Appeals court requires U. of Kentucky to submit redacted records

The University of Kentucky will have to provide redacted records of a Title IX investigation — and specific justifications for those redactions — to a state circuit court for review, after a ruling Friday by the Kentucky Court of Appeals.

That amounts to a win for UK’s student newspaper, the Kentucky Kernel, which has been seeking the records since 2016. It’s the latest development in a battle over where the line should be between protecting student privacy and informing the public.

It started when a UK professor was being investigated for alleged sexual misconduct. The Kernel requested records under the Kentucky Open Records Act detailing the underlying allegations and the steps UK took to investigate them. UK denied the request, arguing the materials were “privileged,” “preliminary,” and “personal.” The professor, James Harwood, would ultimately resign in February 2016, before the investigation was complete.

The Kernel, meanwhile, used a state statute that permits the state Attorney General to review the records and issue an opinion on whether they should be disclosed. Kentucky Attorney General Andy Beshear requested that the university permit him to review the records in question. The university refused. Beshear, in turn, ruled that UK violated the Act and was required to disclose redacted documents.

UK had 30 days to either comply with Beshear’s ruling or appeal by suing. It chose to do the latter, suing the Kernel and Beshear and arguing that federal law (the Family Educational Rights and Privacy Act, or FERPA) prevented it from disclosing any of the records and that they could not be effectively redacted. FERPA prohibits institutions receiving federal education funding from having a policy or practice of releasing personally identifiable information contained in education records. As the basis for its refusal to disclose the records to Beshear, UK cited a Department of Education opinion letter that said unredacted FERPA records could not be disclosed to the Texas attorney general.

In January 2017, the trial court ruled that no form of the records could ever be effectively redacted to remove personal information. The appellate court reversed that ruling, finding that the blanket denial offered by UK and endorsed by the trial court was not sufficient under state law:

The University, at various times throughout this dispute, has given many reasons why the entire file should be exempt but given no explanation as to how a specific exemption applies to a particular record. This is particularly troublesome where some of the records may be exempt but others clearly are not. We cannot say that the circuit court’s finding that all records are exempt from disclosure under FERPA was supported by substantial evidence. Some records certainly are not directly related to any student such as a camera manual, University policies, and scheduling notes. [Footnote omitted.]

The appellate court continued, writing that while it could reverse the trial court decision as clearly erroneous, it was also compelled to reverse the trial court decision because the university had not fulfilled its basic obligation under the Open Records Act to actually examine the records and determine if any are exempt.

The Act also places the responsibility on the public agency to redact any exempt material from a file and release the remaining materials. … With the responsibility of redaction placed squarely on the agency, blanket exemptions from disclosure are prohibited.

[…]

In this instance, the University has not yet made any attempt to comply with the Open Records Act in any meaningful way. It has not separated the exempt from the nonexempt records, redacted any personally identifying information or provided sufficient proof in circuit court that the records are exempt through a proper index. It has taken the indefensible position that the records are exempt because it says they are and it must be believed. That position is directly contrary to the goal of transparency under the Open Records Act.

The appellate court also noted that UK could have complied with the attorney general’s request consistent with FERPA, because the attorney general requested redacted records, and the Department of Education’s opinion letter only prohibited the disclosure of unredacted records. If the records disclosed to the attorney general don’t have identifiable personal information, after all, they aren’t FERPA records by definition.

Accordingly, the appellate court ruled that UK has to actually comply with the Open Records Act and submit redacted documents with accompanying explanations to the circuit court.

The university’s reaction, as reported by Kentucky.com, seems almost unrelated to the decision:

In a prepared statement, UK spokesman Jay Blanton said the appeals court ruling affirmed UK’s belief that students’ privacy must be protected.

“A court has reaffirmed our actions in that respect and the steps we took to protect our students.” Blanton said.

“We continue to have grave concerns about the chilling effect any breach of a student’s privacy will have on the willingness of victim-survivors to come forward and seek support and justice,” he said. “In the case at hand, The Kernel published the academic department, degree program (with a small number of students), and gender of the victim-survivors. In such cases, an individual’s identity could be easily revealed in a quick set of mouse clicks by a skillful Googler relying upon records already publicly available.”

That’s certainly an interesting reading of the court’s opinion. Let’s give UK the benefit of the doubt and assume that it, in the words of the court, “has not yet made any attempt to comply with the Open Records Act in any meaningful way” out of overwhelming concern for the named students (as opposed to, say, a desire to avoid negative press). I’m not sure the court reaffirmed those decisions, inasmuch as it remanded the case to a lower court with instructions for UK to do the opposite of what it had been doing. As a general matter, one way to tell a court didn’t reaffirm the thing you did is that it reversed and remanded with instructions not to do it again.

Equally dubious is the self-defeating argument that The Kernel’s reporting has made it functionally possible to identify the people in question. If that level of identification came from the name of the professor (which inherently included his department), then UK, not the Kernel, disclosed that information when it investigated him and he resigned. And if that’s the case, UK’s problem is with the concept of transparency, not the newspaper.

Everyone is concerned for the privacy of the survivors; the appellate court, in its opinion, explains why the disclosure matters even though that concern exists:

The public has an interest in the investigatory methods used by its public agencies and to know that a publicly funded university has complied with all federal and state laws, including Title IX. A Title IX investigation into a professor’s sexual abuse of a student is of interest, not because of the identity of the victim or the details of the assault, but because of the interest in seeing that our public universities are in compliance with Title IX and that such allegations are dealt with appropriately.

In at least two cases since Harwood, professors accused of violating the school’s harassment and discrimination code were permitted to resign under settlement deals where UK promised not to disclose the allegations to future employers. That cases can evaporate silently without public scrutiny is all the more reason, when a case does come to the public’s attention, that we need to review it in depth.