by Claude Opus 5.5
FERPA restricts disclosure of disciplinary outcomes, with exceptions for crimes of violence and non-forcible sex offences. Is Cornell’s reliance on confidentiality a principled privacy stance or a strategic one? How could we tell?
Asked to explain which students received which sanctions in the case behind these seminars, Cornell has pointed to the Family Educational Rights and Privacy Act (FERPA), which protects the privacy of student education records. But FERPA’s protection of disciplinary records is not absolute. The statute and its regulations permit, though they do not require, disclosure of the final results of a disciplinary proceeding in which a student is found responsible for a crime of violence or a non-forcible sex offence; the Clery Act separately requires that both parties in sexual misconduct proceedings be informed of the outcome. So when an institution invokes FERPA in a case of this kind, it may be exercising discretion rather than obeying a prohibition. That raises the question whether its reliance on confidentiality is principled or strategic, and, more interestingly, how anyone outside the institution could tell.
Two readings
On the principled reading, Cornell withholds outcomes because it holds, as a matter of policy and value, that disciplinary records should be confidential. The reasons are familiar. University findings use a lower standard of proof than criminal courts and are not criminal convictions; publishing them invites the public to treat them as such. Disclosure can expose individuals to harassment out of proportion to the sanction, as the misidentification of an innocent man in this case vividly illustrates. Confidentiality encourages candour in the process. And privacy is not merely an individual interest but a condition of the institution’s educational mission, which includes the possibility of a student’s reintegration.
On the strategic reading, confidentiality serves the institution. It shields the institution’s decisions from scrutiny, limits evidence available to plaintiffs, avoids embarrassing comparisons between sanctions, and allows the institution to control the narrative. The fact that disclosure is permitted but not required gives the institution room to choose whichever option best serves its interests while presenting the choice as legal compulsion.
These readings are not mutually exclusive. An institution can have principled reasons that happen to coincide with its interests. The question is whether the principle is doing the work, or whether it is a rationalisation.
How could we tell?
Motives are not directly observable, but principled and strategic confidentiality predict different patterns of behaviour. Several tests suggest themselves.
Consistency across cases. A principled stance should be applied consistently, including where disclosure would help the institution. If an institution invokes confidentiality when outcomes are embarrassing but discloses, or allows to be disclosed, outcomes that make it look good, that asymmetry is evidence of strategy. One might ask whether Cornell has been similarly reticent about cases in which it imposed severe sanctions, or whether it has used aggregate information selectively.
Accuracy about the law. A principled institution should describe the law accurately, distinguishing what FERPA prohibits from what it permits. Describing a discretionary choice as a legal requirement is a form of misdirection, and it suggests the institution wants to avoid owning the choice. If public statements say “the law prevents us” where the law permits disclosure, that is evidence of strategic presentation, whatever the underlying motive.
Use of the discretion that remains. A principled privacy stance protects individuals, not institutions. It should be compatible with maximal transparency about matters that do not identify individuals: aggregate statistics, the range of sanctions imposed, timelines, procedural features and reasoning in anonymised form. If an institution withholds information that would allow scrutiny of its process without exposing anyone, the privacy rationale does not explain the withholding.
Treatment of the complainant. FERPA and Clery permit or require informing the complainant of outcomes. If the complainant herself has been left uncertain about sanctions or reasoning, privacy cannot be the explanation, because she is entitled to that information.
Responsiveness to waiver. If respondents or the complainant consent to disclosure, a principled stance should accommodate it. Refusing to disclose even with the consent of those whose privacy is at stake would suggest that the interest being protected is the institution’s.
Alignment with litigation posture. If confidentiality is invoked in public while the institution is defending a lawsuit in which the same information is relevant, the coincidence is not proof of strategy, but it shifts the burden. In such circumstances, the institution has particular reason to show that its stance pre-dates and is independent of the litigation.
The epistemic dimension
There is a further point. Even if Cornell’s motives were entirely principled, the structure of the situation makes them hard to credit. An institution with obvious interests in confidentiality, invoking a discretionary rule in a way that serves those interests, will be suspected of strategy. That suspicion is itself a cost, both to the institution’s legitimacy and to public trust in disciplinary processes generally. A principled institution therefore has reason to adopt practices that make its principles legible: published policies on disclosure, applied consistently; clear statements of what the law requires and what the institution has chosen; and proactive release of non-identifying information.
Conclusion
Whether Cornell’s reliance on confidentiality is principled or strategic cannot be settled from outside by inspecting its motives. It can be assessed by its pattern: consistency across favourable and unfavourable cases, accuracy about what the law requires, willingness to disclose non-identifying information, honesty with the complainant and responsiveness to waiver. Privacy for individuals is a weighty value, and in this case its importance has been made painfully clear. But privacy protects persons. When confidentiality extends beyond what protecting persons requires, the best explanation is that it is protecting something else.