What a Judge Doesn’t Understand About Digital Privacy May Harm Your Children

Key Points

• A federal judge’s decision to disclose the complete records of an estimated 10 million California public schoolchildren to a private plaintiff raises serious concerns about privacy and digital security.
• A simple two-part framework can help the judiciary properly balance affected parties’ privacy interests and cybersecurity concerns against the need for trial discovery. First, the court should protect privacy by limiting the exposure of sensitive and superfluous information. Second, once the court has decided which sensitive data to expose, it must act to protect those data.
• These strategies will not prevent all data spills, but they will raise the awareness and protective diligence of all the concerned parties.

Read the full PDF.

Introduction

In this era of big data, how should a judge prudently measure the parties’ burdens—including privacy and cybersecurity concerns—and still permit discovery as a legitimate case may demand? It is a simple question of remarkable import. The judiciary is given special privilege as the gatekeeper to this country’s and each individual’s most guarded information. Even congressional statutes that promote extreme privacy protections carve out a judicial order exception.¹

But what if the threat of massive privacy invasion of millions was not in some hypothetical future? What if the release of incredibly sensitive data, such as names, Social Security numbers, birth dates, addresses, mental health records, medication lists, disciplinary records, and more, was not a threat, but the very real result of a judicial order? And what if the data to be released were of the most vulnerable population in the United States: children?

The scenario is exactly the reality faced by parents and guardians of children who attended any California public school since January 1, 2008.² A federal judge ordered the California Department of Education to gather, consolidate, and disclose to the plaintiffs the complete student records of all California public schoolchildren during this time frame—an estimated 10 million student records.³ The plaintiffs in Morgan Hill Concerned Parents Association v. California Department of Education, a local parent group and a statewide parent association, will have nearly unfettered access to those students’ records.⁴

The case is sympathetic to be sure: a parent organization in the southern tip of Silicon Valley raised concerns that some special education students are not receiving appropriate academic accommodations. A statewide parent organization joined, and the case expanded its focus to the special education accommodations being provided in every California school district.

The data in question are maintained by the California Longitudinal Pupil Achievement Data System (CALPADS), a data system that tracks every California public school student from kindergarten through 12th grade. Initially the judge ordered CALPADS to be physically transferred to the plaintiffs.⁵ Fortunately, the judge amended this part of the order to keep CALPADS on site with the defendant but gave the plaintiffs full access to search, copy, and transfer any data from CALPADS under supervision by the special master.⁶

Despite the amendment, there are still strong privacy and cybersecurity concerns left unaddressed. First, why should private plaintiffs have any access to highly private, identifying information of any students, let alone all the public schoolchildren in California?⁷ Second, after the private plaintiffs run their analyses, how are the results to be stored, transferred, and later destroyed? The first question is a privacy concern, and the second is primarily a cybersecurity concern. A judge must be concerned with both.

Read the full report.

Notes

1. For examples of statutes that allow courts to order the disclosure of congressionally protected information, see 20 U.S.C. § 1232g(b)(2)(B) (2013) and 45 C.F.R. § 164.512(f)(1)(ii)(A) (2016).
2. See Morgan Hill Concerned Parents Association v. California Department of Education, 2013 WL 1326301 Notice of Disclosure of Student Records Case No. 2:11-CV-03471 (Dist. Ct. E.D. 2013), http://www.cde.ca.gov/re/di/ws/documents/order2016jan26.pdf.
3. See California Department of Education Educational Demographics Unit, “Enrollment by Grade for 2014–15: Statewide Enrollment by Grade,” accessed March 23, 2016, http://dq.cde.ca.gov/dataquest/Enrollment/GradeEnr.aspx?cChoice= StEnrGrd&cYear= 2014-15&cLevel=State&cTopic=Enrollment&myTimeFrame=S&cType=ALL&cGender=B. See also California Department of Education Data Reporting Office, “Enrollment, Graduates and Dropouts in California Public Schools, 1974–75 Through 2013–14,” accessed March 23, 2016, http://dq.cde.ca.gov/dataquest/EnrGradDrop.asp. Looking at the data, approximately 6,235,000 students in grades K–12 were enrolled in California public schools in the 2014–15 academic year. Then, approximately 2,837,000 students graduated from California public schools between 2008 and 2014. That results in nearly 9.1 million students but does not account for dropouts and students that transferred out of the California public school system.
4. See Morgan Hill Concerned Parents Association v. California Department of Education, 2013 WL 1326301 Notice of Disclosure of Student Records Case No. 2:11-CV-03471 (Dist. Ct. E.D. 2013).
5. See Morgan Hill Concerned Parents Association v. California Department of Education, Case no. 2:11-CV-03471, Order ECF No. 164, 6:16-28 (March 1, 2016).
6. Ibid.
7. See, for example, Morgan Hill Concerned Parents Association v. California Department of Education, Case no. 2:11-CV-03471, Letter from Sonora Union High School District ECF No. 173 (April 12, 2016).

• California
• Cybersecurity
• Judges
• Judiciary
• Plaintiff
• Privacy
• Security