If a Delaware state agency keeps its records in an electronic database, does FOIA require giving requesters the data itself, not just paper printouts?

Official title

06-IB17 RE: Freedom of Information Act Complaint Against State Public Integrity Commission

Plain-English summary

A newspaper reporter asked Delaware's Public Integrity Commission for lobbying expense reports and public officials' financial disclosure reports in electronic form, so he could search and sort the data himself instead of flipping through printed pages. The Commission refused on four different theories: it's only required by statute to keep paper records; it already gave the reporter paper copies, which should be enough; a private vendor, not the Commission, actually runs the electronic database; and pulling the data into the specific file format the reporter wanted would mean creating a brand-new record FOIA doesn't require. If the database was covered at all, the Commission separately wanted to withhold its vendor's software, personal identifiers like passwords, and the financial details in the disclosure reports over identity-theft concerns.

The AG rejected every one of the Commission's threshold arguments but sided with it on how far redaction could go. FOIA's definition of a "public record" doesn't depend on whether the law required the agency to create the record in the first place, so a database the Commission wasn't statutorily obligated to build still became a public record once it existed. The reporter was entitled to the actual electronic data, not just paper printouts of the same information, since Delaware's FOIA makes no distinction between storage formats. That the data physically sits on a private contractor's server didn't matter either: because the Commission owned the data and had full administrative access to it under its contract, the Commission was legally the record's custodian. But the AG agreed the Commission didn't have to reprogram the database into the specific comma-separated file format the reporter asked for, since that would mean building a new record rather than handing over an existing one, and agreed the Commission could strip out passwords, user IDs, and similar security-related fields before releasing the data. On the financial disclosure reports, though, the AG found the underlying investment and creditor information (as opposed to bank account numbers) was exactly the kind of data the public is entitled to check for conflicts of interest, whether it's typed on paper or searchable online, and ordered it released electronically like the rest.

Currency note

This opinion was issued in 2006. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Does a Delaware agency's electronic database count as a public record even if no law required the agency to build one?

Yes, according to this opinion. The AG found Delaware's FOIA defines a public record by what information the agency actually owns, uses, or compiles, not by whether a statute obligated the agency to create or maintain it in the first place.

Can a Delaware public body satisfy an electronic-records request by just handing over paper printouts of the same information?

No, according to this opinion. The AG found FOIA doesn't let an agency substitute a different format for the one requested; if the information exists electronically, the agency generally has to provide it electronically.

If a private company runs a government database under contract, is that database still subject to Delaware's FOIA?

Yes, according to this opinion, so long as the public body owns the data and has administrative access to it. The AG found a government agency can't shield its records from FOIA simply by outsourcing the database to a private vendor.

Does FOIA require a Delaware agency to reformat or reprogram its database into whatever file format a requester wants?

No, according to this opinion. The AG found that converting data into a new file structure, as opposed to just deleting exempt fields, amounts to creating a new public record, something FOIA does not require.

Background and statutory framework

FOIA requires that "[a]ll public records shall be open to inspection and copying," 29 Del. C. § 10003(a), and defines a "public record" as information "owned, made, used, retained, received, produced, composed, drafted or otherwise compiled or collected, by any public body, ... regardless of the physical form or characteristic by which such information is stored, recorded or reproduced," id. § 10002(g). Financial disclosure and lobbying reports filed with the Commission must separately "be made available at reasonable hours for public inspection and copying pursuant to [FOIA]," id. §§ 5814(b), 5836(b).

On the threshold "required by law" argument, the AG distinguished the Delaware Court of Chancery's Jacobs v. City of Wilmington, which held certain voluntary traffic-accident reports were exempt because a different statute specifically shielded them, not because the police weren't required to create them. Delaware's broad definition of "public record," the AG held, following the Maryland Court of Special Appeals' Office of the Governor v. The Washington Post Co., is not limited to records a public body is legally required to make or keep. On the format question, the AG relied on the D.C. Circuit's Yeager v. Drug Enforcement Administration and the Illinois Supreme Court's American Federation of State, County & Municipal Employees v. County of Cook, both holding that an agency cannot respond to a request for electronic data by supplying paper records instead, tempered by the Ohio Supreme Court's State ex rel. Margolius v. City of Cleveland, which clarified the rule reaches only records already in existence, not records an agency must newly create or store in a different medium.

On the private-vendor question, the AG applied the Ohio Supreme Court's State ex rel. Cincinnati Enquirer v. Krings, which held a government cannot shield public records from disclosure simply by delegating their custody to a private contractor so long as the government owns the data and can monitor and access it, exactly the arrangement the Commission had with its vendor here. On reformatting, the AG followed the Georgia Supreme Court's Schulten, Ward & Turner, LLP v. Fulton-DeKalb Hospital Authority and the Ohio Supreme Court's State ex rel. Kerner v. State Teachers Retirement Board, both holding an agency need not reprogram its systems or build a new query to satisfy a request, while noting that redacting a few exempt fields from an existing record, unlike restructuring the record's content, does not turn it into a "new" document.

On the exemptions, the AG relied on Delaware's own Board of Managers of the Delaware Criminal Justice Information System v. Gannett Co. for the rule that database disclosure must be assessed field by field rather than exempting an entire system, and on the U.S. Supreme Court's Department of Justice v. Reporters Committee for Freedom of the Press for the idea that aggregation can heighten a privacy interest in otherwise scattered information, justifying redaction of passwords, user IDs, and direct contact information. But for the financial disclosure reports' investment and creditor data, the AG found Reporters Committee's aggregation concern didn't apply, since other states already post the same category of information online without incident, citing the federal district court's Price v. Conine and the Third Circuit's A.A. v. New Jersey upholding online publication of financial disclosures, and New York's Archdeacon v. Town of Oyster Bay for the principle that the source of an official's income is exactly the kind of information the public has a right to examine for conflicts of interest. Only genuinely sensitive account-level details, following the D.C. district court's Judicial Watch, Inc. v. Export-Import Bank, warranted redaction, echoing the Florida court's early recognition in Seigle v. Barry that information stored electronically is no less a public record than the same information on paper.

Citations

• 29 Del. C. § 10003(a) (public records open to inspection and copying)
• 29 Del. C. § 10002(g) (defining "public record" regardless of the form in which information is stored)
• 29 Del. C. § 10002(g)(2) (exemption for trade secrets and confidential commercial or financial information)
• 29 Del. C. § 10002(g)(6) (records exempted from disclosure by other statute or common law)
• 29 Del. C. § 5814(b) (financial disclosure reports available for public inspection and copying)
• 29 Del. C. § 5836(b) (lobbyist docket and related filings available for public inspection and copying)
• 21 Del. C. § 4203(d) (traffic accident reporting requirement discussed in Jacobs)
• 29 Del. C. § 10005(f) (AG's office cannot investigate FOIA complaints against agencies it does not represent, including the Public Integrity Commission)
• 29 Del. C. § 2515(b) (Attorney General's duty of legal representation does not extend to the Public Integrity Commission)
• Jacobs v. City of Wilmington, C.A. No. 18679, 2002 WL 27817 (Del. Ch., Jan 3, 2002) (Delaware state court; voluntarily-filed accident reports were exempt under a separate confidentiality statute, not because they weren't legally required)
• Office of the Governor v. The Washington Post Co., 759 A.2d 249, 269 (Md. App. 2000) (Maryland state court; a public records law is not limited to records required by law to be made or kept)
• Yeager v. Drug Enforcement Administration, 678 F.2d 315, 321 (D.C. Cir. 1982) (federal appeals court; the storage medium an agency chooses cannot diminish its disclosure duties)
• American Federation of State, County & Municipal Employees v. County of Cook, 555 N.E.2d 361 (Ill. 1990) (Illinois state court; an agency must provide the format requested, including computer tape, absent an exemption)
• State ex rel. Margolius v. City of Cleveland, 584 N.E.2d 665, 669 (Ohio 1992) (Ohio state court; no duty to create new records or store them in a different medium to expand access)
• State ex rel. Cincinnati Enquirer v. Krings, 758 N.E.2d 1135 (Ohio 2001) (Ohio state court; a government cannot conceal public duties by delegating recordkeeping to a private entity)
• Board of Managers of the Delaware Criminal Justice Information System v. Gannett Co., 808 A.2d 453 (Del. Super. 2002) (Delaware state court; database disclosure must be assessed field by field, not exempted wholesale)
• Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (1989) (U.S. Supreme Court; aggregating otherwise scattered information can heighten a privacy interest)
• Schulten, Ward & Turner, LLP v. Fulton-DeKalb Hospital Authority, 535 S.E.2d 243 (Ga. 2000) (Georgia state court; an agency need not develop a computer program to satisfy a records request)
• State ex rel. Kerner v. State Teachers Retirement Board, 695 N.E.2d 256, 258 (Ohio 1998) (Ohio state court; no duty to reprogram a computer system to create a requested record)
• Price v. Conine, 2006 WL 1080491 (D.N.J., Apr. 20, 2006) (federal district court; online posting of already-public financial disclosure information is constitutional)
• A.A. v. New Jersey, 341 F.3d 206 (3rd Cir. 2003) (federal appeals court; online publication of already publicly available information doesn't itself raise a new constitutional problem)
• Archdeacon v. Town of Oyster Bay, 813 N.Y.S.2d 289, 295 (Supr. 2006) (New York state court; the source of an official's income is information the public has a right to examine for conflicts of interest)
• Judicial Watch, Inc. v. Export-Import Bank, 108 F. Supp.2d 19, 37 (D.D.C. 2000) (federal district court; personal bank account numbers may be redacted as a clearly unwarranted invasion of privacy)
• Seigle v. Barry, 422 So.2d 63, 65 (Fla. App. 1982) (Florida state court; information stored on a computer is as much a public record as a written page)

Source

• Landing page: https://attorneygeneral.delaware.gov/2006/08/21/06-ib17-re-freedom-of-information-act-complaint-against-state-public-integrity-commission/
• Original PDF: not linked from landing page

Original opinion text

Del. Op. Atty. Gen. 06-IB17 (Del.A.G.), 2006 WL 2630107

Office of the Attorney General

State of Delaware

Opinion No. 06 - IB17

August 21, 2006

Re: Freedom of Information Act Complaint Against State Public Integrity Commission

*1 Mr. Chris Barrish

Senior Reporter

The News Journal

P.O. Box 15505

New Castle, DE 19850

Dear Mr. Barrish:

Our Office received your Freedom of Information Act ("FOIA") complaint on July 8, 2006 alleging that the State Public Integrity Commission ("the Commission") violated FOIA by denying you access to lobbying expense reports and financial disclosure reports of public officials in electronic form. 1

By letter dated July 12, 2006, we asked the Commission to respond to your complaint by July 24, 2006. We received the Commission's response on July 24, 2006. We made several requests to the Commission for additional information which we received over the course of July 27- August 7, 2006.

Pertinent Facts

The Commission is required by statute to receive and maintain lobbyist expense reports and financial disclosure reports of public officials. Until 2002, all reports were filed in hard copy and maintained by the Commission in its offices for inspection and copying pursuant to FOIA.

In 2002, the State contracted with a private company, Delaware Digital Management Group ("DDMG"), to create a database system for electronic filing of reports. The database contains the same information as in the hard copy reports with some additional fields (e-mail address, user ID number, and password) for secure electronic filing.

According to the Commission, lobbyists have the option since 2002 to file their expense reports electronically though a few continue to file in hard copy. For lobbyists who file in hard copy, the Commission's staff makes "the data entry for those few forms" into the electronic database. The database is programmed to post the lobbying expense reports on the Commission's website. The reports on the website are arranged by year (back to 2002), quarter, and name (in alphabetical order). By accessing the website, a citizen can use a personal computer to download and print out reports in hard copy.

According to the Commission, starting this year public officials have the option to file financial disclosure reports electronically with a user ID and password; 144 (out of 317) public officials filed their 2005 financial disclosure reports in hard copy rather than electronically. For public officials who continue to file reports in hard copy, the Commission scans the reports into PDF files. "Once that conversion is made, we can administratively attach the PDF file to the public officer's file in the [electronic] database. It remains a PDF file, and is identical to the hard copies on file." The Commission does not post any of the information in the financial disclosure reports on its website.

Commission's Legal Position

The Commission contends FOIA does not apply to its electronic database because: (1) FOIA only requires access to records a public body is required by law to maintain, and the Commission is only required by law to maintain reports in hard copy; (2) the Commission provided you with the reports in hard copy and FOIA does not require it to make the same information available to you in electronic form; (3) the Commission is not the custodian of the records you requested because DDMG maintains the electronic database; (4) to provide the electronic data in the form you requested requires computer programming to convert the information to a new format, thereby creating a new public record which FOIA does not require.

*2 Alternatively, if the electronic database is a public record under FOIA, the Commission contends that FOIA exempts from disclosure: (1) DDMG's proprietary software; (2) personal identifiers; and (3) personal financial information in electronic form because of the risk of identity theft.

RELEVANT STATUTES

FOIA provides: "All public records shall be open to inspection and copying by any citizen of the State during regular business hours by the custodian of the records for the appropriate public body." 29 Del. C. § 10003(a).

FOIA defines a "public record" as "information of any kind, owned, made, used, retained, received, produced, composed, drafted or otherwise compiled or collected, by any public body, relating in any way to public business, or in any way of public interest, or in any way related to public purposes, regardless of the physical form or characteristic by which such information is stored, recorded or reproduced." Id. § 10002(g).

FOIA exempts from disclosure "[t]rade secrets and commercial or financial information obtained from a person which is of a privileged or confidential nature." Id. § 10002(g)(2). FOIA also exempts "[a]ny records specifically exempted from public disclosure by statute or common law." Id. § 10002(g)(6).

Financial disclosure reports which public officers must file with the Commission "shall be made available at reasonable hours for public inspection and copying pursuant to [FOIA]." 29 Del. C. § 5814(b).

"The lobbyist docket maintained by the Commission and any reports, authorizations or other documents filed with the Commission pursuant to this subchapter shall be made available at reasonable hours for public inspection and copying pursuant to [FOIA]." Id. § 5836(b).

LEGAL AUTHORITY

A. Commission Statute

By statute, the Commission must receive and maintain lobbying expense reports and financial disclosure reports of public officials. See 29 Del. C. Ch. 58. The Commission contends it is required to maintain the reports only in hard copy and not in an electronic format. The Commission contends its electronic database is not subject to FOIA because the "Delaware Courts have held that information not mandated by statute is not a 'public record'" (citing Jacobs v. City of Wilmington, C.A. No. 18679, 2002 WL 27817 (Del. Ch., Jan 3, 2002) (Strine, V.C.)).

In Jacobs, a chiropractor made a FOIA request for traffic accident reports prepared by the Wilmington Police Department. State law (21 Del. C. § 4203(d)) requires police to submit traffic reports to the Department of Public Safety for accidents involving an impaired driver, personal injury or death, or apparent property damage of $1,500 or more. Those reports "shall be for the information of the Department of Public Safety and shall not be open to public inspection." Id. § 313(b).

*3 The Wilmington Police Department went beyond the statutory requirements and submitted a report to the Department of Public Safety for every traffic accident, even minor ones. Because the statute did not require the filing of minor accident reports, the chiropractor argued they were not exempt under Section 313(b) but rather public records under FOIA.

The Chancery Court rejected that argument as "inconsistent with the statutory promise of confidentiality for reports of traffic accidents made by drivers under the statutory reporting scheme. I hold that Non-Mandatory Reports are specifically exempted from public disclosure. As such, per 29 Del. C. § 10002(d)(6), they are not public records subject to disclosure under FOIA." 2002 WL 27817, at p.1. 2

Jacobs holds that minor traffic accident reports are not public records under FOIA because they are specifically exempted by another statute. Jacobs does not hold that such reports are public records because the police department did not have to prepare them.

The public records law in some states applies only if the records are "required by law" to be created, kept or maintained by the public body. 3 The definition of a public record under Delaware's FOIA, in contrast, does not turn on whether the public body is required by law to maintain the record. FOIA defines a public record as "information of any kind, owned, made, used, retained, received, produced, composed, drafted or otherwise compiled or collected." 29 Del. C. § 10002(g). Like the Maryland Public Information Act, Delaware's FOIA "is not limited to public records which are records required by law to be made, maintained, or kept." Office of the Governor v. The Washington Post Co., 759 A.2d 249, 269 (Md. App. 2000). See also City of Grand Forks v. Grand Forks Herald, Inc., 307 N.W.2d 572, 578 (N.D. 1981) ("Public records are not limited to those records which are required by law to be kept and maintained.").

The Commission may not be required by law to compile and maintain an electronic database, but once it does the database becomes a public record unless specifically exempted by FOIA.

B. Electronic Records

FOIA requires access to public records "regardless of the physical form or characteristic by which such information is stored, recorded or reproduced." 29 Del. C. § 10002(g). FOIA does not make any "'distinction between records maintained in manual and computer storage systems.'" Att'y Gen. Op. 97-IB06 (Mar. 17, 1997) (quoting Yeager v. Drug Enforcement Administration, 678 F.2d 315, 321 (D.C. Cir. 1982)). Accord Seigle v. Barry, 422 So.2d 63, 65 (Fla. App. 1982) ("There can be no doubt that information stored on a computer is as much a public record as a written page in a book or a tabulation in a file stored in a filing cabinet.").

*4 "Although accessing information from computers may involve a somewhat different process than locating and retrieving manually-stored records, these differences may not be used to circumvent the full disclosure policies of the FOIA. The type of storage system in which the agency has chosen to maintain its records cannot diminish the duties imposed by the FOIA." Yeager, 678 F.2d at 321.

According to the Commission, its electronic database "has the same data" as the hard copy reports filed by lobbyists and public officials with "some additional fields" (e.g., user ID, password, e-mail address) created for secure electronic filing. Because you have access to hard copy reports, the Commission contends FOIA does not require it to provide you with the same information in electronic form.

In American Federation of State, County & Municipal Employees v. County of Cook, 555 N.E.2d 361 (Ill. 1990), a union requested names of county employees by department, job title, rate of pay, and work location. The county provided a computer printout of the information. The union then asked for the same information on computer tape or diskette. The county denied the request because it had already provided the same information in hard copy.

Like Delaware's FOIA, Illinois law defines a "public record" to include recorded information "regardless of physical form or characteristics." Ill.Rev.Stat., ch.116, para.202(c). The Illinois Supreme Court held this definition includes "computer tapes within its scope." AFSCME, 555 N.E.2d at 364.

The court rejected the argument that the county "may choose the format in which it releases information so long as the requestor is provided reasonable access to the information, regardless of the format that was requested." Id. at 365. The public records law "does not state that a public body may reply to information requests by supplying different public records than those for which the requestor asked. Rather, the public body must make the public record available, including computer tapes, unless it can properly invoke an exception." Id. at 364. Accord State ex rel. Margolius v. City of Cleveland, 584 N.E.2d 665, 669 (Ohio 1992); Farrell v. City of Detroit, 530 N.W.2d 105, 109 (Mich. App. 1995); Brownstone Publishers, Inc. v. New York City Department of Buildings, 560 N.Y.S.2d 642 (App. Div. 1990).

In Margolius, the Ohio Supreme Court made clear "this holding only applies to public records already stored in a tangible medium at public expense. There is no requirement on the part of public agencies to create records that are not already in their possession, or to store records in a particular medium in order to provide greater public access to the records." 584 N.E.2d at 670. "Any increased financial burden caused by compliance with this decision can and should be passed on to the party making the request." Id. at 669 n.4.

*5 We believe that under Delaware's FOIA an existing electronic database is a public record separate and distinct from the underlying records used to compile the database. Under FOIA, a public body cannot respond to a request for information in electronic form by supplying paper records that contain the same information.

C. Private Custodian

FOIA requires that public records "shall be open to inspection and copying by … the custodian of the records for the appropriate public body." 29 Del. C. § 10003(a).

The Commission contends it is not the custodian of the electronic data you requested because the database was "constructed by a private vendor" (DDMG) and this "database is not on the State's server, but on DDMG's server."

In State ex rel. Cincinnati Enquirer v. Krings, 758 N.E.2d 1135 (Ohio 2001) (per curiam), the city contracted with two private companies to construct a new football stadium. The contracts required the companies to maintain cost-accounting records and afford the city access to those records. A newspaper asked the county administrator for construction records to investigate cost overruns on the stadium. The county provided all records physically located in the county administration building but argued that records maintained by the two contractors were not subject to the Ohio Public Records Act.

The Ohio Supreme Court held the act affords "access to public records, even when a private entity is responsible for the records … Governmental entities cannot conceal information concerning public duties by delegating these duties to a private entity." 758 N.E.2d at 1139, 1140. A private entity is subject to the public records law if: "(1) it must prepare the records in order to carry out a public office's responsibilities, (2) the public office must be able to monitor the private entity's performance, and (3) the public office must have access to the records for this purpose." Id. at 1140. The terms of the stadium contracts "are sufficiently broad to establish a right of access on the part of the county to the [contractors'] records concerning cost overruns on the public construction project." Id. 4

The Commission provided us with a sworn affidavit of Alan D. Cole, Chief Technology Officer of Delaware Digital Management Group. According to Mr. Cole, "DDMG is a private company which contracted with the Public Integrity Commission (PIC) to create a database system for electronic filing of financial disclosure reports and lobbying reports." Under the contract, "the PIC Staff will have full administration access to all data within the system." According to DDMG, the "data itself belongs to PIC per the contract" and "the State of Delaware has the right to provide web hosting of this web site at a State facility." The Commission acknowledges it has access to the database to check to make sure that lobbyists and public officials have filed their reports; to review the reports for completeness and accuracy; and to input information from hard copy reports into the electronic database.

*6 We determine that the electronic database maintained by DDMG under contract with the Commission is subject to FOIA. 5 DDMG maintains the database to help carry out the Commission's statutory responsibility to maintain lobbying expense reports and financial disclosure reports of public officials. The Commission owns the database and has complete right of access to the data even though it is maintained on DDMG's server. The Commission is the custodian of the database for purposes of FOIA because it contains information "owned," "used," or "otherwise compiled and collected" by the Commission. 29 Del. C. § 10002(g).

D. Creation of a New Public Record

The Commission contends your FOIA request would require it "to create a new document, developed under Mr. Barrish's specified needs" and FOIA does not require a public body to create a record that does not already exist.

According to the Cole affidavit, you "requested a CVS (which is a comma separated text file) of the tables of the database and the information on lobbying and financial disclosure housed within those tables. The CVS could then be imported into such programs as Access or other relational database systems to make the data searchable." Mr. Cole states that your request would require: "(A) Identifying and blocking tables/columns that contain non-public information such as User Ids and passwords; and (B) Converting the existing information from a relational database system into multiple CVS files." Mr. Cole estimates "it would take approximately two days if DDMG put aside the work for its other clients to perform the work requested."

To redact non-public information like user ID numbers and passwords does not amount to creating a new document under FOIA. "The argument that a document with some information deleted is a 'new document,' and therefore not subject to disclosure, has been flatly rejected." Yeager, 678 F.2d at 321. "This is true even if all but one or two items of information have been deleted." Id. 6 FOIA, however, does not require "any manipulation or restructuring of the substantive content of a record." Id. at 323.

In Att'y Gen. Op. 04-IB14 (June 28, 2004), our Office determined that FOIA did not require a school district to "produce computerized data in a special format requested by a citizen" through "'a search of the online database, accomplished by entering the requesting party's search criteria'" (quoting Gabriels v. Curiale, 628 N.Y.S.2d 882, 883 (App. Div. 1995)). "Nor does FOIA obligate an agency 'to develop a program to accomplish this task for the purpose of complying with [the FOIA] request.'" Id. 7

In Schulten, Ward & Turner, LLP v. Fulton-DeKalb Hospital Authority, 535 S.E.2d 243 (Ga. 2000), a law firm requested Medicare information which would require "a computer technician [to] extract the requested information from files maintained in the Authority's database." 535 S.E.2d at 245. The Georgia Supreme Court held that FOIA "does not require a public agency or officer to create or compile new records by any method, including the development of a computer program or otherwise having a computer technician search the agency's or officer's database according to criteria conceived by the citizen making the request." Id. Accord State ex rel. Kerner v. State Teachers Retirement Board, 695 N.E.2d 256, 258 (Ohio 1998) (per curiam) ("In order to create the requested records, the board would have had to reprogram its computer system. Therefore, the Board had no duty to provide access to the requested records."). 8

*7 We determine that FOIA does not require the Commission to convert its electronic database from a relational database into CVS (comma separated) files. That would amount to the creation of a new public record which FOIA does not require. 9

E. Exempt Information Under FOIA

The Commission contends that if FOIA requires access to its database, FOIA exempts from disclosure: (1) DDMG's proprietary software; (2) personal identifiers; and (3) personal financial information in electronic form.

1. Proprietary Software

The Commission contends the electronic database maintained by DDMG is exempt from disclosure under FOIA "to the extent that the database and its tables are proprietary or trade secrets of the private vendor" (citing 29 Del. C. § 10002(g)(2)).

"When a public agency makes a diskette copy for someone, that person will have to have his own software to be able to read the information stored on the diskette … By giving out a diskette, the city is not giving out any software. It is only giving out its database files and these files are a public record." State ex rel. Athens County Property Owners Association, 619 N.E.2d 437, 439 (Ohio App. 1992).

DDMG has confirmed that copying the electronic database in the format you requested would not infringe on its proprietary software. That software is separate and distinct from "the database itself which stores the data."

We determine that providing you with the reports in the Commission's electronic database maintained by DDMC would not require disclosure of any proprietary software which is exempt as a trade secret under FOIA.

2. Personal Identifiers

According to the Commission, before it decided to allow optional electronic filing of reports by public officials and lobbyists, there were concerns that hackers might try to manipulate the information. To prevent that, the Commission asked DDMG to create tables and fields such as "phone numbers, e-mail addresses, User Identification numbers, and passwords. That information is gathered as part of the database program to help insure security and some certainty in who is filing the report. That information is not released to the public to avoid possible tampering with the on-line filing."

We agree that disclosure of personal identifiers like home address and telephone number, e-mail address, user ID number, or password would invade personal privacy and is not essential for government accountability. FOIA allows the Commission to redact direct personal identifiers from the electronic database before making it available to the public. 10

3. Personal Financial Information

The Commission also wants to redact from the electronic database the names of banks, mutual funds, brokerage firms, creditors, and companies in which a public official owns stock or bonds. The Commission fears that information, in electronic form, might be used for identity theft.

*8 According to the Commission, "we presently make the hard copy reports, even with the personal financial information available, pursuant to a FOIA request, but that is because it then gives us some control over who had access to the information in the event it should be misused." The Commission contends that under FOIA it can withhold that same information in electronic form because "State agencies may limit dissemination of even public records" if widespread dissemination would increase the risk to personal privacy.

The Commission contends that the "United States Supreme Court and Delaware Courts have noted the difference between information obtained by going to a Courthouse or office to review bits of information, as compared to gaining information that is in a database. Board of Managers of the Delaware Criminal Justice Information System v. Gannett Co., 808 A.2d 453 (Del. Super. 2002) (citing Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (1989)). Both courts recognized that even information which is public can take on a more private nature depending on the degree of dissemination."

Computerized databases may enhance the concerns about individual privacy, but the courts in the DELJIS litigation did not hold that the entire criminal history database was exempt from disclosure under FOIA, only certain data fields. "[Disclosure of databases, like any other information, must be looked at on a case-by-case basis, and should only be excluded from FOIA if it falls into one of the enumerated exceptions to FOIA." DELJIS v. Gannett, 808 A.2d at 460.

In Price v. Conine, 2006 WL 1080491 (D.N.J., Apr. 20, 2006), the federal district court denied a request to enjoin the posting of financial disclosures on the Internet. The New Jersey Casino Control Act requires casino employees to file an annual financial disclosure statement (FDS) with the Casino Control Ethics Commission listing "all assets and liabilities, property and business interests, and sources of income of said employee or agent and his spouse." N. J. Stat. Ann. § 5:12-58(e). By executive order, Governor Corzine required the Ethics Commission to post the financial disclosure statements on its Internet site beginning with statements for 2005.

"Plaintiffs challenge only the online publication of their FDS information. They do not challenge the State's requirement that [casino] employees provide that information, or the prevailing practice of making it available for inspection and copying" in hard copy. 2006 WL 1080491, at p.2. The district court noted, however, "that federal courts have upheld the constitutionality of numerous state statutes requiring the disclosure of personal financial information for the purpose of preventing conflicts of interest." Id. (and citations therein).

The Third Circuit has "suggested that the online publication of information that is already publicly available, by that fact alone, would not make otherwise permissible conduct unconstitutional." Id. at p.3 (citing A.A. v. New Jersey, 341 F.3d 206 (3rd Cir. 2003)). "The question was whether the information was entitled to protection and, if so, whether the government's interest in disclosing it outweighed that interest." Conine, 2006 WL 1080491, at p.3.

*9 "The State has a substantial interest in deterring corruption and conflicts of interest among its employees by requiring the disclosure of their financial information." Id. at p.4.

In posting the FDS information online, no additional data would be provided beyond what was already available to the public. Indeed, the website would provide less information than what was previously available. The Ethics Commission personnel review all FDS information prior to their posting to redact certain personal identifying information, including social security numbers, account numbers and home addresses.

Id. p.5. "The Court also notes that financial disclosure statements are currently available online for a number of other states, including Alabama, Georgia, Connecticut, Hawaii, Iowa, Indiana, Louisiana, Michigan, New Hampshire, New Mexico, Ohio, Pennsylvania, and South Dakota." Id.

If FOIA requires disclosure of financial disclosure reports in electronic form, the Commission contends it should be able to redact two of the three sections of those reports to protect against identity theft: Section 1 (legal or equitable ownership in excess of $5,000); and Section 2 (creditors owed more than $1,000). That would leave only Section 3 (income, capital gains, reimbursement for expenditures, honoraria, and gifts).

According to the Commission, "[e]ven if hackers do not have an account number, … [o]n the financial disclosure reports, they would have the name of the bank where the public officer has an account, and could send a 'phishing' e-mail using that bank and making the e-mail look legitimate. Also, the disclosure reports have information not only on where their assets are located, but also where they have debts, and other information about them, which if someone wanted to steal their identity, they would have lots of information available."

"Phishing" and other forms of Internet identity theft are an unfortunate consequence of the computer age. Yet other states have made financial disclosure information available to the public in electronic form without any evidence that it increases the risk of identity theft for public officials so long as personal identifiers (e.g., home address and telephone number, e-mail address, social security number, and account numbers) are first redacted.

"The State has a substantial interest in deterring corruption and conflicts of interest among [public officials] by requiring the disclosure of their financial information." Conine, 2006 WL 1080491, at p.4. Financial information such as the names of banks, mutual funds, brokerage firms, creditors, and companies in which a public official owns stocks or bonds is essential to the core purpose of requiring financial disclosure by public officials. "[T]he source of the official's income and a delineation of investments, is the very type of information that the public has a right to uncover when looking into conflicts of interest." Archdeacon v. Town of Oyster Bay, 813 N.Y.S.2d 289, 295 (Supr. 2006).

*10 This information is already available in hard copy to the public for inspection and copying at the Commission's offices. We do not believe that making the same information available in electronic form would so increase the risk to personal privacy as to make the information exempt under FOIA.

We determine that FOIA does not exempt from disclosure in electronic form the information required to be disclosed by public officials in Sections 1 and 2 of the Commission's financial disclosure report forms.

CONCLUSION

For the foregoing reasons, we determine that the Commission violated FOIA by denying you access to lobbying expense and financial disclosure reports in electronic form.

As remediation, we direct the Commission to provide the information contained in those reports to you in the electronic form in which they are currently maintained within twenty days of the date of this letter. The Commission may charge a reasonable cost for redacting direct personal identifiers like home address and telephone number, e-mail address, user ID, or password. The Commission may not redact from the database the information in Sections 1 or 2 of the financial disclosure reports, except for direct personal identifiers like account numbers. The Commission is not required by FOIA to convert the database into the specific format you requested to create a new public record.

The Commission's attorney is directed to report back to our Office in writing within five business days after the Commission completes remediation.

Very truly yours,

W. Michael Tupman

Deputy Attorney General

Approved

Lawrence W. Lewis, Esquire

State Solicitor

Footnotes

1
FOIA prohibits our Office from investigating "an alleged violation [of FOIA] by an administrative officer, agency, department, board, commission or instrumentality of state government which the Attorney General is obliged to represent pursuant to Section 2504 of [Title 29 of the Delaware Code]." 29 Del. C. § 10005(f). The Attorney General's duty to provide legal advice, counsel and services to State agencies and officials "shall not apply to the State Public Integrity Commission." Id. § 2515(b).

2
The section of FOIA cited by the Chancery Court is now recodified as § 10002(g)(6), which provides that FOIA does not apply to "records specifically exempted from public disclosure by statute or common law."

3
See, e.g., N.J.Stat. Ann. § 47:1A-2 ("all records which are required by law to be made, maintained or kept on file"); Mo.Ann.Stat. § 575.010(5) ("required by law to keep"); Kan.Stat.Ann. § 45-201(a) ("by law are required to be kept and maintained"); Okla.Stat. 1970 s. 24 ("required by law to keep public records"). But see N.M.Stat.Ann. § 14-2-6(E) ("whether or not the records are required by law to be created or maintained").

4
See also Harold v. Orange County, 668 So.2d 1010 (Fla. App. 1996) (the county "delegated to [the contractors] responsibility, on behalf of the County, to assure that the trade contractors comply with the Fairness in Procurement Ordinance and to maintain whatever records are necessary so that the County can verify such compliance."); Prince George's County v. The Washington Post Co., 815 A.2d 859, 885-86 (Md. App. 2003) (a private company "set up the risk management database and fields for the County to be used for the transaction of public business. Therefore, we believe that both are public records and available, absent an applicable exemption, for public dissemination.").

5
This does not mean that DDMG is a "public body" for purposes of FOIA. Because the Commission is the constructive custodian of the records you requested, you do "'not have to deal with a private third party in order to gain access to the records.'" Krings, 758 N.E.2d at 1141 (quoting State ex rel. Recodat Co. v. Buchanan, 546 N.E.2d 203, 204 (Ohio 1989) (per curiam)).

6
See also Bowie v. Evanston Community Consolidated School District, 538 N.E.2d 557, 561 (Ill. 1989) ("Deleting information from a record does not create a 'new' record"); State ex rel. Stephan v. Harder, 641 P.2d 366, 374 (Kan. 1982) (the public records law "implies a duty upon the agency to delete confidential and nondisclosable information from that which may be disclosed").

7
A public body, however, may have "to develop a special computer program which would delete exempt information." Hamer v. Lentz, 547 N.E.2d 191, 195 (Ill. 1989).

8
In Kerner, the Ohio Supreme Court noted that "if the clerk's computer were already programmed to produce the desired printout, the 'document' would already exist for the purpose of a [FOIA] request." 695 N.E.2d at 257.

9
We understand you also asked the Commission to scan hard copy reports onto a CD. FOIA does not require the Commission to do so. FOIA only requires a public body to make records "open to inspection and copying." 29 Del C. § 10003(a). FOIA does not require a public body to do the copying itself, though it may choose to for administrative convenience and charge the actual costs of copying. FOIA only requires the Commission to make the hard copy reports available to you to photocopy or scan at your own time and expense.

10
FOIA also allows the Commission to redact bank or other account numbers (to the extent they are listed, the financial disclosure report form does not require them). "Disclosing personal bank account numbers would constitute a clearly unwarranted invasion of personal privacy because this information could be used for nefarious purposes. In addition, there is no public interest in this information." Judicial Watch, Inc. v. Export-Import Bank, 108 F. Supp.2d 19, 37 (D.D.C. 2000).

Del. Op. Atty. Gen. 06-IB17 (Del.A.G.), 2006 WL 2630107