¶ 1. J. Marshall Osborn and the Center for Equal Opportunity made public record requests to the University of Wisconsin System for records of applicants to its campuses and two graduate schools. The circuit court granted the requests for records of those applicants who had not enrolled at the University, but it denied the requests for those who had matriculated, including a request by Osborn that personally identifiable information be redacted from their records prior to production. The University appealed, and Osborn cross-appealed. Because we have concluded that all the records sought are education records for which 20 U.S.C. § 1232g and public policy prohibit disclosure and because the University is not required to create records to satisfy Osborn's request, we reverse the order to provide records of applicants who did not enroll and affirm the circuit court's decision to refuáe to direct the University to create new records for the applicants who did enroll.
BACKGROUND
¶ 2. This appeal arises out of public record requests directed to the University of Wisconsin System pursuant to Wis. Stat. § 19.35 (1999-2000)1 which *964sought records relating to applicants for admission2 to eleven campuses in the University System, the University of Wisconsin Law School and the University of Wisconsin Medical School for 1993 to 1999. It is asserted that the requests were made to facilitate the study of the effects of race, ethnicity, immigration and other factors on the University's admission decisions. Osborn also planned to distribute the information received to media, public officials and the public.
¶ 3. The University responded by providing more than 390 pages of records to Osborn, but it did deny some requests.3 In part, the denials were based on the University's not maintaining the information requested, and in part on the University's determination that it was prohibited from disclosing the requested records for the following reasons: (1) the University's obligations in regard to the requested records under the Family Educational Rights and Privacy Act of 1974 (FERPA), 20 U.S.C. § 1232g, as amended; (2) the public *965interest in maintaining the privacy and reputational interests of the enrollees and applicants for admission outweighs the public interest in disclosure; and (3) the lack of a requirement to create new records in order to satisfy Osborn's requests.
¶ 4. In an attempt to compel the production of the requested records, Osborn brought a mandamus action in the circuit court. The court sustained the University's determination that 20 U.S.C. § 1232g prohibited it from disclosing the records for those applicants who did enroll in the University and that it was not required to create new records to satisfy Osborn's requests. The court also held that neither federal nor state law applied to records of those applicants who had not matriculated at the University because they were not "students" under those laws, and it ordered the production of their records. The circuit court did not conduct a balancing of the applicants' privacy and reputational interests with the public's interest in disclosure to determine whether, on balance, public policy favored access to or denial of the records. The University appeals the order directing it to produce the unen-rolled applicants' records, and Osborn cross-appeals the court's refusal to order production of the records of those applicants who did matriculate, redacted to remove personally identifiable information.
DISCUSSION
Standard of Review.
¶ 5. Whether a circuit court's order is final is a question of law, which we review de novo. Fredrick v. City of Janesville, 92 Wis. 2d 685, 688, 285 N.W.2d 655, 657 (1979). We also review as a question of law whether *966federal or Wisconsin statutes were properly applied to the undisputed facts before us. State ex rel. Blum v. Board of Educ., Sch. Dist. of Johnson Creek, 209 Wis. 2d 377, 381, 565 N.W.2d 140, 142 (Ct. App. 1997). Additionally, the application of the balancing test to a request for access to public records presents a question of law, which we decide independently of any action or inaction by the circuit court. Wisconsin Newspress, Inc. v. School Dist. of Sheboygan Falls, 199 Wis. 2d 768, 784, 546 N.W.2d 143, 149 (1996).
Finality.
¶ 6. Osborn contends that the circuit court's order is not final because the court did not know whether certain records existed in the form requested, and the court did not rule on the sufficiency of the law school's response. He argues there were factual and legal questions that remained unresolved; therefore, this appeal should be dismissed. The University counters that, notwithstanding those concerns, the court's decision covered all factual alternatives and legal questions. Therefore, the decision resolved all issues relating to what information the University was required to provide or not provide, which caused the circuit court's order to be a final order.
¶ 7. Only final orders may be appealed as of right. Wis. Stat. § 808.03(1). The test for whether an order of a circuit court is final is whether the court contemplated that it be final at the time of entry of the order. Fredrick, 92 Wis. 2d at 688, 285 N.W.2d at 657. Here, the circuit court decided that the University was not to fulfill the objected-to requests for any student who enrolled at the University and that it was required to provide those records for applicants who did not enroll. *967It also decided that the University was not required to create records to satisfy Osborn's requests. That it was unknown whether the University maintained a certain type of record is of no consequence because, if it did and the court ordered its production, the University was obliged to comply, and if the record did not exist, obviously the University could not comply. The circuit court also applied its order to the law school, which had responded but which response the court had not had the opportunity to review. Therefore, its order addressed each item in controversy in a way that established the rights of the parties to the mandamus action. Accordingly, we conclude it was a final order.
The Public Records Requests.
1. General Principles.
¶ 8. Upon a proper written request, a requester has the statutory right to inspect records kept by state agencies. Wis. Stat. § 19.35(1). Wisconsin courts have long recognized that records of government agencies should be open and available to the public as a necessary component to maintaining an informed electorate in a representative form of government. Wis. Stat. § 19.31; Mayfair Chrysler-Plymouth, Inc. v. Baldarotta, 162 Wis. 2d 142, 155, 469 N.W.2d 638, 642 (1991). The Wisconsin Supreme Court has held that:
[T]he general presumption of our law is that public records shall be open to the public unless there is a clear statutory exception, unless there exists a limitation under the common law, or unless there is an overriding public interest in keeping the public record confidential.
Hathaway v. Green Bay Sch. Dist., 116 Wis. 2d 388, 397, *968342 N.W.2d 682, 687 (1984). However, the open records laws are not without limits, particularly when personally identifiable information bearing on privacy and reputational interests is sought. Milwaukee Teachers' Educ. Ass'n v. Milwaukee Bd. of Sch. Directors, 227 Wis. 2d 779, 786, 596 N.W.2d 403, 406 (1999). Additionally, certain records which are specifically exempted from disclosure by state or federal law or which are authorized to be exempted from disclosure by state law need not be produced. Wis. Stat. § 19.36(1).
¶ 9. A written request for public records that has been denied in whole or in part by a state agency is brought before the circuit court by an action for mandamus. Wis. Stat. § 19.37. On appeal of a circuit court's order in such an action, we engage in a step-by-step analysis to determine whether records have been appropriately denied or provided. Wisconsin Newspress, 199 Wis. 2d at 784, 546 N.W.2d at 149. First, we decide whether the custodian's denial of access was made with the requisite specificity. Id. Second, we determine whether the stated reasons were sufficient for denial or an order directing access. Id. In regard to that second step, we also examine whether the circuit court made a factual determination based on the evidence of record, unless the facts are undisputed, whether the requested documents implicated a public interest in secrecy if so asserted by the custodian and, if they do, whether those interests outweigh the public's interest in access to the records. Id. However, if the information requested is specifically exempted from disclosure by a statute, then there is no need for the custodian to weigh competing public interests, as the legislature has already done so by the statutory exemption. Blum, 209 Wis. 2d at 387, 565 N.W.2d at 145.
*969¶ 10. Here, one of the University's bases for objection was its obligation under 20 U.S.C. § 1232g to maintain the privacy of these records. That is an objection made with the requisite degree of specificity. Rathie v. Northeastern Wisconsin Technical Inst., 142 Wis. 2d 685, 687, 419 N.W.2d 296, 297 (Ct. App. 1987). Therefore, we next examine the sufficiency of that basis for denial. Wisconsin Newspress, 199 Wis. 2d at 784, 546 N.W.2d at 149.
2. Nature of Records Sought.
¶ 11. The records subject to the appeal and cross-appeal are those in the possession of the University for two classes of applicants for admission: those who did not enroll and those who did. Federal law proscribes access to records maintained by an educational institution if they are "education records." 20 U.S.C. § 1232g. Therefore, in order to analyze the records at issue here, our first determination must be whether the records are education records under federal law. The facts relevant to this determination are undisputed; therefore, we are presented with a question of law. Boutelle v. Chrislaw, 34 Wis. 2d 665, 673, 150 N.W.2d 486, 490 (1967).
¶ 12. FERPA applies to all educational agencies and institutions, which include high schools, post-secondary institutions and educational agencies, that may receive money under a program administered by the United States Department of Education.4 34 C.F.R. *970§§ 99.1 and 99.3 (2000). The Secretary of the Department is charged with enforcing its provisions. 20 U.S.C. § 1232g(f). The Act benefits parents and students in regard to their interests in "education records," and it gives parents and students certain rights of access, notice and privacy with regard to those records. In this decision, we address only the privacy facet of the Act.5 The Act provides in relevant part:
No funds shall be made available under any applicable program to any educational agency or institution which has a policy or practice of permitting the release of educational records (or personally identifiable information contained therein other than directory information ...) of students without the written consent.. ..
20 U.S.C. § 1232g(b)(l). There are certain exceptions to this prohibition, but none that are relevant here.
¶ 13. The Secretary has promulgated regulations to implement the Act. The regulations define "education records" as follows:
*971Education records, (a) The term means those records that are:
(1) Directly related to a student; and
(2) Maintained by an educational agency or institution or by a party acting for the agency or institution.
(Authority: 20 U.S.C. 1232g(a)(4))
34 C.F.R. § 99.3. The Act defines a "student" as "any person with respect to whom an educational agency or institution maintains education records or personally identifiable information, but does not include a person who has not been in attendance at such agency or institution." 20 U.S.C. § 1232g(a)(6). In order to implement this provision and explain in which educational agencies or institutions a person may have the status of "student," the Secretary promulgated the following definition:
Student, except as otherwise specifically provided in this part, means any individual who is or has been in attendance at an educational agency or institution and regarding whom the agency or institution maintains education records.
(Authority: 20 U.S.C. 1232g(a)(6))
34 C.F.R. § 99.3. Therefore, past, as well as present, relationships can form the basis for student status under FERPA.
¶ 14. The circuit court determined that those applicants who had not enrolled in the University could not be students under the Act, and therefore, their records were not "education records" for which .protection is afforded. However, it relied on a definitional *972limitation of who is a student which was less understandable and which no longer applies.6 The current regulations define a student as, "any individual who is or has been in attendance at an educational agency or institution." 34 C.F.R. § 99.3 (emphasis added). In so doing, it causes us to focus on the relationship of the individual whose records are at issue to the entity that created the records when the records were created.7 This permits us to determine the nature of the physical documents that have been created. Here, the records of a high school student were education records when the *973high school created them. In a like manner, the records of a post-secondary student were education records when they were created by the post-secondary institution that the individual attended. Additionally, those who took the standardized tests Osborn seeks were students "in attendance at" an educational agency when they took the examinations.8
¶ 15. Once created by an agency or institution while an individual is a student at that agency or institution, the records become "education records" within the Act. Nothing in the Act causes a change in the nature of those records. They are confidential education records when the educational agency or institution where the student is in attendance creates them, and they remain confidential in the hands of an educational institution that later receives them. To clearly demonstrate this, the Secretary promulgated rules addressing the Act's contemplation of record transfers from one educational institution to another. See 34 C.F.R. §§ 99.31, 99.33, 99.34. The Secretary's regulations, which specifically prohibit "redisclosure" by a party that did not create the record without the prior consent of the parent or student, confirm that the nature of education records remains unchanged in the hands of the recipient. 34 C.F.R. § 99.33(a)(1).9 As the *974supreme court noted in Milwaukee Teachers', "The key to determining the status of records under the open records law is the nature of the records, not their location." Milwaukee Teachers', 227 Wis. 2d at 792, 596 N.W.2d at 409. Therefore, we conclude that the effect of the definition of student, which includes those individuals who are or who have been in attendance at any educational agency or institution, when combined with the prohibition against redisclosure, ensures that education records already created will continue to be protected and used only for the purpose for which they were given to a third party. 34 C.F.R. § 99.33; 53 Fed. Reg. 11,942, 11,951 & 11,954 (Apr. 11, 1988).
¶ 16. Here, the records of non-enrolled applicants to the University were created by a high school, by a post-secondary school or by an educational testing agency and sent to the University for its use. They relate to students who were "in attendance" at those schools or agencies when the records were created. Therefore we conclude that the records transferred to the University from another educational institution or agency are education records under the Act while in the hands of the University. As such, they may be used only for those purposes for which they were transferred to the University: evaluations of applications for admission. 34 C.F.R. § 99.33(a)(2). Any other use, such as those contemplated by Osborn, is prohibited under the Act unless the prior written consents of the applicants are obtained. 34 C.F.R. § 99.33(e).
*975¶ 17. Furthermore, we are not persuaded that United States v. Brown Univ., No. Civ. A. 91-3274, 1992 WL 2513 (E.D. Pa. Jan. 3, 1992), or any other out-of-state case10 cited to us, has any relevance to the questions with which we are presented. Brown, an opinion which we note is unpublished, opined that the term "student" was not defined differently in different parts of the Act because there was no legislative history to support such a view. To some extent we agree with that view because we do not conclude that student is "defined differently" in different sections. However, "student" is qualified by different modifiers in various sections of the C.F.R., as explained by the Secretary's publication in 53 Fed. Reg. 11,942 et seq., and those modifiers affect our opinion as well as bear upon the *976other two facets of the Act, access and notice, which we do not address. Therefore, because the records Osborn requested are specifically exempted from disclosure by federal law, the University is not required to produce them. Wis. Stat. § 19.36(1). Additionally, even though we have concluded that the University lawfully denied access to the requested education records under § 19.36(1), nondisclosure of those records was also properly denied "by virtue of the significant public policy inherent in the federal statute." Rathie, 142 Wis. 2d at 690, 419 N.W.2d at 299.
3. Public Policy.
¶ 18. We concluded in Rathie that FERPA was both a source and an indication of the public policy establishing "an overriding public interest in preserving privacy of student education records." Id. After considering the nature of the education records requested and their coverage under the federal Act, we concluded that "unrestricted third-party access . . . would directly undercut the public policy inherent in [FERPA]." Id. at 693, 419 N.W.2d at 300. We also concluded that the public interest in maintaining the privacy of education records outweighs any public interest in their disclosure. Id. at 694, 419 N.W.2d at 300-01.
¶ 19. The very same education records are being sought for students who enrolled at various University of Wisconsin System schools and programs as for the applicants who did not enroll. We held in Rathie that the public policy exemplified by FERPA renders the records of enrolled students inaccessible under the Wisconsin Open Records law, regardless of whether the federal Act constitutes a direct statutory exemption. Id. at 689-90, 419 N.W.2d at 298-99. The Rathie analysis *977and holding is an alternative basis for concluding that the University properly denied access to the education records of non-enrollees.
¶ 20. If the issue is approached as a matter of public policy as opposed to one of statutory interpretation, it would make no sense to conclude that the very same records of a student who applied to both UW-Oshkosh and UW-Whitewater, but enrolled at only the latter, could be obtained from the first institution but not the second. Additionally, we are aware of no public policy justification for having unsuccessful applicants for admission to University of Wisconsin schools or programs forfeit their right to the privacy of education records submitted during the application process. Therefore, even if FERPA were not to provide a specific statutory exemption for the nondisclosure of non-enrollees' education records submitted in the application process, as well as enrollees1 education records, the public policy considerations which drove our decision in Rathie provide an alternate basis for denying access.
¶ 21. The University also argues in its brief in chief that, even if the records sought were not education records under federal law, they are pupil records protected from disclosure by confidentiality provisions in Wis. Stat. § 118.125.11 Because we have resolved this question under federal law and under public policy considerations, it is not necessary for us to address the question under § 118.125. Accordingly, we reverse the order of the circuit court that required production of the records of applicants who did not enroll.
*978 4. Record Redaction.
¶ 22. Osborn contends in the cross-appeal that even if the University is not required to produce the records he seeks in their current form, Wis. Stat. § 19.36(6) requires the University to redact the applicants' records to remove personally identifiable information and then produce them.12 The circuit court concluded that doing so would be tantamount to creating new records, which the University was not required to do.
¶ 23. Wisconsin Stat. § 19.36(6), on which Osborn relies, states in relevant part:
Separation of infoemation. If a record contains information that is subject to disclosure under s. 19.35(l)(a) or (am) and information that is not subject to such disclosure, the authority having custody of the record shall provide the information that is subject to disclosure and delete the information that is not subject to disclosure from the record before release.
We conclude that § 19.36(6) does not require the University to produce the records after redacting personally identifiable information.
¶ 24. Our analysis of a similar request in Blum controls the outcome here. Blum had sought her own *979interim grades and those of another high school student. We examined the protection given to those records under Wis. Stat. § 118.125 and concluded that once a record has been afforded confidentiality under § 118.125 nothing in that statute suggested that the record was "exempted from the confidentiality requirement if released under a guise of anonymity." Blum, 209 Wis. 2d at 384-85, 565 N.W.2d at 144. Here, we have concluded that all of the requested records are afforded privacy protection by virtue of 20 U.S.C. § 1232g and the public policy evidenced therein; therefore, they are similarly positioned to those pupil records protected by § 118.125 which we examined in Blum. As with § 118.125, there is nothing in 20 U.S.C. § 1232g that suggests that education records are exempted from the students' right to have them remain confidential if they are released with the students' names redacted. The nature of the records remains the same. They cannot be released upon Osborn's request without the written consent of the individual applicants. Additionally, because the records Osborn seeks are not "subject to disclosure" under Wis. Stat. § 19.35(l)(a), pursuant to the exemption of Wis. Stat. § 19.36(1) as required by § 19.36(6), the University is not required to review each education record and remove part of it. Accordingly, we affirm the circuit court's decision on the cross-appeal.
CONCLUSION
¶ 25. Because we have concluded that all the records sought are education records for which 20 U.S.C. § 1232g and public policy prohibit disclosure and because the University is not required to create records to satisfy Osborn's request, we reverse the order to provide records and affirm the circuit court's decision *980refusing to direct the University to create new records for the enrollees. Therefore, the portion of the order directing disclosure is reversed; the portion of the order directing non-disclosure which is the subject of the cross-appeal is affirmed.
By the Court. — Order affirmed in part; reversed in part.
All references to the Wisconsin Statutes are to the 1999-2000 version unless otherwise noted. Although the requests for information were made during 1998 and 1999 for applicants from 1993 to 1999, the current statutes are used for this opinion because no changes were made in the relevant provisions that would affect our decision.
The applicants can be separated into two classes: those who did enroll and those who did not. Of the latter class, some were granted the opportunity to enroll but chose not to do so, and others were denied that opportunity.
The records sought and refused were alleged to contain standardized test scores, grade point averages and high school or undergraduate class rank of each individual applicant. The requests also sought each applicant's extracurricular activities, preferred undergraduate areas of study, state of residence, location of residence within the state, race, sex and whether the applicant had a parent or another relative who was a graduate of the school for which admission was sought. Additionally, Osborn requested enrollees' first-year grade point averages, whether any enrollees were classified as remedial students, whether any enrollees were placed on academic probation the first year and whether the grade point averages of any enrolled applicants were "adjusted."
Osborn did not argue, either before the circuit court or this court, that any record at issue was created by an educational agency or institution that did not have funds made *970available from the United States Department of Education and therefore would not be subject to FERPA. We assume it was not raised because it is not a contested issue. However, because this issue is the foundation of the dissent, we note that the Secretary does make funds available to public high schools and public colleges as well as to educational testing organizations. See 20 U.S.C. § 1400 et seq.; 42 U.S.C. §§ 2751-2756b; 34 C.F.R. §§ 673.1 and 675.1; 20 U.S.C. §§ 1070a-11 et seq.; 20 U.S.C. § 1070e; and 66 Fed. Reg. 20,440, 20,441 (Apr. 23, 2001). Additionally, the College Board's annual report shows funds received from the Department of Education. See http://www.coIlegeboard.org/pubaff/annrep0Q/annrep00.pfd.
We cannot analyze the access and notice rights available to parents and students under the Act without facts in addition to those presented in this record.
An older version of 34 C.F.R. § 99.3 provided the definition on which the circuit court relied:
The term does not include an individual who has not been in attendance at an educational agency or institution. A person who has applied for admission to, but has never been in attendance at a component unit of an institution of postsecondary education (such as the various colleges or schools which comprise a university), even if that individual is or has been in attendance at another component unit of that institution of postsecondary education, is not considered to be a student with respect to the component to which an application for admission has been made.
The definition applicable to the records sought here became effective forty-five days after its publication in 53 Fed. Reg. 11,942 (Apr. 11, 1988).
The dissent asserts, "There is nothing ambiguous about the phrase 'but does not include a person who has not been in attendance at such agency or institution.' There is no way to read that phrase and conclude that Congress really intended to include within the definition of 'student' a person who has not been in attendance at an institution." We respectfully disagree. Whether the attendance spoken of in the statute is one that has occurred in the past or is presently occurring when the request for records is made is not unambiguously addressed by the statute. However, it is addressed by the Secretary of the Department of Education, who was designated by Congress to implement the Act.
Under 34 C.F.R. § 99.1, an "educational agency" is included within FERPA if it "provides educational services" or "performs service functions for, public elementary, or secondary schools or post secondary institutions." This definition is broad enough to extend to the entities that prepare and administer standardized admissions tests such as the ACT, SAT, LSAT, and MCAT.
Section 99.33 provides in relevant part:
(a)(1) An educational agency or institution may disclose personally identifiable information from an education record only on the condition that the party to whom the information is *974disclosed will not disclose the information to any other party without the prior consent of the parent or eligible student.
There are certain exceptions to this rule, but none that bear on the questions we must decide in this appeal. See, e.g., 34 C.F.R. § 99.31.
Many of the cases cited to us, or which our research uncovered, were based on the obsolete definition of "student" cited above or upon incomplete research. See Tarka v. Franklin, 891 F.2d 102 (5th Cir. 1989) (holding 20 U.S.C. § 1232g provides no private right of action and employs an outdated definition of "student"); Norwood v. Slammons, 788 F. Supp. 1020 (W.D. Ark. 1991) (holding that requests for records of another must be denied and relying on the dicta in Tarka without even mentioning the C.F.R.); Lawson v. Edwardsburg Pub. Sch., No. 1:90-CV-68, 1990 WL 359811 (W.D. Mich. Nov. 14, 1990) (holding that a complaint which alleged that the school board had wrongfully said that Lawson had commenced a lawsuit against it did not state a claim under the Act); Lieber v. Board of Trs. of S. Illinois Univ., 680 N.E.2d 374 (Ill. 1997) (holding individuals who had been granted the privilege to enroll were not students between the time such privilege was granted and classes began, without any reference to the C.F.R. and the Secretary's implementation of the Act); and Carl v. Board of Regents of Univ. of Oklahoma, 577 P.2d 912 (Okla. 1978) (relying on a definition of "student" that does not apply to the records sought by Osborn).
This was not a reason given by the University in its response to Osborn.
Osborn repeatedly asserts that he seeks no "personally identifiable information," yet he ties his requests to each individual applicant rather than requesting a range of information for a group of applicants. For example, he requests, "The math and verbal scores achieved on the Scholastic Aptitude Test ("SAT") and the composite scores achieved on the American College Testing Assessment ("ACT") by each American Indian, Asian, black, Hispanic, and white, male freshman" (emphasis added).