Oliver Wendell Holmes once wrote that hard cases make bad law. Harsh statutes also create problems, and an Ohio law that declined to take privacy into account offers an example. The failure of this statute to recognize privacy interests may not be good for data subjects or, ironically, for data users either.
Two court decisions from Ohio make the point. Every state has a general access-to-records law. In Ohio, it is called the Public Records Act. The federal equivalent is the Freedom of Information Act.
The federal law exempts most personal information from disclosure. For example, a request for a list of names and home addresses of federal employees will be denied on privacy grounds. A list of public employees is available, for the most part, but not home addresses or other personal data.
The Ohio law, like the law in some other states, does not contain a privacy exemption. As a result, personal information about state or local employees is not exempt from disclosure. In 1994, a newspaper asked the city of Akron for a computer tape containing the name and address, telephone number, Social Security number (SSN), birth date, education, employment status and position, pay rate, annual and sick leave, overtime pay and hours and year-to-date earnings of each employee. That is a lot of detailed personal information.
Acting under the Public Records Act, the city handed over all requested data except for SSNs. For reasons that escape me, the newspaper challenged this limited withholding. The case ended up in the Ohio Supreme Court. Since the law had no privacy exemption, the court couldn't find any statutory basis for withholding the SSNs. But the court didn't like disclosing the numbers because it found that there was a high potential for fraud through the release of SSNs. Lacking any alternative, the court decided that disclosure was a violation of the U.S. Constitution. The decision was a narrow one, confined by the court to the circumstance of the case, whatever that means.
The failure of the public records statute to recognize privacy meant that the court had to rely on the Constitution as the only available means for establishing appropriate protections. There was no other option than making new law.
This brings us to the second Ohio case, decided in February by the federal Sixth Circuit Court of Appeals. The case did not arise under the Public Records Act, but that act still was relevant. The contested disclosure arose during a criminal prosecution of members of a violent drug gang. Defense counsel asked for the personnel files of three undercover police officers.
The files contained even more information than the Akron tapes. The files included the names, addresses and phone numbers of family members and personal references; the officers' banks and bank accounts, including account balances; responses to personal questions from polygraph examinations; and copies of driver's licenses, including pictures and home addresses.
Needless to say, the officers were not pleased at the prospect that this information about themselves and their families would be handed over to the lawyers for accused drug dealers. The risks to personal safety are apparent.
As in the Akron case, the court could not find any statutory basis for withholding the records. The lack of a privacy exception in the Public Records Act was crucial. The federal court, as the state court did earlier, turned to the federal Constitution to find a basis for preventing the injustice of turning personal and family information over to accused criminals.
To reach that result, the court had to break new ground. It held that the officers' privacy interests implicated a fundamental constitutional interest, specifically an interest in preserving their and their family members lives and personal safety. The release of information to the lawyers for the accused was clearly a problem. The court enjoined disclosure of the undercover officers' files.
It is easy to dismiss the case based on the unusual circumstance of disclosing undercover police files to violent criminal defendants. However, the implications may go further. The court recognized that the release of the data to anyone would increase the risk that it would fall into the wrong hands. The court said, “Should this information fall into the wrong hands, the officers or their family members may suffer serious and
irreparable harm.”
Information from public records not only puts undercover police and their families at risk, but also other police, judges, public officials, crime victims, witnesses and others. Ohio state and local personnel files, motor vehicle records, hunting and fishing licenses and other records have no privacy protections. Anyone presumably can obtain and re-disclose these records.
It is not hard to argue that making the records public is the equivalent of turning them over to the lawyers for every accused criminal defendant and to every dangerous individual. Lookup services, for example, acquire personal records from Ohio and other states and provide information to their many customers. The Sixth Circuit decision offers support to the conclusion that disclosing any state personal records may abridge constitutional privacy interests for at least some individuals because of the widespread availability of public records from commercial services.
Had the Ohio law provided a reasonable privacy balance, the court could have avoided making a constitutional decision. Instead, privacy advocates may now be able to use the new constitutional principle to challenge the availability of other public records. The case offers the opportunity for a broad attack on the availability of personal information from state and local files.
The absence of a balance on privacy has produced a broad new constitutional principle. This result may be something to consider next time marketers huddle together to oppose a new privacy law.
Robert Gellman is a Washington-based privacy and information policy consultant and former chief counsel to the House of Representatives subcommittee on information, justice, transportation and agriculture. He can be contacted at [email protected].
