Suppressed v. Suppressed
Filing
155
MEMORANDUM Opinion and Order Signed by the Honorable Sheila Finnegan on 6/2/2015: CSI's objection that it cannot produce directory information relating to former students without first providing notice and an opportunity to opt out under FERPA is overruled. CSI's objections that certain of the requested student identifiers do not constitute directory information are sustained in part and overruled in part. [For further details see memorandum opinion and order.] Mailed notice. (is, )
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ILLINOIS
EASTERN DIVISION
UNITED STATES OF AMERICA, ex rel.
)
LIZETTE MUNOZ and WESLEY FRENDT, )
)
Plaintiffs/Relators,
)
)
v.
)
)
COMPUTER SYSTEMS INSTITUTE, INC., )
)
Defendant.
)
No. 11 C 7899
Judge Robert M. Dow
Magistrate Judge Finnegan
MEMORANDUM OPINION AND ORDER
Plaintiffs-Relators (“Relators”) have brought this qui tam action on behalf of the
United States of America alleging that their former employer, Defendant Computer
Systems Institute, Inc. (“CSI”), a for-profit educational institution, violated the False
Claims Act, 31 U.S.C. § 3729 et seq., by making a number of misrepresentations to the
Department of Education, its accrediting agencies, and prospective students. Relators
allege that these misrepresentations enabled CSI to secure student financial aid in the
form of loans and grants from the federal government.
In the course of discovery, Relators asked CSI to produce a variety of information
about its former students over the four-year period from January 2008 through
December 2011, including: student ID, date of birth, graduation credential (i.e., high
school diploma, GED or Ability to Benefit), attendance, course of study, and non-Title IV
loan tuition paid by a student or on a student’s behalf. Relators claim that this data is
necessary to enable them to perform statistical analyses that will prove CSI made false
statements about (1) student job placement rates, (2) student eligibility to take
certification examinations without a high school diploma or GED, (3) commissions and
bonuses paid to Admissions Representatives, and (4) the amount of revenue CSI
derives from non-Title IV program funds. CSI objects that the information is overly
burdensome to produce because the school must first give each former student notice
and an opportunity to opt out pursuant to the Family Educational Rights and Privacy Act
(“FERPA”).1 Relators respond that notice is not required for former students when, as
they claim here, the data in question all constitute “directory information” under the
statute.
For the reasons set forth here, the Court finds that FERPA does not require an
educational institution to notify former students prior to disclosing directory information,
and CSI’s objection in that regard is overruled. The Court also finds that for purposes of
this case, directory information includes student ID, date of birth, course of study, and
time period when a student attended CSI (but not specific dates the student attended
each class). It also includes whether the student has been awarded a high school
diploma or GED, but not whether the student took and passed the Ability to Benefit
(ATB) test to qualify for student aid. Likewise, tuition payments made by ESL students
do not qualify as directory information under the statute.
DISCUSSION
A.
Notice and Opt Out Requirements Under FERPA
FERPA “was adopted to address systematic . . . violations of students’ privacy by
unauthorized releases of sensitive information in their educational records.” Daniel S. v.
Board of Educ. of York Community High Sch., 152 F. Supp. 2d 949, 954 (N.D. Ill. 2001)
(quoting Jensen v. Reeves, 45 F. Supp. 2d 1265, 1276 (D. Utah 1999)). In that regard,
1
The Court will address in a separate opinion CSI’s additional objection that the cited
categories of directory information are irrelevant under Rule 26.
2
schools and educational institutions that receive federal financial assistance are not
allowed to disclose “personally identifiable information other than directory information .
. . without parental consent.” Disability Rights Wisconsin, Inc. v. State of Wisconsin
Dep’t of Public Instruction, 463 F.3d 719, 730 (7th Cir. 2006). Personally identifiable
information includes, without limitation, “the students’ names, names of their parents or
other family members, the addresses of the students or their family, any personal
identifiers such as social security numbers or student numbers, a list of personal
characteristics that would make the students’ identities easily traceable or any other
information that would make the students’ identities easily traceable.” Id. (citing 20
U.S.C. § 1232g; 34 C.F.R. § 99.3).
Directory information is “a type of personally identifiable information not usually
considered harmful [or an invasion of privacy] if disclosed.” Id.; 34 C.F.R. § 99.3. It
includes, but is not limited to, the student’s name; address; telephone number; email
address; photograph; date and place of birth; major field of study; grade level;
enrollment status (e.g., undergraduate or graduate, full-time or part-time); dates of
attendance (e.g., academic years, semesters or quarters when enrolled); degrees,
honors, and awards received; and the most recent educational agency or institution
attended. 34 C.F.R. § 99.3. An educational institution is allowed to disclose “directory
information” if:
it has given public notice to parents of students in attendance and eligible
students in attendance at the institution of:
(1) the types of personally identifiable information the agency has
designated as directory information;
(2) the right to refuse to let the institution disclose any or all of those types
of information about the student; and
3
(3) the period of time to notify the institution in writing that he or she does
not want any or all of those types of information about the student
designated as directory information.
34 C.F.R. § 99.37(a).
The rule is different for former students.
Specifically, an
educational institution
may disclose directory information about former students without
complying with the notice and opt out conditions in paragraph (a) of this
section. However, the agency or institution must continue to honor any
valid request to opt out of the disclosure of directory information made
while a student was in attendance unless the student rescinds the opt out
request.
34 C.F.R. § 99.37(b).
“Under FERPA, each educational institution can choose whether to make the
various categories of directory information public or not.” Electronic Privacy Info. Ctr. v.
United States Dep’t of Educ., 48 F. Supp. 3d 1, 20 (D.D.C. 2014). Prior to May 2011,
CSI did not designate any student identifier as directory information, choosing to forego
the ability to disclose such information. As a result, CSI did not provide students in
attendance at the time either with notice that such information may be disclosed or with
an opportunity to opt out. Between May and December 2011, CSI changed its policy
and decided that instead of designating nothing as directory information, it would
designate the following student identifiers: student name; address; telephone number;
email address; enrollment status; program of study; photograph; degrees and awards
received; and dates of attendance (the “2011 categories”). (Doc. 149, at 10). Students
attending CSI from May through December 2011 received notice of these categories
and a chance to opt out as required by section 99.37(a).
4
Relators are seeking information relating to former students who attended CSI
before January 2012. CSI has agreed that pursuant to section 99.37(b), it may produce
the 2011 categories of directory information for any student who did not opt out between
May and December 2011.
The question is whether CSI may also produce other
categories of directory information for those same students, or produce any directory
information for students in attendance before May 2011 who never had a chance to opt
out since nothing had been designated as directory information at the time.
CSI reads the statute to require that an educational institution never disclose any
directory information of current or former students unless the institution has at some
point (1) designated which student identifiers fall within that definition, and (2) given
students notice and an opportunity to opt out. With respect to the designation element,
CSI notes that directory information “comprises different categories of information
depending on the categories of information that an institution chooses to publicly identify
as ‘directory.’” (Doc. 149, at 10). The University of Illinois-Champaign, for example,
designates date of birth as directory information. Academic Policies and Regulations, §
3-602(c) (http://studentcode.illinois.edu/article3_part6_3-602.html, last visited May 20,
2015). The University of Michigan does not. University of Michigan Student Rights and
Student Records (http://ro.umich.edu/ferpa/, last visited May 20, 2015). In CSI’s view,
since it affirmatively designated only certain categories of directory information from
May through December 2011, absent consent, it cannot disclose any other categories of
information for students who received the notice and did not opt out. (Doc. 149, at 10).
The Court agrees that when it comes to current students, nothing may be
disclosed as directory information unless an educational institution has given the proper
5
notice, which includes designating the specific student identifiers that will be subject to
release.
See Electronic Privacy Info. Ctr., 48 F. Supp. 3d at 20 (“[I]t is within
Georgetown University’s discretion to decide whether it will publicize student ID
numbers by requiring that they be placed on a student badge.”).
For this reason,
students in attendance at CSI from May through December 2011 had to be notified
about which categories of information CSI intended to disclose as directory information
while they remained students. For example, had CSI failed to notify current students
that it treated email addresses as directory information, then it would not have been
allowed to disclose the email addresses of those students while they remained in
attendance at CSI.
With respect to former students, however, educational institutions are expressly
allowed to disclose “directory information” without complying with the notice and opt out
requirements.
34 C.F.R. § 99.37(b).
The regulations do not state that once an
educational institution selects particular student identifiers as directory information, no
other categories can qualify as directory information for its former students. Thus, CSI’s
decision to designate certain categories as directory information in May 2011 has no
bearing on whether identifiers that clearly fall within the statutory definition of directory
information but have not been designated as such nonetheless may be disclosed for
former students.
CSI insists that even if it is not limited to disclosing only those student identifiers
it designated in May 2011, it still must give all former students an opportunity to opt out
before any new categories of directory information are disclosed.
This argument
focuses on the second sentence of section 99.37(b), which states that educational
6
institutions “must continue to honor any valid request to opt out of the disclosure of
directory information made while a student was in attendance unless the student
rescinds the opt out request.” CSI says that “for the regulation to make sense, there
must have been public notice when the former students were attending the institution.
Otherwise, the opportunity to object under FERPA would be meaningless.” (Doc. 149,
at 12). The Court disagrees.
The regulations plainly state that educational institutions are allowed to disclose
directory information of former students “without complying with the notice and opt out
conditions.” 34 C.F.R. § 99.37(b). See also 73 F.R. 15574-01 (Mar. 24, 2008) (an
educational institution “does not have to notify former students about its policy on
directory information disclosures and their right to opt out.”). Though an educational
institution must continue to honor opt outs made when students were in attendance
there, the regulations do not mandate that students who were never given an
opportunity to opt out (e.g., because the school did not designate any identifiers for
disclosure at the time of attendance) receive a chance to opt out as former students. In
fact, the regulations do not even require that educational institutions notify former
students that they have changed the categories included as directory information.
Thus, a now-former student who had an opportunity while enrolled to opt out but chose
not to when directory information included only name, email address and major field of
study, has no right to notice if, after graduation, the school decides to expand the
definition to include other identifiers the student might find objectionable, such as
address, photograph and date of birth. In such circumstances, where a now-outdated
version of a prior notice suffices for purposes of section 99.37(b), it makes no sense to
7
require an educational institution to notify former students about which identifiers may
constitute directory information merely because the prior “definition” included none and
the new definition includes every possible identifier listed in the statute.
The cases CSI relies on deal with current as opposed to former students and
therefore are not instructive on this issue. See Electronic Privacy Info. Ctr., 48 F. Supp.
3d at 20 (addressing university decision to require that student ID numbers be placed
on student badges); Zomba Recording LLC v. Does 1-15, No. 08 C 31-HRW, 2008 WL
10722357 (E.D. Ky. June 2, 2008) (requiring notice to current students before releasing
their directory information pursuant to subpoena where “the record does not reflect
whether [the university] provides the type of annual notice contemplated by FERPA.”).
The only possible exception is Alberts v. Wheeling Jesuit Univ., No. 5:09-CV109, 2010 U.S. Dist. LEXIS 40816 (N.D.W.V. Mar. 29, 2010), where a former professor
sought a list of names of students who attended faculty meetings in 2006-2007 (for use
in a discrimination lawsuit). Id. at *11. The university argued that the names constituted
“education records” that could not be disclosed under FERPA; the plaintiff responded
merely that the names were relevant to his case. Id. The court held that the student
names were not education records but did “qualify as directory information, which is
subject to notice and time for objection” prior to disclosure. Id. at *12. Based on the
dates involved (a February 2010 motion seeking names from 2006-2007), it is likely that
the information related to former students. The court, however, did not indicate that
these were former students, nor did it cite to or discuss section 99.37(a) or (b). For this
reason, to the extent Alberts required that notice be given to former students, this Court
does not find the holding persuasive.
8
B.
Specific Student Identifiers
CSI argues that even if notice is not required prior to disclosing directory
information associated with former students, it still must obtain student consent to
disclose data that cannot be classified as directory information. CSI identifies six such
categories: (1) student ID; (2) date of birth; (3) graduation credential; (4) non-Title IV
tuition information; (5) dates of attendance; and (6) course of study.
1.
Student IDs
FERPA provides that a student ID number may be considered directory
information “if the identifier cannot be used to gain access to education records except
when used in conjunction with one or more factors that authenticate the user’s identity,
such as a personal identification number (PIN), password or other factor known or
possessed only by the authorized user.” 34 C.F.R. § 99.3. At a hearing on May 28,
2015, this Court determined from information provided by the parties that student ID
numbers cannot be used to access education records without a password or PIN,
meaning they constitute directory information. For the reasons discussed earlier, the
fact that CSI chose not to designate student IDs as directory information until 2013,
(Doc. 149, at 13), does not mean that former students must receive notice before CSI
discloses their student IDs in this case.
2.
Date of Birth
A student’s date of birth is expressly listed as an example of directory
information. 34 C.F.R. § 99.3. CSI’s only basis for refusing to disclose date of birth is
the fact that it has never designated date of birth as directory information. (Doc. 149, at
13). Once again, the Court does not find that argument persuasive. CSI also cites
9
Richardson v. Board of Educ. of Huber Heights City Schools, No. 3:12-CV-00342, 2014
WL 8619228 (S.D. Ohio Mar. 11, 2014), for the proposition that “courts require that
institutions redact date of birth before disclosing documents.” (Doc. 149, at 14). In
Richardson, the court ordered the production of student disciplinary files in connection
with a lawsuit seeking redress for a hazing incident, finding the documents relevant to
the issues in the case.
Id. at *1-2.
The court also found, however, that personal
identifiers, such as student ID numbers, dates of birth, addresses, and photographs had
to be redacted prior to production. Id. at *3. Given that the Richardson court was
addressing identifiers linked with disciplinary records, the case is not instructive as to
whether date of birth, standing apart from any sensitive data, may constitute “directory
information.”
On the record presented, CSI may disclose the dates of birth of former students
without giving them notice and an opportunity to opt out.
3.
Graduation Credential
Relators want to know whether, at the time of enrollment, each particular student
had a high school diploma or GED, or took and passed an Ability to Benefit (“ATB”) test
administered by CSI (i.e., their “graduation credential”).
CSI first objects, without
supporting citation, that since it “maintains this information in students’ educational
records,” it is not “directory information” subject to disclosure. (Doc. 149, at 14). In the
absence of any authority suggesting that information that otherwise qualifies as
“directory information” loses that status if an educational institution decides to place the
information in educational records, CSI’s argument in that regard is rejected.
10
CSI also contends that graduation credentials are not directory information in any
event. It is true that the non-exhaustive list of directory information does not expressly
include graduation credential, but Relators say the information is of the same type as
“degrees, honors, and awards received; and the most recent educational agency or
institution attended,” all of which are expressly identified as directory information. (Doc.
146, at 12). The Court agrees that the phrase “degrees, honors and awards received”
fairly encompasses whether a student received a high school diploma or its
equivalency, a GED. The phrase is not, as CSI suggests, limited to degrees the student
received from CSI. The diploma and GED data may be disclosed without prior notice to
former students.
This Court is not persuaded, however, that information about whether a student
passed an ATB test administered by CSI reasonably qualifies as directory information
regarding a “graduation credential” (as Relators put it). This test is administered to
students who do not have a diploma or GED in order for them to qualify to receive
government financial aid awards.
The definition of directory information does not
include a list of standardized tests a student took – be it the SAT, ACT or ATB – and
you would not expect to find such private information in a student directory. The Court
recognizes that as a practical matter, process of elimination likely will allow Relators to
determine which students took the ATB test in this case. Nevertheless, that information
is not “directory information” and may not be disclosed absent student consent.
4.
Non-Title IV Tuition Information
Relators also seek tuition payment information for students in the ESL program.
The regulations do not include tuition payments as a type of directory information, but
11
Relators claim that ESL tuition qualifies because it “is not of a confidential or sensitive
nature and CSI does not treat it as such.” (Doc. 146, at 12). By way of example,
Relators note that CSI “has a ‘net price calculator’ on its website where students can
estimate tuition and fees and posts the fees for its ESL programs on its website.” (Id.)
(citing CSI Tuition & Fees webpage, www.csinow.edu/esl/tuition-fees, last visited May
21, 2015). According to the webpage, tuition ranges from $3,600 to $6,000 per year,
depending on the specific ESL program, plus quarterly book fees of between $90 and
$150.
In the Court’s view, the fact that tuition rates for ESL programs are publicly
available is insufficient to justify treating individual student tuition payments as directory
information. Tuition payments are not the type of information that generally appears in
a student directory, and disclosing individual financial data would be a clear invasion of
privacy. CSI may not disclose ESL tuition payment information without first obtaining
consent.
5.
Dates of Attendance
As with date of birth, dates of attendance is expressly included as directory
information and defined as follows: “the period of time during which a student attends or
attended an educational agency or institution. Examples of dates of attendance include
an academic year, a spring semester, or a first quarter.” 34 C.F.R. § 99.3. CSI may
produce this attendance information without notice to former students. CSI’s argument
that it cannot do so since it never designated dates of attendance as directory
information is rejected for the reasons already stated. (Doc. 149, at 15).
12
Relators seek more than this, however, insisting that CSI also produce specific
dates that each student was in class. As Relators explain, “CSI determines whether a
student has started a program based on their attendance in the first five days, . . . and
considers a student to have dropped out if not attending classes for more than 14
calendar days.”
(Doc. 150, at 8 n.4) (citing CSI “Job Description: Admissions
Representative,” Doc. 150, Ex. E, at 73). The problem with Relators’ request is that
pursuant to the FERPA regulations, the term dates of attendance “does not include
specific daily records of a student’s attendance at an educational agency or institution.”
34 C.F.R. § 99.3. For this reason, CSI must obtain student consent before it produces
daily attendance records.
6.
Course of Study
Relators asked CSI to produce “courses” for each former student, prompting CSI
to object that directory information does not include data about the individual courses a
student took while at CSI. Relators have now clarified that they “do not seek data on
the individual courses that former students took” but instead want to know the students’
“course of study,” meaning the type of program each student pursued at CSI (e.g., the
Healthcare Program, the Network Career Program, etc.). (Doc. 146, at 11). With this
limitation, the Court agrees that course of study falls within the definition of directory
information. See 34 C.F.R. § 99.3 (defining directory information to include “major field
of study.”).
(See also Doc. 149, at 13 n.4) (confirming that CSI itself designated
“program of study” as directory information from May through December 2011). CSI’s
assertion that it may only produce the program/course of study information for students
13
who attended CSI between May and December 2011 is without merit, as already
explained.
CONCLUSION
For the reasons stated above, CSI’s objection that it cannot produce directory
information relating to former students without first providing notice and an opportunity
to opt out under FERPA is overruled. CSI’s objections that certain of the requested
student identifiers do not constitute directory information are sustained in part and
overruled in part.
ENTER:
Dated: June 2, 2015
_____________________________
SHEILA FINNEGAN
United States Magistrate Judge
14
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?