By Vanessa L. Holton, General Counsel, The State Bar of California
On August 23, 2018, a California appeals court held that the State Bar does not need to modify private demographic information that it received from bar applicants in order to produce a supposedly anonymous dataset for the public.
This important decision ensures that state agencies holding private information cannot be forced to release that data publicly using “anonymization” methods that have come under increasing criticism as ineffective to protect privacy.
The case began in 2006, when UCLA law professor Richard Sander asked the State Bar to assist his research into what he calls the “mismatch” theory – that admissions preferences harm minority students by placing them in “better” schools than would otherwise admit them.
Professor Sander wanted the State Bar to generate various statistics for him using private applicant data, including race, that the State Bar collects as part of its efforts to monitor and ensure the fairness of the California Bar Examination.
The State Bar received substantial public comment about the ethics of using private applicant data to assist such research without the applicants’ permission, and decided not to participate in Professor Sander’s research.
Professor Sander and a few others then made a formal public records request, asking the State Bar to publicly release race, school, grade, and test score data for all bar applicants over 30 years. The State Bar denied that request, starting this decade long lawsuit over whether the data must be made public.
Professor Sander insisted that this private data could be made anonymous by changing some of the data points. At trial, the State Bar presented evidence by Latanya Sweeney of Harvard University, the nation’s leading expert in this area.
Dr. Sweeney explained that Professor Sander’s “anonymization” methods did not work, and that releasing the data presents a significant privacy risk to applicants and would “have a disproportionate adverse impact on underrepresented minorities.”
Release of the data would harm minority applicants because (1) the percentage of minority applicants is too small to anonymize without deleting the race data, (2) the requested data manipulation distorted the remaining data, and (3) even without individual identification, the data could be misused to stigmatize minority groups.
Evidence was also presented that the State Bar, like most public agencies, does not have the expertise to properly make this type of data anonymous. Indeed, Dr. Sweeney explained that her undergraduate students had been able to re-identify similar data on minority law students produced to Professor Sander by several UC law schools (which Professor Sander posted online).
While noting Dr. Sweeney’s conclusion that Professor Sander’s specific proposals did not protect privacy, the Court of Appeal found more broadly that public agencies are not required to create new data, or replace existing data with new values, in order to create a “public” form of private data. In other words, if data is too private to release, an agency cannot be required to change or distort the data in an attempt to make it private.
There is no doubt that many public agencies create statistical data for public research use. But what data to create and release, when, and using what privacy method are legal and policy questions for the agency. These questions should be answered by the publicly accountable agency after stakeholder input, scientific analysis and legal scrutiny, not at the whim of individual researchers.
The Court of Appeal’s decision will prevent agencies from being pressured into unsafe data releases by the threat of litigation and attorney’s fees. It will also allow agencies like the State Bar to continue collecting data to advance diversity in the legal profession without causing applicants to fear that the data collection will be used against them by future employers, clients, or other members of the public.
Professor Sander has until October 2nd to petition the California Supreme Court for review.