Opinion No. ( 1997 )

The Honorable David C. Hausam State Representative 1214 N.E. Tenth Street Bentonville, AR 72712

Dear Representative Hausam:

This is in response to your request, on behalf of Bentonville City Attorney Kevin Pawlik, for an opinion regarding the Arkansas Freedom of Information Act ("FOIA"), codified at A.C.A. §§25-19-101 through -107 (Repl. 1996). Mr. Pawlik has submitted a letter received by the Bentonville Police Department ("Department") requesting computerized backup copies of certain library files pursuant to the FOIA. Mr. Pawlik states that "among the requested information, the computer files contain social security numbers, juvenile arrests and investigations, medical information, employment histories, unlisted and unpublished phone numbers and addresses, as well as other typically confidential and sensitive information." He notes that "[t]he majority of this information would not have been provided to anyone other than police involved in a criminal investigation." Mr. Pawlik specifically inquires as to:

[W]hether the Bentonville Police Department is at liberty to comply with the FOI request without being in violation of the Federal Privacy Act? Other than the specifically listed exceptions to disclosure in the Arkansas Freedom of Information Act, are there other disclosure prohibitions to this FOI request? How should the Bentonville Police Department respond to such a request?

It must be initially noted in responding to these questions that a conclusive determination regarding the release of particular information will require reference to the specific record(s) in question. For instance, although provision is made for the nondisclosure of juvenile detention and arrest records (A.C.A. § 9-27-352(a)), such records may be open pursuant to juvenile court order (id. at subsection (a)(1)). Employment histories, assuming they fall within the "personnel records" provision of the FOIA (A.C.A. § 25-19-105(b)(10)), could conceivably contain exempt information, that is, information that the disclosure of which would constitute a "clearly unwarranted invasion of personal privacy." Id. But this office has previously opined that information related to work history of public employees is generally subject to disclosure under the FOIA, and does not give rise to a "clearly unwarranted invasion of personal privacy." Op. Att'y Gen.95-113. Regarding unlisted phone numbers and addresses, this office has previously opined that a decision to excise such information from personnel records is consistent with the FOIA.See, e.g., Op. Att'y Gen. Nos. 95-242 and 90-335. A different question will arise, however, with respect to non-personnel records. There is no generally applicable privacy exemption under the Arkansas FOIA. Thus, unless the phone numbers and addresses constitute "personnel records" or otherwise fall within a specific exemption (see A.C.A. § 25-19-105(b)(1) and (2)), the FOIA will require disclosure. Op. Att'y Gen. 95-220. Ordinarily, the only basis for excising phone numbers and addresses would be a federal constitutional privacy claim. Op. Att'y Gen. 95-262 at n. 2. See generally McCambridge v. Cityof Little Rock, 298 Ark. 219, 766 S.W.2d 909 (1989) (recognizing that the constitutional right of privacy can supersede the specific disclosure requirement of the Arkansas FOIA). This would require a case-by-case determination. The uncertainty of the scope of the constitutional privacy right (see J. Watkins, The Arkansas Freedom of Information Act 308 (2nd ed. 1994)) precludes any categorical determination in this regard.

It thus becomes apparent that a review of the particular computerized information or files would be necessary in order to determine whether what has been denoted by Mr. Pawlik as "typically confidential and sensitive information" is, in fact, exempt from disclosure under the FOIA. The above will hopefully offer some guidance in this regard. Please note also that I have previously forwarded several Attorney General Opinions to Mr. Pawlik for his review in the course of assisting the records' custodian in making decisions with respect to particular records.

Turning, then, to Mr. Pawlik's specific questions, it is my opinion in response to the first question concerning the Federal Privacy Act that a freedom of information request under the Arkansas FOIA will ordinarily not implicate this federal law. The Privacy Act (5 U.S.C. § 552a) is limited to federal agencies. See5 U.S.C. § 552(a)(1) (1996) (defining "agency") and The ArkansasFreedom of Information Act, supra at 11. See also generallyShields v. Shelter, 682 F. Supp. 1172 (D.Colo. 1988). The Privacy Act's restrictions on the use of social security numbers should, however, be noted. These restrictions apply to state and local governments as well as to federal agencies. See 5 U.S.C. § 552a note and The Arkansas Freedom of Information Act, supra at 22 n. 34. This office has thus previously opined that social security numbers should be excised from records that are otherwise public under the Arkansas FOIA. See, e.g., Op. Att'y Gen. 95-262.See also 42 U.S.C. § 405(c)(2)(C) (viii) (I II)) (part of the federal Social Security Act providing that "[s]ocial security numbers and related records that are obtained or maintained by authorized persons pursuant to any provision of law enacted on or after October 1, 1990, shall be confidential . . . [,]" and defining "authorized person" to include state and local officers and employees).

With regard to the second question concerning other disclosure prohibitions, I cannot in the limited format of an official opinion undertake a comprehensive review of other potential exemptions. The FOIA's catchall for "laws specifically enacted to provide otherwise" must of course be considered. A.C.A. §25-29-105(a). And as noted above, the federal constitutional right of privacy can supersede the Arkansas FOIA, at least with respect to the release of documents containing constitutionally protectable information. The Arkansas Supreme Court has recognized such a privacy right that includes protection for an individual's interest in "nondisclosure of personal matters."McCambridge v. City of Little Rock, supra, 298 Ark. 229. The court in McCambridge held that a constitutional privacy interest applies to "personal matters" that: (1) an individual wants to and has kept confidential; (2) can be kept confidential but for the challenged governmental action in disclosing the information; and (3) would be harmful or embarrassing to a reasonable person if disclosed. The court further held that if these attributes apply to the matters in question, it must then be considered whether the governmental interest in disclosure under the FOIA (i.e., the public's legitimate interest in the matter) outweighs the individual's privacy interest in non-disclosure.

In making disclosure decisions, therefore, the custodian of the records may need to consider whether the requested records contain information that meets the criteria set forth in McCambridge. The public and private interests must then be balanced. As noted TheArkansas Freedom of Information Act, supra, however, McCambridge "suggests that [the court] is not willing to apply the constitutional right to privacy in an expansive fashion." Id.

In response to Mr. Pawlik's third question as to how the Department should respond to this request, I must note that there is no specific quidance in the FOIA concerning the precise manner in which the duty of disclosure shall be carried out by any given agency. The FOIA does not specify how records are to be managed or accessed, apart from the requirement that "[r]easonable access to public records and reasonable comforts and facilities for the full exercise of the right to inspect and copy those records shall not be denied to any citizen." A.C.A. § 25-19-105(d) (Repl. 1996). See also A.C.A. § 25-19-105(a) (requiring access "during the regular business hours of the custodian . . .") and -105(e) (regarding records that are "in active use or storage. . . .") It thus seems that the specific details are left to a great extent to the discretion of the agency. A particular challenge does arise, however, in this instance involving an FOIA request for computerized information. The above discussion regarding potential exemptions should offer some guidance in analyzing the specific information in question. Complying with required exemptions in connection with any given computerized record database in light of economic and technical realities is, however, a matter that has not yet been addressed by the Arkansas legislature. Nor, according to my research, has the Arkansas Supreme Court had occasion to consider the unique issues that arise in this regard.

As noted by the author of a recent law review article, it is probably safe to conclude that computerized information is a "record" for FOIA purposes. Brooks, Adventures in Cyber Space:Computer Technology and the Arkansas Freedom of Information Act, 17 U.A.L.R. L.J. 417, 419 (1995) (citing the plain language of the FOIA and Blaylock v. Staley, 293 Ark. 26, 732 S.W.2d 152 (1987)).See also Watkins, The Arkansas Freedom of Information Act, supra at 69 and Op. Att'y Gen. Nos. 97-115 and 97-030. The court inBlaylock, supra, agreed that the computerized form of the Pulaski County voter registration list was a record for purposes of the FOIA. 293 Ark. at 27. The final ruling in Blaylock (denying the particular FOIA request as a request for equipment) has been interpreted by at least one recognized commentator, moreover, to mean that if the ability to copy the tape exists with the agency, then the copy must be made. The Arkansas Freedom of InformationAct, supra at 70. But what if, as appears to be the case in this instance involving the Department's computer files, the computerized records contain exempt and nonexempt information? To what extent is searching or programming required in responding to such an FOIA request? Under what circumstances, if any, will the legally required exemptions prevent disclosure of the entire record?

According to my review, there are no clear answers to these questions under current law. These issues are explored and succinctly addressed in Adventures in Cyber Space, supra. As noted therein, because the FOIA was "written for a paper era rather than a computer era" (id. at 427), it has not kept pace with technology (id. at 418). Thus, while the FOIA is generally viewed as requiring release of the record with the exempt information deleted (The Arkansas Freedom of Information Act,supra at 78 and Op. Att'y Gen. 95-262 n. 1), the extent to which this requirement applies in connection with computer records is unclear. Would an Arkansas court be receptive to the argument, for instance, that retrieval of the non-exempt information is equivalent to creating a new record,¹ or that programming is required for retrieval and that no such requirement should be imposed?

The problem with these arguments, as noted in Adventures inCyber-Space, supra, is that the burden in connection with "redacting" exempt information or "compacting" data is "dramatically reduced with computer databases." Id. at 429. The policy behind the so-called "no new record" rule (supra n. 1) is not easily applied to computer databases because much of the burden on the agency can be relieved by proper programming. Id. 430-431. If deletion of the exempt information can be accomplished with reasonable effort with existing software, I believe a good argument probably exists in favor of requiring that the non-exempt electronic information be provided in its electronic form. This reasonably follows, in my opinion, from the Arkansas Supreme Court's support for the idea of redaction. Seegenerally Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992) andAdventures in Cyber-Space at 428 n. 71. A question remains however, regarding the agency's obligation to program the software to segregate exempt information. Clearly, a system designed and developed without considering the public's right to access the records could hamper or frustrate the right to inspect and copy public records. I believe it can reasonably be anticipated, therefore, that the court will be receptive to the general idea of requiring that consideration be given to public access from a programming standpoint. But how far would or should such a requirement extend?

In this regard, I agree with the pronouncement in Adventures inCyber-Space that "the government should bear the burden of establishing the existence of a burden that is onerous enough to overwhelm the policy of full agency disclosure." Id. at 430. If the court accepts this view, a case-by-case determination will of course be required. As can be seen from the above discussion, however, there are currently more questions than answers when addressing these issues involving the manipulation of computerized data in order to comply with an FOIA request. A recurrent theme in Adventures in Cyber-Space, supra, is the need for new legislation. Current judicial rulings and the existing legislation simply do not provide a sufficient basis for conclusively resolving these difficult issues.

The foregoing opinion, which I hereby approve, was prepared by Assistant Attorney General Elisabeth A. Walker.

Sincerely,

WINSTON BRYANT Attorney General

WB:EAW/cyh

¹ It is generally recognized that an agency is not obligated to create a new record by compiling or collecting information.See, e.g., Op. Att'y Gen. Nos. 90-234 and 96-044.