Do I have legal standing to force a website to remove my Personally Identifiable Information (PII)?

Question

I recently learned a high school coach of mine used a website (athletic.net) to track meets, etc, and posted there is quite a bit of PII (full name, High school, graduation year, events competed in, etc.). I would obviously like this deleted but according to their forum Q&A section they can't / don't do that:

"Coaches use Athletic.net for meet entry, tracking athlete results and progress, as well as compiling school history and records in the sport. For all of the above reasons, athlete profiles, and results are never deleted."

Do I have any legal standing to make them either delete, anonymize, or privatize (make not publicly searchable) the information posted about me?

Answer 1

The only legal limits would arise from FERPA, the federal student record law. That law says that a student's education records must be made available (to the student or parent, depending), and that disclosure outside the context of school requires permission. This law applies to any school that receives federal funding (and it may be difficult to determine if that is the case). Your name is included in the class of "Personally Identifiable Information". For minors, the legal rights created by the law initially are held by the parent, but transfer to the student they they become "eligible". You become "eligible" at age 18, or once you transfer to a post-secondary institution.

The general rule is that a school cannot disclose an education record without the written and signed consent of the student (or parent, when relevant). An education record can be disclosed in redacted form, eliminating PII. However, there are also a number of exceptions where consent is not required. Most relevant to this case is that "directory information" can be disclosed, which

includes, but is not limited to, the student's name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; enrollment status (e.g., undergraduate or graduate, full-time or part-time); dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors, and awards received; and the most recent educational agency or institution attended.

To take advantage of this exception, the institution has to have "given public notice to parents of students in attendance and eligible students in attendance at the agency or institution" regarding what information will be disclosed, they must allow a refusal to disclose, and must say when the refusal has to be given. This disclosure must be made annually, while the student is enrolled. Specifically,

An educational agency or institution may disclose directory information about former students without complying with the notice and opt out conditions in paragraph (a) of this section. However, the agency or institution must continue to honor any valid request to opt out of the disclosure of directory information made while a student was in attendance unless the student rescinds the opt out request.

The requirements for giving notice about privacy policy are rather weak: the student does not have to be personally and clearly alerted to specific actions. Notice might have been given to parents, and might have been in the form of a large wall of information that is hard to interpret. Here is one typical notice for a university, which says that the notice is published in the "Master Schedule of Classes", which used to be a printed document but nobody uses it – they do however email everybody at the beginning of the year. If they failed to provide an opt out notice, that would be a violation, whereas if they provided notice and you didn't see it (for instance, you were under 18 when the annual notice was given), they would have complied.

Answer 2

The data you cite as PII are simply facts that are public information; your name, photo, your school, track meets, race times, track records, and you have little recourse against the publishing and dissemination of public information, either on a site like Athletic.net that collects and scrapes public information, or against the original sources, such as news outlets and school officials.

Collecting and publishing public information is clearly allowed under press freedoms and the 1st Amendment. And, concerning photos: news outlets have the clear right to photograph people in public spaces and identify them.

A possible exception regarding athletic.net is the Children's Online Privacy Protection Rule ("COPPA") for children under the age of 13. But they cover that in their Privacy Policy and offer a removal policy.

One other possible exception is FERPA, the federal student record law, as pointed out by user6726 in their answer; see eCFR — Code of Federal Regulations. But your parents may have signed a release to allow the information to be made public.

In the event neither of those exceptions is the remedy, you would need a court order to force Athletic.net to remove information, and you would need to show very compelling evidence that such data is harmful to you in order for the court to risk violating the First Amendment.

Also see Cyberstalking and RateMyProfessors.com

Answer 3

I don't see any legal mechanism by which you could force the removal of the information.

I doubt FERPA protects the information you're asking about:

1. First, because the information on that website is probably directory information, and the school almost certainly sent home a disclosure at the beginning of the year notifying your parents that it would be releasing information like this, and your parents -- if they're like 99 percent of the rest -- did not opt out of disclosure.
2. Also because of the decent odds that the athlete's coach was not even the one who posted the information. More frequently, times are submitted by an official from the state high school athletic association, or by the school that hosted the meet. So unless we're dealing with a meet hosted at the athlete's school, I'd guess that these scores are not education records at all.

Even if the scores were protected education records under FERPA and the school broke the law by disclosing them, the athlete would still be out of luck. The website didn't break any laws by receiving or publishing those records, so the First Amendment prohibits the government from successfully forcing them to take it down. Bartnicki v. Vopper, 532 U.S. 514, 527 (2001) ("[S]tate action to punish the publication of truthful information seldom can satisfy constitutional standards.").

Nor would there be a valid claim against the school, as FERPA doesn't allow for a private cause of action. Gonzaga Univ. v. Doe, 536 U.S. 273, 289 (2002) ("FERPA's nondisclosure provisions fail to confer enforceable rights."). The only penalty for a FERPA violation is a loss of federal funding, which to my knowledge, has never actually been imposed.

That would probably only leave a state-court action for some kind of privacy violation. The available options -- public disclosure of private facts and intrusion upon seclusion -- both require that the information involved be private. Because track meets are held in public, information about what happens there isn't private, so this claim would also fail.

If there is some compelling reason why an athlete would need this information taken down -- and I can't think of any -- the best bet could be to try asking and seeing if there's a way around their policy. Such policies are often written more forcefully than they are enforced.