MANSFIELD, Justice.

This case requires us to decide where disclosure ends and where confidentiality begins under the Iowa Open Records Act and the Federal Educational Rights and Privacy Act (FERPA). See 20 U.S.C. § 1232g (2006 and Supp.2010); Iowa Code §§ 22.2, .7, .9 (2007). In October 2007, two University of Iowa football players were accused of sexually assaulting another student in a campus dorm room. This incident led to a criminal investigation, criminal charges, and the conviction of one player on a charge of assault with intent to inflict serious injury and the other on a charge of simple assault. This incident also led to internal actions and responses by the University, external criticism of the University, and a special counsel investigation and report. Finally, this incident led to the present lawsuit.

The present litigation concerns Open Records Act requests that the Iowa City Press-Citizen served on the University after reports of the incident surfaced. Dissatisfied with the University's initial response to those requests, the Press-Citizen filed suit. The lawsuit resulted in more documents being produced and others being submitted for in camera review by the district court. The court then ordered additional documents produced, in some instances with redactions.

The University has appealed that order in part. It argues that FERPA prohibits the disclosure of the remaining documents, including even redacted versions of "education records" where the identity of the student is known to the recipient. The Press-Citizen counters that FERPA does not supersede any obligation to produce records under the Open Records Act, and in any event, the University has misinterpreted FERPA. For the reasons discussed herein, we ultimately agree with the University's arguments as to the meaning and force of FERPA, and therefore reverse the district court's judgment in part.

I. Background Facts and Proceedings.

During the early morning hours of Sunday, October 14, 2007, a female student-athlete was allegedly sexually assaulted at the Hillcrest dormitory at the University of Iowa. Two University of Iowa football players who were accused of involvement were suspended and later dismissed from the team. A criminal investigation resulted in both men being charged. One ultimately pled guilty to assault with intent to inflict serious injury, and the other was convicted of simple misdemeanor assault following a jury trial. See Iowa Code §§ 708.1, 708.2(1), 708.2(6).

Numerous University officials were informed of the incident by Monday, October 15, 2007; however, the parents of the student-athlete believed their response was inadequate. Among other things, concerns were expressed that the University had shown a lack of understanding for the victim, had communicated poorly with her, and had allowed her to be subjected to retaliatory harassment from other students. In 2008, the University's Board of Regents engaged an outside law firm (the Stolar Partnership) to conduct a detailed investigation. Their report (the Stolar Report) criticized some aspects of the University's policies and performance.

Meanwhile, the incident received considerable publicity in the media. Articles appeared in which both football players were named. Beginning November 13, 2007, the Iowa City Press-Citizen served requests on the University under the Iowa Open Records Act. See Iowa Code § 22.2(1) (2011) ("Every person shall have the right to examine and copy a public record ...").1 The requests sought, among other things, reports of attempted or actual sexual assaults; correspondence to or from various University officials relating to any such incidents; and e-mail, memos, and other records relating to any such incidents from October 1, 2007 to the present.

The University initially produced only eighteen pages of documents, claiming that any other responsive documents were protected from disclosure under Iowa Code section 22.7(1). See id. § 22.7(1) (protecting from disclosure "[p]ersonal information in records regarding a student ... maintained, created, collected or assembled by or for a school corporation or educational institution maintaining such records"). On January 4, 2008, the Press-Citizen filed a petition in district court seeking judicial enforcement of the Open Records Act. See id. § 22.10 (providing for civil enforcement of the Act).

Shortly after bringing suit, the Press-Citizen filed a motion to compel. The motion asked the district court to order the University to produce a Vaughn index of the documents it was withholding.2 It also urged that documents be produced in redacted form where necessary, without identifying individual students. The University resisted the motion to compel based on, among other things, FERPA. On August 7, 2008, the district court granted the Press-Citizen's motion to compel. The University thereafter released approximately 950 additional pages of documents to the Press-Citizen; prepared a Vaughn index for over 3000 pages of documents (including both the pages that had been released and over 2000 that were being withheld); and submitted those 3000 pages to the district court for in camera review.

After conducting a painstaking in camera review, the district court entered another order on August 31, 2009. The order divided the University's documents into five categories:

The district court's August 31 order directed the University to disclose the Category 3 documents without redaction and the Category 4 documents with appropriate redactions within thirty days. On October 5, 2009, the district court entered a final judgment incorporating the provisions of its August 31 order, again directing the disclosure of the documents, and also awarding the Press-Citizen $30,500 in attorneys' fees pursuant to Iowa Code section 22.10(3)(c). The University sought and obtained a stay of the district court's order pending appeal. The University now argues to us that the district court erred in ordering the production of some of the Category 3 and all of the Category 4 documents.3

II. Standard of Review.

We review the district court's interpretations of chapter 22 and FERPA for errors at law. Rathmann v. Bd. of Dirs. of Davenport Cmty. Sch. Dist., 580 N.W.2d 773, 776 (Iowa 1998). We review of the court's application of those statutes de novo. Id.

III. Analysis.

A. The Iowa Open Records Act. Generally speaking, the Iowa Open Records Act (also known as the Examination of Public Records Act or the Iowa Freedom of Information Act) requires state and local entities to make their records available to the public. Iowa Code §§ 22.1(3), .2(1); see also City of Riverdale v. Diercks, 806 N.W.2d 643, 652 (Iowa 2011) (characterizing chapter 22 as "our state's freedom of information statute"). The Act seeks "to prevent government from secreting its decision-making activities from the public, on whose behalf it is its duty to act." Iowa Civil Rights Comm'n v. City of Des Moines, 313 N.W.2d 491, 495 (Iowa 1981). We have said the Act establishes "a presumption of openness and disclosure." Gabrilson v. Flynn, 554 N.W.2d 267, 271 (Iowa 1996). The University of Iowa, a state institution, is clearly covered by the Open Records Act; indeed, we have previously held that a private corporation commissioned by a state university to engage in fundraising for the university is covered by the Act. Gannon v. Bd. of Regents, 692 N.W.2d 31, 42-44 (Iowa 2005) (holding that the Iowa State University and its private foundation were subject to the Open Records Act).

The Open Records Act is subject to a number of listed exemptions, both large and small. See Iowa Code § 22.7 (stating that "[t]he following public records shall be kept confidential, unless otherwise ordered by a court, by the lawful custodian of the records, or by another person duly authorized to release such information" and listing sixty-four separate exceptions). Nonetheless, the University does not argue that any of those designated exceptions applies here. Its sole argument on appeal is that federal law, i.e., FERPA, requires the appealed Category 3 and the Category 4 documents to be kept confidential.

B. FERPA. Congress enacted the Family Educational Rights and Privacy Act or FERPA in 1974 "under its spending power to condition the receipt of federal funds on certain requirements relating to the access and disclosure of student educational records." Gonzaga Univ. v. Doe, 536 U.S. 273, 278, 122 S.Ct. 2268, 2272-73, 153 L.Ed.2d 309, 318 (2002). "The Act directs the Secretary of Education to withhold federal funds from any public or private `educational agency or institution' that fails to comply with these conditions." Id. at 278, 122 S.Ct. at 2273, 153 L.Ed.2d at 318. The Act provides in part:

20 U.S.C. § 1232g(b)(1). It also provides:

(A) there is written consent from the student's parents ... Id. § 1232g(b)(2).

The Department of Education (DOE) has adopted regulations to implement FERPA. See 34 C.F.R. § 99.3 (2009). In relevant part, they define "education records" as follows:

Id.

The same regulations define "personally identifiable information" as follows:

Id.

In light of these definitions, the University argues that the appealed Category 3 and the Category 4 documents cannot be produced at all. As it understands the law, "education records" with "personally identifiable information" cannot be released. Further, even if no student is actually identified in the document, either because his or her name and personal identifiers have been redacted or because the original document did not have that information, the regulations prohibit disclosure if the recipient would "know[] the identity of the student" — or "a reasonable person" would be able to "identify the student with reasonable certainty." See Id. In short, the University contends that if the Press-Citizen or the student community would know the student being discussed in the education record, the record cannot be divulged — even in redacted form — under FERPA.

For purposes of this appeal, we assume that the appealed Category 3 and Category 4 documents are in fact "education records" under FERPA.4 The Press-Citizen does not dispute that if these documents were produced, even in redacted form, it would be able to determine the students to whom the documents refer.5 However, the Press-Citizen argues that FERPA is merely a funding statute that does not prohibit the disclosure of documents whose production is otherwise required by the Iowa Open Records Act. Alternatively, the Press-Citizen argues that FERPA does not allow the withholding of records, as opposed to their redaction. We now turn to these points of disagreement.

C. The Interplay Between FERPA and the Open Records Act. The University argues that the relationship between FERPA and the Open Records Act is a simple matter of federal supremacy. See U.S. Const. art. VI (providing that the laws of the United States "shall be the supreme Law of the Land"). Iowa law, according to the University, cannot authorize disclosure where federal law requires confidentiality. The Press-Citizen, on the other hand, maintains that FERPA is not a positive law at all, but simply a funding provision, which cannot override the express directives of the Open Records Act.

This debate has been played out in cases from other jurisdictions. Some courts have concluded that FERPA does not prohibit the disclosure of educational records. See Bauer v. Kincaid, 759 F.Supp. 575, 589 (W.D.Mo.1991) ("FERPA is not a law which prohibits disclosure of educational records. It is a provision which imposes a penalty for the disclosure of educational records."); WFTV, Inc. v. Sch. Bd. of Seminole, 874 So.2d 48, 57 (Fla.Dist.Ct.App. 2004) ("FERPA does not prohibit the disclosure of any educational records. FERPA only operates to deprive an educational agency or institution of its eligibility for applicable federal funding based on their policies and practices regarding public access to educational records if they have any policies or practices that run afoul of the rights of access and disclosural privacy protected by FERPA."); see also Kirwan v. The Diamondback, 352 Md. 74, 721 A.2d 196, 206 (1998) ("Another alternative argument made by The Diamondback is that the federal Family Educational Rights and Privacy Act does not directly prohibit the disclosure of protected education records, that the only enforcement mechanism under the Act is the withholding of funds from institutions having `a policy or practice of permitting the release of education records' ... [I]n light of our holding that the records are not education records within the meaning of the federal statute, we need not and do not reach this issue." (citation omitted)).

FERPA regulations allow for the possibility that an educational institution "cannot comply with the Act or this part due to a conflict with State or local law." See 34 C.F.R. § 99.61. One could argue that the mere recognition of this possibility in the regulations indicates that FERPA does not supersede state law.6

On the other hand, other courts have given direct effect to FERPA's provisions, treating them as positive law with binding force on state authorities. See Sherry v. Radnor Twp. Sch. Dist., 20 A.3d 515, 525 (Pa.Cmwth.Ct.2011) (finding that the release of the requested reports "was precluded by FERPA"). In United States v. Miami University, 294 F.3d 797, 803 (6th Cir.2002), a federal court of appeals affirmed an injunction against the release of student disciplinary records covered by FERPA. The court reasoned that the remedies for FERPA violations were not limited to a cutoff of federal funding. Miami Univ., 294 F.3d at 809-10. Rather, once funds are accepted, "the school is indeed prohibited from systematically releasing education records without consent." Id. at 809; see also Rim of the World Unified Sch. Dist. v. Super. Ct., 104 Cal.App.4th 1393, 129 Cal.Rptr.2d 11, 15 (2002) (finding that FERPA preempts California law requiring the disclosure of student expulsion records); Unincorporated Operating Div. of Ind. Newspapers, Inc. v. Trs. of Ind. Univ., 787 N.E.2d 893, 904 (Ind.Ct.App.2003) (stating that "FERPA is a federal law which requires education records to be kept confidential").

In short, as one court has observed, "state and federal courts are sharply divided on this issue." Caledonian-Record Publ'g Co. v. Vt. State Colls., 175 Vt. 438, 833 A.2d 1273, 1274-76 (2003) (citing cases).

We need not step into this controversy here, however, because we believe a provision of the Iowa Open Records Act already gives priority to FERPA. Section 22.9 of the Act provides:

Otherwise stated, the first paragraph of section 22.9 suspends the operation of a provision of the Open Records Act if the provision would cause the denial of federal funds to a state agency. This paragraph, we believe, answers the Press-Citizen's argument that FERPA in and of itself is not a positive law. Section 22.9 gives it the effect of a positive law. If the University regularly released educational records pursuant to section 22.2(1) of the Open Records Act, it would be engaging in a "practice" of permitting the release of confidential education records, assuming the records contained "personally identifiable information." See 20 U.S.C. § 1232g(b)(1). The sanction for this would be a loss of federal funding. See 20 U.S.C. §§ 1232c, 1234c (authorizing the withholding of funds when a recipient "is failing to comply substantially with any requirement of law applicable to such funds"); see also id. § 1232g(f) (providing that "[t]he Secretary shall take appropriate actions to enforce this section and to deal with violations of this section, in accordance with this chapter, except that action to terminate assistance may be taken only if the Secretary finds there has been a failure to comply with this section, and he has determined that compliance cannot be secured by voluntary means").

The Press-Citizen responds that the University has not shown the disclosure of records would "definitely" cause it to lose funds as required by the first paragraph of section 22. This argument, we believe, misreads the statute. Section 22.9 requires that the federal funds be "definitely available." That they are. The University enjoys considerable federal support. See University of Iowa, General Education Fund, FY 2011-Use of New Revenues and Reallocations (2011), available at www.uiowa.edu/fusbudg/2011_final_budget_spread.pdf (disclosing total federal support of $258,999,082 for the University in fiscal year 2009). The statute does not have similar language requiring that the loss be definite.

The Press-Citizen urges, however, that a one-off production of records in this case would not amount to a "policy or practice." See Gonzaga Univ., 536 U.S. at 288, 122 S.Ct. at 2278, 153 L.Ed.2d at 324 (noting that FERPA's nondisclosure provisions "speak only in terms of institutional policy and practice, not individual instances of disclosure" and "have an aggregate focus" (citation)); see also Achman v. Chisago Lakes Indep. Sch. Dist. No. 2144, 45 F.Supp.2d 664, 674 (D.Minn. 1999) (finding that "a solitary violation is insufficient to support a finding that the District has violated FERPA as a matter of policy or practice"). One problem with this argument, however, is that the production would not be accidental or inadvertent and would necessarily set some kind of precedent after having been authorized by the Iowa courts. A "policy or practice" to some extent would be established.7

The larger problem with the Press-Citizen's position is that section 22.9 also operates on an aggregate basis. That section asks us to consider not whether a specific production of records in a particular case would result in a loss of funds, but whether a "provision" — e.g., section 22.2(1), the overall legal requirement that public records be made available — would cause such a loss. Hence, we need to focus on the provision itself, not just a one-time application of it, and determine whether that provision would lead to a loss of federal funding for the agency. In other words, section 22.9 requires us to consider whether section 22.2(1), the basic open records "provision," applied consistently to education records at the University of Iowa, i.e., "an agency of this state," would "cause the denial of funds," and if so it "suspend[s]" that provision.8

Of course, at the end of the day the federal government might not try to defund the University of Iowa regardless of the circumstances. But we do not think section 22.9 requires Iowa courts to make predictions about policy decisions made in Washington D.C. That would be unworkable. See Iowa Code § 4.4(3) (setting forth a presumption that "[a] just and reasonable result is intended"). As we read the first paragraph of section 22.9, it requires us to withhold legal effect from a provision of the Open Records Act, such as section 22.2(1), if it appears that provision (not just an isolated application of the provision) would result in a loss of federal funding for a state agency.

The Press-Citizen also relies on the second paragraph of section 22.9. It urges that the University has failed to adopt a "rule" as required by that paragraph and, in the absence of such a rule, the first paragraph has no effect.9 When the Open Records Act was originally enacted in 1967, only the first paragraph of section 22.9 was included. See 1967 Iowa Acts ch. 106, § 11 (codified at Iowa § 68A.9 (1971), now Iowa Code § 22.9). The second paragraph was not added until 1984. See 1984 Iowa Acts ch. 1185, § 8 (codified at Iowa Code § 22.9 (1985)).

Our difficulty with this argument is that it treats two separate mechanisms as if they were one. The first paragraph of section 22.9 is written in the passive voice ("shall be suspended") and is directed at everyone. Thus, the first paragraph comes into effect whenever "it is determined," without confining itself to determinations by an agency. By contrast, the second paragraph is directed to agencies of this state, telling each of them to adopt by rule "in each situation where [section 22.9] is believed applicable, its determination identifying those particular provisions of this chapter that must be waived in the circumstances to prevent the denial of federal funds, services, or information." See also S.F. 2294 Explanation, 70th G.A., Reg. Sess. (Iowa 1984) ("Section 8 requires state agencies to adopt certain rules regarding conditions of federal funds."). There is no indication in any part of section 22.9 that if an agency should fail to discharge its duty under the second paragraph, or should discharge it incorrectly, the legislature intended the first paragraph to have no effect. After all, the first paragraph was a stand-alone provision with independent force for seventeen years before the second paragraph was enacted. In sum, we believe the 1984 amendment simply imposed a new obligation on state agencies, without altering the preexisting law. We therefore find that the Open Records Act incorporates confidentiality obligations from FERPA.

D. FERPA and "Personally Identifiable Information." Assuming FERPA applies, the next issue is whether its obligations can be met by redaction or whether it requires the withholding of entire records in some instances. The University argues that under the DOE's interpretation of "personally identifiable information," an educational record must be withheld if the recipient would know the student to whom the record refers, even with the redaction of personal information, such as the student's name. See 34 C.F.R. § 99.3 (defining personally identifiable information to include "[i]nformation requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates"). Given the notoriety of the October 14, 2007 incident, the University contends that no amount of redaction of personal information would prevent the newspaper from knowing the identity of various persons referenced in records relating to that incident.

The Press-Citizen responds that under the Open Records Act, access is a yes-or-no proposition. It cannot vary based upon the identity of the party making the request. See, e.g., Ne. Council on Substance Abuse, Inc. v. Iowa Dep't of Pub. Health, 513 N.W.2d 757, 761 (Iowa 1994) (rejecting a party's contention under the Open Records Act "that release of the applications should depend on the status of the party seeking them"). The flaw in this argument, however, is that the relevant legal standards in this case actually come from FERPA, incorporated into Iowa law through section 22.9.

The Press-Citizen also maintains that the DOE regulation should not be followed, either because the relevant part of it did not become effective until this lawsuit was already pending or because it is contrary to prior caselaw. As noted by the Press-Citizen, current subparts (f) and (g) of the definition of "personally identifiable information" were only approved as a final rule by the DOE on December 9, 2008, and became effective January 9, 2009. See Family Educational Rights and Privacy, 73 Fed.Reg. 74,806, 74,806 (December 9, 2008) (codified at 34 C.F.R. pt. 99). This action was filed January 4, 2008. The district court rendered its decision on the Category 3 and Category 4 documents on August 31, 2009.

Yet under federal law, there exists a "principle that a court is to apply the law in effect at the time it renders its decision, unless doing so would result in manifest injustice or there is statutory direction or legislative history to the contrary." Bradley v. Sch. Bd. of Richmond, 416 U.S. 696, 711, 94 S.Ct. 2006, 2016, 40 L.Ed.2d 476, 488 (1974). True, there is also the "principle that the legal effect of conduct should ordinarily be assessed under the law that existed when the conduct took place." Kaiser Aluminum & Chem. Corp. v. Bonjorno, 494 U.S. 827, 855, 110 S.Ct. 1570, 1586, 108 L.Ed.2d 842, 865 (1990) (Scalia, J., concurring). Thus, the United States Supreme Court has asked whether applying the change in law to a pending case "would impair rights a party possessed when he acted, increase a party's liability for past conduct, or impose new duties with respect to transactions already completed." Landgraf v. USI Film Prods., 511 U.S. 244, 280, 114 S.Ct. 1483, 1505, 128 L.Ed.2d 229, 262 (1994); see also Fernandez-Vargas v. Gonzales, 548 U.S. 30, 37, 126 S.Ct. 2422, 2427-28, 165 L.Ed.2d 323, 334 (2006).

We think the modified definition of "personally identifiable information" easily passes the federal test for retroactivity. The relevant "conduct" here is the University's decision to withhold the appealed Category 3 and the Category 4 documents. That conduct continued after the lawsuit was filed. It was still ongoing even when the regulation was modified. There was no reliance such that there would be prejudice if we followed the new regulation.

Also, the previous definition of "personally identifiable information" was not all that different. It prohibited the disclosure of any "information that would make the students' identities easily traceable." 34 C.F.R. § 99.3(f) (2008). The DOE substituted the new language because the old language

73 Fed.Reg. 74,806, 74,831 (December 9, 2008).

But the DOE had issued guidance under the earlier language that educational records could not be released if the recipient could determine the student to whom reference was being made:

See Letter to School District re: Disclosure of Education Records to Texas Office of Attorney General (April 6, 2006), available at www2.ed.gov /policy/gen/guid/fpco/ferpa/library/tx040606.html. As DOE explained in its notice of proposed rulemaking for the amendment, "The proposed regulations are needed to establish this guidance in a definitive and legally binding interpretation...." Family Educational Rights and Privacy, 73 Fed.Reg. 15574, 15583 (March 24, 2008). Hence, the intent of the January 2009 amendment was to clarify the law, not change it.

The Press-Citizen also insists that it is not a legally permissible construction of the term "personally identifiable information" for the University to withhold entire documents, rather than redact them. We disagree. The statute forbids federal funding of institutions that have a policy or practice of releasing "education records (or personally identifiable information contained therein ...)" without parental permission. See 20 U.S.C. § 1232g(b)(1). This either-or language, as we read it, is at least subject to the interpretation that an entire record can be withheld where redaction would not be enough to protect the identity of a student. And as long as the underlying statute is ambiguous, we are required to defer to any reasonable and permissible interpretation made by the agency — here DOE. See Chevron U.S.A., Inc. v. Natural Res. Def. Council, Inc., 467 U.S. 837, 842-43, 104 S.Ct. 2778, 2781-82, 81 L.Ed.2d 694, 702-03 (1984); Miami Univ., 294 F.3d at 814.

The Press-Citizen cites to a case where the Montana Supreme Court ordered release of student disciplinary records with the names redacted, even though the two students involved were known to the requesting newspaper. Bd. of Trs., Cut Bank Pub. Schs. v. Cut Bank Pioneer Press, 337 Mont. 229, 160 P.3d 482, 487 (2007). But that case was decided before the 2009 amendment to the FERPA regulations. In any event, the school district never made the specific argument, as far as we can tell, that FERPA prohibits release of an entire record where redaction would not be enough to avoid identification of the students involved. The Press-Citizen also cites to a passing observation of the Wisconsin Supreme Court that "once personally identifiable information is deleted, by definition, a record is no longer an education record since it is no longer directly related to a student." Osborn v. Bd. of Regents of Univ. of Wis. Sys., 254 Wis.2d 266, 647 N.W.2d 158, 168 n. 11 (2002). That comment also was made before the 2009 amendment to the regulations, and that case likewise did not address the particular issue that is now before us.

Thus, consistent with current DOE regulations, we conclude that educational records may be withheld in their entirety where the requester would otherwise know the identity of the referenced student or students even with redactions.

The Press-Citizen criticizes this position as a matter of policy. In its view: "The University's position boils down to a peculiar argument that FERPA applies on a sliding scale, saving its most vigorous application to records concerning crimes and alleged crimes that are the most notorious." This feature of FERPA, however, derives from earlier determinations by Congress and the DOE that preservation of student confidentiality should be an overarching goal of the statute. It is not our role to reexamine those decisions.

E. Additional Issues. The Press-Citizen points out that FERPA has an exception when education records are "furnished in compliance with judicial order, or pursuant to any lawfully issued subpoena, upon condition that parents and the students are notified of all such orders or subpoenas in advance of the compliance therewith by the educational institution." See 20 U.S.C. § 1232g(b)(2)(B); see also 34 C.F.R. 99.31(a)(9)(i) (2009) (indicating that an education record may be disclosed "to comply with a judicial order or lawfully issued subpoena"). This exception has been applied in prior cases. See, e.g., Ragusa v. Malverne Union Free Sch. Dist., 549 F.Supp.2d 288, 293-94 (E.D.N.Y.2008) (ordering the production of relevant education records in a discrimination case); Catrone v. Miles, 215 Ariz. 446, 160 P.3d 1204, 1210-12 (Ariz.Ct.App.2007) (holding that education records could be ordered to be produced in a medical malpractice case and noting "the protections afforded to educational records by statute do not prohibit, but rather permit, disclosure pursuant to court order"); Gaumond v. Trinity Repertory Co., 909 A.2d 512, 518 (R.I.2006) (holding that FERPA does not bar the production of relevant education records pursuant to court order in a personal injury case). But in those instances, the records were relevant to litigation that did not involve the records themselves. See Gaumond, 909 A.2d at 518 (distinguishing prior cases where public disclosure was sought by newspapers and was not granted). It would make no sense to interpret the "judicial order" exception as authorizing disclosure whenever a party chose to bring a separate court action seeking access to education records. This would lead to a highly incongruous situation where FERPA would only have effect until the party requesting records chose to go to court, at which point FERPA would cease to have any effect at all.10

The Press-Citizen also argues that the University has been inconsistent in its position. As the Press-Citizen points out, University officials, including the president, the athletic director, and the football coach have commented publicly on aspects of the University's response to the alleged sexual assault. In addition, the seventy-two-page Stolar Report that was commissioned by the Board of Regents contains a detailed narrative and critique of the University's response to the incident, replete with references to "Football Player # 1," "Football Player # 2," and "the Student-Athlete."

We are not persuaded that the University has been altogether consistent. At the same time, commentators have criticized FERPA for permitting institutions to behave inconsistently — revealing student information when it puts the university in a good light and withholding it when it does not. See Matthew R. Salzwedel & Jon Ericson, Cleaning Up Buckley: How the Family Educational Rights and Privacy Act Shields Academic Corruption in College Athletics, 2003 Wis. L.Rev. 1053, 1105-06 (2003) (commenting that universities "provide disclosure that is selective in application"). Regardless, the Press-Citizen does not attach any particular legal significance to the University's alleged inconsistency. It provides no legal authority in this section of its brief and, at oral argument, specifically disclaimed any waiver argument. Cf. City of Riverdale, 806 N.W.2d at 657 (finding a municipality had waived the exemption in section 22.7(50) of the Open Records Act). For these reasons, the Press-Citizen's inconsistency argument does not alter our conclusions as to what FERPA requires in this case.

The amici curiae urge that it would violate federal and state constitutional provisions if access to public documents could depend upon the knowledge or identity of the requester. Although this argument is developed at some length in the brief of the amici, it was not raised below or by the Press-Citizen. We therefore decline to reach it. See Mueller v. St. Ansgar State Bank, 465 N.W.2d 659, 660 (Iowa 1991) (noting that "[u]nder Iowa law, the only issues reviewable are those presented by the parties"); see also Rants v. Vilsack, 684 N.W.2d 193, 198-99 (Iowa 2004) (declining to reach an argument raised by amici curiae that was not presented to the district court).

IV. Conclusion.

We reverse the judgment of the district court to the extent it orders the production of the appealed Category 3 documents and the Category 4 documents. The University has not challenged any other aspects of the district court's judgment, including its award of attorneys' fees to the Press-Citizen. Therefore, we affirm the remainder of the judgment.11 We remand for further proceedings in accordance with this opinion.

DISTRICT COURT JUDGMENT REVERSED IN PART AND REMANDED.

All justices concur except Appel, Wiggins, and Hecht, JJ., who dissent.

APPEL, Justice (dissenting).

I respectfully dissent.

The Federal Educational Rights and Privacy Act (FERPA) states that federal funds shall not be available "to any educational agency or institution which has a policy or practice" of releasing personally identifiable information without the written consent of parents. 20 U.S.C. § 1232g(b)(1) (2006). In my view, compliance with a judicial order pursuant to a generally applicable state public records statute does not amount to a policy or practice of any educational agency or institution. See generally Maynard v. Greater Hoyt Sch. Dist. No. 61-4, 876 F.Supp. 1104, 1108 (D.S.D.1995). The majority opinion repeatedly cites "policy or practice," while omitting the statutory requirement that the "policy or practice" must be one of the "educational agency or institution." In effect, the majority opinion amends the statute to strike the words "agency or institution."

In light of this explicit wording of FERPA and the Iowa Open Records Act, I would not rewrite either statute. While federal law plainly is supreme, I find no conflict between FERPA and the Iowa Public Records Act. As a result, I would require disclosure of the public records in this case.

WIGGINS and HECHT, JJ., join this dissent.