Director partially grants Chapman appeal, orders release of some security-classified records

The Department of Government Records director granted in part and denied in part petitioner Mr. Chapman’s appeal of the Utah System of Higher Education’s GRAMA withholding decisions, after reviewing in-camera submissions and hearing testimony about search practices and security-classification procedures.

Chapman, who represented himself, alleged that the board improperly used GRAMA’s security exception to withhold records about an alleged unauthorized internal-access incident affecting hundreds of individuals, claimed he had unredacted screenshots demonstrating exposure of protected health and education information and asked for an in-camera review of all withheld records.

USHE counsel and general counsel (Ms. Adams) told the tribunal the board conducted multilevel review, relied on GRAMA §106 (records of security measures) and §305(17) (attorney-client privilege) for classifications, and noted they provided disputed records to the director for in-camera review. Counsel said the board lacks backend DTS search access and relied on custodians, the data-privacy officer and legal review.

The director said the in-camera records contained many duplicates but concluded a reasonable search occurred. After weighing public and governmental interests, the director found that while many withheld records were properly protected (attorney-client and true security-sensitive material), a subset classified under the security measure provision had been overbroadly withheld and should be released; the director will identify those records in a written decision to be issued within seven business days. Other withholdings were upheld. Either party may appeal to district court within 30 calendar days.

Chapman said he had reported the issue to the state auditor and to legislators and asked the director to order broad disclosure; counsel for the board emphasized risk of making system-level security details public and defended the board’s classification methodology. The director directed release of specific records while preserving legitimately sensitive material.