Center
for Democracy and Technology Public Records: Access, Privacy, and Public Policy
A Discussion Paper Prepared by Robert Gellman
Consultation on Public Records April 21, 1995

© 1995 All Rights Reserved. Revised Draft May 16, 1995

TABLE OF CONTENTS

Executive Summary

I. Introduction and Issue Definition

II. The Stakes: Personal Information in Government Records

III. Right of Access

A. Constitutional Considerations

B. Statutory Considerations

C. Common Law

IV. Right of Privacy

A. Constitutional Considerations

B. Statutory Considerations

V. Use Restrictions

A. Publication Limitations

B. Commercial Speech

1. Credit Reporting

2. Traffic Violations

C. Other Records

1. Election Records

2. Voter Registration

3. Postal Records

D. Copyright and the Price of Information

VI. Observations

Appendix: The Driver's Privacy Protection Act of 1994



Executive Summary

This paper provides background for a policy discussion about access to public records. It is not intended to offer solutions to the conflict between access and privacy interests. A "public record" includes any information maintained by or on behalf of a unit of government that can be linked to a specific individual. This includes a record that contains a name, address, social security number, or other identifier. There is a wealth of personal information in government files, including motor vehicle licensing, land ownership, voter registration, and occupational licensing records.

Constitutional principles governing access to government records and the right of informational privacy are unsettled and controversial. The Supreme Court has found a qualified First Amendment right of access to criminal trials and to records directly related to criminal trials. However, there is no clear First Amendment right of access to other government records, including most records about individuals. The adoption of federal and state freedom of information laws has made exploration of constitutional access rights largely unnecessary.

The Supreme Court has implied that a constitutional right of informational privacy exists, but there is no direct holding. In interpreting the Freedom of Information Act, the Court has come down strongly in favor of protecting privacy, but these decision are statutory and do not explicate the edges of constitutional protections. Other federal and state statutes governing the disclosure of public record information reach a wide variety of results ranging from full public access to no public disclosure. It is difficult to derive general principles from existing statutory law.

Use restrictions may offer a middle ground between openness and confidentiality. Some laws permit limited access to public records or restrict use of the records by the recipients. An example is a voter registration list that may be used for election-related purposes but not for commercial solicitation. Restrictions on publication of information placed in the public domain may be unconstitutional, but other types of restrictions on access or use have been upheld. Giving individuals a choice about the public release of personal information in public records is another option for balancing access and privacy. The legality of use restrictions for public record information is unclear.

Tradition is a recurring theme in discussions about access. There is a greater reluctance to interfere with the availability of information that has been traditionally made public. This is balanced, in part, by a developing concern about the increased threat to privacy by computerization of personal information.

Overall, sharp conflicts between privacy advocates and information users over the availability of public records remain unresolved by absolute principles.


I. Introduction and Issue Definition

What are the principles that govern or should govern access to and use of public records? This paper reviews policy issues surrounding decisions by governments to make available to third parties or to withhold from availability information from government files that can be linked to identifiable individuals. The purpose is to outline the ongoing debate over access to public records, to identify the policies that impact on disclosure decisions, and to provide the basis for a discussion of options and approaches available to address access and privacy interests.

Examples of records that fall within the scope of this discussion include, but are not limited to:

These types of records are commonly referred to as "public records." This terminology is troublesome for several reasons. First, one underlying issue is whether these records should be available for public inspection and copying. The use of the term "public" to describe the records implies a result. It is best to consider that the word "public" refers to the public organization that maintains the records.

Second, the concept of "record" has grown fuzzy with new technology. In the past, a record was a paper document containing particular data. In the computer era, there may be no fixed relationship between information and the format in which it is maintained or disclosed. Also, practical limitations on collection, maintenance, use, and disclosure that exist for paper records may disappear when records are electronic and easy to extract, combine, or otherwise manipulate. Some court decisions on access were significantly influenced by differences in ease of use and disclosure that exist between paper and computer records.

Despite these problems, the term "public records" will be used in this paper for convenience and lack of a readily available alternative. No inference should be drawn one way or another by use of the term that any type of information identified as a "public record" should or should not be publicly available or that the information should be available under particular terms or conditions.

For purposes of this paper, a "public record" includes any record maintained by law, regulation, or practice, by or on behalf of a unit of federal, state, or local government, that contains information that can be linked to a specific individual. This includes a record that contains a name, address, social security number, or other identifier. Records without identifiers are outside the scope of this paper.

Access to a proceeding, hearing, or meeting does not fall directly within the scope of this paper. However, there is a healthy jurisprudence on the issue of access to judicial proceedings and a direct policy overlap between access to judicial proceedings and access to judicial records. As a result, it is appropriate and necessary to consider some "proceedings" precedents when exploring "records" issues. However, these precedents are not always directly relevant to records access because the decisions often hinge on other values (e.g., fair trials, deliberative process).

The paper proceeds by considering the constitutional, statutory, and common law rules governing the right of access, the right of privacy, and restrictions on use of public record information. Court cases and statutes have been selected to illustrate different approaches, theories, results, and points of view.


II. The Stakes: Personal Information in Government Records

Many details of an individual's life, activities, and personal characteristics can be found scattered throughout the files of government agencies. At the federal level, the privacy exemption in the Freedom of Information Act and the Privacy Act of 1974 prohibit the public disclosure of personal information contained in government files. At the state and local level, however, different types of records are maintained, and the laws and policies governing access and disclosure vary, leading to disparate results.

It is possible to construct a detailed profile of an individual using only publicly available, individually identifiable information from government records. While the types of records available from jurisdictions vary, the information that may be available on a given individual (and a likely source of the information) can include:

There may be considerably more information available in public records about an individual who has interacted with the courts as a criminal defendant, as a plaintiff or defendant in civil litigation, as a juror, through divorce proceedings, in bankruptcy proceedings, as a beneficiary of a will, or in other ways. Additional information is also available about individuals who are required to file information on stock ownership with the Securities and Exchange Commission; political candidates and government employees required to file ethics disclosure forms with state or federal offices; recipients of student loans, housing loans, small business loans, and other forms of government assistance; and employees who have filed workers compensation claims.

There are categories of personal information maintained by government agencies that are not routinely available to the public. These include:

The discussion in this paper tends to focus on one specific type of record at a time because this is the manner in which cases have arisen in court or statutes have been passed. The simultaneous availability of many different types of public records containing personal data on an individual is not discussed separately. The ability to compile a detailed dossier on an individual from disparate government records is a broader concern that has yet to receive significant attention in case law.


III. Right of Access

Public access to government records, activities, and proceedings serves several different and overlapping policy goals. Citizens need government information to make political decisions about government programs, legislative and regulatory options, and candidates running for office. Knowledge about government is an important element in instilling confidence in the political system. Citizens need government information to assist in oversight of and accountability for government programs. Individuals need government information to know what services are provided by the government. Many government agencies exist principally to create, collect, or provide information to assist in the conduct of business, legal, or personal affairs. Government information is a valuable resource and commodity that can be used in many different ways to further economic growth. This is not an exhaustive list of the benefits of government information.

Other reasons support public access to specific government records. The list of authorized disclosures included in the Driver's Privacy Protection Act of 1994 provides an example. For motor vehicle records, the law recognizes fourteen disclosures that are either mandatory or permissive. For example, motor vehicle records may be made available for use in any judicial proceeding, including the service of process, and in investigations in anticipation of litigation. Each permitted disclosure can be read as reflecting a legislative judgment that a particular use of the public record is beneficial, legitimate, or otherwise tolerable.

There are other interests and values that may be negatively affected by the public availability of government information, and most cases call for a balance of conflicting interests. Government records may need to be withheld from public disclosure to protect foreign policy or national defense interests, to foster law enforcement investigations, to support the deliberative processes of government, to protect the confidentiality of private business information in government files, and to protect the privacy interests of individuals. At the federal level -- and for some states as well -- there may be hundreds of laws providing that specific categories of information are not available for public access. For other records, specific legislation expressly provides for public inspection and use or for inspection and use for specified purposes. These laws reflect specific conclusions about the appropriate balance between disclosure and non-disclosure.


IV. Right of Privacy

There is a vast literature on the nature and scope of the right of privacy, but there is no consensus on the constitutional, legal, or general meaning of the concept of privacy. The U.S. Constitution guarantees individuals a right to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures; a right against self-incrimination; and a right to speak and assemble. These and other constitutional principles have been associated with privacy interests. Justice Brandeis referred to these collective interests as the "right to be let alone." The right of privacy has been analyzed as two separate interests: an interest in avoiding disclosure of personal matters and an interest in independence for personal decisions involving marriage, procreation, contraception, family relationships, child rearing, and education.

As with other constitutional rights, there is no absolute right of privacy. Like the right of access, the right of privacy must always be balanced against other interests. Many interests involved in balancing access and privacy are the same: national security, law enforcement, and the operational requirements of government. Of course, interests in access and privacy are constantly balanced against each other.


V. Use Restrictions

Access to public records is not simply a yes-or-no proposition. Sometimes, only selected parties have been permitted to have access to the records, parties are permitted to have access for specific uses, or specific uses are prohibited while others are permitted. Use restrictions can be categorized as an exception to an access policy or, depending on your point of view, as an exception to a confidentiality policy. Use restrictions offer additional alternatives for crafting policy, but it becomes more difficult to establish a simple framework for analysis. New constitutional considerations may arise with use restrictions.


VI. Observations

Drawing general principles from the material summarized here is a challenging task. Precedents range from one extreme to the other. Some records are entirely public and available for use without restrictions. Some records are not available to the public under any circumstances. Intermediate models illustrate partly open or partly confidential disclosure systems, with either statutory, regulatory, or wholly discretionary standards.

Existing case law provides a wealth of material from which support for any desired result can be found. Judicial rhetoric supporting both public access and personal privacy abounds. There are separate lines of conflicting or overlapping precedents that allow a judge to select the precedent that achieves a desired outcome. Some cases offer constitutional conclusions, although it is difficult to extrapolate in this area with any confidence unless using rulings of the U.S. Supreme Court, and even the Supreme Court decisions are fuzzy in many respects. Except in the area of access to criminal trials, there is no clear, sharp, single line of reasoning or precedent that controls decision making.

Similarly, policy support can be found for all points of view. General freedom of information principles can be cited to support maximum use of government records for the benefit of all. Yet somewhat conflicting principles have been applied to limit disclosures under the FOIA to information that relates to the operations and activities of the government. This line of reasoning has been applied to sharply restrict the disclosure of personal information. Fair information practice principles raise similar questions about the propriety of using personal information for a purpose other than the purpose for which the information was collected. Support for any result can be found by selective use of available policies and principles. Reasonable people can agree on principle yet disagree on the application to particular records.

The many statutes that require, permit, or prohibit the disclosure of specific categories of public records would appear to offer a wealth of material from which more general principles can be deduced and policies can be isolated. In practice, this is much more difficult than it appears. For state statutes, it is frequently impossible to find materials explaining the intent or purpose of the law. Even if materials may be found, they may not reflect current controversies.

For example, a statute opening drivers records that passed decades ago in the pre-computer era may have resulted in unforseen uses of those records. One may argue fairly that the intent of the open records law was to permit all such uses without distinction. One may just as easily argue that the expanded use of records resulting from computers and industry practices was not foreseen or intended. More recent statutory activity in one state or another will offer support for both sides.

Conflicting policies can be found in the same state for different types of records. One record may be closed to inspection while another record with similar information is open. For example, a social security number may be public through motor vehicle records but not through voter registration records. Similarly, medical information in a state public health department is normally confidential, but medical information from a driver's license may be disclosed.

In addition, there has been a considerable change in the general approach to the disclosure of government records since the passage of the federal Freedom of Information Act in 1966 and the Privacy Act of 1974. This too cuts both ways. While there has been much greater focus on the benefits of access to government records in general, there has also been a greater emphasis on the protection of privacy interests. Much has been learned about disclosure and privacy laws in the last twenty years, and old laws often fail to address modern issues.

It is a truism that legislatures do not always make decisions with logical, rational, and consistent policy objectives in mind. Sometimes, however, statutes on related subjects passed over time can be analyzed to divine a coherent set of legislative principles. Other times, this is difficult or impossible. For public records, this is a difficult task if approached with a broad focus. It may be possible to categorize policies for specific classes of records, but this is much harder when many types of records are under consideration.

Attempts to look behind the statutes to constitutional principles are equally frustrating. There are no absolutes to be found. There is no absolute constitutional or First Amendment right of access to government records about individuals in their personal capacity. The First Amendment interests in disclosure are qualified. The interests range from strong to non-existent. Similarly, there is no firm constitutional right of privacy that can be cited to prevent the government from generally disclosing personal information about individuals. There is some suggestion of a constitutional right of informational privacy, but the support is uncertain and the scope is far from clear. There are conflicting precedents and considerable confusion in the courts.

There are recurring themes, but they lack the consistency needed for making broader determinations. One important theme is tradition. Some public records have traditionally been open to the public, and this has influenced the setting of some access policies. Yet tradition can be a double-edged sword when new classes of records are created that begin with no tradition of public access. Traditions also may be subject to change when circumstances change, when new legislation is passed, or when record keeping technologies change. Older traditions were restrictive with respect to some categories of government records. More recent traditions -- highlighted by the modern freedom of information movement -- are much less restrictive. However, the open access policies reflected in freedom of information laws are a tradition with roots of less than thirty years. Recent cases involving personal information have mostly but not exclusively limited public access.

Another identifiable theme is special concern about computerized records. The trend of modern information policy has been to support the availability of computerized government records in electronic formats convenient to users. Legislation to support access to computerized records has been proposed or adopted in many jurisdictions. But some courts have found greater threats to privacy when personal records are computerized and have imposed restrictions on computerized records that do not necessarily apply to paper records. These format restrictions appear inconsistent with the strong trend toward increased access to computerized and networked information, although personal information may simply be an exception to a general rule.

At the same time, the availability of computers and networks may result in instantaneous, unrestricted, world-wide access to digital government records. Broader availability may intensify the privacy intrusion that flows from the initial disclosure. Case law tends to address disclosure issues through a system-by-system approach, and the overall effects of the availability of many different types of personal information from disparate government systems is frequently ignored.

Another complication is the possibility that individual records made available by government may be collected by the press or by others and compiled independently into complete, computerized databases that are privately maintained and unregulated. Those who are willing to make individual records available -- but not computerized compilations -- may find that the distinction becomes less meaningful as private repositories are developed.

One type of personal record that has drawn special attention is the social security number. Strong arguments have been presented about the possibility of fraud and economic loss resulting from the misuse of social security numbers, and courts have imposed special restrictions on availability. It is unclear whether these concerns are narrowly limited to social security numbers or whether similar arguments can be presented for other classes of data.

The cases and statutes restricting use of public records represent a largely unexplored area. The clash between privacy interests and First Amendment interests has resulted occasionally in the establishment of legislative use restrictions as a middle ground between the extremes of access and disclosure. The middle ground, however, is filled with vague categories, unclear distinctions, fuzzy language, and different approaches.

There are several different models of use restriction. The Fair Credit Reporting Act (FCRA) contains no access restrictions, but it limits the use of some public information in credit reports. Yet this same information may be used by others without regulation under the Act. As the Equifax case suggests, credit grantors can obtain and rely on public record information although credit reporting agencies are prohibited from reporting that same information. The Fair Credit Reporting Act is similar in some respects to the rules governing FEC contribution records. Here too, there are no limits on access, but specific uses are prohibited. Under the FCRA, only specific actors are prohibited from using regulated information. Under the FEC law, all actors are prohibited from using information in specific ways.

The Colorado statute upheld in the Lanphere case permits disclosure of criminal justice information except to those who will use the information in direct solicitation of business for pecuniary gain. A similar approach can be found in the New York Freedom of Information Law that includes a legislative determination that use of names and addresses for commercial or fundraising purposes is an unwarranted invasion of personal privacy. Information sought for that purpose is exempt from disclosure.

The new Postal Service rule for disclosing address records over-the-counter supports disclosure only to qualifying organizations or for approved purposes. Others may not have the information at all. By affirmatively identifying those entitled to the information, the postal model avoids the use of broad and vague categories of uses and users. The California voter registration law uses a similar model of disclosure to identified organizations or for specified purposes. The California restrictions follow the information as it is passed to downstream users. The Postal Service limitations do not. Access to postal records is case-by-case. Downstream restrictions appear to be a significant issue only for large collections of records.

The Federal FOIA offers a different twist. Under the Reporters Committee decision, the identity or purpose of a requester is not relevant in determining whether personal information can be disclosed. The law, however, includes a fee structure that distinguishes among requesters by purpose or status. Requesters who seek information for "commercial use" are charged the highest fees. The cost of search, duplication, and review can be charged for these requests. The term "commercial use" is not defined in the statute. Another category of requester is "representative of the news media". These requesters are charged the lowest fees.

At a minimum, the Equifax decision identified some uncertainty about the constitutionality of use restrictions. If use restrictions are unconstitutional, then parts of the Fair Credit Reporting Act are unconstitutional. This is a troublesome conclusion for a law that appears to be working well with respect to the use limitations. Even if the Equifax holding is correct, however, other approaches to implement use restrictions may still be available. It is far from clear that all of these methods would be tarred as unconstitutional. If any form of access restriction, use restriction, or fee differential is upheld, then the door to substantive restriction is open. Further, if use restrictions are unconstitutional, then the only alternative for those concerned about privacy and misuse of personal information may be to cut off public access entirely. For most public records, there is no clearly established constitutional right of access that would trump a statutory limitation on disclosure. For some categories of records, however, a complete bar to public access would interfere with other objectives and may be objectionable from a political or policy perspective.

It is hard to find firm principles that can be used to evaluate use restrictions from a constitutional or a policy perspective. There has not been enough litigation to enable the drawing of clear lines. A secondary complication is whether use restrictions can be realistically enforced in an era of computers and networks. Only the FEC law polices remote users by salting lists with fake names. In other cases, it may be impossible to determine if there has been an actual violation of a use restriction.

The Driver's Privacy Protection Act of 1994 (see appendix) offers individual choice as an alternative. Instead of treating all records as open or confidential, the subject of each record is allowed to determine the degree of public disclosure of his or her own record. The way in which the option is presented has been and will be the subject of considerable debate, but individual choice offers a way of balancing interests on a case-by-case basis. It may be appropriate to break down choices even further. For example, an individual could be offered a choice about the disclosure of elements of a record. Some might object to disclosure of medical information, height and weight, or need for corrective lenses from a driver's license but not to home address. Individual choice offers an alternative to complex or unclear statutory standards, but the costs of collecting and enforcing individual choices may not be trivial. Computerization may reduce these costs significantly, making individual choice a viable option to address conflicts over access and privacy interests.


Appendix: The Driver's Privacy Protection Act of 1994:

As part of the Violent Crime Control and Law Enforcement Act of 1994, Congress enacted the Driver's Privacy Protection Act of 1994 to establish rules governing the disclosure of individually identifiable information from state department of motor vehicle records. The legislation was sponsored in the House of Representatives by Rep. James Moran (D-VA) and in the Senate by Senator Barbara Boxer (D-CA). The idea of providing an opt-out for drivers records and for other state records dates back at least to 1977 when the Privacy Protection Study Commission recommended that state agencies be directed to develop an opt-out procedure.

The Driver's Privacy Protection Act of 1994 restricts the ability of motor vehicle departments to disclose motor vehicle operator permits, motor vehicle titles, and motor vehicle registrations. Information on accidents, driving violations, and driver's status is expressly excluded from the federal disclosure rules. For covered information, only those disclosures specifically authorized in the Driver's Privacy Protection Act are allowed. Violations are punishable by a criminal fine or by a civil fine against a department of motor vehicles. The law also provides for civil actions by aggrieved individuals.

Mandatory disclosures cover motor vehicle and driver safety and theft programs; motor vehicle emissions; product alterations, recalls or advisories; performance monitoring of vehicles and dealers by manufacturers; and activities mandated under federal laws regulating motor vehicles. Essentially, motor vehicle records can continue to be used to conduct legally mandated motor vehicle activities.

There are fourteen permissive disclosures in the Act, and two of these were especially controversial. The twelve less controversial disclosures are --

to a government agency or its agent

These disclosures generally authorize specific uses of motor vehicle information that relate to public or private motor vehicle activities, or that had become established in past years. Interest groups that regularly use motor vehicle records were generally successful in lobbying to retain access to and use of the records.

There are two disclosures that were made contingent on offering the subject of the record the opportunity to object to the disclosures. The first is for use in response to a request for an individual record. Before any such disclosure, the individual must be given notice of the possibility of a disclosure to any requester and a clear and conspicuous opportunity to prohibit the disclosure. The notice can be provided on application or renewal forms, titles, or registrations. The law does not require specific notice of each request.

The other contingent disclosure is for bulk distribution for surveys, marketing, or solicitations. Before making this type of disclosure, a motor vehicle department must have implemented procedures to ensure that a) individuals have been provided an opportunity, in a clear and conspicuous manner, to prohibit the disclosure, and b) the information will be used, rented, or sold solely for bulk distribution for surveys, marketing, or solicitations but that no survey, marketing, or solicitation will be directed at an individual who objected in a timely fashion.

The first of the controversial disclosures was crafted in response to objections from the news media. One concern that prompted the establishment of dual opt-out procedures was that a single opt-out by individuals seeking to avoid marketing use of their names also would eliminate access by reporters as a by-product. A two part opt-out was used, and the first permits record subjects to object to requests for individual motor vehicle records.

The second of the controversial disclosures was carefully crafted to allow disclosure of individual information for use in marketing and related activities but to prohibit the use of the information by the recipient when an objection was on file. This procedure was developed because some organizations maintain complete drivers records obtained from motor vehicle departments and use them for a variety of authorized purposes such as vehicle recalls. The statute allows the organizations to maintain a complete list but to exclude from marketing uses those individuals who have opted-out.

The Driver's Privacy Protection Act of 1994 becomes effective in 1997. The opt-out provision may be implemented beginning with license renewals after the effective date. States must allow individuals who have not yet been offered an opt-out through the renewal process to initiate an opt-out on their own.




The Center For Democracy And Technology
1634 Eye Street NW, Suite 1100
Washington, DC 20006
(v) +1.202.637.9800 (f) +1.202.637.0968

For more information, write webmaster@cdt.org