The Results Are In: Individual State Bar Applicant Data is Outside the Scope of the CPRA … For Now

Harrison (Buzz) Frahn
Michael R. Morey
Katerina Siefkas
Simpson Thacher & Bartlett LLP

On August 23, 2018, the California Court of Appeal, First District, affirmed the Superior Court of San Francisco City and County’s holding that the State Bar of California was not required to disclose individual-level data for applicants to the State Bar in response to several California Public Records Act (“CPRA”) requests seeking such data. Sander v. Superior Court, 237 Cal. Rptr. 3d 276 (Cal. Ct. App. 2018) (hereafter, the “Appellate Opinion”). The decision came after roughly ten years of litigation balancing the State Bar’s obligations to release applicant data to the public against the privacy interests of State Bar applicants. Although the Superior Court based its decision on five separate grounds, the Court of Appeal addressed only one of the grounds and found that the State Bar was not required to disclose the applicant data because it would have to create new records when disclosing the data to protect the applicants’ privacy, thus bringing the disclosure outside the scope of the CPRA. Id. at 280. On November 14, 2018, the California Supreme Court denied the appellants’ petition for review, cementing for now the State Bar’s lack of obligation to disclose individual-level applicant data under the CPRA.

Factual Background and Procedural History

In the early summer of 2008, UCLA law professor Dr. Richard Sander, former State Bar of California governor Joe Hicks, and the First Amendment Coalition (collectively, the “Petitioners”) sent CPRA requests to the State Bar of California seeking “individual-level” law school and bar admission data for all applicants to the State Bar from 1972 to 2008 (hereafter, the “Requests”). Sander v. The State Bar of California, No. CPF-08-508880, 2016 WL 6594874, at *2 (Cal. Super. Ct. Nov. 7, 2016) (hereafter, the “Trial Court Opinion”). The Requests specifically sought the following data for all applicants to the State Bar from 1972 to 2008: (a) “race,” (b) “law school,” (c) “whether an applicant was a ‘transfer student,’” (d) “year of law school graduation,” (e) “law school grade point average (“GPA”),” (f) “undergraduate GPA,” (g) “Law School Admission Test (“LSAT”) score,” (h) “whether the applicant passed the California bar exam,” and (i) “raw and scaled scores for each component of each California bar exam taken.” Id. The Petitioners sought this data to conduct a study on whether there was a “relationship between preferential admissions programs in higher education” and discrepancies in “bar passage rates between racial and ethnic groups.” Appellate Opinion at 280. The State Bar refused to produce the requested data and, in October 2008, the Petitioners filed a writ of mandate in the Superior Court of California for San Francisco City and County against the State Bar seeking to require the State Bar to produce the data. Trial Court Opinion at *2-3.

The Petitioners and the State Bar stipulated to conduct the litigation in two phases: (1) Phase I addressed “whether the State Bar ha[d] any legal duty to produce the requested records,” and (2) Phase II addressed “whether the provision of the requested records to Petitioners would violate the privacy of any person, and whether the cost or burden of manipulation, reproduction, or disclosure of the requested records provide[d] a basis for denying or limiting disclosure.” Id. at *3. Phase I concluded in 2013 with a decision by the California Supreme Court that, under California’s common law right of public access, there was a “sufficient public interest in the information” requested by the Petitioners that the State Bar should “provide access to it.” Appellate Opinion at 280. The California Supreme Court qualified its decision by holding that the trial court must address the following two issues before requiring the State Bar to produce the requested data: (1) whether it was possible to release the requested data in a way that did not violate the applicants’ privacy, and (2) whether there were any other interests that “outweigh[ed] the public’s interest in disclosure.” Id. at 280-81. On remand, the State Bar allowed the Petitioners’ experts to examine a subset of the requested data to determine whether it was possible to produce it in a form that would protect the State Bar applicants’ privacy. Id.

While Phase II of the litigation was still pending, the California Legislature passed Business and Professions Code section 6026.11, a provision that generally made State Bar records subject to CPRA requests. Id. However, Business and Professions Code section 6060.25—enacted at the same time as section 6026.11—exempted certain State Bar records containing data that “may identify an individual applicant” from the scope of the CPRA. Trial Court Opinion at *3-5, *7. The trial for Phase II began on July 11, 2016 in the wake of these newly enacted provisions. Id. at *4.

The Trial Court Decision

(A) Petitioners Propose Four Protocols To Protect Applicant Privacy

At trial, the Petitioners presented four different protocols that their experts determined the State Bar could use to protect the applicants’ privacy rights when the State Bar produced the data sought by the Requests. Id. at *4.

1. Protocol One proposed that the State Bar could, among other steps, (a) create a “physical data enclave” that provided restricted access to the requested data, (b) remove all “personally identifying information” (i.e., names, addresses, and Social Security numbers) from the data, and (c) require any person wishing to access the data “to sign Data User Agreements through which they agree not to attempt to identify individuals or disclose any inadvertent identifications” and which would “limit what items members of the public can take into and out of the enclave.” Id. at *12.
2. Protocol Two proposed that the State Bar could (a) create “a public use file” for the requested data, and (b) combine or eliminate “aspects of the data that would tend to produce only a few matches.” Id. For example, “data related to persons graduating from unaccredited law schools would be eliminated, or race categories would be reduced from eight to four….” Id.
3. Protocol Three also proposed that the State Bar could create a public use file “using a variety of de-identification techniques,” such as eliminating law school names from the data, and standardizing applicants’ LSAT scores and GPAs “to reflect . . . a computed average,” rather than the applicants’ “actual scores and GPAs.” Id. at *14.
4. Protocol Four was similar to Protocol Two, and added additional techniques that focused on preventing the identification of an individual applicant by a person who knew the applicant’s GPA, such as “round[ing] . . . GPAs to two significant digits.” Id. at *13.

The State Bar argued that if it used the Petitioners’ proposed protocols when producing the requested data, then the State Bar would be forced to create new records, which the State Bar argued it was not required to do when responding to CPRA requests. Id. at *5-6. The State Bar also asserted that even if it followed the procedures of any one of the four protocols, significant risks remained that the produced data would individually identify the applicants, and thus violate their privacy. Id. at *4.

(B) Petitioners’ Protocols Fail To Adequately Protect Privacy And Demand More Than What The CPRA Requires

The trial court agreed that the State Bar did not have to release the requested data and based its holding on five separate grounds. Id. at *5. First, the trial court ruled that the State Bar would be forced to create new records to comply with the Petitioners’ proposed protocols to protect the applicants’ privacy, and that the CPRA does not require the creation of new records to comply with information requests. Id. Second, the trial court decided that disclosure of the requested data would violate the Business and Professions Code section 6060.25 because it could be used to re-identify the applicants. Id. at *5,*7. The trial court also found that the following three provisions of the CPRA each exempted the State Bar from disclosing the requested data: (a) Government Code Section 6254(c) which protects against disclosure of information that would be “an unwarranted invasion of personal privacy,” (b) Government Code Section 6254 (k), which prohibits releasing the information if it is barred by other federal or state law, and (c) Government Code Section 6255(a), which is a “catch-all exemption” that “balance[s] the public interest in disclosure against the public interest in non-disclosure.” Id. at *5, *7-10.

The trial court’s main focus in ruling for the State Bar was the applicants’ privacy. The trial court agreed with the State Bar and its experts that the Petitioners’ proposed protocols to protect the applicants’ privacy did not sufficiently reduce the risk of the applicants being individually identifiable. Id. at *12. The court found that, even after applying Protocols One, Two, and Four, a high percentage of unique records would still exist in the resulting datasets, which would contribute to a serious risk of individual identification. Id. at *13. The trial court was also concerned that even if an applicant could not be individually identified, the requested data still posed a risk of “attribute disclosure[],” wherein “a person is able to determine that an applicant who attended a particular law school, graduated at a certain year, and is of a certain race/ethnicity must also be one of such applicants who share a certain range of law school GPA, for example.” Id. at *14. Accordingly, because of the significant risk of identification, the trial court held that disclosure would violate Business and Professions Code section 6060.25, which the trial court determined was an absolute bar against disclosure if an applicant “may” be identified from the release of their data. Id. at *7. And, although the trial court also found that Protocol Three posed less of a risk of individually identifying applicants, the court determined that Protocol Three’s proposed manner of distilling and grouping the data eliminated the disclosed data’s value. Id. at *14.

The trial court also determined that producing the requested data under the Petitioners’ proposed protocols would violate Government Code Section 6254(c)––the CPRA exemption concerned with “invasion of personal privacy.” Id. at *8. In analyzing this provision, the trial court weighed the public interest in disclosing the requested data and the applicants’ privacy interest in nondisclosure. Id. While the trial court agreed that there was a strong public interest in understanding the bar admission process and any discrepancies therein, the trial court concluded that the applicants’ privacy interest in nondisclosure was stronger because of the risk of identification and potential stigma resulting from the possibility of the data being “used to draw broad conclusions.” Id. at *8-9.

The trial court also examined how the risk of individual identification from the disclosure of the requested data would affect the State Bar’s ability to collect and release other data. Id. at *10. In examining the CPRA’s “catch-all exemption,” Government Code Section 6255(a), the trial court found that “the public interest in non-disclosure clearly outweigh[ed] the public interest” in disclosure in part because disclosure would impede the State Bar’s collection of data that was “necessary, or otherwise helpful, to the performance of its functions.” Id. The court noted that concerns about privacy would make individuals and entities reluctant to provide such data to the State Bar. Id. It also stated that allowing the Petitioners’ Requests would likely lead to other parties’ making “similar requests in the future” which would result in the release of large amounts of individual data. Id. at *11. The trial court concluded that having this much applicant data available to the public would significantly increase the risk that any “valuable, non-identifying” data that the State Bar released in the future would contribute to the ease of identifying State Bar applicants. Id.

The Petitioners appealed the trial court’s decision.

The Appellate Court Decision

The California Court of Appeals affirmed the trial court’s decision on August 23, 2018. Appellate Opinion at 279. The appellate court addressed only one of the five grounds that the trial court relied on in denying the Petitioners’ writ of mandate, and held that there was no need to reach the other grounds because one ground was sufficient. Id. at 280. The appellate court agreed with the trial court and the State Bar that the Petitioners’ proposed protocols to protect the applicants’ privacy would force the State Bar to create new records, and the CPRA does not require responding entities to create new records to respond to information requests. Id. at 286, 292.

The appellate court began its analysis of the trial court’s decision by noting that, although the goal of the CPRA is to ensure transparency between the government and the public, there is a “tension” between this goal and “the equally important public interest in protecting citizens and public servants from unwarranted exposure of private matters.” Id. at 286-87. And despite the CPRA’s presumption that disclosure should occur unless an exemption applies, the appellate court ruled that the question presented on appeal was not whether the data sought by the Petitioners fell under an applicable exemption to the CPRA, but whether the “information in the form” that the Petitioners wanted was even included under the “obligations imposed by the CPRA.” Id. at 287.

The appellate court then held that there was no obligation to create new records when responding to CPRA requests. Id. at 288. Citing to both California precedent and precedent relating to the federal Freedom of Information Act, the appellate court stated that the State Bar only had a duty to release records that already existed at the time of the request, not to create a new data file to comply with the request. Id. The appellate court noted a distinction between “searching, extracting, compiling, or redacting” already-existing data and creating new data values, which is what the Petitioners’ proposed protocols asked the State Bar to do. Id. at 289.

Petitioners made several unsuccessful arguments for why the State Bar should be compelled to produce the requested data. First, the Petitioners argued that their proposed protocols did not require creation of new data but “merely required the State Bar to redact or manipulate existing data and do some computer programming” which was within the scope of the CPRA. Id. at 290. The appellate court disagreed and found compelling the trial court’s review of the Petitioners’ four proposed protocols and reasoning for why each one of the protocols would compel the State Bar to create new records. Id. at 289-90. For example, Protocol One required the State Bar to create new coding values and recode the data to fit within these values, as well as the creation of a “physical data enclave.” Id.Protocols Two and Four required the State Bar to create new data categories and calculate new values to mask data that could individually identify applicants. Id. The appellate court agreed with the trial court that the Petitioners’ protocols did not simply require the State Bar to redact certain data––instead, the protocols required the State Bar to recode and produce new data. Id.

The Petitioners also argued that the State Bar should disclose the requested data because two provisions of the CPRA permitted public agencies to charge costs to the requestor related to “data compilation, extraction or programming” and to delay responding to the request because of “the time it takes to ‘compile data, [] write programming language,’” showing that the creation of new records is contemplated within the CPRA.Id. at 290 (citing Government Code Sections 6253.9 (b)(2), 6253 (c)(4)). The appellate court disagreed and found that the provisions cited by the Petitioners did not encompass the work required by the proposed protocols to protect the applicants’ privacy if the State Bar was forced to respond to the Requests. Id. at 290-91. The appellate court noted that the Petitioners provided no examples of when an agency was forced “to undertake programming that would assign new or different values to existing data, replace groups of data with median figures or variables, and collapse and band data into newly defined categories.” Id. at 291.

The Petitioners further contended that the trial court “on its own initiative should have concocted a plan for disclosing at least some of the bar application data ‘subject to a process that entails only redaction of information, which would not require creating anything.’” Id. at 291. In particular, the Petitioners asserted that, as a public agency, the trial court itself had the burden of “prov[ing] a basis for nondisclosure of a public record.” Id. Because Petitioners had not raised the issue of only partially releasing data at the lower court level, the appellate court did not rule on this issue, but noted that “it seem[ed] odd for Petitioners to expect the trial court to succeed where their own experts in this highly technical field did not.” Id. at 291-92.

On November 14, 2018, the California Supreme Court denied the Petitioners’ petition for review of the appellate court’s decision.

Conclusion

Accordingly, the appellate court affirmed the denial of the Petitioners’ writ of mandate seeking to compel the State Bar to respond to their CPRA Requests after finding that the State Bar would have to create new records to comply with the Requests, which took the requested data outside the scope of the CPRA. Although the appellate court’s decision was fairly narrow––addressing only one of the five grounds relied on by the trial court––it nonetheless may have a significant impact on future CPRA requests submitted to the State Bar and the continued debate between the public’s interest in State Bar applicant data and the privacy interests of State Bar applicants.

A number of advocacy groups and individuals weighed in on both sides of this case, thus demonstrating that the debate is important to many. Several parties intervened in support of the State Bar, including the Black Women Lawyers Association of Los Angeles, Inc., the John M. Langston Bar Association of Los Angeles, and many past applicants to the California Bar. Several other entities and individuals filed amicus briefs in support of the Petitioners, including the Reporters Committee for Freedom of the Press and thirteen media organizations (American Society of News Editors, Associated Press Media Editors, Association of Alternative Newsmedia, Bay Area News Group, California News Publishers Association, Californians Aware, The Center for Investigative Reporting, Los Angeles Times Communications LLC, The McClatchy Company, MPA- The Association of Magazine Media, National Press Photographers Association, Online News Association, and Society of Professional Journalists), the Pacific Legal Foundation, the National Association of Scholars, the Electronic Frontier Foundation, and other individuals.