The Missouri Supreme Court heard oral arguments Tuesday in the Jefferson City School District's appeal on a judge's ruling to reinstate a fired employee.
Tammy Ferry, a former instructional technology coordinator, was fired in July 2019 after allegations she had put student information at risk when she transferred files to her personal Google account. In January 2019, Ferry used the Google Takeout application to transfer her work files - including confidential student information - to her personal account.
Upon learning Ferry had transferred the confidential student information, the district placed her on administrative leave.
Following a hearing, the board terminated Ferry's employment on the basis: she had willfully and persistently violated several board policies on staff conduct, technology usage, and data governance and security; that Ferry's transfer of the data to her own account was a disclosure prohibited under federal privacy law regarding students - the Family Educational Rights and Privacy Act, or FERPA - and she did not have a "legitimate educational interest when she transferred the data to her personal email account."
Cole County Circuit Judge Jon Beetem ruled in March 2020 the district had illegally fired Ferry, saying there was no evidence a disclosure of information had been made to a third party. Beetem ordered the district to restore Ferry's employment, pay her back from between her discharge and reinstatement and pay attorney's fees.
The district then filed a notice of appeal on Beetem's ruling, arguing Ferry had violated FERPA and board policy by transferring files to her personal Google account. Missouri's Western District Court of Appeals upheld the initial judgment, reversing the Board of Education's decision to fire Ferry.
In January, the district filed a request to the Missouri Court of Appeals to transfer the case to the Missouri Supreme Court. The Court of Appeals denied the request, so the district then filed a request to the Missouri Supreme Court, which accepted transfer of the case.
This appeal presented two questions to the court: whether Ferry's use of the Google application to transfer the confidential student information to her personal account constitutes a "disclosure" for purposes of FERPA given the confidential information was not otherwise shared with or communicated to any third party, and whether there is competent and substantial evidence in the record to support the board's conclusion that Ferry willfully and persistently violated the board's policy when she transferred the files to her personal account.
On Tuesday, Ferry's attorney, Dennis Egan, said Ferry had total access to the files she transferred and was called the owner of the files. He argues transferring files to a personal Google account was not disclosing to a third party as defined by FERPA. Because her job involved helping staff use computer technology, her computer files "necessarily contained some confidential student data," Egan said.
"Logging into her own computer files thousands of times for 11 years, never once has Tammy Ferry ever released or disclosed even one computer key stroke of confidential data to any party outside the educational server," Egan said.
Egan said the board did not provide proof Ferry disclosed confidential information to a third party or violated board policy and should therefore be reinstated.
"Throughout the board brief, there is this false portrayal that Tammy Ferry engaged in a data breach," he said.
While FERPA prohibits personal student information from being shared with a third party, the district tailored the definition of "disclosure" in its board policy to specifically keep an employee from inappropriately accessing or taking files, said Drew Marriott, the school board's attorney. He claims the Family Policy Compliance Office suggests school districts have policies and procedures in place, including appropriate training, to help ensure school officials do not misuse education records for their own purposes.
"You don't have to have a third party disclosure," he said. "The district can create regulations that are more stringent than that because we don't want anybody to get close to us getting defunded by the Missouri Department of Education."
Missouri School Boards' Association also filed a brief in support of the school board's action in response to what it argues was a significant violation of FERPA.
Egan claims authorities do not support the board's interpretation of FERPA. He argues the board necessarily relied on the definition of "disclosure" in FERPA, "because if there was no disclosure as defined by FERPA, Board Procedure JO-AP(1) does not apply."
He also argues the board knows how to adopt a rule clarifying when and how staff can relocate confidential files to personal accounts, "but it had no such policy when it ended Tammy Ferry's tenured career."
Egan said Ferry transferred the files to her personal Google account at his request to preserve evidence of her entire body of work for possible use of the non-confidential parts of the files in her discrimination lawsuit against the district, which is currently scheduled for Nov. 15-24 but was scheduled for only a month away at the time.
Board policy and FERPA state a school official may have access to confidential student records only if they have a "legitimate educational interest."
Board Administrative Procedure JO-AP(1) states "legitimate educational interest" is present if the school official is performing a task that is specified in his or her position description or by a contract; performing a task related to a student's education in accordance with the school official's position; performing a task related to the discipline of a student in accordance with the school official's position; providing a service or benefit relating to the student or student's family, such as healthcare, counseling, job placement or financial aid; or maintaining the safety and security of campus. A legitimate educational interest may also be present if the official is "supporting students in an educational setting."
Egan argues the district, through the years, disclosed the confidential information to Ferry as a school official with a legitimate educational interest. He also claimed Ferry was unaware of the policies she violated, which means it was not a willful and persistent violation of these policies.
Marriott claims Ferry's contract required her to acknowledge and comply with board policies, and she completed training on confidentiality and student records. He argued Ferry did not have a legitimate educational interest because she transferred the files for personal purposes and was not a school official at the time.
"In this case, specifically, we are looking at whether the district had policies, procedures, regulations in place to protect this data and if Ferry knew of that - she did," Marriott said. "She signed off on it. She was trained on it. It was in her contract."
Marriott claims Ferry attempted to transfer the district's entire Google Drive. She allegedly transferred more than 19,000 files, including 3,000 personally identifiable details of more than 1,300 students.
"This required the district to contact each and every one of the students' families to indicate their personally identifiable medical records, physical therapy records (and) special education records had been taken from the district and were being held on a personal Google Drive by Miss Ferry that the district no longer had control of," Marriott said.
Marriott also alleged Tuesday that Ferry modified the files in an effort to hide proof she was sharing the files with a personal account, arguing this is proof of a willful and persistent violation. This is not in the findings of fact and conclusions of law, and this allegation was not raised in the Circuit Court, Egan said.
"That's not something we have covered," Egan said. "In an administrative appeal, they are locked into the record, and the board is doing everything they can to run from paragraph 12 in the conclusions of law that says the one and only thing that they found (was) 'the board finds that the disclosure of the district's files containing confidential student information to a personal Google account to be a willful violation of board policies.' The board doesn't consider and doesn't address the remaining allegations."