Personally identifiable information concerning a deceased former student cannot be released without the student’s consent
In a rare case where the Ohio Supreme Court’s analysis primarily focused on the Ohio Student Privacy Act, R.C. 3319.321 (OSPA), the Court determined the Act’s provisions apply to the records of a former student, even when the student is deceased. In doing so, the Court demonstrated that, under certain circumstances, the personal information of students enrolled in Ohio schools receive greater protection than they would if only federal law applied.
State ex rel. Cable News Network, Inc. v. Bellbrook-Sugarcreek Local Schools, 2020 Ohio 5149 involved requests made by several news organizations for the high school records, including disciplinary records, of a former student who perpetuated a mass shooting in the Oregon District in Dayton. Since the former student was an adult at the time of his death, the District responded that both the federal Family Educational Rights and Privacy Act (FERPA) and the OSPA prohibited the release of the records without the former student’s consent, which he could not give. As a result, the District could not release the requested records. The news organizations filed a mandamus action to attempt to obtain the records.
The Court agreed with the District, and began by rejecting an argument made in Justice Kennedy’s dissent that the OSPA does not apply to records of former students. According to the majority, “the statute is concerned not with the current status of the person whose information is being requested but rather with whether the personally identifiable information at issue relates to an individual's attendance at the public school.” The Court bolstered its conclusion by noting that the General Assembly enacted the OSPA in order to bring Ohio into compliance with FERPA. Since FERPA’s confidentiality provisions apply to both current and former students, it would be “nonsensical” to believe that the legislature would enact a provision that falls short of FERPA’s requirements.
The Court concluded that, unless an exception applies, the District could not release personally identifiable information subject to the OSPA without the consent of either a student’s parent or guardian if the student is under 18 years of age or the student himself if the student is 18 or older. The court pointed at that while R.C. 3319.321 has several exceptions, none of those involves the death of the student. The Court also stated that the General Assembly has demonstrated in several other statues that when it intends to alter the confidentiality provisions of a law based on a person’s death, it will enact such a rule.
In reaching this conclusion, the Court rejected an argument that the OSPA should be interpreted the same way as the U.S. Department of Education interprets FERPA. Specifically, the Family Policy and Compliance Office (FPCO), more recently renamed the Student Privacy Policy Office, has taken the position for many years that FERPA’s confidentiality requirements should be interpreted in light of the common law right to privacy. Under the common law, a person’s right to privacy generally expires upon their death. Under the FPCO’s interpretation, whether FERPA continues to protect personally identifiable information after a student’s death depends on whether the student is an “eligible student,” as defined by FERPA. If a student is younger than 18 and is not attending college, the right to consent to the release of such information belongs to the student’s parents. In those situations, if a student dies, the right to grant or refuse consent remains with the parents and only expires upon the death of the parents. The student, however, becomes eligible when they turn 18 or attend college. At that point, the right to consent to the release of the information transfers from the parent to the student. If the student subsequently passes away, then, like the common law right to privacy, the right to consent is extinguished. If the agency’s interpretation of FERPA controlled in the case before the Court, the federal statute would not protect the records from release because the former student was 24 at the time of his death.
The Ohio Supreme Court, however, refused to apply this analysis under the OSPA. Instead, the Court held that the requirements of R.C. 3319.321 are unambiguous and the use of such interpretive tools would be inappropriate. Further, the District was not relying on the common law right in refusing to release the records but instead they relied on confidentiality duties imposed by state statute. Those duties prevented the District from releasing the requested records.
This case serves as a reminder that in Ohio there are two statutes to apply when considering whether to release the personal information of primary and secondary school students. In those cases where FERPA may permit the release of certain information without consent, a school district should consider whether the OSPA might require a different conclusion. If it does, the school district should not release the information.
