Are Arizona Empowerment Scholarship Account (ESA) records public, or do FERPA and state privacy laws keep them confidential?

Plain-English summary

Senate Bill 1224 (2020) amended Arizona's Empowerment Scholarship Account (ESA) statutes and required the Attorney General to issue written guidance to the Arizona Department of Education (ADE) and the State Board of Education (SBE) on which ESA records are subject to public records requests. AG Mark Brnovich's response: ESA records are generally public records, but FERPA and parallel state laws compel redaction of personally identifiable information.

The opinion makes three core points:

1. ADE and SBE are state agencies subject to A.R.S. § 39-121.01(B). All records they maintain about ESA administration are presumptively public.

2. PII must be redacted. A.R.S. § 15-1045 expressly states that PII in ADE's "education database of pupil records" is "confidential and is not public record." A.R.S. § 15-1042(I) reinforces that "all student level data" is confidential. FERPA (20 U.S.C. § 1232g) and 34 C.F.R. §§ 99.30-99.31 prohibit disclosure of PII from student education records without parental consent.

3. Some records may be withheld entirely. Personal documents like birth certificates raise privacy interests that can outweigh the public interest in disclosure. Each request requires fact-intensive, case-by-case review under Scottsdale Unified Sch. Dist. No. 48 v. KPNX Broadcasting and Carlson v. Pima County.

The opinion is a guide, not a rulebook. It does not list which records to disclose in which form. Custodians have to review each request, identify the records, redact PII, and consider privacy/confidentiality balancing for any sensitive personal documents.

Currency note

This opinion was issued in 2020. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Historical context: what the opinion meant in 2020

For ADE and SBE records officers

The opinion confirmed the default: respond to ESA records requests under A.R.S. § 39-121.01(B), but redact PII per § 15-1045 and FERPA before release. It also flagged the technical concern that redaction must be "resilient" and unrecoverable, citing § 18-522.

For ESA parents and families

The opinion offered some reassurance that a public records request to ADE will not produce a list of identifiable students, their disabilities, or their school selections. It also did not establish a blanket rule that ESA participation itself is private, aggregate counts of participants are explicitly disclosable.

For journalists and watchdog requesters

Aggregate ESA data, agency correspondence, vendor relationships, audit findings, contractor records, payment records (with PII redacted), and policy documents are presumptively disclosable. Per-family detail is not.

For school choice advocates and litigation parties

The opinion's distinction between "education records" (FERPA-protected) and other ESA records mattered for litigation discovery. Some ESA records held by ADE may not qualify as FERPA "education records" because the ESA program is "not an educational institution", the opinion cites Niehaus v. Huppenthal, 233 Ariz. 195 (App. 2013). Other records, however, almost certainly do qualify as education records when they reach ADE in the course of administering the program.

Common questions

Q: Are all ESA records public?
A: Generally yes, under Arizona's broad public records law (A.R.S. §§ 39-121, 39-121.01(B)). But PII must be redacted, and some records may be withheld entirely on privacy grounds.

Q: What counts as PII under FERPA?
A: Names, addresses, personal identifiers (SSN, student number), and "[o]ther information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community … to identify the student with reasonable certainty" (34 C.F.R. § 99.3).

Q: What about Arizona's own privacy rules?
A: A.R.S. § 15-1045(A) incorporates FERPA into Arizona law. § 15-1045(B)(2) makes PII in ADE's education database "confidential and not a public record." § 15-1042(I) makes "all student level data" confidential. § 15-141(A) more generally confirms that release of education records is governed by FERPA.

Q: Can ADE be required to create a new record (e.g., compile data) to answer a request?
A: No. Under Lunney v. State, 244 Ariz. 170 (App. 2017), agencies are not required to "tally and compile previously untallied and un-compiled information or data available" in an electronic database. They have to produce existing records, not create new ones.

Q: Can ADE just deny ESA records requests outright?
A: No. The agency cannot blanket-deny. Under Carlson v. Pima County, 141 Ariz. 487 (1984), a custodian must analyze each request and consider whether the public interest in disclosure outweighs any privacy or confidentiality interest. Redaction, not denial, is the preferred path when privacy concerns can be addressed by less drastic means.

Q: What about non-education records ADE collects from ESA families (like utility bills, banking info, household income)?
A: They're presumptively public records under § 39-121.01(B), but ADE must redact PII and personal identifying information under § 18-521 / § 18-522 before release. Some, like birth certificates, may be withheld entirely if the privacy interest outweighs the public interest, citing Scottsdale Unified Sch. Dist., 191 Ariz. at 303.

Q: Are aggregate ESA statistics disclosable?
A: Yes. The opinion specifically lists "general aggregate data requests (e.g., number of children currently in ESA program, how many have applied in a given time period, or number of appeals for different appealable agency action categories)" as presumptively disclosable.

Background and statutory framework

Arizona's ESA program (Title 15, Chapter 19) provides parents with state funds to pay for private school tuition or other alternative educational options. ADE administers the program (§ 15-2402(D)) and SBE handles appeals (per the Senate fact sheet for SB 1224). Children do not "attend" the ESA program; the program is a funding source.

The public records statute (§ 39-121.01(B)) requires "[a]ll officers and public bodies" to maintain records reasonably necessary to maintain accurate knowledge of their official activities. Those records are presumptively public under § 39-121.

But there's a "substantial nexus" limit: under Griffis v. Pinal County, 215 Ariz. 1 (2007), "only those documents having a 'substantial nexus' with a government agency's activities qualify as public records." Documents of "a purely private or personal nature" are not public records, even if held in a government setting (ACLU v. Arizona Dep't of Child Safety, 240 Ariz. 142 (App. 2016)).

The countervailing rule from Carlson v. Pima County, 141 Ariz. 487 (1984): when "the countervailing interests of confidentiality, privacy, or the best interests of the state should be appropriately invoked to prevent inspection," a custodian "may refuse inspection." The preferred path is redaction, not denial.

FERPA and Arizona's parallel statutes layer on top:

• FERPA (20 U.S.C. § 1232g; 34 C.F.R. §§ 99.10-99.12, 99.20-99.22, 99.30): prohibits disclosure of PII from student education records without parental (or eligible student) consent.
• A.R.S. § 15-141(A): Arizona expressly incorporates FERPA's release rules.
• A.R.S. § 15-1045: PII in ADE's education database is "confidential and is not public record."
• A.R.S. § 15-1042(I): all student-level data is confidential and not a public record.
• A.R.S. § 18-521 and § 18-522: require state agencies to keep PII secure and to use commercially reasonable procedures to prevent unauthorized access.

The opinion stresses that redaction must be resilient: it must "fully accomplish the goal of preventing the disclosure to the public of the personal information that is to not be disclosed." Sloppy redaction (e.g., black highlighting that can be removed in a PDF reader) is not redaction.

Citations and references

Federal law:
- 20 U.S.C. § 1232g (FERPA)
- 34 C.F.R. §§ 99.3, 99.10-99.12, 99.20-99.22, 99.30, 99.31 (FERPA regulations)

Statutes:
- A.R.S. § 39-121, § 39-121.01(B) (Arizona public records law)
- A.R.S. § 15-141 (FERPA incorporation)
- A.R.S. § 15-1042(I) (student-level data confidentiality)
- A.R.S. § 15-1045 (ADE pupil records database confidentiality)
- A.R.S. § 15-2402 (ESA fund administration)
- A.R.S. § 18-521, § 18-522 (PII security)

Cases:
- Griffis v. Pinal County, 215 Ariz. 1 (2007), substantial nexus rule for public records
- Carlson v. Pima County, 141 Ariz. 487 (1984), countervailing interests, redaction preferred over denial
- ACLU v. Arizona Dep't of Child Safety, 240 Ariz. 142 (App. 2016), purely private or personal documents not public records
- Catrone v. Miles, 215 Ariz. 446 (App. 2007), § 15-141(A) incorporates FERPA
- Niehaus v. Huppenthal, 233 Ariz. 195 (App. 2013), overview of ESA program
- Lunney v. State, 244 Ariz. 170 (App. 2017), agencies not required to compile new records
- Scottsdale Unified Sch. Dist. No. 48 v. KPNX Broad. Co., 191 Ariz. 297 (1998), privacy interest balanced against public interest in records

Source

• Landing page: https://www.azag.gov/opinions/i20-010-r20-010
• Original PDF: https://www.azag.gov/sites/default/files/2025-06/I20-010.pdf

Original opinion text

To:

Arizona Department of Education

State Board of Education

Introduction

Senate Bill 1224 requires that the Arizona Attorney General provide written guidance to the Arizona Department of Education ("ADE") and the State Board of Education ("SBE") "regarding what types of information […] collected under title 15, chapter 19, Arizona Revised Statutes, as amended by this act, are subject to public records requests under state and federal law, including the [F]amily [E]ducational [R]ights [A]nd [P]rivacy [A]ct of 1974." 2020 Ariz. Legis. Serv. Ch. 12, § 6 (S.B. 1224). The Arizona Attorney General therefore provides the following guidance. See A.R.S. § 41–193(A)(7).

Summary

ADE's and SBE's response to public records requests is governed by Arizona's public records law and related precedent, as well as pertinent federal and state privacy laws. Title 15, chapter 19, relates to Arizona Empowerment Scholarship Accounts, commonly known as ESA. The ESA program is not an educational institution; instead, it serves as a funding source for children to attend private schools or participate in other alternative educational options under A.R.S., Title 15, Chapter 19. As a general matter, ESA records are subject to public records requests received by ADE or SBE. Some records collected or created through the ESA program are public records and can be produced without redaction in response to a public records request. To the extent ESA records contain personally identifiable information ("PII"), however, ADE and SBE must redact protected PII prior to disclosure or withhold the record because of privacy and/or confidentiality interests as set forth in pertinent state and federal law.

Background

A. S.B. 1224 And Types of Records Collected Under Title 15, Chapter 19

Title 15, Chapter 19 of the Arizona Revised Statutes governs the operation of the ESA program. The ESA program provides parents with funds from State sources "to provide options for the education of students in this state." A.R.S. § 15–2402(A). Children do not attend the ESA program; rather, the program serves as a funding source for children to attend private schools or participate in other alternative educational options. See Niehaus v. Huppenthal, 233 Ariz. 195, 196, 199, ¶¶ 2, 15 (App. 2013).

ADE administers the ESA program. See A.R.S. §§ 15–2402(D); –2401(3). SBE is responsible for processing appeals of an ESA administrative decision. ADE will receive various records in administering the ESA program, and SBE will likely receive similar records through its role in the appeal process. To receive ESA funds, parents generally submit information to ADE in the course of: (1) submitting an application and related documentation to demonstrate a student's eligibility to participate in the ESA program; (2) providing documentation to satisfy their obligations under the ESA contract and A.R.S. § 15–2402; and (3) corresponding with ADE.

B. Arizona's Public Records Law

Arizona law requires that "[a]ll officers and public bodies shall maintain all records, including records as defined in § 41-151.18, reasonably necessary or appropriate to maintain an accurate knowledge of their official activities and of any of their activities which are supported by monies from this state or any political subdivision of this state." A.R.S. § 39–121.01(B). Those records are presumptively disclosable to the public. See A.R.S. § 39–121. Nevertheless, "only those documents having a 'substantial nexus' with a government agency's activities qualify as public records." Griffis v. Pinal County, 215 Ariz. 1, 4, ¶ 10 (2007). Indeed, "the purpose of the law is to open government activity to public scrutiny, not to disclose information about private citizens." Id. at 4, ¶ 11; see also ACLU v. Arizona Dep't of Child Safety, 240 Ariz. 142, 147, ¶ 10 (App. 2016).

"While access and disclosure is the strong policy of the law, the law also recognizes that an unlimited right of inspection might lead to substantial and irreparable private or public harm; thus, where the countervailing interests of confidentiality, privacy, or the best interests of the state should be appropriately invoked to prevent inspection," a custodian "may refuse inspection" of such records, "subject to judicial scrutiny." Carlson v. Pima County, 141 Ariz. 487, 491 (1984). Of course, "a practical alternative to the complete denial of access" is to redact confidential PII information. See id.

Additionally, agencies are neither required to create new records to respond to a records request nor search and provide individualized information contained within records, such as a database. See Lunney v. State, 244 Ariz. 170, 177, ¶ 20 (App. 2017).

C. Federal Privacy Protections For Education Records Under FERPA

The Family Educational Rights And Privacy Act of 1974 ("FERPA") and related regulations protect the privacy of student "education records" by affording parents and eligible students the right to: (1) access their own education records; (2) seek to have the education records amended; and (3) have some control over the disclosure of PII contained in education records. 20 U.S.C. § 1232g; 34 C.F.R. §§ 99.10–99.12; 99.20–99.22; 99.30.

FERPA defines a "student" as an individual "who is or has been in attendance at an educational agency or institution and regarding whom the agency or institution maintains education records." 34 C.F.R. § 99.3. "Education records" are those records that are (1) "[d]irectly related to a student;" and (2) "[m]aintained by an educational agency or institution or by a party acting for the agency or institution." 34 C.F.R. § 99.3. PII "includes, but is not limited to[,]" names, addresses, "personal identifier[s]" (e.g., social security number or student number), and "[o]ther information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty[.]" Id.

FERPA prohibits an educational agency or institution from disclosing PII from student education records without a parent's or eligible student's prior written consent unless the disclosure meets an exception to FERPA's general consent requirement. 34 C.F.R. §§ 99.30–99.31. While certain records collected or maintained by ADE or SBE through the ESA program may not fall within FERPA's definition of "education records," it is likely that other records that come into possession of ADE or SBE through the ESA program are "education records" for FERPA purposes.

D. State Privacy Protections For Educational Records

Arizona law incorporates FERPA. See A.R.S. § 15–141(A); Catrone v. Miles, 215 Ariz. 446, 454, ¶ 24 (App. 2007). Arizona law also expressly states that "[a]ny collection, maintenance or disclosure of pupil educational records compiled by [ADE] in an education database of pupil records shall comply with [FERPA]." A.R.S. § 15–1045(A).

And, of particular relevance here, Arizona law expressly states that PII maintained in ADE's "education database of pupil records" is "confidential and is not public record." A.R.S. § 15–1045(A), (B)(2) (emphasis added); see also A.R.S. § 15­–1042(I) (providing that "[a]ll student level data" is "confidential and is not a public record").

Analysis

As state agencies, ADE and SBE are subject to Arizona's public records law. See A.R.S. § 39–121.01(B). Each public records request is unique and must be reviewed on a case-by-case basis in light of the circumstances surrounding the request. Because complying with public records requests is necessarily a fact-intensive process, no portion of this guidance should be relied on exclusively when responding to record requests.

To the extent ADE and SBE collect and maintain records relating to the ESA program, such records are generally presumed to be public records. For example, either agency may receive general records requests (e.g., external correspondence) and general aggregate data requests (e.g., number of children currently in ESA program, how many have applied in a given time period, or number of appeals for different appealable agency action categories).

These types of records are generally disclosable with proper redaction and de-identification measures. In particular, in responding to public records requests, ADE and SBE must redact any PII in education records that are received or maintained through the ESA program because, under FERPA and corresponding provisions of state law, PII "is confidential and is not public record." A.R.S. § 15–1045(B)(2). ADE and SBE must also redact any PII in non-education records that are received or maintained through the ESA program because of privacy and/or confidentiality interests. See Scottsdale Unified Sch. Dist. No. 48 of Maricopa Cty. v. KPNX Broad. Co., 191 Ariz. 297, 300, ¶ 9 (1998). For redaction to be proper, it must be resilient and fully accomplish the goal of preventing the disclosure to the public of the personal information that is to not be disclosed. See, e.g., A.R.S. § 18–522; see also A.R.S. § 18–521.

ADE or SBE may also withhold some records relating to the ESA program in connection with public records requests. In particular, personal documents such as birth certificates may be withheld when disclosure of such documents would invade privacy and that invasion outweighs the public's right to inspection. See, e.g., Scottsdale Unified Sch. Dist., 191 Ariz. at 303, ¶ 25.

In sum, many records received, maintained, or created by the ESA program are public records under A.R.S. § 39–121.01; however, some of those records might be withheld for privacy reasons and some (perhaps many) would be subject to redaction prior to disclosure to ensure that individuals' identities and PII are adequately protected.

Conclusion

Records held by ADE or SBE in connection with the ESA program are subject to public records requests under Arizona law. ADE and SBE may be required to disclose ESA program documents to the extent that they are de-identified and have a substantial nexus to the government's activities. However, certain information related to ESA accounts may need to be redacted or withheld based on privacy considerations under state and federal law.

Mark Brnovich

Attorney General