.)
Because redaction of information withheld under authority of KRS 61.878(1)(h), the statutory exception that KSP relied upon there, 11 is discretionary, unlike FERPA, which the Pulaski County Schools invoked here, this reasoning, if anything, is more compelling in the instant case, particularly given the high volume of records implicated. 12 However "'scrupulously [the agency] perform[s] its duty to ensure that any privileged material'" is not disclosed, 13 "the sheer volume of the records encompassed by Mr. [Thompson's] request magnifies the possibility" that personally identifiable information protected under FERPA is contained therein and may be inadvertently disclosed if all three superintendents and their legal counsel do not carefully scrutinize each and every responsive e-mail, a process the agency has credibly estimated could take weeks.
FERPA restricts access to "education records" or personally identifiable information contained therein, "on pain of withdrawal of federal funds." 04-ORD-052, p. 6. Regardless of how many e-mails actually contain such information, and even assuming the agency waived the other cited exceptions, 14 the fact remains that a review of all existing responsive e-mails would be required in order to conclusively determine how much redaction was required under applicable federal/state law. Accordingly, this office concludes that the agency "offers clear and convincing evidence that the time and manpower required to fulfill Mr. [Thompson's] request is not a function of inefficiencies in its record keeping system, but is, instead, a function of the expansive scope of his request [and the need to identify and redact all FERPA information]." 11-ORD-144, p. 7; compare 11-ORD-084 (claim that request was improperly framed and thus unreasonably burdensome was not established with clear and convincing evidence given that some of the perceived burden would not have existed if the agency had properly maintained all records in accordance with applicable records retention schedules and it also failed to identify the specific difficulties associated with redaction of the records, etc.). "While continuing to firmly adhere to the principles articulated in Chestnut ," this office affirms the "denial of Mr. [Thompson's] request, in its current form, under KRS 61.872(6) based upon the clear and convincing evidence of an unreasonable burden presented." 11-ORD-144, p. 7.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Distributed to:
Dan ThompsonLarry G. BrysonBarbara Teague
Footnotes
Footnotes
1 Mr. Thompson explained that such records would "consist merely of the information of the subject of the email, the individual the email was either sent to or received from, and the date the email was sent." The request was "specifically drafted to eliminate any personal privacy information and the subject records should not be redacted in any manner."
2 September 21, 2011.
3 FERPA regulates access to "education records," which is expansively defined at 20 U.S.C. § 1232g(4)(A). FERPA precludes the disclosure of personally identifiable student information to third parties in the absence of a parent or eligible student's prior written consent. 04-ORD-052, p. 6.
4 KRS 61.878(1)(k) and (l) authorize public agencies to withhold:
(k) All public records or information the disclosure of which is prohibited by federal law or regulation;
(l) Public records or information the disclosure of which is prohibited or restricted or otherwise made confidential by enactment of the General Assembly.
5 Mr. Bryson further explained that ASCII format "is a plain text format. Our emails are stored as PST files which are not ASCII. PST files are a Microsoft specified type file and the user must have Microsoft Outlook to open and access the information." It may be possible, Mr. Bryson advised, "to export some of the requested information into a CSZ file format, which is an ASCII format, but this would be a very time consuming endeavor. For example, with Mr. Richardson's emails, his email inbox is organized with folders, specifically 82 folders. " All of these folders are part of his inbox, Mr. Bryson continued, and would have to "be exported separately because they do not exist in ASCII format. Even if this information was exported, it would still be necessary to view each email separately to determine if its contents could be disclosed. . . ."
6 As with any decision involving statutory application, our duty "is to ascertain and give effect to the intent of the General Assembly." Beckham v. Board of Education of Jefferson County, 873 S.W.2d 575, 577 (Ky. 1994), citing Gateway Construction Co. v. Wallbaum, 356 S.W.2d 247 (Ky. 1962). In so doing, the Attorney General is at liberty to neither add nor subtract from the legislative enactment "nor discover meaning not reasonably ascertainable from the language used." Id. This office must refer to the literal language of the statute as enacted rather than surmising the meaning that may have been intended but was not articulated. Stogner v. Commonwealth, 35 S.W.3d 831, 835 (Ky. App. 2000).
7 The agency did not reference any of the potentially relevant sections of either the Public School District Records Retention Schedule or the Local Governments General Records Retention Schedule nor did it clarify whether its retention policy authorized the deletion of e-mails only after expiration of the retention period authorized in the applicable retention schedule(s) developed by the Kentucky Department for Libraries and Archives. The content of the record itself, regardless of the format, determines whether it must be released. 09-ORD-203, p. 5. Accordingly, this office consulted the KDE for insight regarding the interplay between these retention schedules and the referenced portion of the "KETS agreement." KDE explained that it was actually a guide or manual which, more importantly, is not current. Within the Live@edu system, "which became the single e-mail system for KDE and Kentucky school districts in May 2010" and provides individual employees of the agencies with a much greater storage capacity (10GB), KDE observed, "all recovery features are end-user managed as opposed to being split between the end user and the local district CIO. Once an item is deleted it will remain in the deleted items folder for 30 days." At the end of the 30 days, KDE advised, "it will be moved to a system folder (called dumpster) for an additional 14 days. During this final 14 days the item is no longer visible to the end-user, but can still be recovered by the end-user, " meaning deleted items "are recoverable by an end-user or someone in the school district for up to 44 days from the day of deletion." Significantly, the KDE policy explained above presumes that each user will only delete items based on content per appropriate sections of the applicable retention schedule(s) (for example, Series L5875, Nonbusiness Related Correspondence, should be destroyed immediately).
"The key to records access is effective records management." 11-ORD-10, p. 4 (citation omitted). Having conferred with representatives from both KDE and the KDLA, this office concludes, based on the limited evidence of record, that potential records management issues may exist which, consistent with KRS 61.8715, necessitate a referral to KDLA for additional inquiry as that agency deems appropriate. See 11-ORD-104. Such issues are not justiciable in the context of this appeal nor do the questions raised in this regard alter the analysis or outcome of this decision as, if anything, the potential existence of more e-mails would further substantiate our conclusion.
8 Although Mr. Thompson disputed the assertion that he requested nonexistent records, expressing concern that "some of the records have been deleted or removed to avoid turning them over," and that "messages on the individual computers are not automatically deleted, " which is why the agency claims there are 8500 e-mails, the record on appeal contains no actual evidence to support his position. This office cannot "adjudicate a dispute regarding a disparity, if any, between records for which inspection has already been permitted, and those sought but not provided. Indeed, such is not the role of this office" under the Act. OAG 89-81, p. 3. In other words, "questions relating to the verifiability, authenticity, or validity of records disclosed under the Open Records Act are generally not capable of resolution under the Act." 05-ORD-236, p. 3 (reporter questioned the validity of invoices produced in response to request and the Attorney General advised that the relief sought was unavailable under the Act). As in these decisions, the Attorney General finds that issues concerning the value of information contained in public records produced for inspection, the volume of records implicated or produced, etc. are not justiciable in the context of an Open Records Appeal; this office therefore declines to assign error on that basis.
9 Because the agency is not a "covered entity" within the meaning of 45 C.F.R. § 160.103, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) would not apply.
10 "FERPA restricts access to 'education records (or personally identifiable information contained therein). . .' on pain of withdrawal of federal funds." 04-ORD-052, p. 6. Among the definitions of "personally identifiable information" found at 34 CFR § 99.3 is "[o]ther information that would make the student's identity easily traceable."
11 "[T]he decision to [separate protected information] rests within the sound discretion of the public agency because the exemptions contained within KRS 61.878(1) are permissive, not mandatory. " 97-ORD-6, p. 4, quoting OAG 89-76. This cannot be said of separate and more specific mandatory provisions, including FERPA.
12 This office has consistently noted "that the presence of some exempt information in the disputed records does not relieve the agency of its obligation to provide all nonexempt information since 'the alleged necessity of separating exempt and nonexempt material is not a sufficient reason for denying access to records.' 97-ORD-6, p. 5, citing OAG 81-198, p. 4." 08-ORD-060, p. 8. However, the "holding in those decisions was predicated on the notion that 'the decision [to redact] rests within the sound discretion of the public agency because the exemptions contained within KRS 61.878(1) [as noted above] are permissive, not mandatory. ' OAG 89-76, p. 3." Because the agency in 08-ORD-060 had to "engage in a case-specific analysis [] to determine whether portions of the records must be redacted in accordance with applicable statutory provisions and case law," and the "decision to redact [was] not discretionary, " this office affirmed the agency's denial per KRS 61.872(6). 08-ORD-060, p. 9 (copy enclosed)(original emphasis). That decision predated Chestnut by one month but is factually distinguishable and consistent therewith in relevant part.
13 Chestnut at 666.
14 More than likely, a number of responsive e-mails, or portions thereof could also be properly withheld under KRS 61.878(1)(a), (h), (i), (j), and/or the attorney-client privilege, but a conclusive determination cannot possibly be made based upon the limited evidence presented in this regard.