Facts and Procedural History:

Peter Martin, attorney for Independent School District 283, St. Louis Park Public Schools (District) asked the Commissioner to issue an advisory opinion regarding access to certain data that the District maintains under the Minnesota Government Data Practices Act, Minnesota Statutes, Chapter 13 (Data Practices Act).

The District wrote:

The School District recently received a request from a parent to view certain hallway security video. The requested video depicts an altercation between two students, one of whom is the parent’s child. The video also depicts several students in the background who were not involved in the altercation. 

The District then asked whether the requesting parent could have access to the video.

Issue:

Discussion:

Both Minnesota and federal law govern data about public school students. Minnesota Statutes, section 13.32, classifies most data relating to students as private and incorporates by reference much of the federal Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. section 1232g, and its implementing regulations, 34 C.F.R. Part 99. Both laws provide for access rights of students and their parents and privacy protections that limit access by others.

Educational data are “data on individuals maintained by a public educational agency or institution or by a person acting for the agency or institution which relates to a student. (See section 13.32, subdivision 1.) FERPA defines an education record as, “those records that are (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution.” (See 34 C.F.R. 99.3.)

Under Minnesota law, data subjects, including parents of minor children, have the right to access public and private data about themselves. (See Minnesota Statutes, section 13.04.) Moreover, Minnesota Rules provide that, “[t]he responsible authority shall not deny access by parents to data that is considered an education record, as that term is defined by [FERPA].” (See Minnesota Rules 1205.0500, subpart 4.) The Data Practices Act also gives data subjects the right to consent to the release of their private data to others. (See Minnesota Statutes, section 13.05, subdivision 4(d) and Minnesota Rules 1205.1400, subparts 3 and 4.) 

The Data Practices Act also provides that private data are only accessible to the subject of the data, those authorized by law, those within an entity who need the data to do their job, and those to whom the data subject has given consent. (See Minnesota Statutes, section 13.02, subdivision 12 and Minnesota Rules 1205.0400, subpart 4.)

Minnesota law does not resolve how a data subject’s right of access to private data is impacted by another data subject’s right to privacy when the private data of the one cannot be separated from the private data of the other. 

The Commissioner has previously opined that, “[e]ducational data ultimately are controlled by FERPA; the Minnesota Legislature's ability to act in the area of access to and dissemination of school data is limited by the provisions of FERPA and the accompanying regulations.” (See Advisory Opinions 09-021 and 17-010.)

FERPA provides, “[i]f the education records of a student contain information on more than one student, the parent or eligible student may inspect and review or be informed of only the specific information about that student.” (See 34 CFR 99.12(a). See also 20 U.S.C. sec. 1232g(a)(1)(A).)

In Advisory Opinion 17-010, the Commissioner addressed a similar situation to the one at issue here. She provided a lengthy analysis of the provisions of state and federal law implicated in providing parents access to an audio recording of an interview with their identifiable student, when the recording also contained private data about other identifiable students. 

Relying on the federal guidance available at the time (see Letter of technical assistance to school district re: disclosure of education records containing information on multiple complainants (FPCO, Oct. 31, 2003)), the Commissioner concluded:

The District must provide access to data on Student to Parent. The District must make every reasonable effort to redact the personally identifiable information on other students from the recording and provide access to Student’s data. Only if the District cannot easily separate Student’s education records from those of other students, then it must “inform” Parent of the specific information about Student.

On the same day that the Commissioner issued Advisory Opinion 17-010, the Office of the Chief Privacy Officer (OCPO) of the Student Privacy Policy Office (formerly the Family Policy Compliance Office or FPCO) at the U.S. Department of Education, issued a letter addressing a situation nearly identical to the circumstances here. (See the Letter to Wachter, OCPO (December 7, 2017).)

In Letter to Wachter, a parent of a student shown in a video of a hazing incident that also depicted a number of other students, asked for a copy of the video under applicable state law. (The incident took place in a Pennsylvania public school.) The OCPO concluded that if the school could segregate the data about the parent’s student, then the FERPA requires the school to do so. This is consistent with the Commissioner’s conclusion in 17-010. However, the letter goes on to say that if the school was unable to do so, then the school should provide access to the parents by letting the parent view the unredacted video. The OCPO wrote:

In providing access to the video, the District must provide the parents of a disciplined student (or the student if the student is an eligible student) with the opportunity to inspect and review the video so long as the video cannot be segregated and redacted without destroying its meaning. 

While the Commissioner has not viewed the video at issue here, based on the District’s description, she agrees with the District that the video is an education record under FERPA and educational data under the Data Practices Act of the two students involved in the incident. 

The District stated that it is unable to segregate the image of the parent requester’s student without destroying the meaning of the record. As stated above, Minnesota law does not resolve the question of providing access under these circumstances. The District has an obligation to provide data subjects access to data and to protect private data on others. 

The District relied on a previous Advisory Opinion to argue that it could withhold access to the entire video. In Issue 3 of Advisory Opinion 03-010, a school district asked about a situation where a parent of a student involved in an incident with a school employee requested a copy of the video of that dispute. The Commissioner concluded:

Thus, in situations where the District determines it is impossible to redact a videotape without inappropriately releasing private data about a student or employee, the District may withhold the entire videotape.

The facts in that opinion are distinguishable from the facts at issue here. Advisory Opinion 03-010 addressed a combination of private educational data and private personnel data (see Minnesota Statutes, section 13.43). Private personnel data are not subject to FERPA, as the data in the District’s video are, which are solely educational data. Moreover, the Commissioner issued Advisory Opinion 03-010 nearly 16 years ago and she assumes that recording and redacting technology have advanced beyond what was reasonable and available to government entities in 2003. As she wrote in Advisory opinion 17-010:

The Commissioner cautions government entities to pay careful attention to the way in which they create records. The entity must have in place the policies, procedures, and capacities to respond to any data practices requests that might arise subsequent to the creation of records. In other words, if an entity creates an audio recording record, it must ensure it has the capability to redact that recording appropriately, if necessary, in response to a data request.

In the alternative, the District asks the Commissioner to reaffirm her conclusion in Advisory Opinion 17-010, that the parent requester in this situation should be “informed” of the specific information about the parent’s student but not given access to the video. However, the Commissioner relied on federal guidance to reach that conclusion and the federal guidance has changed. The Commissioner cannot ignore the more recent, clear statement from the federal government on the question raised here. Thus, consistent with the most recent federal guidance, the District should provide the parents of the students (or eligible student data subjects) involved in the altercation access to the unredacted video in these circumstances.

The District also argued that the students in the background of the video, who were not a part of the altercation, may also be subjects of educational data. (See Echo Newspaper v. St. Louis Park Public Schools, A17-1967 (Minn. App. Aug. 13, 2018) (finding that data that “relates” to a student “appears to cover a wide range of data”).) However, the Data Practices Act defines educational data as “data on individuals” that relate to a student. (See section 13.32, subd. 1.) The phrase “data on individuals” is defined as data in which:

Any individual is or can be identified as the subject of that data, unless the appearance of the name or other identifying data can be clearly demonstrated to be only incidental to the data and the data are not accessed by the name or other identifying data of any individual.

(See section 13.02, subdivision 5.) (Emphasis added.) Therefore, if the background students’ images are incidental and not accessible by their names (i.e., in their education records or files or labeled by their names), then the video does not constitute educational data on those students and neither they, nor their parents, would be entitled to access the unredacted video. (Under FERPA, images of students in the background of videos are not education records. See Letter to Wachter.)

The Commissioner recognizes that all government entities in Minnesota are in a difficult position when administering data that combine private data on multiple data subjects. Educational entities are further challenged by the fact that failure to comply with the requirements of FERPA jeopardizes their continued receipt of federal funding. The Commissioner encourages the legislature to consider educational entities’ data practices duties under state law in light of their FERPA obligations. 

Opinion:

Based on the facts and information provided, the Commissioner’s opinion on the issue is as follows:

Independent School District 283, St. Louis Park Schools, should allow a parent of a student in a video access to the video even if it also depicts other students, pursuant to the federal guidance interpreting FERPA.  

Signed:

Alice Roberts-Davis
Commissioner

March 28, 2019