Linda M. Hamel
Information Technology Division
Executive Office for Administration and Finance
One Ashburton Place, Room 801
Boston, Massachusetts 02108
Dear Ms. Hamel:
I have received your request for an advisory opinion concerning the public records status of certain information technology and electronic government related documents. See 950 C.M.R. 32.07 (Supervisor of Public Records may issue advisory opinion upon written request of custodian).
"Public records" is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any division of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26) (2000 ed.). The statutory exemptions are strictly and narrowly construed. Attorney General v. Assistant Comm´r of the Real Property Dep´t of Boston, 380 Mass. 623, 625 (1980); Attorney General v. Board of Assessors of Woburn, 375 Mass. 430, 432 (1978).
Specifically, you question whether website pages fall within the Public Records Law. As stated above, the statutory definition of public records includes any document created or received by any employee of any division of the Commonwealth, regardless of physical form or characteristics.
In examining the phrase, "regardless of physical form or characteristics," courts have consistently held that public records statutes encompass computer records. Tennessean v. Electric Power Bd. of Nashville, 979 S.W.2d 297 (Tenn. 1998) (city electric company ordered to provide customer list maintained on computer database); Seigle v. Barry, 422 So. 2d 63 (Fla. Dist. Ct. App. 1982) (no doubt that information stored on a computer is as much a public record as a paper record); Stephan v. Harder, 230 Kan. 573, 641 P.2d 366 (1982) (duty to segregate nonpublic information also necessary with computer records); Maher v. Freedom of Information Comm´n, 192 Conn. 310, 472 A.2d 321 (1984) (requester bore the cost of creating program to obtain information from agency database). Courts have also held that allowing agencies to utilize computers to assist in their operation yet limiting dissemination to the public frustrates the purpose of public records statutes. Tennessean, 979 S.W.2d at 304.
Federal courts have also held that, "it is clear that computer-stored records, whether stored in the central processing unit, on magnetic tape or in some other form, are still ´records´ for purposes of the Federal Freedom of Information Act." Long v. IRS, 596 F.2d 362, 365 (9th Cir. 1979); cert denied, 446 U.S. 917 (1980). Relying on this precedent, a federal court has also determined that an electronic mail system was a record. Armstrong v. Executive Office of the President, 810 F.Supp. 335, aff´d and remanded, 1 F.3d 1274, on remand 877 F.Supp. 690, rev´d on other grounds 90 F.3d 553, reh and cert denied 117 S.Ct. 1842.
Whereas the website and its corresponding pages are created and published by an employee of the Commonwealth, they fall within the statutory definition of "public records" and is therefore subject to the Public Records Law. The determining characteristic to consider is the substance of the record, not the medium in which it is retained.
You also question whether disclosure of certain information received by the Information Technology Division (Division) may implicate the privacy interests of individuals. Accordingly, exemption (c) merits consideration.
Exemption (c) applies to:
personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy.
G. L. c. 4,§7(26)(c) (2000 ed.).
Exemption (c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-34 (1983). Only the second clause is relevant to this determination. Analysis under the second clause is subjective in nature and requires a balancing of the public´s right to know against the relevant privacy interests at stake. Real Property Dep´t, 380 Mass. at 625, Torres v. Attorney General, 391 Mass. 1, 9 (1984). Therefore, determinations must be made on a case by case basis.
The second clause only protects "intimate details of a highly personal nature." Real Property Dep´t, 380 Mass. at 625. Marital status, legitimacy of children, paternity, medical condition, government assistance, substance abuse, family disputes and reputation are examples of the kind of information the exemption was designed to protect. Id. at 626 n.2. Since the Public Records Law favors disclosure, the exemption will apply only where the privacy interest of the subject record outweighs the public interest in disclosure. Attorney General v. Collector of Lynn, 377 Mass. 151, 156 (1979).
Personalization information is information provided by an individual accessing a website in order to allow the website to interact with the user in a more individualized and personal manner. It provides visitors with easy access to the site and to information which may be useful to their unique situation. By definition then, this information may contain data of a personal nature such as the user´s marital and financial status or medical condition.
In the example provided in your request letter, if an individual is seeking information over the website on government assistance, on one hand, it may indicate that he or she is experiencing financial difficulty. An individual´s private financial problems can be characterized as an intimate detail of a highly personal nature. See Real Property Dep´t, 380 Mass. at 626 n.2 (government assistance one example of an intimate detail); see also Torres, 391 Mass. at 8 (disclosure of information provided to governmental agency in connection with obtaining services or benefits is an invasion of privacy). Consequently, disclosure of any details which directly or indirectly identifies an individual as an applicant or recipient of government assistance would reveal intimate details of a highly personal nature. Identifying details consist of information which identifies an individual not only to the public at large, but also to those who are familiar with the individual. Globe Newspaper Co., 388 Mass. at 438.
On the other hand, the public interest in disclosure of this information must be considered on a case by case basis. The public has a legitimate interest in knowing whether government assistance is being provided to qualified recipients. See Collector of Lynn, 377 Mass. at 158 (great public interest in knowing whether public officials are carrying out their duties efficiently and legally).
In this instance, however, disclosure of information concerning particular recipients and applicants does not assist the public in assessing the performance of public officials responsible for determining an individual´s eligibility. Disclosure of personalization information reveals nothing to further the public interest in the expenditures of public funds or the job performance of public employees. The public interest in such information is minimal.
Therefore, the individual´s privacy interests clearly outweighs the public´s interest in disclosure and the personal information need not be disclosed. Accordingly, the Division may withhold the names and any identifying details of government assistance applicants and recipients provided over the web site pursuant to exemption (c).
Customer Relations Management Documents
You also question whether the disclosure of Customer Relationship Management Documents, which may include an individual´s name, address, and phone number, fall within an exemption. Exemption (c) may be applicable. As stated above, the second clause only protects "intimate details of a highly personal nature." Real Property Dep´t, 380 Mass. at 625. Since the Public Records Law favors disclosure, the exemption will apply only where the privacy interest of the record subject outweighs the public interest in disclosure. Collector of Lynn, 377 Mass. at 156.
An individual´s name and address are commonly available through a variety of public sources and cannot be identified as being an intimate detail of a highly personal nature. See Collector of Lynn, 377 Mass. at 157 (seriousness of any invasion of privacy resulting from disclosure of records is reduced since substantially the same information is available from other sources); see also G. L. c. 51, §§ 6-7 (1998 ed.) (street list statute); see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 427 (1988) (that information may be derived elsewhere reduces the expectation of privacy but it is not dispositive). Moreover, residential addresses are generally available through public sources such as telephone directories. Although availability of information in other forms is not dispositive of its public records status, it is a factor in the determination thereof. See Pottle v. School Comm. of Braintree, 395 Mass. 861, 866 (1985). Therefore, since names and home addresses are not intimate details of a highly personal nature, they are disclosable.
Published telephone numbers are not exempt for the same reasons that names and home addresses are not, as discussed above. However, disclosure of an unpublished number can result in an unwarranted invasion of privacy. Specifically, an individual whose telephone number is unpublished may have a reasonable expectation of privacy in the number if it was provided in a manner intended to secure its private nature. Real Property Dep´t, 380 Mass. at 627 (inquiry into privacy interests at stake in disclosure of numbers called on municipal telephone lines).
The extent of the privacy interest affected turns on whether the individuals whose numbers are unpublished took measures to ensure that their telephone numbers were not further publicized. The public interest in disclosure of such telephone numbers may be outweighed by an individual´s demonstrated interest in protecting the confidentiality of an unpublished number. Accordingly, the public records status of unpublished telephone numbers can only be made on a case by case basis.
An individual who calls the Division with inquiries about the website avails himself of agency assistance and has put himself into the public forum. Therefore, he cannot have any reasonable expectation of privacy. Nonetheless, any person who wishes to retain privacy concerning his identity may do so. An individual who wishes to preserve his anonymity may remain unknown if he so chooses.
You question whether authentication information, received through the Massachusetts website portal and stored by the Division system, relate solely to the internal practices of the Division and therefore may be withheld pursuant to exemption (b).
Exemption (b) applies to those records which are:
related solely to internal personnel rules and practices of the government unit, provided however, that such records shall be withheld only to the extent that proper performance of necessary governmental functions requires such withholding.
G. L. c. 4, § 7(26)(b) (2000 ed.).
There are no authoritative Massachusetts decisions interpreting exemption (b). The general purpose of the cognate federal exemption, however, is merely to relieve agencies of the burden of assembling and maintaining for public inspection materials in which the public cannot reasonably be expected to have an interest. See Department of the Air Force v. Rose, 425 U.S. 352, 362-70 (1976) (interpreting the federal Freedom of Information Act, which provides an exemption for records which are "related solely to the internal personnel rules and practices of an agency"); see also Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432 (1983) (Massachusetts Public Records Law modeled on federal Freedom of Information Act).
Materials relating to matters such as personnel´s use of parking facilities, regulation of lunch hours and statements of sick leave policy are examples of the types of records to which that exemption applies. Department of the Air Force, 425 U.S. at 362. The courts have interpreted the federal exemption to allow withholding of materials which, if released, could cause agency rules or regulations to be circumvented. See Fiumara v. Higgins, 572 F. Supp. 1093, 1102 (1983) (internal codes are exempt where disclosure may enable outsiders to circumvent agency functions).
The analysis employed by the federal courts requires a two-pronged test. Material is exempt if it is predominantly used internally and if disclosure would significantly risk circumvention of agency regulations and statutes. NTEU v. U.S. Customs Service, 802 F.2d 525, 528 (D.D.C. 1986), quoting from Crooker v. Bureau of Alcohol, Tobacco & Firearms, 670 F.2d 1051, 1074 (D.D.C. 1981) (en banc) (investigative strategy used by agency to detect criminal violations exempt where disclosure would make detection much more difficult and ultimately render the materials obsolete); see also Marrera v. United States Dep´t of Justice, 622 F. Supp. 51, 55 (D.D.C. 1985) (Bureau of Prisons access and identity codes were properly withheld as materials in which the public would have no legitimate interest or which would compromise security if disclosed).
The language of the federal provision is duplicated in the first clause of exemption (b). The second clause of exemption (b), however, contains language which requires a more restrictive application. The addition of the qualifying second clause of exemption (b) evidences a legislative intent to create an exemption which is narrower in scope than the previously enacted, parallel federal exemption. See Globe Newspaper Co., 388 Mass. at 432-33 (if language in a state statutory provision differs in material respects from an analogous, previously enacted federal statute, a rejection or expansion of the legal standards embodied or implicit in the federal statute may be inferred).
Therefore, in Massachusetts, a record custodian must not only demonstrate that the records relate solely to the internal personnel practices of the government entity, but that proper performance of necessary government functions will be inhibited by disclosure. See G. L. c. 66, §10(c) (2000 ed.) (it is the record custodian´s burden to demonstrate with specificity that an exemption applies).
It is my understanding that authentication information will allow individuals access to confidential and personal information via the website. In order to receive such data, the individual must provide an identification name and password and be verified as an appropriate receiver of such confidential data. A primary function of the Division is to provide reliable and secure data communication services to state agencies and citizens accessing the web site. In addition, part of that function is to provide visitors with easy access and information useful to their situation.
Information regarding the procedures used by Division staff to verify the identity of a particular user relates solely to the internal workings of the Division. Moreover, disclosure of this information could prove detrimental to the Division´s protection and maintenance of the website, as knowledge of the Division´s computer network system could enable an unauthorized individual to access personal and confidential information. Therefore, as the information relates solely to internal practices of the Division and disclosure could inhibit the Division´s governmental function of maintaining a secure web site, exemption (b) will operate to exempt authentication information, server logs and any other means of monitoring records, from disclosure.
You question whether exemption (a) would operate to withhold from disclosure copyrighted or proprietary information held by the Division. Therefore, exemption (a) warrants review:
Exemption (a) allows the withholding of those records which are: specifically or by necessary implication exempted from disclosure by statute.
G. L. c. 4,§7(26)(a) (2000 ed.).
A governmental entity may use exemption (a) as a basis for withholding requested materials where the language of the exempting statute suggests that the public´s right to inspect records under the Public Records Law is restricted. Attorney General v. Collector of Lynn, 377 Mass. 151, 154 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). My authority as Supervisor of Public Records does not permit me to order disclosure of records if a statute mandates nondisclosure. General Chemical Corp. v. Department of Envtl. Quality Eng´g, 19 Mass. App. Ct. 287, 294 n.4 (1985).
You argue that proprietary information should be exempt, by necessary implication, because state statutes protect trade secrets from disclosure when received by other state agencies. See, e.g., G. L. c. 23G, § 2 (any documentary materials or data whatsoever made or received by any member or employee of the Massachusetts Development Finance Agency and consisting of, trade secrets or commercial or financial information shall not be deemed public records; G. L. c. 40G, §10 (any documentary materials or data made or received by the Massachusetts Technology Development Corporation, to the extent that such material or data consist of trade secrets, commercial or financial information, shall not be deemed public records).
A statute can only exempt a record by necessary implication where the language of the statute implies that disclosure of certain information would be restricted. The above statutes were specifically enacted to protect trade secrets received by subsidiary divisions established within state agencies. Therefore, it is beyond the authority of this office to proclaim that the legislature intended to protect all trade secrets received by state agencies, where those agencies´ own regulations do not provide or imply protection for proprietary or trade secret information.
You question whether proprietary information associated with trial software may fall within exemption (g).
Exemption (g) applies to:
trade secrets or commercial or financial information voluntarily provided to an agency for use in developing governmental policy and upon a promise of confidentiality; but this subclause shall not apply to information submitted as required by law or as a condition of receiving a governmental contract or other benefit.
G. L. c. 4, § 7(26)(g) (2000 ed.).
Textual differences distinguish this exemption from the cognate federal provision, 5 U.S.C.§552(b)(4). Unlike its federal counterpart, exemption (g) provides stringent criteria which must be met in order for information to be exempt from mandatory disclosure. These criteria are:
- trade secrets or commercial or financial information
- voluntarily provided to an agency
- for use in developing governmental policy
- upon a promise of confidentiality
- information not submitted as required by law; or information not submitted as a condition of receiving a governmental benefit.
If statutory language differs in material respects from a previously enacted federal statute, a rejection of the legal standards embodied or implicit in the federal statute may be inferred. See Globe Newspaper Co., 388 Mass. at 432-33. Therefore, it may be inferred that the Massachusetts Legislature has rejected the broader protection afforded commercial and financial information by the federal Freedom of Information Act.
Accordingly, proprietary information associated with trial software may fall within exemption (g) if it satisfies the above criteria of the exemption.
I hope that this advisory opinion has been helpful to you. If you have further questions, please contact this office.
Very truly yours,
Alan N. Cote
Supervisor of Public Records