Why I disagree with the judge's ruling on student COVID data & FERPA

Ruling against student newspaper elevates student privacy over public health

Last week a Rockingham County Circuit Judge ruled in favor of James Madison University in a case brought by the editor of JMU’s student newspaper, The Breeze, over the access to the per-day number of COVID-positive cases per on-campus residence.1

Armchair-quarterback that I am, I’ve read the ruling, which is posted at the bottom of this post (h/t to the paper’s editor and faculty adviser), and probably unsurprisingly, I disagree.

The ruling says the university rightly cited the Family Educational Rights & Privacy Act (FERPA) when it initially withheld, then delayed disclosing by more than a month, student COVID cases broken down by campus residence. In other words, the ruling validated a policy that essentially says an individual student’s privacy rights are greater than the rights of all other students in the same residence — or campus, even — to protect themselves or to know whether they may have been exposed, thus potentially exposing others that he or she later came into contact with.

How it started

On Jan. 25, 2021, the editor, Jake Conley, filed a FOIA request for COVID cases during a 4-day period: Jan. 19 through Jan. 22. The university cited FERPA when denying earlier requests, but said on Feb. 2, 2021, that it would provide the data in the future after a one-month delay, meaning January data would be provided on March 1 and so on.

Conley brought the case on his own, without the help of a lawyer. He argued that FERPA did not prohibit the disclosure of aggregate data when individual students weren’t identifiable.

JMU, represented by the AG’s office, filed a response with exhibits totaling 47 pages.2 In it, they said that the Student Privacy Office of the U.S. Department of Education said in May 2013 that when releasing aggregate data, educational institutions should minimize the risk of identification:

the entity disclosing the data should evaluate the risk of . . . disclosure within the context of the data that will be used, and choose a safeguard strategy that is most appropriate for that particular context.

Refusing to or delaying release of the dorm-specific data was an “institutional decision” exercised in good faith in order to comply with FERPA, the response said.

The response did not mention the Sept. 24, 2020, set of FAQs issued by the exact same office on the specific issue of COVID data:

May a school disclose the number of students who have COVID-19 in order to provide general health data to the public (including the media) without prior written consent?

Yes, provided that the information the school shares does not allow for any individual student to be identified. Similar to sharing information with the school community, if a school discloses information about students in a non-identifiable form, then consent is not needed under FERPA. As discussed above, when a school determines what information may be shared without prior written consent, the school must take into account other reasonably available information that might allow non-identifiable information to become identifiable.

That “as discussed above” reference included this example:

For example, a school generally could release the fact that five students are absent due to COVID-19 without disclosing the students’ identities. This would be allowed under FERPA as long as there are a sufficient number of other students who attend the school and other students at the school are absent for other reasons. However, we caution schools to ensure that in releasing such facts, they do so in a way that does not reveal information that, alone or in combination with other information, would allow a person in the school community to identify the students who are absent due to COVID-19.

In siding with JMU, the judge said the data:

show very small numbers of positive tests on any given date within each dormitory. Therefore, it is very easy to correlate the extended, required absence of an individual from the dormitory with the information provided. If one student is removed from the dormitory and placed in an isolation dormitory due to a positive test . . . they certainly are identifiable to their friends and maybe even some of their dorm-mates. If that positive test is revealed by the school [through FOIA], they become identifiable with a small amount of linked information, such as their absence or other data to the requestor and those with whom the requestor shares the data.

Noting that COVID-positive students are placed in isolation for 10-14 days:

Waiting the short additional time frame [to receive the data] allows these students to return and protect their identity from exposure by the dorm-specific data.

The university has “not acted capriciously” in delaying the release and had not, therefore, violated FOIA, the judge concluded.

Sigh.

So, what’s my problem?

This isn’t critical, but it bugs me that the university is relying on a general-context handout on releasing aggregate data from 2013 instead of the COVID-specific directive from 2020. The 2020 handout isn’t significantly different, but it is most certainly more relevant than the one created in an era when protecting ourselves from a deadly virus was not an overwhelming concern.

Both handouts talk about minimizing the risk of identifying individual students by disclosing information of small numbers of students who could be identified with “reasonably available information” (2013) or a “small amount of linked data” (2020).

The judge was clearly persuaded that because there were so few students being reported as COVID-positive each day, they could be identified by other information or data. But the judge was looking at numbers from mid-September through mid-December,3 where the highest single-day total was 6 cases, the highest 4-day average was 11 cases, and the 4-day average over the entire two months was just five cases. Less than one case per day was reported over the 91-day period.

According to the COVID case dashboard on the paper’s website, the 4-day total for the period in question (Jan. 19 through 22) was 28 cases. The 4-day average from Jan. 19 through March 1 (the day the Jan. 19-22 data was released and the day when 15 cases were reported), was 30: six times that of the previous semester’s 4-day average. In the 47 days between Jan. 19 and March 1, 284 cases had been confirmed, an average of six cases per day. Thirty cases were reported on Jan. 30.

These positive-testing students were being sent to quarantine or isolation for 10 to 14 days at a time. With an average of six cases per day, that means that between 60 and 84 students could be in isolation at any given time.

These are not small numbers of students!

Who knows what?

The judge acknowledged that the friends and dorm-mates of any one person removed for testing positive would know why that person was absent. Regardless of what FERPA says, those people might tell their friends, who might tell their friends and so on.

But I think it’s in error to then conclude that by releasing the per-dorm data to another requester (presumably someone who is not a dorm-mate or an outside friend), that it will somehow expose any one person to identification. There might have been 60 to 84 students missing from their dorms any one day. It is folly to think every student in that dorm is keeping tabs.

(In my recollection of dorm living, beyond my immediate hall-mates, I couldn’t tell you much of anything going on in any other part of my dorm. It was 10 floors, for goodness sake! I barely recognized half the hundreds of people in that dorm, much less knew whether they recently had a prolonged absence from their dorm room. How would I know whether they were in COVID isolation or just spending every night at their bae’s room and ducking in for a change of clothes when I wasn’t there to see them?)

Instead, the judge seemed to rely on the mosaic theory of disclosure — taking small and seemingly random bits of information and putting them together to figure out something that someone doesn’t want you to know — which often overplays the abilities of information-users to string bits of information together and their ability to reach the same or correct (read: bad) conclusion with that information.

Here, the judge seems to think that the newspaper (or a fellow student) would get this data — say, that 2 people from such-n-such dorm tested positive on a specific day — and then would go to that dorm to ask around about who was missing from their room, as of what day and how long they had been gone.

It’s unrealistic. And it’s ultimately irrelevant, at least to the newspaper. They are fellow students. If they really want to know who is in quarantine or who has recently tested positive, they have networks of friends who can likely confirm or refute a rumor.

But the newspaper doesn’t want to know who has COVID. It wants to know how MANY people have COVID and in which dorms.

Why? So they can inform and warn their fellow students!

The roommate may know of the one person who tested positive, but does she know of the person on another hall, another floor? The one she was in the elevator with yesterday morning? Does she know that four students in another dorm tested positive 2 days ago and potentially exposed a friend she met for coffee? She might not know, but the paper wanted her to be able to know if she wanted to.

Contrary to the judge’s finding, I don’t think the university’s policy of releasing the data a month later (and it was actually a month-and-a-half) was “appropriate” if that means students were denied the real-time ability to monitor the location and severity of cases. They were prevented from making decisions to protect themselves from possible exposure. How many more people contracted COVID because they had no idea they were stepping into a danger zone?

The judge’s ruling offers a too-narrow interpretation of FERPA, in my opinion. The number of positive cases each day in January was plenty high enough — unfortunately — to make aggregate release without identification possible. Indeed, scores of other universities have regularly provided per-dorm numbers and have not faced backlash from students or the DOE. The ruling elevates student privacy to dizzying heights while allowing the university community to remain in the dark about their own health risks.

1

The editor originally contested the release of data for three different time periods but then dropped his challenge to two of them during the court hearing on Aug. 26, 2021. The judge’s ruling therefore applies only to the data sought for the period Jan. 19 to Jan. 22, 2021.

2

The response admitted the interesting fact that the university was not tracking COVID-19 case data by location during the first month students had returned to campus in August 2020.

3

The data can be found on pages 27 and 28 of the university’s response brief.