August 23, 2006
The staff of the Committee on Open Government is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the facts presented in your correspondence, unless otherwise indicated.
As you are aware, I have received your letter in which you seek an advisory opinion concerning the propriety of a denial of your request for the data maintained by the State Education Department in its Impartial Hearing Reporting System. Based on printouts from screens displaying the data contained in the system, they include the name of a school district, a case identifier that appears to relate to a particular student, a district code, case type, student classification, the name and contact information pertaining to a district representative, and dates and other notations relating to the progress or status of a hearing. The names of students are not included.
The Department denied both your initial request and your appeal, citing three of the exceptions to rights of access appearing in the Freedom of Information Law. In brief, that statute is based upon a presumption of access. Stated differently, all records of an agency are available, except to the extent that records or portions thereof fall within one or more grounds for denial appearing in §87(2)(a) through (i) of the Law. The three exceptions upon which the Department relied are §87(2)(a), (b), and (i).
Paragraphs (a) and (b) of §87(2) respectively authorize an agency to withhold records that are "specifically exempted from disclosure by state or federal statute" and when disclosure would constitute "an unwarranted invasion of personal privacy." The statute cited by the Department as a basis for denying access is the federal Family Educational Rights and Privacy Act ("FERPA"; 20 USC §1232g). The focus of FERPA is the protection of privacy of students and it provides, in general, that any "education record," a term that is broadly defined, that is personally identifiable to a particular student or students is confidential, unless the parents of students under the age of eighteen waive their right to confidentiality, or unless a student eighteen years or over similarly waives his or her right to confidentiality. The federal regulations promulgated under FERPA define the phrase "personally identifiable information" to include:
"(a)The student's name;
(b)The name of the student's parents or
other family member;
(c)The address of the student or student's family;
(d)A personal identifier, such as the student's social security number or student number;
(e)A list of personal characteristics that would make the student's identity easily traceable; or
(f)Other information that would make the student's identity easily traceable" (34 CFR Section 99.3).
Based upon the foregoing, references to students' names or other aspects of records that would make a student's identity "easily traceable" must in my view be withheld from the public in order to comply with federal law.
Even if FERPA had not been enacted, I believe that personally identifiable information relating to students, particularly those with disabilities, could be withheld under §87(2)(b) on the ground that disclosure would result in an unwarranted invasion of students’ privacy.
The Department has contended that "a release of documents containing the information requested by petitioner (school district names, dates, case types, issues the hearing dealt with, recusal information, etc.) would contain information that could make a student’s identity easily traceable." Based on a review of copies of printouts of forms that I believe are used by school districts and the Department, it would appear that only one item, one field in the database, might make a student’s identity "easily traceable", and even with the inclusion of that item, the likelihood of identifying a student would in most instances appear to be remote.
The printouts include the name of the school district, but not a specific school within the district. There is a "case identifier", which appears to relate to a particular student. However, the two printouts made available to me from a single district identify cases as 4183 and 19110. Disclosure of those numbers alone clearly would not, in my opinion, make a student’s identity easily traceable. Other items involve the progression of a hearing, such "pendency order date", "pendency placement", "pendency appealed", "transcript sent out date", "decision received by SED date", "case closed type" (i.e., "settlement/withdrawn"), and entries regarding a school district’s "rep.". From my perspective, disclosure of those and other items would not, if disclosed, render a student’s identity easily traceable.
In a case involving similar considerations, New York Times Company v. New York State Department of Health, 674 NYS2d 826, 243 AD2d 157 (1998), the issue involved a request for health care data and the ability to withhold certain items on the ground that disclosure would constitute an unwarranted invasion of personal privacy. To the extent that the data would be personally identifiable to patients, the Department of Health would have the ability to deny access. Pursuant to its regulations, the Department granted access to a variety of items, but withheld data pertaining to treating physicians, hospitals and insurers. Following the initiation of a proceeding challenging the denial of access to those items, the Department agreed to release the names of hospitals and insurers. Nevertheless, it continued to withhold the names of physicians. The Supreme Court in its review of the denial "expressly rejected [the Department’s] argument that the disclosure of:
"...physician identifiers, even when such information was used in combination with other disclosable data, would lead to the identification of patients and, hence, would constitute an unwarranted invasion of personal privacy" (id., 828).
The Appellate Division later unanimously affirmed the applicant’s right to the physician identifiers. Referring to the Freedom of Information Law’s presumption of access, the Court determined that:
"It is well settled that all records of a public agency are presumptively available for public inspection and copying, unless the documents in question fall within one of the enumerated exemptions set forth in Public Officers Law § 87(2) (see, Matter of Capital Newspapers Div. of Hearst Corp. v. Burns, 67 N.Y.2d 562, 566, 505 N.Y.S.2d 576, 496 N.E.2d 665). To that end, ‘FOIL is to be liberally construed and its exemptions narrowly interpreted so that the public is granted maximum access to the records of government’ (Matter of Capital Newspapers, Div. of Hearst Corp. v. Whalen, 69 N.Y.2d 246, 252, 513 N.Y.S.2d 367, 505 N.E.2d 932). In this regard, the agency seeking to prevent disclosure bears the burden of demonstrating that the requested material falls squarely within the particular exemption claimed ‘by articulating a particularized and specific justification for denying access’ (Matter of Capital Newspapers Div. of Hearst Corp. v. Burns, supra, at 566, 505 N.Y.S.2d 576, 496 N.E.2d 665; see, Matter of Ruberti, Girvin & Ferlazzo v. New York State Div. of State Police, 218 A.D.2d 494, 496-497, 641 N.Y.S.2d 411; Matter of Legal Aid Socy. of Northeastern N.Y. v. New York State Dept. of Social Servs., 195 A.D.2d 150, 153, 605 N.Y.S.2d 785). This respondent has failed to do."
In finding that the Department could not demonstrate that disclosure would enable the public to identify patients, the Court stated that the Department:
"...would have the court believe...that...providing the identity of the patient’s physician is the one additional factor that ‘could readily permit a third party to deduce logically the identity of a given patient, resulting in a breach of medical confidentiality’. In our view, such speculation falls far short of ‘articulating a particularized and specific justification for denying access’" (id.).
The Court emphasized that other data is routinely disclosed including:
"...the patient’s gender, race and ethnicity; the month and year of the patient’s admission, the month and year of the patient’s discharge; the patient’s length of stay; the patient’s number of preoperative days; the patient’s number of postoperative days; the class of payor; the census tract location of the patient; the age of the patient or one-year intervals for patients one year old or older; the age of the patient at one-week intervals for patients less than one year old; the physician specialty; the number of attending physicians; the presence or absence of an accident; and the facility reimbursement peer group..." (id.).
The one item that might render a student’s identity easily traceable would be the "Student Classification", and the Department has forwarded a list of student classifications. Several are quite broad, such as "autism", "emotional disturbance", and "learning disability". In those instances, because there are hundreds or perhaps thousands of students who attend a particular school district, I do not believe that disclosure would make a student’s identity easily traceable. However, other classifications indicate somewhat unique characteristics, such as "deaf-blindness", "deafness" and "traumatic brain injury." I would conjecture that in some circumstances, the characterization of a student as deaf or blind on a record could make the student’s identity easily traceable.
If the classifications cannot be segregated electronically, due to the possibility that some could, if disclosed, enable a student’s identity to be easily traceable, I believe that Department would have the authority to delete the "student classifications" field from the database. The remainder, however, would in my opinion be accessible. Absent that field, it does not appear that disclosure of the other items would, if disclosed, make a student’s identity easily traceable or, therefore, result in an unwarranted invasion of personal privacy. I note that there is judicial precedent indicating that when an agency has the ability to electronically delete certain data from a record, or conversely, extract data from a record containing both accessible and deniable items, it is required to do so [New York Public Interest Research Group v. Cohen, 729 NYS2d 379 (2001)].
The remaining exception to rights of access cited by the Department, §87(2)(i) authorizes an agency to withhold records which:
"if disclosed, would jeopardize an agency’s capacity to guarantee the security of information technology assets, such assets encompassing both electronic information systems and infrastructures."
It is my understanding that you are not seeking a means of gaining entry into a database by obtaining a password or similar mechanism that would enable you to gain remote access to or alter its content. Rather, I believe that you have requested a copy of the content of a database at a particular moment in time, a snapshot or duplicate of the data that you can analyze independently, but that you cannot change. If my understanding is accurate, I do not believe that §87(2)(i) would serve as a basis for denying access.
In sum, I believe that a duplicate of the Impartial Hearing System data that you have requested must be disclosed, and that the only element or field within the database that might justifiably be withheld is the field involving "Student Classification." Again, that would be so only if it can be demonstrated that the information within that field would render a student’s identity easily traceable.
In an effort to resolve the matter, copies of this opinion will be sent to officials at the State Education Department.
I hope that I have been of assistance.
Robert J. Freeman
cc: Kathy Ahearn
Robert P. Waxman