Does South Carolina's Family Privacy Protection Act force a state licensing agency to hand over licensees' personal email addresses to a trade association that wants to promote continuing-education classes?

Plain-English summary

The South Carolina Department of Labor, Licensing and Regulation (LLR) holds contact information for tens of thousands of licensed professionals (electricians, contractors, cosmetologists, real estate agents, and many more). Many licensees give LLR a personal email or personal phone number because they work for themselves or simply prefer it. Trade associations regularly ask for licensee rosters so they can promote continuing-education classes.

LLR asked the Attorney General whether South Carolina's Family Privacy Protection Act (FPPA) forces it to hand over those personal email addresses to a third party that says it wants them for continuing-education marketing. The AG agreed with LLR's own conclusion: the FPPA does not require production.

The reasoning is straightforward. The FPPA does not contain a production mandate at all. It tells agencies to limit collection of personal information, to publish a privacy policy, and to prohibit the recipient of any information from using it for "commercial solicitation." The statutory definition of "commercial solicitation" then lists four exceptions, one of which is "notification of continuing education opportunities." S.C. Code § 30-2-30(3)(b). Those exceptions do not create a right to demand records; they just narrow the criminal-liability provision in § 30-2-50.

If a third party wants public records, the route runs through the South Carolina Freedom of Information Act, § 30-4-10 et seq. And under FOIA, S.C. Code § 30-4-40(a)(2) lets an agency exempt "information of a personal nature where the public disclosure thereof would constitute unreasonable invasion of personal privacy." The Court of Appeals in Glassmeyer v. City of Columbia held that home addresses, personal telephone numbers, and personal email addresses are exactly the kind of information in which individuals have a privacy interest. Courts then apply a balancing test, and the AG concluded that a court is unlikely to find a categorical right to personal email addresses just because the requestor labels its purpose "continuing education."

What this means for you

If you are general counsel for a South Carolina licensing board or other agency

You can refuse to hand over personal emails (or personal phone numbers, or home addresses) of licensees to a trade association even when the request invokes the continuing-education exception. The "exceptions" in § 30-2-30(3) do not force production; they exclude the user from criminal liability if production happens.

The right framework is: ask the requestor to use FOIA. If they do, the agency can rely on § 30-4-40(a)(2) and apply the Glassmeyer balancing test. Document the analysis: what is the privacy interest, what is the public's need to know, and why does the privacy interest outweigh that need. Boards that release everything by default lose the ability to argue context later.

Build a structural distinction between "business" contact information that the licensee designates as such, and "personal" contact information collected for licensing administration. Release the first category routinely. Treat the second category as presumptively exempt and require an articulated public-interest justification.

When you send your statutory § 30-2-50(B) notice to a requestor who does receive records, keep it explicit: warn that obtaining or using public records for commercial solicitation directed at any person in South Carolina is a misdemeanor.

If you are a licensed professional in South Carolina

You have a real privacy interest in the email address and phone number you gave LLR. If LLR turned everything over on request, your inbox would be flooded by trade-association marketing and your number could be auto-dialed. Glassmeyer says you have a recognized privacy interest in personal email addresses, and this opinion gives agencies a basis to refuse blanket disclosure.

If you can, give LLR a clearly designated business email and a business phone. The AG's reasoning relies on the difference between business and personal contact information. Make that distinction explicit on your renewal forms.

If you are a trade association or continuing-education provider

The continuing-education exception does not give you a right to compel disclosure. You can still buy targeted advertising, partner with the licensing board directly, or rely on opt-in marketing lists. If you submit a FOIA request for the licensee roster, expect the agency to balance the privacy interest of licensees against the asserted public-interest purpose, and expect personal contact data to be exempted in many cases.

Frame your FOIA request around business contact information rather than blanket disclosure. "Business address, business phone, license status" is a far stronger request than "all email addresses."

If you are a journalist or researcher

This opinion is narrower than it might look. It addresses requests under the FPPA and applies the Glassmeyer balancing test to personal email addresses for commercial uses dressed up as continuing-education marketing. A journalist's FOIA request for the same data set, supported by a public-accountability rationale, would get balanced separately. The AG explicitly noted: "This Office cannot anticipate how the professional association might articulate the public's need to know the requested information."

In other words, the answer turns on the requestor's articulated purpose, not just the data type. Document why the public needs to know if you want a balanced shot at access.

If you are a privacy officer in another state's agency

The structural lesson here is portable: a list of statutory exceptions to a "commercial solicitation" prohibition is not, by itself, a list of categories that the government must turn over. It is a list of activities that, if the records are produced, will not subject the user to criminal liability. Production is governed by your records-access statute, not your privacy-protection statute.

Common questions

Q: Doesn't the continuing-education exception mean LLR has to hand over the emails?
A: No. The exception removes the recipient from the criminal-solicitation prohibition in § 30-2-50; it does not transform a privacy statute into a production statute. The AG read the exceptions as carve-outs from liability, not as access mandates.

Q: Could the trade association just file a FOIA request instead?
A: Yes. That is the right channel for any public records request. But under S.C. Code § 30-4-40(a)(2), the agency may exempt records that would constitute an unreasonable invasion of personal privacy, and Glassmeyer treats personal emails as exactly that kind of record. The agency would weigh the requestor's articulated public interest against the licensee's privacy interest.

Q: What is the Glassmeyer balancing test?
A: When information of a personal nature is requested under FOIA, South Carolina courts balance the privacy interest of the affected individual against the public's need to know. In Glassmeyer, the Court of Appeals concluded that the public's need to know the home address of a city manager applicant did not outweigh the individual's privacy interest. Personal email addresses fall within the same privacy category.

Q: Does the agency have to produce a business email or business phone number?
A: That is governed by FOIA, not by this opinion. Business contact information is generally less protected by the privacy exemption because there is no comparable expectation of personal privacy. Many SC licensing boards routinely release business addresses and business phone numbers; the dispute here was about personal contact data.

Q: What about the FPPA's reference to "records pursuant to this chapter" in § 30-2-50(B)?
A: The AG conceded the language is "suggestive" of a production mechanism, but the FPPA itself does not say how a requestor makes a request, by what method records are produced, or by when. The AG read § 30-2-50(B) as a notice provision tied to the FOIA framework, not as a stand-alone production mandate. Where records come out under FOIA, the agency uses § 30-2-50(B)'s notice language to warn the recipient against commercial-solicitation use.

Q: Can the agency exempt the records even if it wanted to release them?
A: The FOIA exemption in § 30-4-40(a)(2) is discretionary: "A public body may but is not required to exempt from disclosure" personal-nature information. The agency makes the call, applying the balancing test, and is accountable if it gets the balance wrong.

Q: Is misuse of disclosed information a criminal offense?
A: Yes. Under S.C. Code § 30-2-50(D), a person who knowingly obtains or uses personal information from a state agency for commercial solicitation is guilty of a misdemeanor. The continuing-education exception removes liability for that specific use; other commercial uses remain prohibited.

Background and statutory framework

The Family Privacy Protection Act of 2002 is codified at S.C. Code §§ 30-2-10 through 30-2-340. Three components matter here:

Collection limit. Section 30-2-20 directs every state entity to develop privacy policies and procedures "to ensure that the collection of personal information pertaining to citizens of the State is limited to such personal information required ... and necessary to fulfill a legitimate public purpose."

Definition of "personal information." Under § 30-2-30(1), "personal information" is broadly defined: photographs or digitized images, social security number, date of birth, driver's identification number, name, home address, home telephone number, medical or disability information, education level, financial status, bank account numbers, agency-issued identification numbers, employment history, height, weight, race, physical details, signature, biometric identifiers, and credit records. The list is illustrative, not exclusive.

Prohibition on commercial solicitation. Section 30-2-50(A) makes it a misdemeanor for a person or private entity to knowingly obtain or use personal information from a state agency or political subdivision for "commercial solicitation directed to any person in this State." Subsection (B) requires every agency to notify each requestor that obtaining or using public records for commercial solicitation is prohibited.

Exceptions to "commercial solicitation." Section 30-2-30(3) defines commercial solicitation as contact "for the purpose of selling or marketing a consumer product or service" and excludes four categories: credit-union membership offers, "notification of continuing education opportunities," banking/insurance/securities/commodities marketing by Gramm-Leach-Bliley-regulated entities, and political contact using voter-registration data.

FOIA framework. Section 30-4-30 gives "a person" a right to inspect, copy, or receive an electronic transmission of any public record of a public body, with stated exceptions. Section 30-4-40(a)(2) lets a public body but does not require it to exempt "information of a personal nature where the public disclosure thereof would constitute unreasonable invasion of personal privacy."

The Glassmeyer balancing test. Glassmeyer v. City of Columbia, 414 S.C. 213, 777 S.E.2d 835 (Ct. App. 2015), applied the common-law balancing test to a FOIA request for the home addresses of city-manager applicants. The Court of Appeals held that home addresses, personal telephone numbers, and personal email addresses are information in which individuals have a privacy interest, and that the public's right to know does not always outweigh that interest.

Construction principle. Denman v. City of Columbia, 387 S.C. 131, 138, 691 S.E.2d 465, 468 (2010), establishes the in pari materia rule for SC: statutes addressing the same subject matter are read together "to produce a single, harmonious result." The AG used that rule to read § 30-2-50(B)'s reference to "records pursuant to this chapter" against the SC FOIA framework rather than as an independent production scheme.

Citations

• S.C. Code §§ 30-2-10 et seq. (FPPA)
• S.C. Code §§ 30-2-20, 30-2-30(1), 30-2-30(3), 30-2-30(3)(b), 30-2-40, 30-2-50, 30-2-50(A), (B), (C), (D)
• S.C. Code §§ 30-2-200(3), 30-2-320
• S.C. Code §§ 30-4-10 et seq. (SC FOIA)
• S.C. Code §§ 30-4-30, 30-4-40(a)(2)
• Glassmeyer v. City of Columbia, 414 S.C. 213, 777 S.E.2d 835 (Ct. App. 2015)
• Denman v. City of Columbia, 387 S.C. 131, 138, 691 S.E.2d 465, 468 (2010)

Source

• Landing page: https://www.scag.gov/opinions/opinions-archive/opinion-addressing-whether-the-family-privacy-protection-act-requires-the-production-of-personal-information-to-third-party-entities-who-seek-the-information-for-the-purpose-of-continuing-education-notification/
• Original PDF: https://www.scag.gov/media/tjvnawox/boones-os-10980-final-opinion-3-12-2025.pdf

Original opinion text

Best-effort transcription from a scanned PDF. Minor errors may remain — the linked PDF is authoritative.

ALAN WILSON
ATTORNEY GENERAL

March 12, 2025

Susan M. Boone, Esq.
General Counsel and Deputy Director
South Carolina Department of Labor, Licensing and Regulation
P.O. Box 11329
Columbia, SC 29211-1329

Dear Ms. Boone:

Attorney General Alan Wilson has referred your letter to the Opinions section. Your letter requests an opinion addressing the following:

LLR has been asked by third-party entities, including professional associations, to disclose licensee email addresses for a number of different purposes. Recently, a professional association has requested licensee email addresses to promote continuing education classes. In response to these types of requests, LLR has provided license rosters to anyone requesting them, including associations. License rosters generally include the following information: a licensee's full name, business name, business address, city, zip code, business phone, issue and expiration date of the license, credential type, credential number, and status of the license.

However, in recognition of the increased utilization of email addresses to communicate information, LLR has sought to balance its responsibilities to protect an individual's private information pursuant to the South Carolina Family Privacy Protection Act with a third-party entity's desire to provide information about continuing education to those individuals. As set forth more specifically below, the contact information LLR collects for its licensees is not guaranteed to be purely business contact information. Thus, if LLR discloses all email addresses of licensees to a third party, then LLR will inevitably be providing personal email addresses to third parties.

LLR collects and stores a voluminous amount of personal and private information about its licensees, and because of that, takes very seriously its responsibility to protect this information and to not release it without the licensee's consent unless clearly required by law. The South Carolina Family Privacy Protection Act requires agencies to develop privacy policies and procedures to ensure that the collection of personal information pertaining to the citizens of the State is limited to such personal information required to fulfill the agency's legitimate public purpose. S.C. Code § 30-2-20. The purpose of each of LLR's Boards is to ensure that applicants for licensure meet the criteria required by law to practice a regulated profession in this state. In order to fulfill that obligation, the Boards are required to collect a significant amount of personal information from applicants and licensees, ... Many licensees work for themselves, maintain their licenses but do not actively practice, and/or simply prefer to utilize their personal phone, personal email address, and home address when dealing with LLR and their respective licensing Boards. Thus, neither LLR nor the Boards require licensees to provide purely "business" information.

Much of the information collected by LLR in order to issue a professional or occupational license constitutes "personal information," as defined in the Family Privacy Protection Act. In recent years, with the increase in technology, personal information can be used alone, or in combination with other collectible data, to steal a licensee's identity and to violate their digital privacy, as well as spoofing, phishing attacks, spam, and account hacking. The information can also be used to locate a licensee, which poses a potential safety risk. South Carolina Code § 30-2-200(3) provides, "When state and local government entities possess social security numbers or other personal identifying information, the governments should minimize the instances this information is disseminated either internally within government or externally with the general public."

The Family Privacy Protection Act anticipates that agencies may release certain information about applicants or licensees upon request and directs that agencies take "reasonable measures to ensure that no person or private entity obtains or distributes personal information obtained from a public record for commercial solicitation." S.C. Code § 30-2-50(C). The Act excludes from the definition of commercial solicitation "notification of continuing education opportunities." S.C. Code § 30-2-30(3)(b). However, given the entirety of Chapter 2, Title 30, entitled "Family and Personal Identifying Information Privacy Protection," LLR has interpreted that to only permit the release of information so long as it does not violate a person's privacy. Additionally, nothing in the text of the Act mandates the release of personal emails even if that information is sought for "notification of continuing education opportunities."

In addition to guidance provided to agencies by the Family Privacy Protection Act, the Freedom of Information Act exempts from disclosure information of a personal nature where the public disclosure thereof would constitute an unreasonable invasion of personal privacy. See S.C. Code § 30-4-40(a)(2) ("A public body may but is not required to exempt from disclosure the following information: [] (2) [i]nformation of a personal nature where the public disclosure thereof would constitute unreasonable invasion of personal privacy.").

Significant in this regard is the South Carolina Court of Appeals' decision in George S. Glassmeyer v. City of Columbia, that home addresses, personal telephone numbers and email addresses are information in which applicants have a privacy interest. 414 S.C. 213, 777 S.E.2d 835 (Ct. App. 2015). In applying the common law balancing test to determine if the public's need to know the information outweighed the individuals' privacy interest, the Glassmeyer Court reminded readers that the purpose of FOIA is to prevent the operation of government in secrecy and concluded, in that instance, that the public's right to know the home address of an applicant for the city manager's job did not outweigh the individual's privacy right in that information. ...

Although the courts are vested with the final authority in applying the privacy balancing test, based on the above authority, LLR believes the law does not mandate that the need for direct notification of continuing education opportunities outweighs an applicant or licensee's privacy interest in his or her personal email address. This is especially true where certain other information can be released to requestors, such as licensee names and business addresses, where there is no risk of violating the licensee's privacy or exposing the licensees to potential harm through the release of personal email addresses. Nonetheless, third parties dispute LLR's interpretation of the laws governing privacy and its position regarding its responsibilities to protect licensee private and personal information. LLR therefore seeks an opinion on whether it must disclose licensee email addresses to third-party entities who purportedly seek the information for the purpose of continuing education notification if the licensee has not consented to the release of his or her email address and has not identified it as a business email address.

Law/Analysis

This Office agrees with the Department's conclusion that the Family Privacy Protection Act of 2002 ("FPPA"), S.C. §§ 30-2-10 et seq., does not mandate the release of personal information even in circumstances where a requestor's purported use would fall under one of the exceptions to "commercial solicitation." S.C. Code § 30-2-30(3) (2011). The FPPA does not contain a production mandate like that established in the S.C. Freedom of Information Act ("FOIA"). Rather, the FPPA requires all state entities to "develop privacy policies and procedures to ensure that the collection of personal information pertaining to citizens of the State is limited to such personal information required ... and necessary to fulfill a legitimate public purpose." S.C. Code § 30-2-20. Each state entity is also directed to display its privacy policy on its website and advise citizens that information collected is "subject to public scrutiny." S.C. Code § 30-2-40. Finally, section 30-2-50 prohibits persons and private entities from "knowingly obtain[ing] or us[ing] personal information obtained from a state agency, a local government, or other political subdivision of the State for commercial solicitation directed to any person in this State." S.C. Code § 30-2-50(A) (emphasis added). Subsection (D) states that a person who "knowingly violat[es] the provisions of subsection (A) is guilty of a misdemeanor." S.C. Code § 30-2-50(D).

The FPPA defines "commercial solicitation" as "contact by telephone, mail, or electronic mail for the purpose of selling or marketing a consumer product or service." S.C. Code § 30-2-30(3). There are four exceptions to this definition,

"Commercial solicitation" does not include contact by whatever means for the purpose of:
(a) offering membership in a credit union;
(b) notification of continuing education opportunities;
(c) selling or marketing banking, insurance, securities, or commodities services provided by an institution or entity defined in or required to comply with the Federal Gramm-Leach-Bliley Financial Modernization Act, 113 Stat. 1338; or
(d) contacting persons for political purposes using information on file with state or local voter registration offices.

Id. (emphasis added). Your letter states, "[A] professional association has requested licensee email addresses to promote continuing education classes." In subsequent communications, it was also relayed that these requests were not initiated as public records requests under the S.C. FOIA, but rather directly under the FPPA. Presumably, the request was presented this way because the personal information sought would be used for a purpose that is an exception to the definition of commercial solicitation. While there is an exception from the statutory definition of "commercial solicitation" for "continuing education opportunities," that alone does not require production. S.C. Code § 30-2-30(3)(b). The exceptions merely exclude a person using personal information obtained from a state agency, a local government, or other political subdivision of the State from criminal liability under S.C. Code § 30-2-50 when used for one of those listed purposes.

Admittedly, the language in subsection 30-2-50(B) is suggestive of a production mechanism under the FPPA. Subsection (B) states:

Each state agency, local government, and political subdivision of the State shall provide a notice to all requestors of records pursuant to this chapter and to all persons who obtain records pursuant to this chapter that obtaining or using public records for commercial solicitation directed to any person in this State is prohibited.

Id. (emphasis added). Within this mandate, the statute's plain language describes requesting and obtaining "records pursuant to this chapter." Id. However, the statutes within the FPPA do not direct how a requestor is to make requests, by what method a public body is to produce records, the time for production, costs, etc. Further, this Office is unaware of an order issued by our state courts compelling document production expressly under the FPPA.

Subsections (B) and (C) of section 30-2-50 refer to a public record or public records. "Public records" is not a defined term in the FPPA, but it is defined in the S.C. FOIA. A rule of statutory construction counsels that where statutes deal with the same subject matter, they "are in pari materia and must be construed together, if possible, to produce a single, harmonious result." Denman v. City of Columbia, 387 S.C. 131, 138, 691 S.E.2d 465, 468 (2010). Here, because section 30-2-50 and the S.C. FOIA both address requesting and obtaining public records, a court would likely address the vagueness of the FPPA's mention of requesting records by reading it in combination with the S.C. FOIA. The S.C. FOIA provides, "A person has a right to inspect, copy, or receive an electronic transmission of any public record of a public body, except as otherwise provided by Section 30-4-40, or other state and federal laws, in accordance with reasonable rules concerning time and place of access." S.C. Code § 30-4-30. The professional association could request email addresses from the Department using this process, and, if the public records are produced, and the Department would provide the notice regarding the prohibition on commercial solicitation as required by S.C. Code § 30-2-50(B).

As noted in your letter, the Glassmeyer Court found individuals have a privacy interest in their email addresses. See Glassmeyer v. City of Columbia, 414 S.C. 213, 223, 777 S.E.2d 835, 840 (Ct. App. 2015). The Department may then choose to exempt personal email addresses under section 30-4-40(a)(2) as "an unreasonable invasion of personal privacy." A court would balance "the privacy interest of the [licensees] against the interest of the public's need to know this information." Id. This Office cannot anticipate how the professional association might articulate the public's need to know the requested information. However, a court is unlikely to find merely citing an exception from the statutory definition of "commercial solicitation" categorically outweighs the privacy interests in "personal information" as defined in the FPPA.

Conclusion

As discussed more fully above, this Office agrees with the Department's conclusion that the FPPA does not mandate the release of personal information even in circumstances where a requestor's purported use would fall under one of the exceptions to "commercial solicitation." S.C. Code § 30-2-30(3). Instead, the FPPA limits the collection of personal information, requires the agencies to publish their privacy policies, and prohibits the recipient from using public records for commercial solicitation. While there is an exception from the statutory definition of "commercial solicitation" for "continuing education opportunities," this exception does not require production. S.C. Code § 30-2-30(3)(b). The exceptions merely exclude a person or private entity using personal information obtained from a State agency, a local government, or other political subdivision of the State from criminal liability under S.C. Code § 30-2-50 when used for one of those listed purposes. Because section 30-2-50 and the S.C. FOIA both address requesting and obtaining public records, a court would likely address the vagueness of the FPPA regarding records requests by reading it in combination with the S.C. FOIA. See S.C. Code §§ 30-4-10 et seq.

Sincerely,

Matthew Houck
Assistant Attorney General

REVIEWED AND APPROVED BY:

Robert D. Cook
Solicitor General