By Jim Small | Arizona Center for Investigative Reporting
he Arizona State Board of Education violated federal student privacy law by disclosing the names of more than a thousand Arizona students, in some cases along with their birthdays, and their scores on the AzMERIT exams in response to a public records request filed by AZCIR.
The students all attend schools that are appealing the letter grades awarded in October by the Board of Education. AZCIR filed a public records request for all such appeals, and the Board of Education on Oct. 13 provided the documents that were submitted by 73 schools. AZCIR published those documents Oct. 16 as part of its reporting detailing the reasons schools cited for appealing their grades.
However, Board staff did not redact identifying student information from the files before complying with the records request, as required by federal law. The Family Educational Rights and Privacy Act, or FERPA, is a federal law that protects the privacy of student education records, including family information, test scores, grades and disciplinary records.
FERPA applies to schools and other educational institutions that accept federal funding, including the State Board of Education. Violators risk losing their federal funding.
Carrie O’Brien, an attorney at Gust Rosenfeld and the Arizona Department of Education’s chief privacy officer and director of legal services from 2012 to 2016, said the breach is troubling, and should prompt the Board of Education to revisit its data practices.
“If I was a parent, and that was my kid’s data, I wouldn’t have been happy,” she said. “The fact that it was published on the Internet makes it worse. The magnitude is that much greater.”
AZCIR learned on Oct. 24 that the documents it published included federally protected student information when an administrator for New School for the Arts and Academics, a charter school in Tempe, asked for documents related to its appeal to be removed from the AZCIR website.
The charter school also informed the Arizona Department of Education that its student data had been released to the media.
Upon examination, AZCIR discovered that student names were included in appeals filings for six schools: Cesar Chavez High School, Flagstaff Arts and Leadership Academy, Leading Edge Academy East Mesa, New School for the Arts and Academics, Paramount Academy and Sinagua Middle School.
In addition to the names, the data included student scores on AzMERIT tests. In several cases, student birthdays were aso included.
AZCIR immediately removed the files from its website.
On Oct. 25, Catcher Baden, the Board of Education’s deputy director and spokesman, told AZCIR that the Board had learned of the disclosure earlier that day. He said he could not comment at that time.
The next day, the Board of Education informed AZCIR and other media organizations that it had incorrectly released records with student identifying information. It is unknown if the Board informed the schools whose students’ privacy was violated, though an administrator at one of the schools was unaware of the disclosure until contacted by AZCIR.
Dr. Karol Schmidt, the executive director of the Board of Education, said her staff had actually prepared redacted versions of the appeals documents, but an employee inadvertently sent the original documents to the media.
“It was an honest mistake,” she said.
Schmidt said the employee who made the mistake was still on staff, but she declined to identify the employee. However, she did say that the Board is adding new procedures to ensure similar disclosures don’t happen in the future.
“Going forward, there will be review by the executive director and attorney general, as appropriate, before the files go out,” she said.
