Colleges can’t hide behind the federal FERPA privacy law to withhold access to the campus email directory, says the state attorney general’s office in Illinois.
That’s good. How the AG’s office got to that conclusion is even better.
A reporter with a suburban Chicago news outlet, Edgar County Watchdogs, asked a local two-year college, the College of DuPage, to turn over a database of all college email accounts.
The college produced the records but withheld the email addresses belonging to students, applying a rather tangled interpretation of student privacy law that requires a little explaining.
The Family Educational Rights and Privacy Act (FERPA) allows colleges to designate certain student records as “directory information,” meaning that they can be revealed without needing the student’s advance permission. Email addresses are among the items that, under FERPA, can be disclosed as directory information.
But the College of DuPage has chosen not to include emails as part of its bundle of directory information. So, the college argues, because COD chose not to take advantage of the opt-out from FERPA, that means the records are still protected by FERPA and can’t be disclosed.
But in a March 20 determination letter, the public access counselor for Attorney General Lisa Madigan disagreed and told the college to comply fully with Kraft’s request.
Illinois’ Freedom of Information Act allows an agency to withhold or redact public records if the information is “specifically prohibited from disclosure” by federal law. But as Assistant Attorney General Josh Jones noted, FERPA does allow colleges to disclose email addresses — the College of DuPage simply chose not to. And that’s not a federal prohibition.
This is significant. College attorneys often take the position that, when FERPA makes it permissible to disclose a piece of information, that means the college is free to choose not to disclose it. That’s not how it works.
Once Congress and the U.S. Department of Education say “we won’t stop you from disclosing,” then there is no longer any federal prohibition against disclosure. And that means the college can no longer rely on the “federal prohibition” exemption in public-records law.
It gets better. The determination letter casts doubt on whether FERPA can ever be interpreted as a federal prohibition against disclosure, because it doesn’t actually say “don’t disclose.” It says, if your college has a policy or practice of disclosing, then you might be financially penalized (although no college ever has been). Jones’ letter concluded: “[E]ducational institutions like the College may opt not to abide by the requirements of FERPA.”
Attorneys for colleges have argued for years that FERPA precludes honoring even one request for public records, although that’s hardly the “policy” or “practice” that Congress could have been intended to outlaw. Madigan’s office has it right — and that common-sense interpretation of FERPA ought to be part of any appeal of a privacy-based FOIA denial in Illinois from now on.