Freedom of Information Acts and Privacy Exemptions
Limits on access to personal data contained in government-managed files are increasing. Courts and legislators cite heightened concern for personal privacy to justify sealing information that once was public.
This may be a reaction to the explosion of information readily available in computer databases. The government is capturing much more information about individuals than ever before. Privacy advocates assert that the risk of invasion of privacy is greater if identifiable information is easily retrieved from computers. The Internet has already become a source for information that once would have been available only through reviewing voluminous paper files located in a government office.
As the private sector finds new ways to obtain information about individuals and to use that information for commercial purposes, a reaction has taken place. One manifestation has been an increase in litigation to establish the parameters of access to personally identifiable information in government files.
Every state, as well as the federal government, has a freedom of information act and open meetings law. Generally, these acts guarantee access to government records and meetings, subject to certain exemptions. Each is a valuable tool for journalists and others who want to know what their government is doing. For example, after interviewing rape victims named in police logs, San Francisco Examiner reporter Candy Cooper reported that calls to police for help from rape victims in Berkeley were more likely to be investigated than calls emanating from drug- and crime-infested neighborhoods in Oakland.
But in enacting these laws, legislatures also decided that secrecy is sometimes necessary to protect the privacy of individuals. Exemptions from the presumption of openness were designed to balance the public's right to know against other competing interests.
Freedom of information laws try to balance the public's right to know and the individual's right of privacy. They typically do not specify how to do so, leaving the courts to reconcile these interests on a case-by-case basis. Increasingly, state and federal courts appear to favor privacy interests over openness to the detriment of newsgathering efforts by reporters, as the following cases illustrate.
Federal Freedom of Information Act
The federal Freedom of Information Act (FOI Act) contains two exemptions that allow an agency to withhold information if it concludes that release would invade the privacy of individuals. Exemption (b)(6) protects "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." (5 U.S.C. s. 552(b)(6)) Exemption (b)(7)(C) applies to "records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information . . . could reasonably be expected to constitute an unwarranted invasion of personal privacy." (5 U.S.C. s. 552(b)(7)(C))
Once an agency decides that the release of information might implicate privacy concerns, it applies a court-defined balancing test: does the public interest in disclosure outweigh the privacy interest that would be violated by disclosure?
Since the FOI Act was passed in 1966, the Supreme Court has chosen privacy over openness numerous times. A 1989 decision skewed the balance in favor of privacy. In that case, the Court held that federal agencies may withhold "rap sheets" -- compilations of arrests, indictments, convictions or acquittals -- on private citizens, even though the information is public at its original source. The Court, narrowly interpreting "public interest," held that those seeking personally identifiable information from government records must show an intent to use the information to examine the workings of the government. (Department of Justice v. Reporters Committee for Freedom of the Press)
Thereafter, the Supreme Court continued to permit agencies to withhold personally identifiable information on privacy grounds. The Court allowed the State Department to refuse to disclose records identifying refugees who were denied asylum and sent back to Haiti. Curiously, the Court found that release of the information might expose the Haitians to persecution or mistreatment, even though much of the information was already in the hands of the Haitian government. (Department of State v. Ray)
In another case, the Court held that the home addresses of government employees should not be disclosed to union organizers. The court reasoned that because the addresses do not relate to government operations, their release would not serve the public interest. The Court further noted that people have a privacy interest in their addresses even though the information "is not wholly private." (Department of Defense v. Federal Labor Relations Authority)
These examples are troublesome because they demonstrate how the presumption favoring disclosure embodied in the FOI Act is becoming subservient to privacy interests. In reshaping the boundaries established by Congress, the Court has restricted access to vital information that could shed light on questionable government activities.
Seven years after the Reporters Committee decision, Congress specifically rejected the high court's narrow definition of "public interest" in the Findings Section of the Electronic Freedom of Information Act Amendments of 1996. There, Congress said the FOI Act was intended to serve any purpose. The Senate Judiciary Committee Report accompanying the amendments confirms that the Findings section was intended to address concerns that Reporters Committee "analyzed the purpose of the FOIA too narrowly." (S. Rep. No. 272, at 26-27 (1996)).
State Freedom of Information Acts
State freedom of information and open meetings statutes also provide exemptions based on grounds of privacy. They are often invoked to seal public employee records.
For example, The Washington Post in December sued Maryland Gov. Parris Glendening to force him to turn over appointment calendars and telephone records for himself and three top aides. State officials refused to turn over the records on privacy grounds. Similarly, a complete list of calls billed to Clark County officials' cellular phones was the subject of a lawsuit filed by the Las Vegas Review Journal. County officials argued that releasing the records would violate the privacy rights of people who communicate with public officials and would inhibit the frank discussion of policy matters. A state district court judge agreed in early March 1998. (DR Partners v. The Board of County Commissioners of Clark County)
Other personally identifiable information about public employees may be withheld as well. An Arizona television station had used birth date information to verify that a substitute teacher, accused of masturbating in class, was a registered sex offender. The station asked a school district for the birth dates of all full-time and substitute teachers to determine whether any other teachers had criminal records. The Arizona Supreme Court held that the teachers' privacy interest in their birthdates outweighed the public's interest in knowing about their criminal backgrounds. (Scottsdale Unified School District v. KPNX Broadcasting Co.)
In another case, the Cedar Rapids Gazette, investigating employees' use of sick leave, sought city documents revealing public employees' pay records, home addresses, ages, and genders. A district court in Iowa held that the city could withhold the information from the newspaper because it is in "an employee's interest to not publicly disclose personal, intimate information that might prompt unwanted personal contacts." The case is on appeal to the state Supreme Court. (Clymer v. City of Cedar Rapids)
In granting heightened privacy protections to elected officials and state employees, courts minimize the public interest served by openness. In addition, courts are wary of disclosing information assembled into a compilation or computer database, even though identical information is accessible from other public documents.
In what has been described as an "unprecedented" decision, a three-judge panel of the federal appeals court in Cincinnati (6th Cir.) unanimously ruled that the release of undercover police officers' personnel files under the state Public Records Act violated their Fourteenth Amendment right to privacy. A friend-of-the-court brief filed by several news organizations argued that the court of appeals erred in holding that the federal Constitution precludes dissemination of personnel information possessed by the government. "No other federal court has ever invalidated a state open government law as violating a constitutional right of privacy," the news organizations wrote. A petition for rehearing is pending. (Kallstrom v. City of Columbus)
The ruling is extraordinary because it recognizes a federal constitutional right to privacy that threatens journalists' ability to gain access to information about government employees that would otherwise be available under state public records laws. According to Dawn Phillips-Hertz, General Counsel for the Michigan Press Association, the decision "will chill access to information in the hands of government . . . [and] . . . is so broad in its reading that much more than personnel files will be removed from public scrutiny."
State governments also maintain extensive records on members of the general public, whose right to privacy is presumably greater than that of state employees. As a result, some courts have upheld nondisclosure even if the information requested can be obtained from other publicly available sources.
Pennsylvania's Open Records Law exempts records "which if disclosed would operate to prejudice or impair a person's reputation or personal security." In one case, the state used this exemption to withhold addresses, telephone numbers and social security numbers in firearms applications. The court said it was "not unaware of the threat to privacy implicit in the accumulation of vast amounts of personal information in computerized data banks or other massive government files." However, the applicant's name, race, reason for requesting the license and answers to background questions could be disclosed because that information does not implicate privacy concerns. (Times Publishing Co., Inc. v. Michel)
Some state courts have ruled that computerized records raise special privacy concerns. The Michigan Supreme Court found that providing a computer tape containing names and addresses of students at a public university "was a more serious invasion of privacy than disclosure in a directory form" because "computer information is readily accessible and easily manipulated," even though the same information would later be published in a public directory. (Kastenbaum v. Michigan State Univ.)
Driver's Privacy Protection Act
In 1994, Congress passed the Driver's Privacy Protection Act (DPPA) which requires states to limit access to "personal information" in motor vehicle records. "Personal information" is defined as an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information.
The law's sponsors invoked the 1989 murder of actress Rebecca Schaeffer, whose assailant hired a private investigator to obtain her address from state motor vehicle records, as justification for the statute's enactment. Although some states had previously restricted access to "personal information" in motor vehicle records, the DPPA imposes withholding specific requirements on every state.
The Act requires states to seal personal information in drivers' records, except in certain defined circumstances, or face imposition of a $5,000 a day fine. However, several categories of requesters, including insurance companies, towing companies, and private investigators, are permitted access. Alternatively, the law allows states to permit public access to the records if they set up an "opt out" system, providing a way for individuals to tell the state not to disclose their personal information. (18 U.S.C. s. 2721-2725)
In mid-September 1997, two federal district courts in South Carolina and Oklahoma declared the DPPA unconstitutional. Both decisions relied on the Tenth Amendment, ruling that the act infringed on the sovereignty of the states by directing them to regulate the disclosure of state-controlled records under threat of penalty. The South Carolina court also found that the information sealed by the DPPA is not the type of "personal" information protected by the Fourteenth Amendment. (Condon v. Reno; Oklahoma v. U.S.)
However, in March 1998 a federal district court in Alabama ruled differently. The court said that the DPPA does not impermissibly compel states to pass laws or invent administrative schemes to govern their own activities. (Pryor v. Reno)
The DPPA took effect on September 13, 1997 and has already resulted in restricted access to motor vehicle records. In late 1997, Maryland drivers rushed to seal all personal information on their driver's licenses (including address, age, height, weight, medical disabilities as well as information about their vehicles), in response to the state's conforming statute. The Washington Post reported in early December 1997 that more than 1,000 motorists a day had asked that the motor vehicle bureau seal their records. By mid-February 1998, nearly 14 percent of Maryland's 3.4 million drivers had "opted out," The Post reported.
Medical Records
In September 1997, Secretary of Health and Human Services Donna Shalala submitted to Congress proposed medical privacy guidelines, as required by the Kennedy-Kassebaum Act.
The recommendations call for a national standard of confidentiality that would protect patient privacy. Specifically, the report proposes that medical records held by health care payers and providers should be disclosed only when necessary for medical treatment and payment, though it provides exceptions for medical research, public health and law enforcement purposes.
The report recommends criminal penalties for unauthorized disclosure of medical information.
Meanwhile, Congress is considering a major medical privacy law, the Medical Information Privacy and Security Act, that would require entities maintaining medical records to develop written privacy guidelines governing disclosure. The bill would impose criminal and civil penalties upon those who obtain or disclose medical information in violation of its provisions. (S. 1368)
In November 1997, President Clinton endorsed proposals set forth in a Consumer Bill of Rights and Responsibilities. The Bill of Rights, recommended by the Advisory Commission on Consumer Protection and Quality in the Health Care Industry, guarantees confidentiality of individually identifiable medical information.
These initiatives present further roadblocks to legitimate newsgathering techniques. Journalists rely on medical information to report on such issues as traffic accidents, disasters and the health of public officials, and to investigate patient abuse and health-care fraud. Access to personally identifiable information allows journalists to present a more complete story to the public. Identification of individuals strengthens the impact and credibility of newsworthy articles. Without such information, reporters cannot probe behind anonymous facts and sanitized details.
Moreover, government regulation of "personal information" may not always be necessary. Consumer pressure can force private companies to change their policy regarding "private" information. For example, public concern about privacy of medical records was heightened in late February 1998 when The Washington Post revealed that a drug store chain and a supermarket providing pharmacy services in the Washington, D.C., area provided confidential prescription information to a Massachusetts company that then contacted patients who did not refill prescriptions. In the wake of consumer outcry, the pharmacies severed their ties with the company.
When courts balance the public interest in disclosure against the privacy interest affected by release, the burden on the requester is a formidable one. It is relatively easy for someone opposing release to argue that disclosure of personally identifiable information has an immediate negative impact. It can be much more difficult for a journalist to demonstrate how disclosure will ultimately serve the public interest.