Opinion
Opinion By: Jack Conway, Attorney General; Amye L. Bensenhaver, Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the Kentucky Higher Education Assistance Authority and Kentucky Higher Education Student Loan Corporation violated the Open Records Act in denying Kevin Schaap's January 28, 2014, request for the "complete and entire history" of an account identified by a nine digit number. Mr. Schaap agreed to the redaction of "any personally identifying information protected, exempt or otherwise, such as the borrower's name and social security number. " Although KHEAA/KHESLC's 1 original response was deficient, the agency met its statutory burden of proof in subsequent correspondence by expanding on the application of KRS 61.878(1)(a) and (k) to the records withheld.
In a timely written response, agency counsel advised Mr. Schaap that the account number identified in his request was "assigned to another KHESLC account for a different borrower and that her client was "unable to provide any account specifics for the requested account number due to the Federal Education Rights and Privacy Act [sic] provisions." Mr. Schaap thereafter initiated this appeal, providing "samples" released to him in July 2013 2 and focusing on the absence of any personally identifying information. It was his position that the disputed records "amount to little more than a bunch of numbers on a page" to which neither the Family Educational Rights and Privacy Act, 3 nor privacy laws generally, apply. Respectfully, we disagree.
In supplemental correspondence directed to this office after Mr. Schaap initiated his appeal, agency counsel asserted that FERPA, incorporated into the Open Records Act by KRS 61.878(1)(k), 4 prohibits disclosure of "individual student records, including those concerning disbursement of financial aid, . . . without the prior written consent of the impacted student." Although she did not specifically reference KRS 61.878(1)(a), counsel also argued that disclosure of another student's loan account history would invade the privacy rights of that student without meaningfully advancing the public's, or Mr. Schaap's, right to know.
In response to a series of questions propounded to the agency by this office pursuant to KRS 61.880(2)(c), 5 counsel later advised:
Under 20 USC § 1232g(b)(1)(d), regarding release of education records, educational agencies and institutions are prevented from releasing education records except in connection with a student's application for, or receipt of, financial aid. Under this provision, educational agencies and institutions are authorized to provide education records to those entities that make the determination as to whether an individual student is eligible for financial aid and the type or types of aid for which the student is eligible. Further, pursuant to 34 CFR § 99.31(a)(4)(i), personally identifiable information from an education record may be disclosed without consent when such disclosure is in connection with financial aid for which the student has applied or received if said information is necessary to determine: eligibility for aid, the amount of the aid, the conditions of the aid, or to enforce the terms and conditions of the aid. As used in that section, "financial aid" is defined as a payment of funds to an individual that is conditioned on the individual's attendance at an educational agency or institution (34 CFR § 99.31(a)(4)(ii)). Student loans are perhaps the most common type of student financial aid. Further, student financial aid records retained by KHEAA as a student loan guarantor and administrator of state financial aid programs were created by that entity from FERPA-protected information. 6 Therefore, records pertaining to student financial aid including student loans are subject to the nondisclosure provisions of FERPA.
April 14, 2014, letter from Melissa Justice to the Office of the Attorney General, p. 1, 2.
Counsel amplified on the challenges associated with "de-identification" of the records, as proposed by Mr. Schaap. She explained:
In a very real sense, these records cannot actually be "de-identified." Apparently, the Requester has obtained the account number of a completely unrelated individual and is now seeking information related to the individual's account. The request is for more than "mere numbers" as Requestor has alleged. Indeed, the Request indicates "a complete and entire history." Presumably this would include promissory notes/applications, any requests for forbearance or deferment, attendance records and other information related to the account owner. Utilizing the account number and information contained in these records, even if the SSN, name and date of birth are redacted, it might still be possible for the Requestor to identify the individual.
April 14 letter, p. 2.
Finally, counsel provided additional support for the agency's position that the unrelated student account holder's privacy interest in his or her financial records, recognized at KRS 61.878(1)(a), is superior to the public's interest in disclosure of those records. The latter interest, counsel emphasized, is premised on the public's "right to be informed as to what their government is doing" 7 and that interest is not advanced by disclosure of individual account information. On behalf of the agency, counsel maintained, "A borrower's payment history has nothing to do with what KHEAA/KHESLC, the government, is doing. Such student borrower information constitutes a private matter." April 14 letter, p. 3. In support, counsel again invoked the student privacy interests recognized in FERPA as well as the privacy interests of consumers/customers in their private financial information recognized in federal legislation such as the Gramm-Leach-Bliley Act of 1999 (15 U.S.C. § 6801) and federal regulations governing the Privacy of Consumer Financial Information (16 C.F.R. § 313). We find the arguments advanced by the agency in these supplemental responses persuasive. Because our analysis turns on the application of KRS 61.878(1)(a) to the disputed records, we do not address the agency's assertion that federal law also prohibits disclosure of those records.
KHEAA/KHESLC's original response to Mr. Schaap's request did not satisfy the requirements of KRS 61.880(1). That statute provides:
Each public agency, upon any request for records made under KRS 61.870 to 61.884, shall determine within three (3) days, excepting Saturdays, Sundays, and legal holidays, after the receipt of any such request whether to comply with the request and shall notify in writing the person making the request, within the three (3) day period, of its decision. An agency response denying, in whole or in part, inspection of any record shall include a statement of the specific exception authorizing the withholding of the record and a brief explanation of how the exception applies to the record withheld. The response shall be issued by the official custodian or under his authority, and it shall constitute final agency action.
(Emphasis added.) Although it was issued in a timely fashion, the agency's response did not "include a statement of the specific exception authorizing the withholding of the record." Moreover, it contained only the briefest of explanations "of how the exception applies to the record withheld. " In a recent opinion, the Kentucky Supreme Court recognized that an agency responding to an open records request "should provide the requesting party with . . . sufficient information about the nature of the withheld records ? to permit the requester to dispute the claim." City of Ft. Thomas v. Cincinnati Enquirer, 406 S.W.3d 842, 852 (Ky. 2013). "The agency's explanation must be detailed enough to permit the court to assess its claim and the opposing party to challenge it." Kentucky New Era, Inc. v. City of Hopkinsville, 415 S.W.3d 76, 82 (Ky. 2013). Ultimately, the Court declared, "the agency bears the burden of proof, and what it must prove is that any decision to withhold responsive records was justified under the Act." City of Ft. Thomas , at 848. The agency's original response contained a passing reference to FERPA but inadequate proof that its "decision to withhold responsive records was justified under the Act." Id. The response was, therefore, deficient.
These deficiencies were corrected on appeal. KHEAA/KHESLC advanced a reasoned argument that the unidentified account holder's privacy interest in what clearly constitutes more than "a bunch of numbers on a page" is superior to the public's interest in disclosure of the records, since disclosure of the records does not promote the public's interest in "open[ing] the operations and activities of state agencies to public scrutiny." Kentucky New Era at 85, citing Board of Examiners of Psychologists v. Courier-Journal, 826 S.W.2d 324, 328 (Ky. 1992). 8
As noted, Kentucky's highest court recently revisited the privacy exception to the Open Records Act, reaffirming the fundamental principle that:
Kentucky's private citizens retain a more than de minimus interest in the confidentiality of the personally identifiable information collected from them by the state. This interest increases as the nature of the information becomes more intimate and sensitive and as the possible consequences of disclosure become more adverse.
Kentucky New Era at 859. Thus:
The warrant for disclosure, it bears repeating, must be a public purpose. The ORA is generally not intended to enable private citizens to find out information about other, identifiable private citizens, information disclosed to the government more often than not only under compulsion. . . . Disclosures that shed no meaningful light on agency performance cannot warrant an invasion of a private citizen's privacy.
Lawson v. Office of the Attorney General, 415 S.W.3d 59, 70 (Ky. 2013). 9 Summarizing its position in Kentucky New Era, Inc. v. City of Hopkinsville , above at 89, the Court opined:
[T]he Open Records Act is meant to open the state's public agencies to meaningful public oversight, to enable Kentuckians to know "what their government is up to." It is not meant to turn the state's agencies into clearing houses of personal information about private citizens readily available to anyone upon request. To ensure that that is not its effect, the ORA includes an express exemption for agency records the disclosure of which would amount to a clearly unwarranted invasion of personal privacy.
(Emphasis added.) Our resolution of the issue in Mr. Schaap's appeal turns on the application of that "express exemption," KRS 61.878(1)(a), to the disputed records. While we do not address the propriety of the agency's invocation of federal law extending protection to educational and financial records, the existence of these laws lends additional support to the unidentified student borrower's substantiated privacy interest in his or her "complete and entire [account] history." Accord, 13-ORD-164 (affirming Lexington-Fayette Urban County Government's reliance on the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801, and KRS 61.878(1)(k) to deny access to "transactional data" submitted by pawnbrokers to local government under state and local law).
In Zink , Kentucky's court's first recognized the personal nature of a private individual's financial records. Analyzing the consequences of disclosure of social security numbers, the Court of Appeals observed:
Access to a wealth of data compiled by both government agencies and private enterprises such as credit bureaus is obtainable simply upon presentation of the proper social security number. Further, few things in our society are deemed of a more intimate nature than one's income. This information is commonly treated circumspectly. We also must consider the fact that other parties such as commercial advertisers and solicitors, as well as the merely curious, would have the same access under the Open Records Act as the [individual] seeking the information in this case.
Zink at 829; accord Hines v. Dept. of Treasury, 41 S.W.3d 872, 875 (Ky. App. 2001) (affirming the Department of Treasury's denial of a request for records reflecting the values of each unit of unclaimed property maintained by the Treasury because the records "could pertain to those owners' possible income, a matter as to which 'few things in our society are deemed of a more intimate nature'"). Records bearing on a private individual's financial affairs, his or her academic status, 10 and his or her need for, or repayment of, a student loan are replete with information of a personal nature the public disclosure of which is only warranted if it "sheds meaningful light on agency performance." Lawson at 70. The challenges of de-identification of those records increase in a manner proportionate to their level of detail and degree of specificity.
It is the opinion of this office that disclosure of the unidentified student borrower's "complete and entire account history" does not sufficiently open KHEAA/KHESLC "to meaningful public oversight [or] enable Kentuckians to know 'what [KHEAA/KHESLC] is up to'" to overcome the privacy interests implicated in this appeal. Kentucky New Era, Inc. , at 89. Pursuant to KRS 164.744, that agency was created "to improve the higher education opportunities of persons who are attending or planning to attend eligible institutions" by:
(1) Insur[ing] loans to students, but such insurance shall be provided only if such loans meet the criteria of the federal act and are the subject of agreements with the secretary, pursuant to the federal act and where the subject eligible lender has entered into an appropriate contract with the authority; and
(2) Provid[ing] from funds available to it loans, grants, scholarships, and work-study awards to eligible students who are residents of Kentucky to enable such persons to pursue an eligible program of study at a participating institution located in the Commonwealth, and, if required by the federal act, to such persons attending such nonprofit institutions as may be approved by the board.
It is empowered, inter alia :
(1) To provide loan guarantees, upon terms and conditions the board may prescribe within the limitations provided by KRS 164.740 to 164.770, and the federal act in respect of loans to eligible borrowers. The board may require additional security, including endorsers it deems necessary and desirable and is not in contravention of the federal act. The purpose of the loans shall be to assist individuals in meeting the expense of their education.
(2) To enter into agreements and undertakings with the secretary as may be required and necessary pursuant to the federal act in order to constitute the authority as a state agency qualified and empowered to insure student loans within the meaning of the federal act and to qualify insured student loans for interest payments, reimbursement, reinsurance, and other benefits available under the federal act to the authority.
(3) To issue loan guarantees in respect of loans made to eligible borrowers by participating lenders, including the authority. No loan guarantee shall be issued, executed, and delivered by the authority unless any insured student loan resulting shall be the subject of agreements pursuant to the federal act by which the insured student loan is made the subject of interest payments, reimbursements, reinsurance, and other benefits to the extent provided by the federal act.
KRS 164.748. Disclosure of individual student loan account information will advance only minimally, if at all, the public's interest in ensuring that the agency is fulfilling its statutory purpose or discharging its statutory function. "Against an Open Records Act public interest in disclosure, which is de minimus at best, we weigh the" 11 strongly substantiated privacy interest of individual student borrowers in records reflecting their private financial affairs and academic status, an interest recognized in the federal laws referenced above. Because the privacy interest of the unidentified student account holder substantially outweighs the negligible Open Records Act related public interest in disclosure, we conclude that disclosure would constitute a clearly unwarranted invasion of personal privacy under KRS 61.878(1)(a). We therefore affirm KHEAA/KHESLC's denial of Mr. Schaap's request.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Distributed to:
Kevin SchaapMelissa F. Justice
Footnotes
Footnotes
1 Mr. Schaap's January 28 request was addressed to the Kentucky Higher Education Assistance Authority. In responding to the request, agency counsel noted that the 800 series number identified in his request was assigned to a Kentucky Higher Education Student Loan Corporation account. KHEAA accounts, she explained, "simply use social security numbers to reference accounts."
2 Mr. Schaap does not indicate to whom the samples relate or how, or from whom, they were obtained.
3 20 U.S.C. § 1232g.
4 KRS 61.878(1)(k) directs public agencies to withhold "[a]ll public records or information the disclosure of which is prohibited by federal law or regulation[.]
5 KRS 61.880(2)(c) provides:
On the day that the Attorney General renders his decision, he shall mail a copy to the agency and a copy to the person who requested the record in question. The burden of proof in sustaining the action shall rest with the agency, and the Attorney General may request additional documentation from the agency for substantiation. The Attorney General may also request a copy of the records involved but they shall not be disclosed.
6 Counsel described the agency's role as follows:
As part of its function as the entity designated to administer student aid programs within the Commonwealth of Kentucky, KHEAA receives and disburses federal funds to students at post-secondary institutions both within and outside the commonwealth. KHEAA is therefore a State educational agency (SEA) as set forth in 34 CFR § 99.10(a)(2).
April 14 letter, p. 3.
7 Citing Zink v. Com., Dept. of Workers' Claims, 902 S.W.2d 825 (Ky. App. 1994).
8 In his final written communication with this office, Mr. Schaap suggests that disclosure of the disputed account history will resolve the problems with his KHESLC student loan account by confirming the misassignment of account numbers. While this may serve Mr. Schaap's personal interest, it "cannot be said to further the principal purpose of the Open Records Act by subject[ing] agency action to public scrutiny." Zink at 829.
9 We acknowledge that neither Kentucky New Era, Inc. , nor Lawson , involve student loan account records. The cases remind us, however, that "[j]udging by order, if nothing more, one might say that [KRS 61.878] (1)(a) is the foremost exception to the disclosure rule," Board of Examiners , at 327, and that in interpreting the exception we must, in general, apply a "comparative weighing of antagonistic interests" analysis. Id.
10 Receipt and repayment of student loans is conditioned, in part, on a student's academic status, information that is, no doubt, a part of the "complete and entire [account] history."
11 Zink at 829.