Opinion
Opinion By: Jack Conway,Attorney General;Michelle D. Harrison,Assistant Attorney General
Open Records Decision
Brian Wallace initiated this appeal by letter dated July 20, 2015, challenging the denial by the Kentucky Department of Education (KDE) of his July 7, 2015, e-mail request for "all email communications" that contain any of the fourteen (14) different names listed "as the sender or recipient of any emails" containing the following search terms: "Title IX, Title 9, Title Nine, OCR, Office of Civil Rights, Office for Civil Rights, Kelly Wallace, volleyball, Brian Wallace, or weight room, in the title or body of the message." 1 Mr. Wallace advised KDE that he did not intend "for the above keywords to be case sensitive" and that all of the named individuals "are current or former employees of the Montgomery County Schools." He asked for all responsive e-mails generated since July 1, 2013. By e-mail sent later that day, after the close of business, Mr. Wallace amended his original request to add one name as well as the search terms "fitness center" and "wellness center." The KDE received his request, including the additions, on July 8, 2015, and issued a timely response on July 13, 2015. Assistant General Counsel Todd Allen advised Mr. Wallace that "this documentation, if it exists, is contained in voluminous files. The [Department] is still searching its files for documents responsive to your request and evaluating the need for redaction." The KDE advised that "an updated response" would be sent by July 22, 2015.
By e-mail directed to Mr. Wallace on July 16, 2015, Mr. Allen supplemented the agency's response as follows:
It appears the records you request, if they exist, would be in the possession of the Montgomery County Public Schools. The documents you have requested under the Open Records Act are not within the ordinary and direct possession of the KDE. The KDE assists school districts in their administration of their district's participation in the statewide K-12 email system but the KDE never accesses district emails except when required by law enforcement or other subpoena authority. The reasons for this are several, including the fact that district emails may contain information protected by the Family Educational Rights and Privacy Act (FERPA), attorney-client privilege, or other Privacy Act laws and the KDE does not have a legitimate educational interest in accessing district email which may contain this FERPA protected or other confidential information just to provide another public agency's documents under the Open Records Act. The KDE as well does not possess the ability and factual knowledge necessary to redact those emails as required by federal and state law prior to release under the Open Records Act, for similar reasons. The individual school districts themselves have administrator rights over their district's email accounts and the ability to access those for response to [requests made under] the Open Records Act. We recommend that you seek the documents requested from the public agency you believe is in possession of those documents.
Mr. Allen further advised Mr. Wallace that if he sought "e-mails or other communication to or from a specific KDE employee, please provide the name of that KDE employee so that we may identify and locate the records you seek."
In reply, Mr. Wallace asserted that "the implication from the content of" the agency's July 7 and July 16 e-mails was that "KDE started searching for the requested documents and determined that the request would take what it deems an inordinate amount of time to fulfill and is trying to dismiss it." Mr. Wallace observed that "KDE does in fact have access to any emails that may exist pertinent to my request, as they are accessible in response to law enforcement or subpoena. Therefore, my request should be fulfilled consistent with KRS 61.872(4), as this diction clearly suggests 'custody' of the records. " Mr. Wallace further argued that he "was not notified within 3 business days that KDE would not fulfill my request and that they wished for me to file it with Montgomery County Schools (KRS 61.872(4) and (5)), in and of itself a violation of" the Open Records Act. In addition, the Records Custodian for the Montgomery County Schools, Jacqui Johnston, has failed to comply with provisions of the Open Records Act in responding to previous requests, according to Mr. Wallace, and therefore "cannot be trusted to lawfully fulfill this request, particularly since she is one of the persons mentioned in the request." Mr. Wallace offered to provide Mr. Allen with contact information for the Montgomery County Schools' attorney so that KDE could search for the responsive e-mails and then forward the records to her in order to have protected information redacted. KDE replied to Mr. Wallace by e-mail on July 20, 2015, but since it was "essentially a rehashing" of the agency's July 16, 2015, e-mail, Mr. Wallace did not include a copy in filing his appeal, though KDE provided a copy with its appeal response.
Mr. Wallace's July 7, 2015, request unambiguously stated that all of the individuals named "as possible senders or recipients are current or former employees of Montgomery County Schools." Accordingly, the July 13, 2015, response of KDE was timely but otherwise deficient as the KDE failed to either comply with KRS 61.880(1) or properly invoke KRS 61.872(4) or (5) if appropriate. KRS 61.880(1) provides that upon receipt of a request, a public agency "shall determine within three (3) days, excepting Saturdays, Sundays, and legal holidays . . . whether to comply with the request and shall notify in writing the person making the request, within the three (3) day period of its decision." This mandatory provision also requires that a public agency response denying, in whole or in part, inspection of any record "shall include a statement of the specific exception authorizing the withholding of the record and a brief explanation of how the exception applies to the record withheld. The response shall be issued by the official custodian or under his authority, and it shall constitute final agency action." In construing KRS 61.880(1), the Court of Appeals held that "[t]he language of the statute directing agency action is exact. It requires the custodian of records to provide particular and detailed information in response to a request for documents." Edmondson v. Alig, 926 S.W.2d 856, 858 (Ky. App. 1996). A "limited and perfunctory response," the Court recognized, does not "even remotely compl[y] with the requirements of the Act--much less [amount] to substantial compliance." Id . (public agency did not deny it was the custodian of the records nor did the agency "include information relevant to obtaining the records from a different source" per KRS 61.872(4) and its response was therefore deficient) ; 01-ORD-183, pp. 2-3; 07-ORD-139; 11-ORD-158.
On July 16, 2015, three business days after it advised that a search was underway, the KDE belatedly advised that it did not actually possess or have custody of the requested e-mails. The Attorney General has consistently recognized that a public agency cannot produce nonexistent records or those which it does not possess in response to a request made per KRS 61.880(1). 07-ORD-190, p. 6; 06-ORD-040. Rather, the right to inspect attaches only if the records being sought are "prepared, owned, used, in the possession of or retained by a public agency. " KRS 61.870(2); 02-ORD-120, p. 10. However, in addressing the obligations of a public agency when denying access to public records based on their nonexistence or its lack of possession, the Attorney General has observed that a public agency's "inability to produce records due to their apparent nonexistence [or lack of possession] is tantamount to a denial and . . . it [is] incumbent on the agency to so state in clear and direct terms ." 01-ORD-38, p. 9 (other citations omitted)(emphasis added); 12-ORD-162.
While it is obvious that a public agency "cannot furnish that which it does not have or which does not exist, a written response that does not clearly so state is deficient. " 02-ORD-144, p. 3; 09-ORD-145. In short, "[i]f a record of which inspection is sought does not exist [or the agency lacks possession], the agency should specifically so indicate." OAG 90-26, p. 4; 09-ORD-145; 12-ORD-162. This office has consistently recognized that a response by a public agency violates KRS 61.880(1) , "if it fails to advise the requesting party whether the requested record exists." 96-ORD-101, p. 1; 12-ORD-162. In ultimately suggesting that Mr. Wallace direct his request to the records custodian of the Montgomery County Schools, KDE substantially complied with KRS 61.872(4), provides that, "[i]f the person to whom the application is directed does not have custody or control of the public record requested, that person shall notify the applicant and shall furnish the name and location of the official custodian of the agency's public records. " Notwithstanding the initial failure of KDE to respond with adequate specificity per KRS 61.880(1) and comply with KRS 61.872(4), this office finds the agency's position, as persuasively set forth on appeal by letter dated July 29, 2015, substantively correct on the unique facts presented.
In the interest of clarity, this office first reaffirms that "mere possession of records by the agency from which those records are requested is enough to compel that agency to make them available for public inspection or explain why they are exempt." 09-ORD-107, p. 4 (Emphasis added.) See 98-ORD-100 (rejecting the argument that a public agency which prepares, owns, uses, possesses, or retains a public record is relieved of its duties under the Open Records Act simply because the record is also in the custody of another public agency from which it can more appropriately be obtained); 06-ORD-166; 12-ORD-215. Our holding today should not be construed as departing from our precedents establishing that no exception to the Open Records Act "authorizes a public agency to withhold public records from an applicant because access to the records may be obtained from another public agency, even if the requested records might more appropriately or more easily be obtained from that other public agency. " 12-ORD-215, p. 3, quoting OAG 91-21. If the KDE actually possessed, maintained, used or had custody or control of the records in dispute, regardless of whether the records could also be accessed from another public agency, it would have a statutory obligation to provide Mr. Wallace with copies in response to his request after making necessary redactions. See 06-ORD-218; compare 98-ORD-90.
However, the KDE properly denied the request for e-mails "which it did not have or did not retain and was not required to retrieve" in order to satisfy his request as the Attorney General has also long recognized that a public agency "does not violate the Open Records Act when it declines to retrieve copies of records which could have been obtained, but were not obtained," for the purpose of complying with a request. 99-ORD-122, pp. 5-6 (relying upon federal case law interpreting the Freedom of Information Act, since neither it nor the Open Records Act compels a public agency to create a record, in recognizing that ordering a public agency to exercise its right of access would effectively be compelling the agency to create a record since it was not a record of that agency prior to such exercise); 12-ORD-098 (neither the courts nor this office have construed KRS 61.870(5) or (6), defining "custodian" and "official custodian, " respectively, to extend the reach of the Act to records that are not currently under the control of the public agency's official custodian even if the records "are for the 'use' of the public agency" ); compare 09-ORD-107; 12-ORD-178.
Because the KDE thoroughly and persuasively articulated its position, this office hereby adopts the following excerpts from its appeal response as the basis for this decision: 2
All 173 Kentucky school districts utilize Microsoft 365 for employee and student e-mail. . . . Each public school district has an Information Technology (IT) Administrator, who controls all components of the district system, including e-mail accounts. District e-mail accounts are created, maintained and deleted by district-level IT administrators. Without the local district administrator, no e-mail accounts would exist within a school district. KDE's administrator password is used exclusively for providing technical assistance to school district IT administrators in the event of technical problems. Absent being compelled by court order or similar legal authority, KDE does not access the content of any individual district-level e-mail account . If individual district-level e-mail accounts are accessed, that function is performed by district IT administrators. Please keep in mind that public school districts are each controlled by a locally elected governing body.[3 ] Local boards of education and districts are not under the direct control of the executive branch of state government. As such, school district employees are not KDE employees and are not under the direct control of KDE. Public school districts recognize that they are the owners of district e-mail accounts and understand that KDE does not access district accounts. For example, Personnel Policy 03.1321 of Montgomery County Schools is a policy regarding "Use of School Property." The policy states: "Employees cannot expect confidentiality or privacy as to information entered or stored in their E-mail accounts. Authorized District personnel may monitor the use of electronic equipment from time to time." Ownership of the e-mail account is clearly claimed by the school district. KDE has no control over the manner in which school district employees utilize e-mail and would have no ability to reprimand or terminate a district employee for e-mail practices. All policies regarding e-mail use are adopted and amended at the local board of education level.
A. It is undisputed that Montgomery County Schools has possession, custody and control of district e-mail .
Pursuant to KRS 61.870(5), an "Official Custodian" is the "chief administrative officer or any officer or employee of a public agency who is responsible for the maintenance, care and keeping of public records, regardless of whether such records are in his actual personal custody and control. " As explained above, district IT administrators are responsible for the maintenance, care and keeping of district e-mail accounts. Accounts are created, maintained, and deleted exclusively at the district level. But for the Montgomery County IT Administrator, no e-mail account would exist for Montgomery County Schools. Furthermore, Montgomery County Schools claims ownership of the district e-mail accounts as evidenced by district policy. . . .
For purposes of the Open Records Act a "Custodian" is the "official custodian or any authorized person having personal custody and control of public records. " Again, district IT administrators, not KDE, have personal custody and control of district e-mail accounts. Specifically, Montgomery County Schools claims ownership of e-mail accounts through its district policies. The district also controls employee and student use of the e-mail system with policies and procedures adopted at the local level without input or control of KDE. District IT administrators control which employees and/or students receive an account, how the account will be monitored, retention requirements, and whether the account will be suspended or deleted. KDE lacks personal custody and control of district e-mail and cannot be the Custodian of these records as defined in KRS 61.870(6).
Here, Montgomery County Schools has exclusive possession, custody and control of its e-mail records. Furthermore, the local school district is a public agency subject to the Kentucky Open Records Act pursuant to KRS 61.870(1)(d). Mr. Wallace does not dispute that Montgomery County Schools has such possession, custody and control of the records he requests. He also acknowledges the existence of an official records custodian in Montgomery County Schools. Instead, he argues that the school district records custodian "cannot be trusted to lawfully fulfill this request. . . . ." Mr. Wallace's distrust for the local school district records custodian does not change the fact that KDE lacks the requisite possession, custody and control of the e-mail records in question.
A. The Appellant incorrectly equates access with possession, custody and control .
It is important to note that the Open Records Act requires more than mere access to public records. State agencies have access to voluminous public records. However, the Open Records Act only requires production of public records in an agency's possession, custody and control. KDE's access to district e-mail through its administrator password does not rise to the level of possession, custody and control required by the Open Records Act. Recall that KDE only uses its administrator password to assist district IT administrators when a technical issue arises and never accesses the content of district e-mail accounts absent being compelled by court order or other legal authority. According to Black's Law Dictionary, 8th Edition, access is "an opportunity or ability to enter, approach, pass to and from, or communicate with." However, custody is the "care and control of a thing for inspection, preservation, or security." Control is "the power or authority to manage, direct, or oversee." Finally, possession is "the fact of having or holding property in one's power." The Montgomery County Schools e-mail system is neither the property of nor held by KDE. The local district admits in its policies that it is the owner of district e-mail. E-mail accounts are created, managed, monitored and deleted exclusively by Montgomery County IT Administrators. Policies regarding e-mail use and retention are developed and adopted at the local school district level and not by KDE.
(Original emphasis.)
Quoting 03-ORD-005, the KDE acknowledged that "[e]-mail may be characterized as 'documentation regardless of physical form or characteristics, which [is] prepared, owned, used, in the possession of or retained by a public agency. ' [KRS 61.870(2)]." KDE argued that e-mail communications to and from local school district personnel should thus "be treated no differently than paper communication to and from local school district personnel. " Counsel advised that "[i]ndividuals sending or receiving e-mail to or from Montgomery County Schools communicate directly with the local school district, not by or through KDE." This fact would not be controlling if KDE nevertheless possessed, used, or retained such records. However, any e-mails responsive to Mr. Wallace's request, "if they exist, were 'prepared, owned, used, in the possession of or retained by' Montgomery County Schools. KDE never prepared, owned, used, possessed or retained the e-mail records ." (Emphasis added.) In summary, the KDE maintained that Mr. Wallace "incorrectly suggests that by way of an administrator password, KDE assumes custody, control and possession of all e-mail records for Kentucky's 173 public school districts." This office agrees that KDE's ability to "access" public records exclusively in response to a subpoena or to provide technical assistance, by virtue of its administrative password, cannot be properly equated with use, or possession, custody or control, and the requested e-mails do not otherwise qualify as public records of KDE. Accordingly, this office affirms the agency's denial of Mr. Wallace's request.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court under KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3) , the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Footnotes
Footnotes