Antitrust and Unfair Competition Law
The Results Are In: Individual State Bar Applicant Data is Outside the Scope of the CPRA … For Now
Harrison (Buzz) Frahn
Michael R. Morey
Katerina Siefkas
Simpson Thacher & Bartlett LLP
On August 23, 2018, the California Court of Appeal, First District, affirmed the Superior Court of San Francisco City and Countyâs holding that the State Bar of California was not required to disclose individual-level data for applicants to the State Bar in response to several California Public Records Act (âCPRAâ) requests seeking such data. Sander v. Superior Court, 237 Cal. Rptr. 3d 276 (Cal. Ct. App. 2018) (hereafter, the âAppellate Opinionâ). The decision came after roughly ten years of litigation balancing the State Barâs obligations to release applicant data to the public against the privacy interests of State Bar applicants. Although the Superior Court based its decision on five separate grounds, the Court of Appeal addressed only one of the grounds and found that the State Bar was not required to disclose the applicant data because it would have to create new records when disclosing the data to protect the applicantsâ privacy, thus bringing the disclosure outside the scope of the CPRA. Id. at 280. On November 14, 2018, the California Supreme Court denied the appellantsâ petition for review, cementing for now the State Barâs lack of obligation to disclose individual-level applicant data under the CPRA.
Factual Background and Procedural History
In the early summer of 2008, UCLA law professor Dr. Richard Sander, former State Bar of California governor Joe Hicks, and the First Amendment Coalition (collectively, the âPetitionersâ) sent CPRA requests to the State Bar of California seeking âindividual-levelâ law school and bar admission data for all applicants to the State Bar from 1972 to 2008 (hereafter, the âRequestsâ). Sander v. The State Bar of California, No. CPF-08-508880, 2016 WL 6594874, at *2 (Cal. Super. Ct. Nov. 7, 2016) (hereafter, the âTrial Court Opinionâ). The Requests specifically sought the following data for all applicants to the State Bar from 1972 to 2008: (a) ârace,â (b) âlaw school,â (c) âwhether an applicant was a âtransfer student,ââ (d) âyear of law school graduation,â (e) âlaw school grade point average (âGPAâ),â (f) âundergraduate GPA,â (g) âLaw School Admission Test (âLSATâ) score,â (h) âwhether the applicant passed the California bar exam,â and (i) âraw and scaled scores for each component of each California bar exam taken.â Id. The Petitioners sought this data to conduct a study on whether there was a ârelationship between preferential admissions programs in higher educationâ and discrepancies in âbar passage rates between racial and ethnic groups.â Appellate Opinion at 280. The State Bar refused to produce the requested data and, in October 2008, the Petitioners filed a writ of mandate in the Superior Court of California for San Francisco City and County against the State Bar seeking to require the State Bar to produce the data. Trial Court Opinion at *2-3.
The Petitioners and the State Bar stipulated to conduct the litigation in two phases: (1) Phase I addressed âwhether the State Bar ha[d] any legal duty to produce the requested records,â and (2) Phase II addressed âwhether the provision of the requested records to Petitioners would violate the privacy of any person, and whether the cost or burden of manipulation, reproduction, or disclosure of the requested records provide[d] a basis for denying or limiting disclosure.â Id. at *3. Phase I concluded in 2013 with a decision by the California Supreme Court that, under Californiaâs common law right of public access, there was a âsufficient public interest in the informationâ requested by the Petitioners that the State Bar should âprovide access to it.â Appellate Opinion at 280. The California Supreme Court qualified its decision by holding that the trial court must address the following two issues before requiring the State Bar to produce the requested data: (1) whether it was possible to release the requested data in a way that did not violate the applicantsâ privacy, and (2) whether there were any other interests that âoutweigh[ed] the publicâs interest in disclosure.â Id. at 280-81. On remand, the State Bar allowed the Petitionersâ experts to examine a subset of the requested data to determine whether it was possible to produce it in a form that would protect the State Bar applicantsâ privacy. Id.
While Phase II of the litigation was still pending, the California Legislature passed Business and Professions Code section 6026.11, a provision that generally made State Bar records subject to CPRA requests. Id. However, Business and Professions Code section 6060.25âenacted at the same time as section 6026.11âexempted certain State Bar records containing data that âmay identify an individual applicantâ from the scope of the CPRA. Trial Court Opinion at *3-5, *7. The trial for Phase II began on July 11, 2016 in the wake of these newly enacted provisions. Id. at *4.
The Trial Court Decision
(A) Petitioners Propose Four Protocols To Protect Applicant Privacy
At trial, the Petitioners presented four different protocols that their experts determined the State Bar could use to protect the applicantsâ privacy rights when the State Bar produced the data sought by the Requests. Id. at *4.
- Protocol One proposed that the State Bar could, among other steps, (a) create a âphysical data enclaveâ that provided restricted access to the requested data, (b) remove all âpersonally identifying informationâ (i.e., names, addresses, and Social Security numbers) from the data, and (c) require any person wishing to access the data âto sign Data User Agreements through which they agree not to attempt to identify individuals or disclose any inadvertent identificationsâ and which would âlimit what items members of the public can take into and out of the enclave.â Id. at *12.
- Protocol Two proposed that the State Bar could (a) create âa public use fileâ for the requested data, and (b) combine or eliminate âaspects of the data that would tend to produce only a few matches.â Id. For example, âdata related to persons graduating from unaccredited law schools would be eliminated, or race categories would be reduced from eight to fourâŚ.â Id.
- Protocol Three also proposed that the State Bar could create a public use file âusing a variety of de-identification techniques,â such as eliminating law school names from the data, and standardizing applicantsâ LSAT scores and GPAs âto reflect . . . a computed average,â rather than the applicantsâ âactual scores and GPAs.â Id. at *14.
- Protocol Four was similar to Protocol Two, and added additional techniques that focused on preventing the identification of an individual applicant by a person who knew the applicantâs GPA, such as âround[ing] . . . GPAs to two significant digits.â Id. at *13.
The State Bar argued that if it used the Petitionersâ proposed protocols when producing the requested data, then the State Bar would be forced to create new records, which the State Bar argued it was not required to do when responding to CPRA requests. Id. at *5-6. The State Bar also asserted that even if it followed the procedures of any one of the four protocols, significant risks remained that the produced data would individually identify the applicants, and thus violate their privacy. Id. at *4.
(B) Petitionersâ Protocols Fail To Adequately Protect Privacy And Demand More Than What The CPRA Requires
The trial court agreed that the State Bar did not have to release the requested data and based its holding on five separate grounds. Id. at *5. First, the trial court ruled that the State Bar would be forced to create new records to comply with the Petitionersâ proposed protocols to protect the applicantsâ privacy, and that the CPRA does not require the creation of new records to comply with information requests. Id. Second, the trial court decided that disclosure of the requested data would violate the Business and Professions Code section 6060.25 because it could be used to re-identify the applicants. Id. at *5,*7. The trial court also found that the following three provisions of the CPRA each exempted the State Bar from disclosing the requested data: (a) Government Code Section 6254(c) which protects against disclosure of information that would be âan unwarranted invasion of personal privacy,â (b) Government Code Section 6254 (k), which prohibits releasing the information if it is barred by other federal or state law, and (c) Government Code Section 6255(a), which is a âcatch-all exemptionâ that âbalance[s] the public interest in disclosure against the public interest in non-disclosure.â Id. at *5, *7-10.
The trial courtâs main focus in ruling for the State Bar was the applicantsâ privacy. The trial court agreed with the State Bar and its experts that the Petitionersâ proposed protocols to protect the applicantsâ privacy did not sufficiently reduce the risk of the applicants being individually identifiable. Id. at *12. The court found that, even after applying Protocols One, Two, and Four, a high percentage of unique records would still exist in the resulting datasets, which would contribute to a serious risk of individual identification. Id. at *13. The trial court was also concerned that even if an applicant could not be individually identified, the requested data still posed a risk of âattribute disclosure[],â wherein âa person is able to determine that an applicant who attended a particular law school, graduated at a certain year, and is of a certain race/ethnicity must also be one of such applicants who share a certain range of law school GPA, for example.â Id. at *14. Accordingly, because of the significant risk of identification, the trial court held that disclosure would violate Business and Professions Code section 6060.25, which the trial court determined was an absolute bar against disclosure if an applicant âmayâ be identified from the release of their data. Id. at *7. And, although the trial court also found that Protocol Three posed less of a risk of individually identifying applicants, the court determined that Protocol Threeâs proposed manner of distilling and grouping the data eliminated the disclosed dataâs value. Id. at *14.
The trial court also determined that producing the requested data under the Petitionersâ proposed protocols would violate Government Code Section 6254(c)ââthe CPRA exemption concerned with âinvasion of personal privacy.â Id. at *8. In analyzing this provision, the trial court weighed the public interest in disclosing the requested data and the applicantsâ privacy interest in nondisclosure. Id. While the trial court agreed that there was a strong public interest in understanding the bar admission process and any discrepancies therein, the trial court concluded that the applicantsâ privacy interest in nondisclosure was stronger because of the risk of identification and potential stigma resulting from the possibility of the data being âused to draw broad conclusions.â Id. at *8-9.
The trial court also examined how the risk of individual identification from the disclosure of the requested data would affect the State Barâs ability to collect and release other data. Id. at *10. In examining the CPRAâs âcatch-all exemption,â Government Code Section 6255(a), the trial court found that âthe public interest in non-disclosure clearly outweigh[ed] the public interestâ in disclosure in part because disclosure would impede the State Barâs collection of data that was ânecessary, or otherwise helpful, to the performance of its functions.â Id. The court noted that concerns about privacy would make individuals and entities reluctant to provide such data to the State Bar. Id. It also stated that allowing the Petitionersâ Requests would likely lead to other partiesâ making âsimilar requests in the futureâ which would result in the release of large amounts of individual data. Id. at *11. The trial court concluded that having this much applicant data available to the public would significantly increase the risk that any âvaluable, non-identifyingâ data that the State Bar released in the future would contribute to the ease of identifying State Bar applicants. Id.
The Petitioners appealed the trial courtâs decision.
The Appellate Court Decision
The California Court of Appeals affirmed the trial courtâs decision on August 23, 2018. Appellate Opinion at 279. The appellate court addressed only one of the five grounds that the trial court relied on in denying the Petitionersâ writ of mandate, and held that there was no need to reach the other grounds because one ground was sufficient. Id. at 280. The appellate court agreed with the trial court and the State Bar that the Petitionersâ proposed protocols to protect the applicantsâ privacy would force the State Bar to create new records, and the CPRA does not require responding entities to create new records to respond to information requests. Id. at 286, 292.
The appellate court began its analysis of the trial courtâs decision by noting that, although the goal of the CPRA is to ensure transparency between the government and the public, there is a âtensionâ between this goal and âthe equally important public interest in protecting citizens and public servants from unwarranted exposure of private matters.â Id. at 286-87. And despite the CPRAâs presumption that disclosure should occur unless an exemption applies, the appellate court ruled that the question presented on appeal was not whether the data sought by the Petitioners fell under an applicable exemption to the CPRA, but whether the âinformation in the formâ that the Petitioners wanted was even included under the âobligations imposed by the CPRA.â Id. at 287.
The appellate court then held that there was no obligation to create new records when responding to CPRA requests. Id. at 288. Citing to both California precedent and precedent relating to the federal Freedom of Information Act, the appellate court stated that the State Bar only had a duty to release records that already existed at the time of the request, not to create a new data file to comply with the request. Id. The appellate court noted a distinction between âsearching, extracting, compiling, or redactingâ already-existing data and creating new data values, which is what the Petitionersâ proposed protocols asked the State Bar to do. Id. at 289.
Petitioners made several unsuccessful arguments for why the State Bar should be compelled to produce the requested data. First, the Petitioners argued that their proposed protocols did not require creation of new data but âmerely required the State Bar to redact or manipulate existing data and do some computer programmingâ which was within the scope of the CPRA. Id. at 290. The appellate court disagreed and found compelling the trial courtâs review of the Petitionersâ four proposed protocols and reasoning for why each one of the protocols would compel the State Bar to create new records. Id. at 289-90. For example, Protocol One required the State Bar to create new coding values and recode the data to fit within these values, as well as the creation of a âphysical data enclave.â Id.Protocols Two and Four required the State Bar to create new data categories and calculate new values to mask data that could individually identify applicants. Id. The appellate court agreed with the trial court that the Petitionersâ protocols did not simply require the State Bar to redact certain dataââinstead, the protocols required the State Bar to recode and produce new data. Id.
The Petitioners also argued that the State Bar should disclose the requested data because two provisions of the CPRA permitted public agencies to charge costs to the requestor related to âdata compilation, extraction or programmingâ and to delay responding to the request because of âthe time it takes to âcompile data, [] write programming language,ââ showing that the creation of new records is contemplated within the CPRA.Id. at 290 (citing Government Code Sections 6253.9 (b)(2), 6253 (c)(4)). The appellate court disagreed and found that the provisions cited by the Petitioners did not encompass the work required by the proposed protocols to protect the applicantsâ privacy if the State Bar was forced to respond to the Requests. Id. at 290-91. The appellate court noted that the Petitioners provided no examples of when an agency was forced âto undertake programming that would assign new or different values to existing data, replace groups of data with median figures or variables, and collapse and band data into newly defined categories.â Id. at 291.
The Petitioners further contended that the trial court âon its own initiative should have concocted a plan for disclosing at least some of the bar application data âsubject to a process that entails only redaction of information, which would not require creating anything.ââ Id. at 291. In particular, the Petitioners asserted that, as a public agency, the trial court itself had the burden of âprov[ing] a basis for nondisclosure of a public record.â Id. Because Petitioners had not raised the issue of only partially releasing data at the lower court level, the appellate court did not rule on this issue, but noted that âit seem[ed] odd for Petitioners to expect the trial court to succeed where their own experts in this highly technical field did not.â Id. at 291-92.
On November 14, 2018, the California Supreme Court denied the Petitionersâ petition for review of the appellate courtâs decision.
Conclusion
Accordingly, the appellate court affirmed the denial of the Petitionersâ writ of mandate seeking to compel the State Bar to respond to their CPRA Requests after finding that the State Bar would have to create new records to comply with the Requests, which took the requested data outside the scope of the CPRA. Although the appellate courtâs decision was fairly narrowââaddressing only one of the five grounds relied on by the trial courtââit nonetheless may have a significant impact on future CPRA requests submitted to the State Bar and the continued debate between the publicâs interest in State Bar applicant data and the privacy interests of State Bar applicants.
A number of advocacy groups and individuals weighed in on both sides of this case, thus demonstrating that the debate is important to many. Several parties intervened in support of the State Bar, including the Black Women Lawyers Association of Los Angeles, Inc., the John M. Langston Bar Association of Los Angeles, and many past applicants to the California Bar. Several other entities and individuals filed amicus briefs in support of the Petitioners, including the Reporters Committee for Freedom of the Press and thirteen media organizations (American Society of News Editors, Associated Press Media Editors, Association of Alternative Newsmedia, Bay Area News Group, California News Publishers Association, Californians Aware, The Center for Investigative Reporting, Los Angeles Times Communications LLC, The McClatchy Company, MPA- The Association of Magazine Media, National Press Photographers Association, Online News Association, and Society of Professional Journalists), the Pacific Legal Foundation, the National Association of Scholars, the Electronic Frontier Foundation, and other individuals.