Individual examination scores and responsible data sharing

Facts and context

The Court considered requests by law schools for information about graduates’ Bar performance. It adopted guidelines allowing useful institutional statistics while protecting individual examinees’ results.

Issue

What examination information could be released to a law school without identifying an individual examinee?

Ruling

Individual scores were treated as sensitive personal information requiring the examinee’s prior consent for the disclosure addressed. The guidelines allowed aggregate, averaged, or anonymized results that did not identify individuals.

Requests must come from the dean or equivalent official and state a legitimate purpose. The Office of the Bar Confidant reviews them.

Practice implications

Parao Law practice guidance

For organizations and professionals

• Define the question a report must answer before requesting names or individual scores. A program review may need trends rather than identifiable records.
• Check whether small groups, unique scores, or combined datasets could reveal an individual despite removal of names. Removing a name alone may not achieve effective anonymization.
• Restrict distribution and keep a record of the approved purpose. Do not automatically reuse a training or assessment report for an unrelated public announcement.

For lawyers

• Distinguish the specific Bar disclosure procedure from the wider analysis of sensitive personal information. Identify the proper legal basis for the actual proposed disclosure.
• In hospital training or credentialing reviews, examine who needs individual-level information and whether an aggregate output would meet the purpose. This is an analogy for privacy design, not a Court-imposed hospital procedure.
• Review consent language for specificity where consent is the basis relied upon; do not assume a broad enrollment or employment form settles every disclosure.

Limits of the ruling

These guidelines govern requests for Bar performance data. They do not directly establish PRC examination procedures or a universal rule that consent is the only lawful basis for every form of sensitive-data processing.