Opinion
Opinion By: Andy Beshear,Attorney General;Michelle D. Harrison,Assistant Attorney General
Open Records Decision The question presented in this appeal is whether the Scott County Public School District ("District") violated the Open Records Act in denying Brad Penn's June 21, 2018, request for a copy of all open enrollment acceptance letters and letters denying requests for open enrollment sent to parents or guardians of students in grades 6-8 for the 2018-2019 school year in addition to a copy of "any [enrollment] documents completed by [Scott County Board of Education member Diana] and/or Dan Brooker [, or Board member Stephanie Powers] and/or in district [enrollment] of any student relative." 1 By letter to Mr. Penn on July 2, 2018, Superintendent Kevin F. Hub stated that most of what Mr. Penn requested "is covered by the Family Education[al] Rights and Privacy Act [of 1974] (FERPA)," and "redaction does not keep them from containing personally identifiable information; therefore, you are not entitled to them."
Mr. Penn subsequently resubmitted his request by letter dated July 11, 2018, asserting that documents he requested contain "directory information" 2 as defined in FERPA, which the District was "required to release" within three days per KRS 61.880(1). Mr. Penn also requested a copy of the "complete open enrollment list by School with student name and address." Having received no additional response, Mr. Penn submitted this appeal by letter dated July 25, 2018.
Upon receiving notification of Mr. Penn's appeal from this office, Joshua M. Salsburey, counsel for the Scott County Board of Education ("Board"), responded on behalf of the District. The District first noted that open enrollment letters and the open enrollment list qualify as "education records," the disclosure of which is prohibited under 20 U.S.C. § 1232g and 34 C.F.R., Part 99. "The names, addresses, and schools of each parent and student contained in those records are not merely 'directory information,'" the District stated, "because, when produced in connection with the open enrollment records and information [that Mr. Penn] seeks, they become much more than that." In providing Mr. Penn with a sample open enrollment letter and blank templates of certain other enrollment records, the District explained, it has given Mr. Penn "all it can without violating FERPA." Likewise, with regard to enrollment records for the children of, and other students related to, named members of the Board, the District asserted, such records unquestionably qualify as "education records." Because Mr. Penn already knows the specific families and students implicated, he continued, any records provided to him would constitute production of "personally identifiable information" 3 of those students, contrary to FERPA. Even assuming that FERPA was not controlling here, the District argued, it could properly withhold the records in dispute because of KRS 61.878(1)(a). Based upon the following, this office affirms the District's denial of Mr. Penn's request in accordance with FERPA, notwithstanding certain procedural deficiencies. Accordingly, discussion of the District's alternative basis for denial is unwarranted.
KRS 61.880(1) provides that a "response denying, in whole or in part, inspection of any record shall include a statement of the specific exception authorizing the withholding of the record and a brief explanation of how the exception applies to the record withheld ." (Emphasis added). In construing the mandatory language of KRS 61.880(1), the Kentucky Court of Appeals observed that the "language of [KRS 61.880(1)] directing agency action is exact. It requires the custodian of records to provide particular and detailed information in response to a request for documents. . . . [A] limited and perfunctory response [does not] even remotely compl[y] with the requirements of the Act-much less [amount] to substantial compliance."
Edmondson v. Alig, 926 S.W.2d 856, 858 (Ky. App. 1996); 04-ORD-208; 07-ORD-226; 12-ORD-211; 15-ORD-080. "[I]t is clear that the burden of proof in sustaining public agency action in the event of an appeal to the Attorney General, or to the circuit court, is on the agency. KRS 61.880(2)(c); KRS 61.882(3)." 00-ORD-10, pp. 10-11(citation omitted). A "bare assertion," such as that initially provided on behalf of the District, simply does not satisfy that burden. Id. , p. 11. However, existing legal authority supports the District's ultimate disposition of Mr. Penn's request.
Among those records excluded from application of the Open Records Act in the absence of a court order are "[p]ublic records or information the disclosure of which is prohibited by federal law or regulation. " KRS 61.878(1)(k). Insofar as the District initially failed to cite this exception, pursuant to which FERPA is deemed incorporated into the Open Records Act, or provide any explanation of how KRS 61.878(1)(k) applied, its response lacked the specificity that KRS 61.880(1) and 61.880(2)(c) require. The District also failed to issue any written response upon receipt of Mr. Penn's July 11, 2018, request per KRS 61.880(1), pursuant to which a public agency, upon receipt of a request made under the Open Records Act, "shall determine within three (3) days, excepting Saturdays, Sundays, and legal holidays, after the receipt of any such request whether to comply with the request and shall notify in writing the person making the request, within the three (3) day period of its decision." Because the District has acknowledged this omission, further elaboration of this point is unwarranted.
Both FERPA, 4 and the implementing regulations codified at 34 C.F.R. § 99 et seq. , are incorporated into the Open Records Act by the express language of KRS 61.878(1)(k). FERPA regulates access to "education records" like those at issue. 20 U.S.C. § 1232g(a)(4)(A) defines this term as "those records, files, documents, and other materials which--(i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution." More specifically, FERPA precludes the public disclosure of personally identifiable student information (see note 3) to third parties, like Mr. Penn, absent prior written consent from a parent or eligible student. FERPA is also intended to ensure that parents of students, and students themselves, if over eighteen years of age, have access to their education records.
The goal of this legislation was "'to end denial of access to parents and students, and to prevent violations of student and family privacy rights by the release of unscreened records to third parties without parental or student consent.'" 99-ORD-217, p. 5 (citation omitted). To that end, the term "education records" has been and was "intended to be broadly construed, and the exceptions . . . must be narrowly construed since the value of [the parents'] right of access and [students'] right of privacy "depreciates with every item that is excluded from the definition of 'education record.'" OAG 91-177, p. 4 (citation omitted); 98-ORD-162. With the exception of narrowly defined categories of records identified at 20 U.S.C. § 1232g(4)(B)(i)-(iv), which are not relevant here, the term is expansively construed to include all information, in whatever form, which satisfies the two-part test described above. Both the Kentucky Supreme Court and this office have recognized that FERPA operates to bar the public disclosure of education records, as that term is defined in federal law, and that FERPA is incorporated into the Open Records Act by KRS 61.878(1)(k).
Hardin Cnty. Schools v. Foster, 40 S.W.3d 865 (Ky. 2001)(statistical compilation of school disciplinary actions requested by newspaper did not contain any information that directly related to a particular student and therefore was not an "education record");
Medley v. Bd. of Educ. of Shelby Cnty., 168 S.W.3d 398 (Ky. App. 2004)(affirming the fundamental proposition of 99-ORD-217 in affirming that "videotapes [used for monitoring that would reveal the identities of students] are, in fact, 'education records' . . . ."), inter alia .
Although 20 U.S.C. § 1232g(a)(4)(A) requires that an "education record" directly relate to a student, "[t]his requirement is satisfied if a record is 'associated in any manner with an identifiable student, . . . regardless of whether the individual is identified by name." OAG 91-177, p. 2 (citation omitted). Critical to resolution of the question presented is the longstanding recognition that in defining "education records," the "congressional intent was to fashion a broad definition."
Belanger v. Nashua, New Hampshire Sch. Dist., 856 F.Supp. 40, 49 (D.N.H. 1994); 00-ORD-213; 10-ORD-150. Accordingly, records of students "do not have to be related to academic matters to be 'education records' under FERPA . . . ."
United States v. The Miami Univ., 91 F. Supp. 2d 1132, 1149, n. 17 (S.D. Ohio, 2000); 00-ORD-213; 10-ORD-150. Having reviewed the blank copy of the District's form letter and the blank open enrollment application (copies of record), this office finds that records pertaining to a student's enrollment and, more specifically, the requested open enrollment letters, "complete open enrollment list," and "any [enrollment] documents" pertaining to student relatives of certain Board members, are "rife with personally identifiable and highly sensitive information," and thus are properly characterized as "education records" within the meaning of 20 U.S.C. § 1232g(a)(4)(A), as the District asserted. Accordingly, FERPA bars public disclosure of the records in dispute.
On appeal the District stated, "The District notifies parents of open enrollment decisions through a form letter that (1) acknowledges the parent's request for open enrollment placement at another school; (2) summarizes the criteria governing open enrollment decisions; and (3) tells the parent which school their child will be attending, and thus, whether the request for open enrollment was approved or denied." The District further indicated the District maintains a list for grades 1-8 of students who applied for open enrollment during the open enrollment period and received letters approving their applications. However, the District disputed Mr. Penn's contention that names, addresses, and schools of students and parents who received open enrollment decisions are simply "directory information" that FERPA permits the District to publicly disclose with parental consent. The District acknowledged that FERPA permits disclosure of certain "basic and harmless information about students if both FERPA and the school district designate such information" as "directory information." In this case, Mr. Salsburey stated, "it is true both FERPA and District policy designate a student's name, grade level, and most recent previous educational institution attended as 'directory information. ' See 20 U.S.C. § 1232g(a)(5); 34 C.F.R. 99.3; and Board Policies 09.14 and 09.14 AP.12[.]"
The District first noted that Mr. Penn asked for the name of the school that each student requested or at which the student was going to enroll for the upcoming school year. However, both FERPA and District Policy only allow public disclosure of the most recent school that a student has previously attended. Second, the District stated, Mr. Penn asked for the address of each student and parent. However, the address "can only be produced if both FERPA and the District have designated addresses as 'directory information,' and here the District has not." Our independent review of 20 U.S.C. § 1232g(a)(5), 34 C.F.R. 99.3, and the relevant Board Policies validated the District's argument on both of these salient points. Citing 34 C.F.R. 99.31(a)(11) and 99.37, the District further noted that disclosure of "directory information" under FERPA is permissive rather than mandatory. Although not dispositive, this fact lends further support to its position. Compare 05-ORD-081, p. 7 (recognizing that statutes relating to public disclosure of directory information are permissive but finding it "disingenuous for a school district to freely publish information" such as name and home address in a student directory, etc .). Third, the District observed, context matters in determining whether certain items of information constitute "directory information." See 34 C.F.R. 99.3 ("'Directory information' means information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed."). See 07-ORD-091; 11-ORD-027; 16-ORD-152.
None of the information that Mr. Penn sought is designated as "directory information" by the District, except for the student's name. See 00-ORD-158 (school district properly denied request for various "listings" of personally identifiable student information, as opposed to raw data reflecting total enrollment, as it had not designated any information contained in student records it maintained as "directory information"). The District correctly asserted that names, addresses, and schools of students and parents who received enrollment letters, or whose names appeared on the requested list, are "personally identifiable" pieces of information pursuant to FERPA. Under the circumstances presented, the District asserted that if it provided Mr. Penn with documents responsive to his request -- "namely, unredacted copies of the open enrollment letters and lists -- it would be telling him much more than just a student's name, address, parents, and school -- rather, it would be telling him the student's parents submitted a request for open enrollment and the disposition of that request[,]" all of which falls well outside the definition and examples of "directory information" found in FERPA. This office agrees.
The definition of "personally identifiable information" found at 34 C.F.R. Part 99.3 includes, among other things, "information that, alone or in combination, is linked or linkable to a specific student" and information requested by a person, such as Mr. Penn, the District "reasonably believes knows the identity of the student to whom the education record relates." The District correctly noted that the personally identifiable nature of the records in dispute is "compounded by the fact that [Mr.] Penn already knows the students (or students' families) to whom the records relate." FERPA prohibits the public disclosure of such information regarding a student. However, FERPA also expressly provides that an entire record constitutes "personally identifiable information," the District argued, when, as in this case, "a school district has a good faith reason to believe the requester already knows the identity of the student or students to whom the records relate." See C.F.R. 99.3. Redaction is futile under these facts.
In summary, the requested enrollment records and enrollment list are "education records," the disclosure of which is prohibited under FERPA; the information contained therein is "personally identifiable information" protected from disclosure, rather than merely "directory information" that may be disclosed, when viewed in context. Accordingly, the District properly denied Mr. Penn's request in accordance with FERPA and KRS 61.878(1)(k).
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General shall be notified of any action in circuit court, but shall not be named as a party in that action or in any subsequent proceeding.
Footnotes
Footnotes
1 Mr. Penn also requested a copy of "any and all emails sent or received by any Scott County School[s] employee, administrator or board member addressing the open [enrollment] for [his daughter]" or "discussing me personally, or my inquiry via email dated 6/5/18." In his July 2, 2018, response, Superintendent Kevin F. Hub indicated that he was enclosing "documents that specifically address you and/or your daughter[.]" Accordingly, our analysis will focus on the propriety of the District's denial as to all remaining documents responsive to Mr. Penn's request. See 40 KAR 1:030 Section 6; 15-ORD-073.
2 Pursuant to 20 U.S.C. § 1232g(a)(5)(A):
For the purposes of this section the term "directory information" relating to a student includes the following: the student's name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended by the student.
3 Pursuant to 34 CFR Part 99.3, "Personally Identifiable Information" includes, but is not limited to:
(a) The student's name;
(b) The name of the student's parent or other family members;
(c) The address of the student or student's family;
(d) A personal identifier, such as the student's social security number, student number, or biometric record;
(e) Other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name;
(f) Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or
(g) Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates .
(Emphasis added.)
4 More specifically, § 1232g(a)(1)(A), the "exception" to the exception, provides:
No funds shall be made available under any applicable program to any educational agency or institution which has a policy of denying, or which effectively prevents, the parents of students who are or have been in attendance at a school of such agency or at such institution, as the case may be, the right to inspect and review the education records of their children.. . . Each educational agency or institution shall establish appropriate procedures for the granting of a request by parents for access to the education records of their children within a reasonable period of time, but in no case more than forty-five days after the request has been made.
Conversely, § 1232g(b)(1) provides:
No funds shall be made available under any applicable program to any educational agency or institution which has a policy or practice of permitting the release of education records (or personally identifiable information contained therein other than directory information, as defined in paragraph (5) of subsection (1) of this section) of students without the written consent of their parents to any individual, agency, or organization, other than to [specified individuals under specified conditions listed at (b)(1)(A)-(J)].