July 28, 2016


The staff of the Committee on Open Government is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the information presented in your correspondence, except as otherwise indicated.


I have received your letter of June 24, 2016 in which you requested an advisory opinion concerning “the extent to which individual education programs (‘IEP’s’) and plans prepared pursuant to Section 504 of the Rehabilitation Act (‘Section 504 Plans’) must be disclosed pursuant to the Freedom of Information Law(“FOIL’)”.

You referred to an opinion rendered by this office in 1999 in which it was advised, based on the information provided then, that following the deletion of typical identifiers pertaining to students, such as names of students or their parents, home addresses and telephone numbers, dates of birth, the remaining content of IEP’s should be disclosed. That opinion was based largely on the definition of “personally identifiable information” as that phrase had been defined in the regulations (34 CFR §99.3) promulgated pursuant to the Family Educational Rights and Privacy Act (“FERPA”, 20 USC §1232g). The definition of that phrase has been amended, and in my view, provides greater protection of students’ privacy than under the original provision.

In addition to the kinds of typical identifiers, such as those referenced above, the amended provision includes within the definition of “personally identifiable information” :

“Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty…”

Pertinent to the analysis is an element of the regulations promulgated by the Commissioner of Education, 8 NYCRR §200.4(d)(2) concerning the required content of IEP’s. I have reviewed that provision, and you paraphrased the content of IEP’s as follows:

“(1) a description of the results of psycho educational testing or any other evaluations of the student’s achievements; (2) a description of the student’s “present levels of performance” in academic, social, behavioral, and physical realms, and how the student’s disability affects the student’s progress in a general education curriculum; (3) a description of the disability classification that applies to the student; (4) a description of measurable annual goals, including academic and functional goals, consistent with the student’s needs and abilities; (5) a description of the short-term instructional objectives and benchmarks that are the measurable intermediate steps between the student’s present level of performance and the measurable annual goal; and (6) the special education services and programs that the student will receive.”

From my perspective, in consideration of the likelihood that relatively few students are associated with IEP’s, the change in the standard regarding “personally identifiable information” in the FERPA regulations coupled with the information required by Commissioner’s regulations to be included in an IEP, the deletion of typical identifiers relating to a student would be insufficient to guarantee the protection of the student’s privacy. When, for example, a record indicates levels of performance in behavior or physical capability or a description of the disability classification applicable to a student, disclosure of those unusual or unique characteristics would, in my opinion, enable “a reasonable person in the school community….to identify the student with reasonable certainty”, even though that person may not “have personal knowledge of the relevant circumstances.”

It has been advised in many instances involving both FOIL and FERPA that disclosure of any aspect of a record that is likely to permit identification of a particular person, i.e., in relation to a medical condition, or a particular student, may be withheld to comply with FOIL or must be withheld to comply with FERPA. It has also been advised that if disclosure of the name or other typical identifier is inadequate to guarantee that a person’s identity will not become known, a record may be withheld in its entirety when it contains unique identifiers, such as those described in the preceding paragraph.

For the reasons suggested above, the advice offered in the opinion rendered in 1999 should be considered to be supplanted by the opinion expressed in this response. In short, in view of the change in FERPA regulations and the nature of information that must be included in an IEP, I believe that IEP’s must, in most instances, be withheld in their entirety to comply with law.

I hope that I have been of assistance.


Robert J. Freeman
Executive Director