West Chester Univ. of PA v. A. Rodriguez

IN THE COMMONWEALTH COURT OF PENNSYLVANIA

West Chester University : of Pennsylvania, : Petitioner : : v. : No. 1078 C.D. 2018 : Submitted: February 22, 2019 Adrian Rodriguez, : Respondent :

BEFORE: HONORABLE P. KEVIN BROBSON, Judge HONORABLE ANNE E. COVEY, Judge HONORABLE CHRISTINE FIZZANO CANNON, Judge

OPINION BY JUDGE BROBSON FILED: July 24, 2019

West Chester University of Pennsylvania (the University) petitions for review of the July 12, 2018 final determination (Final Determination) of the Pennsylvania Office of Open Records (OOR) under the Right-to-Know Law (RTKL).1 In the Final Determination, the OOR granted the appeal of Adrian Rodriguez (Respondent)2 and directed the University to provide Respondent with all responsive records pursuant to Respondent’s RTKL request. For the reasons that follow, we will vacate the Final Determination and remand this matter to the OOR for further proceedings.

1 Act of February 14, 2008, P.L. 6, 65 P.S. §§ 67.101-.3104. 2 By order dated February 21, 2019, this Court precluded Respondent from filing a brief for failure to conform to this Court’s earlier order directing Respondent to do so. Respondent is not represented by counsel on appeal.

I. BACKGROUND On January 17, 2018, Respondent filed a RTKL request with the University seeking the following records: [E]mails from the Office of Student Conduct from [January 1, 2017] to [January 17, 2018] from Christina Brenner, Shelly Siedzikowski, and Dawn Welch that pertain to:

- Adrian Rodriguez, [student ]ID # . . .[3] - Office of Student Conduct Case ID # . . . - Computer Science Club

. . . [E]mails from the Computer Science department from [January 1, 2017] to [January 17, 2018] from Dr. Richard Burns, Dr. James Fabrey, and Dr. Si Chen pertaining to:

- Adrian Rodriguez, SID # . . . - Office of Student Conduct Case ID # . . . - Computer Science Club

(Reproduced Record (R.R.) at 10a.) On February 23, 2018, the University provided 50 pages of the requested emails to Respondent and denied access to the remaining responsive emails. In its accompanying response, the University claimed that the emails it did not provide—totaling approximately 500 pages—are exempt from RTKL disclosure because they are protected by the statute commonly known as the Family Educational Rights and Privacy Act (FERPA).4 The University’s response also informed Respondent that, with respect to the withheld records, it would consider the RTKL request as a request to review Respondent’s own education records pursuant to FERPA.

3 For privacy reasons, we have removed the student identification and student conduct case numbers associated with Respondent. 4 20 U.S.C. § 1232g.

Respondent appealed the University’s action to the OOR on March 5, 2018. In mid-April of 2018, during the appeal proceeding, the University provided Respondent with the remaining pages of responsive records it had withheld, after partially or wholly redacting some of those pages to remove personally identifiable information (PII) of students other than Respondent.5 In its submission of argument to the OOR, the University claimed that it provided the second set of pages pursuant to FERPA (and not the RTKL), which should render moot Respondent’s appeal to the OOR. The University also argued that any responsive records beyond the first 50 pages provided to Respondent are education records under FERPA and are, therefore, exempt from disclosure under the RTKL. In the Final Determination granting Respondent’s appeal, the OOR concluded that the approximately 500 pages of emails the University had initially withheld are not education records under FERPA because the records are (1) not academic records, and (2) not kept in the central, permanent file of any student. Accordingly, the OOR, considering the University’s position that the records are protected under the RTKL as a result of their status as education records under FERPA, concluded that the records are not exempt from disclosure under the RTKL. The OOR directed the University to provide them to Respondent, and the University petitioned this Court for review.

5 Of the approximately 500 pages the University initially withheld and later provided, the University claims that 80 pages were partially or fully redacted to protect the PII of students other than Respondent. The record in this matter establishes, however, that the University fully redacted 77 pages and partially redacted some of the approximately 420 remaining pages. (R.R. at 40a.)

II. ISSUES On appeal,6 the University argues that the OOR erred in determining that the requested records are not education records under FERPA. Specifically, the University asserts that the OOR erred in concluding that: (1) the records are not education records because they do not directly relate to a student, and (2) the records are not education records because they are not maintained in the permanent file of any University student. The University claims that the records in question both directly relate to students and are maintained by the University, making them education records that are exempt from RTKL disclosure. The University also argues that, even if the records are not protected by FERPA, the OOR cannot order their disclosure without first following procedures required to protect student privacy interests in the requested records under the Pennsylvania Constitution. III. DISCUSSION A. RTKL and FERPA Section 708(b)(1)(i) of the RTKL, 65 P.S. § 67.708(b)(1)(i), provides: (b) Exceptions.—Except as provided in subsections (c) and (d), the following are exempt from access by a requester under this act: (1) A record, the disclosure of which: (i) would result in the loss of Federal or State funds by an agency . . . .

Section 1232g(b)(1) of FERPA, 20 U.S.C. § 1232g(b)(1), is also relevant to our analysis and provides, in part: No funds shall be made available under any applicable program to any educational agency or institution which has a policy or practice of permitting the

6 On appeal from the OOR in RTKL cases, this Court’s standard of review is de novo and our scope of review is plenary. Bowling v. Office of Open Records, 75 A.3d 453, 477 (Pa. 2013).

release of education records (or personally identifiable information contained therein . . . ) of students without . . . written consent . . . .

(Emphasis added.) For records which are responsive to a RTKL request but are withheld pursuant to a statutory exception to disclosure, Section 708(a)(1) of the RTKL, 65 P.S. § 67.708(a)(1), requires a Commonwealth agency to prove the elements of the statutory exception by a preponderance of the evidence. Here, the University argues that the 500 pages it initially withheld are exempt from RTKL access pursuant to Section 708(b)(1)(i) of the RTKL because they are education records under FERPA, the unauthorized disclosure of which would endanger the University’s receipt of federal funding. Section 1232g(b)(1) of FERPA protects “education records” and “personally identifiable information contained [in education records].” FERPA defines “education records” as records that (1) “contain information directly related to a student,” and (2) are “maintained by an educational agency or institution.” 20 U.S.C. § 1232g(a)(4)(A). Both components of this definition are at issue in this case. In order to contain information directly related to a student, a record need not concern any particular subject matter, such as academics or discipline. See Easton Area Sch. Dist. v. Miller, 191 A.3d 75, 81-82 (Pa. Cmwlth. 2018) (“Congress made no content-based judgments with regard to its ‘education records’ definition.” (quoting Ellis v. Cleveland Mun. Sch. Dist., 309 F. Supp. 2d 1019, 1022 (N.D. Ohio 2004))), appeal granted, 201 A.3d 721 (Pa. 2019). The agency must establish that the information in the record relates directly, as opposed to tangentially or incidentally, to a student. Cent. Dauphin Sch. Dist. v. Hawkins, 199 A.3d 1005, 1013-14 (Pa. Cmwlth. 2018) (Central Dauphin). For example, in cases involving

surveillance videos that captured images of students, we have held that the videos did not directly relate to students because students were shown only incidentally in the videos, which were ultimately used in proceedings against teachers or parents and not shown to have implications for the students depicted. See id.; Easton Area, 191 A.3d at 82. Contrary to the University’s apparent position, it is not enough that the requested records “involve a disciplinary matter,” “involve students’ activities,” “pertain to . . . individual students,” or contain “students’ names and other information.[7]” (Br. of Petitioner at 11-17 (emphasis added).) Rather, the institution must show that the record contains information related directly (not incidentally) to a student. Records directly relating to students must also be “maintained by” an educational institution in order to constitute education records. Courts have interpreted this statutory provision to require more than bare possession by the institution. In Owasso Independent School District No. I-011 v. Falvo, 534 U.S. 426 (2002), the United States Supreme Court held that assignments graded by students in the classroom were not maintained by the educational institution because they were not treated like typical education records kept in a central file with restricted, monitored access. In so concluding, the Court reasoned: FERPA requires “a record” of access for each pupil. This single record must be kept “with the education records.” This suggests Congress contemplated that education records would be kept in one place with a single record of

7 The University is correct that FERPA requires protection of PII. But that term is “used in [FERPA] and [associated] regulations to describe the kind of information from education records that may not be disclosed without consent.” Family Educational Rights and Privacy, 73 Fed. Reg. 74,805, 74,811 (Dec. 9, 2008) (emphasis added). The University may not, therefore, use FERPA as a justification for redactions authorized by Section 706 of the RTKL, 65 P.S. § 67.706, unless it shows that FERPA restricts access to some education record in which the redacted information is contained.

access. By describing a “school official” and “his assistants” as the personnel responsible for the custody of the records, FERPA implies that education records are institutional records kept by a single central custodian, such as a registrar, not individual assignments handled by many student graders in their separate classrooms.

Owasso, 534 U.S. at 434–35 (quoting 20 U.S.C. § 1232g(b)(4)(A)). This Court has held that the reasoning in Owasso applies regardless of the medium of the record at issue: While Owasso concerned student papers . . . , the Supreme Court’s interpretation of what constitutes “maintenance” of an education record is binding in every context. The Supreme Court explained that because the school did not have a maintenance protocol for peer-reviewed student papers, this supported its conclusion that these papers were not education records.

Central Dauphin, 199 A.3d at 1015. In Central Dauphin, we emphasized that FERPA requires institutions to follow certain maintenance procedures for education records (as opposed to records in general), including logging requests for access. Id. We then concluded that the school bus surveillance video at issue in that case was not maintained by the institution because the school district had no systematic maintenance protocols for school bus videos and did not intend to retain the video for any predetermined amount of time. Id. Although we find no mandatory authority addressing this issue in the context of emails, several courts have persuasively relied upon Owasso to conclude that emails stored in an ordinary manner are not, without more, maintained by the institution. See E.D. v. Colonial Sch. Dist. (E.D. Pa., No. CV 09-4837, Mar. 31, 2017), slip op. at 10 (“Unless [the institution] kept copies of e[]mails related to [a student] as part of its record filing system with the intention of maintaining them, we cannot reach the conclusion that every e[]mail which mentions

[the student] is a bona fide education record within the statutory definition.”); S.A. v. Tulare Cty. Office of Educ. (E.D. Cal., No. CVF 08-1215 LJO GSA, Sept. 24, 2009), slip op. at 4 (“[E]mails that identify [a s]tudent, whether in individual inboxes or the retrievable electronic database, are [not] maintained ‘in the same way the registrar maintains a student’s folder in a permanent file.’” (quoting Owasso, 534 U.S. at 433)).8 As the University admits, emails stored in the ordinary manner may be “deleted within moments” of their transmission, (Br. of Petitioner at 27), suggesting that some emails in the University’s possession—perhaps including some of the requested emails—are not “maintained” as education records. Turning to the instant case, however, we agree with the University that the OOR applied incorrect standards with respect to both elements of FERPA’s education records definition. First, the OOR stated that “only those records relating to student academics are ‘education records,’” suggesting that the potential nonacademic nature of some of the requested emails deprives them of FERPA protection. (Br. of Petitioner, Appendix A at 5-6.) As this Court has made clear, however, the appropriate inquiry is whether the record—regardless of its subject matter—directly relates to a student other than Respondent.9 Second, the OOR concluded that “[b]ecause the University has not proven that the requested emails

8 The University points out that Owasso, which did not address email records directly, was decided in 2002, when the use of email was less widespread than it is today. On that basis, the University urges us not to rely upon cases applying Owasso’s “obsolete” reasoning in the modern email context. (Br. of Petitioner at 26-31.) As we have discussed, however, this Court’s recent decisions are clear enough: regardless of the technological context, FERPA education records must be subject to some kind of maintenance protocol beyond mere possession, including logging requests for access. See Central Dauphin, 199 A.3d 1015. 9 Disclosure of a student’s own education records upon that student’s written request (such as in a RTKL request) is not prohibited by FERPA, and such records are, thus, not exempt from RTKL disclosure. Accordingly, the relevant question is whether the requested records contain information directly related to students other than Respondent.

were kept in the permanent file of . . . any . . . student[], the requested emails are not education records.” (Id. at 8.) That inquiry is, like the first, overly narrow. Education records must be maintained in some way that preserves them and tracks requests for access to them, but placement within a single student’s permanent file is not the only action that could constitute such maintenance. OOR’s restrictive view of the education records definition did not benefit from the two decisions on which we rely most heavily here—Easton Area, 191 A.3d 75, and Central Dauphin, 199 A.3d 1005—which we issued after the date of the Final Determination. Accordingly, because the OOR’s analysis of the critical FERPA issue was misdirected and lacked the conceptual clarity we provided in Easton Area and Central Dauphin, we will vacate the Final Determination and remand this matter to the OOR for analysis of the FERPA issue as discussed in those cases and this opinion. B. Constitutional Privacy Interests The University also argues that, regardless of whether FERPA precludes disclosure of the requested records, the OOR erred in directing their release without following the procedures required for protecting student privacy interests. The University claims that, because the requested records contain information in which students have a reasonable expectation of privacy—i.e., their names, extracurricular activities, and private email conversations—the OOR cannot order their release without first performing a balancing analysis of the relevant privacy interests. Accordingly, the University asks that we reverse the Final Determination and remand this matter to the OOR so that it can conduct the required balancing test.

In so arguing, the University cites decisions of this Court and the Pennsylvania Supreme Court requiring agencies to weigh, prior to RTKL disclosure, the public interest in disclosure against privacy interests grounded in Article 1, Section 1 of the Pennsylvania Constitution. Specifically, our Supreme Court has held that Article 1, Section 1 of the Pennsylvania Constitution guarantees a right to informational privacy. See Pa. State Educ. Ass’n v. Office of Open Records, 148 A.3d 142, 158 (Pa. 2016) (PSEA III). The PSEA III decision reaffirmed prior cases that “recognized a right to privacy inuring in three types of identifiers: Social Security numbers, telephone numbers and home addresses.” Butler Area Sch. Dist. v. Pennsylvanians for Union Reform, 172 A.3d 1173, 1181 (Pa. Cmwlth. 2017). When a right to privacy is implicated, “a balancing test [is] required to determine whether the right to privacy outweigh[s] the public’s interest in dissemination.” State Emp. Ret. Sys. v. Campbell, 155 A.3d 1153, 1155 (Pa. Cmwlth. 2017). When the privacy right attaches to particular personal information, it “exists independent of the exemptions found in the RTKL.” Dep’t of Human Servs. v. Pennsylvanians for Union Reform, Inc., 154 A.3d 431, 437 (Pa. Cmwlth. 2017) (PFUR). Notably, the constitutional right to informational privacy inheres not in agencies, but in individuals who are not usually parties to the RTKL proceeding. The RTKL does not require that such third parties receive notice that a determination affecting their constitutional rights has been appealed.10 Allegheny Cty. Dep’t of

10 There are limited exceptions. “This Court recognizes a due process right to be heard extended to third parties in two distinct scenarios: (1) individuals’ home addresses under the personal security exception, [65 P.S. § 67.]708(b)(1)(ii); and, (2) proprietary or trade secret information under the trade secrets exception, [65 P.S. § 67.]708(b)(11).” Pa. Dep’t of Educ. v. Bagwell, 131 A.3d 638, 649-50 (Pa. Cmwlth. 2016). Agencies cannot waive these recognized, third-party due process rights by action or inaction. See Baron v. Dep’t of Human Servs., 169 A.3d 1268, 1275 (Pa. Cmwlth. 2017) (en banc) (concerning proprietary/trade secret

Admin. Servs. v. A Second Chance, Inc., 13 A.3d 1025, 1032 (Pa. Cmwlth. 2011), appeal denied, 72 A.3d 604 (Pa. 2013). Even when interested third parties learn of an appeal, they cannot participate as parties to the proceeding, and they may supply additional information or argument only at the OOR’s discretion. Id.; see Section 1101(c)(2) of the RTKL, 65 P.S. § 67.1101(c)(2) (“[The OOR] may grant a request [to provide information or to appear].” (emphasis added)). We have noted, with some concern, that this arrangement relies on agencies to protect third-party privacy interests: In an ideal situation, we would rely on those who claim the right to assert it timely. Because of the lack of meaningful procedural due process protections afforded to those whose private information is sought through the RTKL, that obligation must fall on the agencies that hold this information and have the wherewithal, in the context of the RTKL, to protect it from disclosure.

PFUR, 154 A.3d at 437 (footnote omitted). The possibility of such a scenario requires that agencies be attentive to constitutional interests in the RTKL context: [T]here may come a time when a requester seeks a public record that does not fall under an exemption set forth in the RTKL, but where disclosure of the public record would violate a third[]party’s rights under the Pennsylvania Constitution. . . . Because the RTKL provides no meaningful ability for third[]parties to assert their constitutional rights in opposing a request . . . , we must recognize the ability of agencies to invoke this separate and independent basis to deny a request under the RTKL.

Governor’s Office of Admin. v. Purcell, 35 A.3d 811, 821-22 (Pa. Cmwlth. 2011) (Brobson, J., concurring).

exception), aff’d, 194 A.3d 563 (Pa. 2018). Here, the University does not assert that the subject emails contain either home addresses or proprietary information.

We appreciate that the University has raised, on appeal, the prospect that the instant case requires a balancing analysis to protect alleged constitutional privacy rights in the requested records. On remand, we encourage the University to raise and develop its constitutional privacy concerns, and we instruct the OOR to allow the University the opportunity to do so fully. We also remind the OOR that, to the extent this matter involves direct, third-party interests in nondisclosure of the requested records, it may be appropriate for the OOR to require notice to parties so interested and allow their participation pursuant to Section 1101(c)(2) of the RTKL. IV. CONCLUSION Based on the foregoing analysis, we will vacate the Final Determination and remand this matter to the OOR so that it may (1) apply the analysis we discuss above to determine whether the requested records are education records protected by FERPA, and (2) consider asserted constitutional interests in nondisclosure of the requested records.

P. KEVIN BROBSON, Judge

IN THE COMMONWEALTH COURT OF PENNSYLVANIA

West Chester University : of Pennsylvania, : Petitioner : : v. : No. 1078 C.D. 2018 : Adrian Rodriguez, : Respondent :

ORDER

AND NOW, this 24th day of July, 2019, the Final Determination of the Office of Open Records (OOR), dated July 12, 2018, is VACATED and this matter is REMANDED to the OOR for further proceedings consistent with the accompanying opinion. Jurisdiction relinquished.

P. KEVIN BROBSON, Judge