Opinion
Opinion By: Daniel Cameron,Attorney General;Michelle D. Harrison,Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the University violated the Act in denying Courier-Journal reporter Tim Sullivan's ("Appellant") September 19, 2019, request for a copy of the following:
1) Any and all correspondence received by [Athletic Director Mitch] Barnhart from [Heather] Kirk since [January] 1, 2018, and any response he or any other University of Kentucky staff or attorneys have provided.
2) Any correspondence, complaints, memoranda or internal reports concerning the conduct of University of Kentucky football player Kash Daniel since his enrollment at the [U]niversity.
In addition to his request, Appellant explained that he was "in possession of an e-mail ostensibly sent by Heather Kirk to [A]thletics [D]irector Mitch Barnhart on Thursday, Sep. 19" and stated that he wanted "to verify its authenticity and obtain a copy of any response Mr. Barnhart provides."
In accordance with KRS 61.880(1), the Official Records Custodian issued the following written response on behalf of the University within three working days of receipt:
To the extent the University has the records you seek, the records are exempt under the personal privacy exemption KRS 61.878(1)(a) as well as the federal law exemption KRS 61.878(1)(k) and (l), and their disclosure is prohibited by the Commonwealth Constitution. First, because the records directly relate to a student, they are education records under the federal Family Educational Rights and Privacy Act [("FERPA")]. Since the University had reason to believe you know the identity of the student, federal regulations prohibit the disclosure of education records even with redactions. Second, all of the records fall within the statutory personal privacy exemption. Third, all of the records are protected by the state constitutional right of privacy and, thus, the Commonwealth Constitution prohibits their disclosure. Fourth, all of the records are protected by the federal constitutional right of privacy and, thus, fall within the federal law exemption.
This appeal followed.
First, Appellant claimed the University's refusal to confirm or deny whether it possessed any responsive documents violated KRS 61.880(1). Second, Appellant disputed the University's position "that the requested record is an 'education record' under FERPA simply because it relates to a student." Appellant "had reason to believe" the subject e-mail "does not concern a student's educational record in any way, and therefore should not be considered an education record." Third, Appellant challenged the University's failure to cite a statutory exception, as required by KRS 61.880(1), or any case law in support of its "overbroad claims of constitutional privacy interests." 1In summary, Appellant complained the University's "overbroad objections have prevented me from even learning if responsive records exist and, if so," further prevented him from learning their content (even with redactions).
In response, the University first reiterated that it had reason to believe -- as the request plainly confirmed -- the Courier-Journal "already knew the identity of the student (Daniel) whom any responsive records might concern, and as such, the privacy problems implicated by [its] request could not be cured by redaction." The University maintained that FERPA prohibits disclosure of the records in their entirety, but even if FERPA did not apply, the records would still be protected from disclosure pursuant to KRS 61.878(1)(a), (k), and (l). In this particular case, the University argued, "identifying or confirming the existence of responsive records would be tantamount to disclosing information about Daniel in which he clearly has a legally-protected privacy interest."
Based upon the following, this Office finds that FERPA is controlling on the facts presented. The records in dispute are "education records" within the meaning of 20 U.S.C. § 1232g(a)(4), and thus are protected from disclosure under FERPA. Likewise, due to the unique manner in which this request was presented, FERPA and the corresponding regulations prohibit the University from confirming or denying whether it possesses any responsive documents.
Quoting extensively from 18-ORD-168, and citing 08-ORD-052 and 12-ORD-220, the University asserted that FERPA extends to "and prohibits disclosure of records concerning student government officers and, of particular relevance to this case, records about student athletes." Because Appellant sought records "maintained by the University concerning Daniel from the time he was enrolled there[,]" the University concluded that FERPA applies. The University acknowledged that redaction of education records can sometimes anonymize the records adequately to permit disclosure. However, in some cases, including this one, redaction cannot suffice. If any person requests a record that is directly related to a student, and the University has reason to believe the requester knows the student's identity, as in this case, FERPA prohibits disclosure of the entire record. Under the circumstances presented here, the University was correct in stating that "redaction becomes a futile exercise and the end result is the University must withhold those records [if they exist] in their entirety in order to protect Daniel's privacy rights and comply with federal law."
In disputing Appellant's claim regarding the University's obligation to confirm or deny whether it possessed any responsive documents, the University argued that such a disclosure would have "substantive implications contrary to the privacy rights addressed." Because Appellant "purports to have an email from Kirk" and his request indicates that the e-mail "discusses or infers certain alleged conduct by Daniel," the University argued that confirming or identifying responsive documents "would be tantamount to disclosing, confirming, or denying" that Daniel was alleged to have engaged in the conduct while enrolled as a student. Although disclosure of such information, viewed in isolation, "would strike some as benign," the University maintained that such disclosure on these facts would violate FERPA by enabling the requester to connect an identifiable student to a particular situation.
On appeal, this Office asked the University to answer questions to further support its reasoning. The University answered the questions by letter dated February 19, 2020. Quoting the definition of "education records," the University reiterated that, "[b]y its own terms, the Courier-Journal's September 19, 2019, request seeks records related to alleged misconduct by a specific student" while he was enrolled at the University. Accordingly, if any such records exist in the possession of the University, those records would fall squarely within the definition of "education records." The University argued that in this case, the subject e-mail -- insofar as it may exist -- "would be an 'education record' for Daniel even though a private individual outside of the University may have authored it" because it would have been received by an employee acting on the University's behalf and it would directly relate to Daniel. While others, including the author "may be at liberty to disclose their copy of that e-mail" to the Courier-Journal , "the University is not."
The University further argued that confirming or denying the existence of any responsive documents would constitute a "disclosure" of personally identifiable information regarding an identifiable student contrary to FERPA. 34 C.F.R. § 99.3. In support of its position that even confirming the existence of such records would also constitute a "disclosure" prohibited by FERPA, the University noted that 34 C.F.R. § 99.3 defines a "disclosure" to include "the release, transfer, or other communication of personally identifiable information contained in education records by any means ." If the University acknowledged that it may possess any responsive documents, it would "necessarily implicate and address alleged misconduct of Daniel during his enrollment at the University." Thus, identifying or confirming such records exist would amount to, as the University said:
[D]isclosing the fact (assuming for argument's sake it is true) that Daniel has been accused of misconduct and possibly subject to disciplinary proceedings during his enrollment related to those accusations. FERPA plainly prohibits the disclosure of such records in connection with an identifiable student -- see United State v. Miami Univ. , 294 F.3d 797 (6th Cir. 2002) -- and in this case, confirmation of those records' existence would constitute such a disclosure.
Citing 18-ORD-168, the University noted this Office has recognized that production of seemingly innocuous information, depending on the context, may constitute a disclosure that FERPA prohibits.
KRS 61.878(1)(k) exempts from disclosure "[p]ublic records or information the disclosure of which is prohibited by federal law or regulation." Both FERPA, and the implementing regulations codified at 34 C.F.R. § 99 et seq. , are incorporated into the Act by the express language of KRS 61.878(1)(k). FERPA regulates access to "education records," which 20 U.S.C. § 1232g(a)(4)(A) defines as "those records, files, documents, and other materials which--(i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution." With the exception of narrowly defined categories of records identified at 20 U.S.C. § 1232g(4)(B)(i)-(iv), which are not relevant here, the term is expansively construed to include all information, in whatever form, which satisfies this two-part test. See e.g.
United States v. Miami University , 294 F.3d 797, 812 (6th Cir. 2002)("Notably, Congress made no content-based judgments with regard to its 'education records' definition.");
Belanger v. Nashua, New Hampshire Sch. Dist. , 856 F.Supp. 40, 49 (D.N.H. 1994)("congressional intent was to fashion a broad definition.").
The Kentucky Court of Appeals has recognized that FERPA operates to bar the public disclosure of education records, as that term is defined in federal law, and that FERPA is incorporated into the Act by KRS 61.878(1)(k).
Hardin Cnty. Schools v. Foster , 40 S.W.3d 865 (Ky. 2001);
Medley v. Bd. of Educ. of Shelby Cnty. , 168 S.W.3d 398 (Ky. App. 2004); 20-ORD-001. More specifically, FERPA precludes the public disclosure of personally identifiable student information 2to third parties, like Appellant, in the absence of prior written consent from a parent or eligible student.
It is facially evident that any "correspondence, complaints, memoranda or internal reports concerning the conduct of University of Kentucky football player Kash Daniel since his enrollment at the [U]niversity" directly relate to an identifiable student, namely, Kash Daniel. Therefore, any responsive documents are properly characterized as "education records" protected from disclosure under FERPA. This Office was recently asked to determine if Western Kentucky University violated the Act in denying a request for any records or correspondence from several WKU departments "with any reference to" four named students. After concluding that any existing responsive "academic records, athletic records, and disciplinary records" constituted "education records" under FERPA, this Office noted that FERPA also prohibits the release of "education records" where the "personally identifiable information" contained therein, "alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty." See 34 C.F.R. § 99.3(f). 20-ORD-001, p. 4. Here, as in 20-ORD-001, "[e]ven if the name[ ] and information of the student [was] redacted, they would still be linkable to [a] specific student[ ] because of the specific nature of Appellant's request. See 34 C.F.R. § 99.3(f)." 20-ORD-001, p. 5. Accordingly, FERPA prohibits the University from disclosing any existing documents responsive to item 2 of the request.
Item 1 of the request presents a closer question because Appellant did not specifically reference Kash Daniel, but instead asked for "[a]ny and all correspondence received by [Athletic Director Mitch] Barnhart from [Heather] Kirk since [January] 1, 2018, and any response he or any other University of Kentucky staff or attorneys have provided." However, item 1 must be reviewed in context. In 18-ORD-168, this Office was asked to determine whether a public school district violated the Act in denying a request for all open enrollment acceptance letters and letters denying requests for open enrollment sent to parents or guardians of students in grades 6-8 for the 2018-2019 school year, in addition to a copy of any enrollment documents completed by identified school board members and their student relatives. The district first noted that open enrollment letters and the open enrollment list qualified as "education records," the disclosure of which is prohibited by FERPA. 20 U.S.C. § 1232g; 34 C.F.R. § 99.3. "The names, addresses, and schools of each parent and student contained in those records are not merely 'directory information,'" the district stated, "because, when produced in connection with the open enrollment records and information [the requester] seeks, they become much more than that." 18-ORD-168, p. 2. Because the requester already knew the specific families and students involved, this Office concluded that disclosure of any responsive documents to him would constitute production of "personally identifiable information" of those students, contrary to FERPA. This Office reaches the same conclusion here.
The following excerpt from 18-ORD-168 is equally persuasive in this appeal:
The definition of "personally identifiable information" found at 34 C.F.R. Part 99.3 includes, among other things, "information that, alone or in combination, is linked or linkable to a specific student" and information requested by a person, such as [the requester], the District "reasonably believes knows the identity of the student to whom the education record relates." The District correctly noted that the personally identifiable nature of the records in dispute is "compounded by the fact that [the requester] already knows the students (or students' families) to whom the records relate." FERPA prohibits the public disclosure of such information regarding a student. However, FERPA also expressly provides that an entire record constitutes "personally identifiable information," . . . when, as in this case, "a school district [or any public agency] has a good faith reason to believe the requester already knows the identity of the student or students to whom the records relate." See C.F.R. 99.3. Redaction is futile under these facts.
18-ORD-168, pp. 7-8. Although redaction of "personally identifiable information" contained in any documents responsive to item 1 of the request may be possible in a generic sense, the information would still be "linked or linkable to a specific student" when viewed in the overall context of this request, and redaction would thus be equally futile in this case. As in 20-ORD-001 and 18-ORD-168, the University has a "good faith reason to believe the requester already knows the identity of the student" to whom the records would relate. Thus, FERPA also bars disclosure of any existing documents responsive to item 1 of the request.
The final issue presented in this appeal is whether the University violated the Act in refusing to confirm or deny the existence of responsive records. Ordinarily, to satisfy its burden under KRS 61.880(2)(c) and justify its denial based on the nonexistence of certain records, a public agency must offer a written explanation for the nonexistence of the records if appropriate. See
Eplion v. Burchett , 354 S.W.3d 598, 604 (Ky. App. 2011). "The language of the [KRS 61.880(1)] directing agency action is exact. It requires the custodian of records to provide particular and detailed information in response to a request for documents."
Edmondson v. Alig , 926 S.W.2d 856, 858 (Ky. App. 1996). A "limited and perfunctory response [does not] even remotely compl[y] with the requirements of the Act-much less [amount] to substantial compliance." Id . Thus, in addressing the obligations of a public agency denying access to public records based upon their nonexistence, this Office has consistently observed that a public agency's "inability to produce records due to their apparent nonexistence is tantamount to a denial and . . . it is incumbent on the agency to so state in clear and direct terms ." 01-ORD-38, p. 9 (internal citations omitted). While it is obvious that a public agency "cannot furnish that which it does not have or which does not exist, a written response that does not clearly so state is deficient." 02-ORD-144, p. 3. The holding of this decision should not be construed as departing from this line of authority. However, the plain text of KRS 61.878(1)(k) states that both "public records or information " prohibited by federal law from being disclosed are exempt. Confirming or denying the existence of any responsive documents, under the unique circumstances presented in this appeal, would constitute a "disclosure" of personally identifiable information directly related to an identifiable student -- Kash Daniel -- within the meaning of both 34 C.F.R. 99.3 and KRS 61.878(1)(k).
This Office finds 13-ORD-127 sufficiently analogous to be instructive on this question. In that case, 502 KAR 30:060, the applicable regulation, prohibited the public agency from giving "any substantive response to a request about CHRI [Criminal History Record Information] from a person who is not entitled to obtain NCIC [National Crime Information Center] records." 13-ORD-127, p. 5. This Office held that "since both 'records' and 'information' are covered by the applicable law," the agency could "limit the public's access to records which would disclose information contained in NCIC." 13-ORD-127, p. 6. The agency, like the University in this case, was prevented by the applicable regulation "from confirming the existence or nonexistence of [the record in dispute] by stating whether records existed" containing the protected information. 13-ORD-127, pp. 7-8. Accordingly, this Office affirms the University's denial of Appellant's request.
Either party may appeal this decision may appeal by initiating action in the appropriate circuit court per KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General shall be notified of any action in circuit court, but shall not be named as a party in that action or in any subsequent proceeding.
Footnotes
Footnotes
1 Because the Attorney General's review under KRS 61.880(2)(a) is restricted to deciding "whether the agency violated provisions of KRS 61.870 to 61.884," and FERPA is controlling here, this Office respectfully declines to review these constitutional issues.
2 Pursuant to 34 CFR Part 99.3, "Personally Identifiable Information" includes, but is not limited to:
(a) The student's name;
(b) The name of the student's parent or other family members;
(c) The address of the student or student's family;
(d) A personal identifier, such as the student's social security number, student number, or biometric record;
(e) Other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name;
(f) Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or
(g) Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates . (emphasis added.)