Opinion ID: 4427793
Heading Depth: 4
Heading Rank: 1

Heading: The student’s name;

Text: 29 (b) The name of the student’s parent or other family members; (c) The address of the student or student’s family; (d) A personal identifier, such as the student’s social security number, student number, or biometric record; (e) Other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name; (f) Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or (g) Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates. [34 C.F.R. § 99.3.] As amended, FERPA regulations envision that once “personally identifiable information” is redacted, and the educational institute reasonably determines that the record will not reveal the identity of the student at issue, the record may be publicly disclosed: An educational agency or institution, or a party that has received education records or information from education records under this part, may release the records or information without the consent required by § 99.30 after the removal of all personally identifiable information provided that the educational agency or 30 institution or other party has made a reasonable determination that a student’s identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information. [34 C.F.R. § 99.31(b)(1).] The New Jersey Department of Education has twice amended N.J.A.C. 6A:32-7.5 since the federal regulations incorporated the redaction of personally identifiable information as a means of ensuring student privacy, see 45 N.J.R. 419(a) (proposed Mar. 4, 2013), 45 N.J.R. 2590(a) (adopted Nov. 14, 2013); 46 N.J.R. 1775(a) (proposed Aug. 18, 2014), 47 N.J.R. 464(a) (adopted Feb. 17, 2015). The Department, however, has not incorporated in a proposed rule the concept of personally identifiable information, or adopted a procedure whereby student records may be disclosed following the redaction of such information. 5 5 New Jersey has declined in other respects to conform its NJPRA regulations to FERPA regulations. For example, federal regulations allows for production of educational records in response to a “lawfully issued subpoena” as well as a court order, 34 C.F.R. § 99.31(a)(9)(i) to (ii), but only a court order warrants such production under New Jersey regulations, N.J.A.C. 6A:32-7.5(e)(15). Under state regulations, a New Jersey school district served with a court order authorizing disclosure of student records must “give the parent or adult student at least three days’ notice of the name of the requesting agency and the specific records requested unless otherwise judicially instructed.” N.J.A.C. 6A:32-7.6(a)(4). FERPA regulations, in contrast, require only that the school district “make a reasonable effort to notify the parent or eligible student” of an impending release. 34 C.F.R. § 99.31(a)(9)(ii). In both regards, New Jersey safeguards student privacy more strictly than does federal law. 31 In sum, although New Jersey educational agencies must comply with FERPA and its regulations, and although that introduction of those federal standards prompted state officials to address the question of student record privacy, New Jersey has diverged from the federal path. C. Against that backdrop, we review the Appellate Division’s holding that a “student record” protected from disclosure under the NJPRA, as defined in N.J.A.C. 6A:32-2.1, remains a student record and retains its protected status even if all “personally identifiable information,” as defined in FERPA, is redacted from that record. 1. We concur with the Appellate Division that the regulation’s plain language indicates that a document need not include “personally identifiable information” to constitute a “student record.” --- L.R., 452 N.J. Super. at 82-87. N.J.A.C. 6A:32-2.1 expansively defines a “student record” to denote “information related to an individual student gathered within or outside the school district and maintained within the school district.” Categories of documents addressed in these appeals illustrate the meaningful distinction between that regulatory language and federal law. A settlement agreement between a student’s parents and a school district, for 32 example, might be redacted pursuant to 34 C.F.R. § 99.3 to delete personally identifiable information so that the agreement could not be traced to an individual student. If that redaction left in the agreement information about the student’s disability, however, the record would contain “information related to” that student, and would still constitute a “student record” under the plain language of N.J.A.C. 6A:32-2.1. ------- See L.R., 452 N.J. Super. at 84-85. Similarly, an individualized education program developed in accordance with 20 U.S.C. § 1414(d) and N.J.A.C. 6A:14-3.7 might be redacted so the student could not readily be identified, thus satisfying 34 C.F.R. § 99.31(b)(1) and FERPA. If, however, “information related to the student” remained, that document would constitute a “student record” under N.J.A.C. 6A:32-2.1 notwithstanding the federally-mandated redactions. In short, as the Appellate Division concluded, N.J.A.C. 6A:32-2.1’s plain language indicates that a “student record” does not necessarily lose its protected status under state law merely because it is redacted in compliance with FERPA regulations. 2. We likewise share the Appellate Division’s view that N.J.A.C. 6A:32- 7.5(g), which states that “[i]n complying with this section, individuals shall 33 adhere to requirements pursuant to [OPRA] and [FERPA],” does not alter the analysis. See L.R., 452 N.J. Super. at 85-86. We do not construe N.J.A.C. 6A:32-7.5(g)’s reference to OPRA to suggest that a requestor’s invocation of OPRA undermines the privacy protections set forth in NJRPA regulations. Instead, N.J.A.C. 6A:32-7.5(g) confirms that individuals and entities may request student records in accordance with OPRA’s provisions, and that educational agencies must comply with those provisions when they respond to such requests. See, e.g., N.J.S.A. 47:1A-5 (prescribing procedure for inspection of public records); N.J.S.A. 47:1A-6 (authorizing requestor to challenge denial of access in Superior Court or Government Records Council). 6 In mandating compliance with OPRA, N.J.A.C. 6A:32-7.5(g) does not purport to determine whether a given OPRA request will ultimately prevail; indeed, that regulation underscores the Legislature’s recognition of exemptions to OPRA created by statute, regulation, and other enumerated sources of law. N.J.S.A. 47:1A-1, -9. N.J.A.C. 6A:32-7.5(g)’s mention of OPRA does nothing to resolve the core inquiry in these appeals: whether the requested documents, if redacted to 6 N.J.A.C. 6A:32-7.5(c) permits a district board of education to charge “a reasonable fee for reproduction of student records,” not to exceed the schedule of costs set forth in an OPRA provision, N.J.S.A. 47:1A-5. 34 remove personally identifiable information, remain “student records” that the NJPRA and its regulations exempt from disclosure under OPRA. N.J.A.C. 6A:32-7.5(g)’s general reference to FERPA is no more significant to these appeals than its allusion to OPRA. As a matter of New Jersey administrative law, N.J.A.C. 6A:32-7.5(g)’s general reference to FERPA does not incorporate into that regulation the redaction and disclosure procedure set forth at 34 C.F.R. § 99.31(b)(1), or the provisions of any federal statute or regulation addressing the privacy of student records. When agencies adopt New Jersey administrative regulations, they may “incorporate[] into a rule by reference” sections of New Jersey Statutes Annotated, the United States Code, and the Code of Federal Regulations, as well as other enumerated sources of authority. N.J.A.C. 1:30-2.2(a). They must do so, however, with precision, so that regulated persons and entities are on notice of the requirements imposed on them: Any agency incorporating any section of a source by reference shall adopt and file as a rule appropriate language indicating: 1. What is incorporated including either:
source incorporated; or
incorporated includes future supplements and amendments. 35 2. Where and how a copy of the section can be obtained. [N.J.A.C. 1:30-2.2(c).] N.J.A.C. 6A:32-7.5(g) contains no cross-reference to any federal regulation enacted under FERPA, let alone the specific regulation, 34 C.F.R. § 99.31(b)(1), that addresses the disclosure of educational records after redaction of personally identifiable information. It cannot be read to substantively import that regulation into New Jersey student privacy law. Significantly, as to a subset of student records -- student health records -- the regulation requires that “[a]ccess to and disclosure of” such records “meet the requirements of” FERPA. N.J.A.C. 6A:32-7.5(d). Even that limited provision does not incorporate the redaction procedure prescribed by 34 C.F.R. § 99.31(b)(1) into New Jersey’s rule. Moreover, the Commissioner of Education has issued no rule, or even informal guidance, providing that the redaction of personally identifiable information from a student record is sufficient to satisfy the NJPRA’s student privacy goals. See In re Request for Solid Waste Util. Customers Lists, 106 N.J. 508, 518-520 (1987) (discussing informal agency action). In short, although N.J.A.C. 6A:32-7.5 generally refers to FERPA, neither 34 C.F.R. § 99.31(b)(1) nor the redaction and disclosure procedure that it prescribes has been made part of New Jersey law. 36 To date, the Department of Education simply has not taken the regulatory steps necessary to provide that a “student record” under N.J.A.C. 6A:32-2.1 loses its privacy protection if a school district redacts the document in accordance with 34 C.F.R. § 99.31(b)(1) -- or to give parents, students, requestors and the public notice of such a provision. Accordingly, we concur with the Appellate Division’s conclusion that N.J.A.C. 6A:32-7.5 does not support the contention that a “student record” loses that status if it is redacted to remove personally identifiable information. 3. Our dissenting colleagues contend that, in its amicus curiae brief, the Department of Education expressed its intention to integrate the FERPA regulations’ provisions for redaction and disclosure, 34 C.F.R. § 99.3, into the NJPRA’s student privacy regulations. They urge deference to what they characterize as the Department’s position. Post at ___ (slip op. at 10-15). Our dissenting colleagues may be correct in that the Department of Education may indeed intend to incorporate FERPA redaction and disclosure procedures into New Jersey’s student privacy regulations, subject to exceptions such as those explained by its counsel at oral argument in this appeal. If it is the Department’s intention to incorporate FERPA regulations into their New Jersey counterparts, however, it cannot accomplish that 37 objective in an appellate brief. The Department has yet to “adopt and file as a rule appropriate language indicating . . . [w]hat is incorporated” from federal law into New Jersey even in general terms, much less the precise terms that N.J.A.C. 1:30-2.2(c) requires. Accordingly, the setting of this case is distinct from the ordinary administrative setting in which the agency has promulgated rules under the APA, and its interpretation of those rules is afforded considerable deference. The provision of clear and specific guidance to the public is a core regulatory function; “[t]he regulated community . . . has a reasonable expectation that known and uniform rules, standards, interpretations, advice and statements of policy will be applied to them.” Catholic Family & Cmty. Servs. v. State-Operated Sch. Dist. of City of Paterson, 412 N.J. Super. 426, 442 (App. Div. 2010). In the rulemaking setting, the Department will have ample opportunity to reconcile the compelling interests of public disclosure, parental and student rights of access, and student privacy, and to unmistakably identify any federal regulatory provisions that will be made part of New Jersey student privacy regulations, as N.J.A.C. 1:30-2.2(c) mandates that it do. We anticipate that the rulemaking process that will follow this decision will afford essential guidance to the parties and the public. 4. 38 We offer two additional comments about the Appellate Division’s analysis of the regulations promulgated pursuant to NJPRA. First, we agree with the Department that the term “student records” in N.J.A.C. 6A:32-2.1 should not be construed to generally bar public disclosure of aggregate data such as average standardized test scores for a school or district, or similar statistical information. 7 Indeed, a restriction on access to aggregate test score data by those authorized to access student records under N.J.A.C. 6A:32-7.5 could run afoul of the NJPRA, which charges the Department to ensure “the opportunity for the public schools to have the data necessary to provide a thorough and efficient educational system for all pupils.” N.J.S.A. 18A:36-19. We do not view the Appellate Division’s decision to undermine the Department’s policy of publicly disclosing certain categories of aggregate data. As the Department’s counsel explained, pursuant to that policy, the public has access to information about student achievement test scores, district graduation rates, district violence and other safety issues, as well as other areas 7 At oral argument, counsel for the Department explained that the Department and districts make aggregate test score data publicly available on their websites, but that data is withheld if the sample size from which the aggregate data is derived is so small that the aggregate data may reveal a test score of an individual child. 39 of concern identified by our dissenting colleagues. Post at ___ (slip op. at 3). Our colleagues’ suggestion that public access to such composite information is somehow at stake in this appeal is simply wrong. Second, although neither L.R. nor Innisfree claimed to be a “bona fide researcher” authorized to request “student records” pursuant to N.J.A.C. 6A:32-7.5(e)(16), or asserted “bona fide researcher” status in the OPRA requests, the Appellate Division remanded for a determination of whether either plaintiff constituted such a “researcher.” L.R., 452 N.J. Super. at 87-88. As counsel for the Department explained, school districts must comply with FERPA regulations that govern “researcher” access to personally identifiable information in educational records. See, e.g., 34 C.F.R. § 99.31(a)(6)(i) (addressing “researcher” status of “organizations conducting studies for, or on behalf of, educational agencies or institutes to: (A) [d]evelop, validate, or administer predictive tests; (B) [a]dminister student aid programs; or (C) [i]mprove instruction”); id. § 99.31(a)(6)(iii) (imposing requirements on researchers). It is unclear whether the Appellate Division considered federal regulations when it suggested that L.R. and Innisfree might be authorized, as “bona fide researchers” under N.J.A.C. 6A:32-7.5(e)(16), to have access to the documents requested. 40 If, on remand, either L.R. or Innisfree seeks authorization to view student records based on “bona fide researcher” status under N.J.A.C. 6A:32- 7.5(e)(16), we caution the remand court to carefully consider both federal and state standards that govern requests by researchers for student records such as those at issue here.