Chicago Public Schools improperly redacted student cell size data under privacy exemptions

This reading view follows the source PDF's positioned text blocks. Page headers, repeated office furniture, and lower-margin notes are kept out of the narrative; source notes are available below. Reconstruction is automatic and imperfect — the PDF is the authoritative version, and it's linked on this page.

Dear Ms. Karp and Ms. Shull:

5 ILCS 140/ 7. 5( r) ( West 2016)). Specifically, CPS stated that it had redacted " student identifiers where there are less than 10. i3 On June 13, 2017, this office received Ms. Karp' s Request for Review disputing the redactions to the spreadsheet. She stated: " There is no way that I can identify any individual student with the information requested, nor is it my intention. i4 On June 23, 2017, this office forwarded a copy of the Request for Review to CPS and asked it to provide an unredacted copy of the record that was withheld for this office's confidential review, together with a detailed explanation of the legal and factual basis for the asserted exemptions. On July 18, 2017, CPS provided the requested materials. On July 19, 2017, this office forwarded a copy of CPS' response to Ms. Karp. She replied on September 6, 2017, noting that WBEZ had received the same type of record without redactions from CPS in 2011. Ms. Karp also provided this office with a copy of the record that WBEZ had received that year.

In its response to this office, CPS stated that it had furnished Ms. Karp with " a document listing offers made by each * * * selective enrollment high school and the corresponding grammar school of the student( s) receiving the offer" but had redacted certain student cell sizes of less than 10 students so as not to personally identify any student who received an offer" where the total number of students from a specific grammar school totaled less than 10 students. 5 CPS asserted, in pertinent part:

The small number of students offered enrollment at a particular selective enrollment school that also attended a particular elementary school makes it possible for a reasonable person within the school community to identify a student even without the release of the student' s name, therefore pursuant to ISSRA parent consent is required for release of this information.

Chicago Public Schools' standard redaction practice is to use the ' Rule of 10.' This standard is used when redacting aggregate reporting of student record information involving small cell size prior to public release. This standard is one that both the Illinois State Board of Education (ISBE) and the Chicago Public Schools have long -employed to comply with the student record privacy requirements found in the Illinois Student Records Act 105 ILCS 10/ 1)( ISSRA) and the Federal Educational Rights and Privacy Act ( 20 U. S. C. § 1232g; 34 CFR Part 99)( FERPA).

The guiding principle behind establishing a minimum cell size for redactions is [ to] ensure that the release of de -identified student information for a small number of students would not allow those students to be indirectly identified by a reasonable person in the student' s school community thereby revealing their confidential student information. 161 CPS' response to this office also alluded to the following example from the Federal guidelines on protecting personally identifiable student information issued by the U. S. Department of Education (Department of Education):

5Letter from Elyssa Shull, Freedom of Information Act Officer, Chicago Public Schools, to Teresa Lim, Assistant Attorney General, Public Access Bureau ( July 18, 2017).

I] t might be well known among students, teachers, administrators, parents, coaches, volunteers or others at a local high school that a student was caught bringing a gun to class last month but generally unknown in the town where the school is located. In these circumstances, a school district may not disclose that a high school student was suspended for bringing a gun to class last month, even though a reasonable person in the community where the school is located would not be able to identify the student, because a reasonable person in the high school would be able to identify the student." ( See 73 FR 74806 at 7832). 2 This office has reviewed additional Federal guidelines issued by the Department. According to the Federal guidelines, "[ t] he simple removal of nominal or direct identifiers, such as name and SSN ( or other ID number), does not necessarily avoid the release of personally identifiable information" because "[ o] ther information, such as address, date and place of birth, race, ethnicity, gender, physical description, disability, activities and accomplishments, disciplinary actions, and so forth, can indirectly identify someone depending on the combination offactors and level of detail released." ( Emphasis added.) 8 Thus, the Federal guidelines explain, the " reasonable person" standard is intended to " provide[ ] the standard an agency or institution should use to determine whether statistical information or a redacted record will identify a student, even though certain identifiers have been removed, because of a well- publicized incident or some other factor known in the community." ( Emphasis added.) 9 The Department' s Privacy Technical Assistance Center has issued further guidance on the The FERPA [ Family Educational Rights and Privacy Act] standard for de -identification assesses whether a " reasonable person in the school community who does not have personal knowledge of the relevant circumstances" could identify individual students based on reasonably available information ( 34 CFR § 99. 3 and 99. 31( b)( 1)). This includes other public information released by an agency, such as a report presenting detailed data in tables with small size cells. The " reasonable person" standard should be used by state and local educational agencies and institutions to determine whether statistical information or records have been sufficiently redacted prior to release such that a " reasonable person" ( i. e., a hypothetical, rational, prudent, average individual) in the school community should not be able to identify a student because of some well- publicized event, communications, or other similar factor. School officials, including teachers, administrators, coaches, and volunteers, are not considered in making the reasonable person determination since they are presumed to have inside knowledge of the relevant circumstances and ofthe identity of the students. ( Emphasis added.) 11° 1 In this matter, the contested information is markedly different from the types of student information to which the rule of 10 applies pursuant to the Federal guidelines. With student demographic data, certain fields may be redacted to protect the identity of students when the fields taken together would enable students to be individually identified. The question with student demographic data is how many descriptors of an individual student must be removed in order to avoid identifying that student. For example, if there are a very small number of students of a particular race or ethnicity at a school, redaction of those students' race or ethnicity may be necessary to prevent those students from being identified in demographic data. In contrast, the records at issue here contain no attributes of specific students— they merely reflect the number of students from certain elementary schools who were given offers to attend particular selective enrollment schools. Student cell size counts do not individually identify students absent additional details about the students, such as demographic information or a description of a well- publicized event involving the students. Cf. Ill. Att'y Gen. PAC Req. Rev. Ltr. 46840, issued September 14, 2017, at 3- 4 ( student discipline data properly redacted where students' identities could be ascertained from small group sizes combined with the release of various racial and ethnographic data about the students); Ill. Att'y Gen. PAC Req. Rev. Ltr. 44301, issued January 27, 2017, at 4 ( records of school investigation exempt from disclosure because " specific events 10Privacy Technical Assistance Center, U. S. Department of Education, Frequently Asked Questions — Disclosure Avoidance (revised July 2015), http:// ptac. ed. gov/ sites/ default/ files/ FAQ_ DisclosureAvoidance. pdf, at 2.

and circumstances are discussed that could be used to identify individual students who were the subject of the records"). CPS has not identified any well- publicized event or other circumstance from which students in the data at issue may be individually identified.

Although a person in a school community may be independently aware of students who were chosen for selective enrollment, a " Rule of 10" standard would be no more effective at protecting students' identities under those circumstances than a " Rule of 100" or a Rule of 1, 000" because it would be solely the community member' s independent knowledge, rather than any information within the list of how many students came from each school, that could individually identify the students. A reasonable person in a school community who does not have personal knowledge of which students were selected would not be able to ascertain the identity of any student if the cells with less than ten students were to be disclosed. Therefore, this office concludes that CPS has not demonstrated by clear and convincing evidence that student cell size counts of less than 10 are exempt from disclosure under section 7. 5( r) of FOIA.

In accordance with the conclusions expressed in this determination, this office requests that CPS disclose to Ms. Karp the student cell size counts consisting of less than 10 students. The Public Access Counselor has determined that resolution of this matter does not require the issuance of a binding opinion. This letter shall serve to close this matter. If you have any questions, please contact me at the Chicago address listed on the first page of this letter.

Very truly yours,