Sander v. State Bar of Cal.
26 Cal. App. 5th 651
Cal. Ct. App. 5th2018Background
- Petitioners Richard Sander and the First Amendment Coalition sought de-identified, non‑identifiable extracts of the State Bar admissions database for all bar applicants from 1972–2008 (race/ethnicity, law school, transfer status, graduation year, GPA, LSAT, and bar performance) to study racial disparities in bar passage.
- The State Bar produced confidential raw data to experts under protective order; intervenors (individual applicants and minority bar groups) opposed disclosure to protect privacy and reputational interests.
- Petitioners proposed four de‑identification "protocols" (including a supervised data enclave and k‑anonymity approaches) intended to prevent re‑identification; State Bar and its expert (Dr. Latanya Sweeney) testified the protocols still posed re‑identification risks and would require computing new variables not present in the original files.
- The superior court denied the petition on five independent grounds, principally holding the CPRA does not require an agency to create new records (i.e., to recode, compute medians, band years, collapse categories, or otherwise change substantive content of existing electronic records).
- The Court of Appeal affirmed, holding (1) the requested forms of disclosure would require creation of new records beyond the CPRA duty to produce existing records, and therefore the petition could be denied on that independent ground.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether CPRA requires the State Bar to produce the admissions data in the de‑identified formats proposed | Sander: CPRA and electronic‑records provisions require production; needed programming/compilation is within CPRA duties | State Bar: CPRA obligates production of existing records but does not require creation of new records or substantive recoding | Held: CPRA does not require creation of new records; protocols would create new records, so disclosure not compelled |
| Whether the proposed protocols adequately protect applicants' privacy to satisfy common‑law/public‑access concerns | Sander: protocols sufficiently de‑identify and prevent re‑identification | State Bar/Intervenors: experts showed cognizable re‑identification risk under each protocol | Court: also found State Bar met burden under privacy analysis (trial court found applicants could be identified) |
| Whether CPRA provisions for electronic records (e.g., programming/compilation costs) compel creation of new computed fields | Sander: §§ 6253.9 and related provisions show CPRA contemplates programming/extraction to produce records | State Bar: those provisions allow extraction/redaction, not substantive re‑coding or generation of new data values | Held: extraction/segregation permitted, but creating new values/variables exceeds CPRA duties |
| Whether court should have fashioned a limited disclosure remedy (e.g., release fewer fields) sua sponte | Sander: court should have ordered partial disclosure/redaction rather than deny entirely | State Bar: petitioners never offered or proved a viable, limited field‑by‑field plan; courts cannot invent complex technical solutions on appeal | Held: forfeited issue; court not required to create a plan in absence of trial evidence or request |
Key Cases Cited
- Sander v. State Bar of California, 58 Cal.4th 300 (Cal. 2013) (public interest may require access to admissions database if privacy can be protected)
- Haynie v. Superior Court, 26 Cal.4th 1061 (Cal. 2001) (agency not required to create new records to satisfy disclosure)
- Fredericks v. Superior Court, 233 Cal.App.4th 209 (Cal. Ct. App. 2015) (CPRA requires production of existing records but not creation of new records)
- Regents of Univ. of Cal. v. Superior Court, 222 Cal.App.4th 383 (Cal. Ct. App. 2013) (no obligation to create or obtain a particular record not used or retained by the agency)
- Kissinger v. Reporters Committee for Freedom of the Press, 445 U.S. 136 (U.S. 1980) (FOIA does not obligate agencies to create records)
- Yeager v. Drug Enforcement Admin., 678 F.2d 315 (D.C. Cir. 1982) (agencies need not create documents or perform analysis beyond providing existing records)
- Center for Public Integrity v. F.C.C., 505 F.Supp.2d 106 (D.D.C. 2007) (court cannot compel an agency to adopt plaintiff's proposal that would require producing modified or newly created values rather than redacting existing ones)
- Sierra Club v. Superior Court, 57 Cal.4th 157 (Cal. 2013) (CPRA covers electronic records and agencies may be required to compile/redact existing electronic data)