1 Bender on Privacy and Data Protection § 24.10 (2020)
New York’s Freedom of Information Law (FOIL) requires every agency in the state government to establish rules for availability of records and procedures under which the public may obtain access to and copy these records. Exemptions exist for several categories of records, including an exemption for records whose disclosure would constitute an unwarranted invasion of personal privacy, examples of which are provided in the statute. However, there is no invasion of privacy when identifying details are deleted, when a data subject consents to disclosure, or when a person seeks records about himself or herself. New York’s highest court has held that the statute requires an agency to make its records publicly available unless an exemption applies, that exemptions are to be interpreted narrowly, and that the agency has the burden of showing that an exemption applies. To meet this burden, the agency must show that the records fall squarely within a FOIL exemption by articulating a specific justification for denial. And even when the privacy exemption applies, the agency may be required to provide a redacted version. The FOIL does not require a requestor to show any particular need or purpose, and a requestor’s commercial motives are generally irrelevant.
The New York State Freedom of Information Law
1 (the “FOIL”) was enacted after the legislature found that “a free society is maintained when government is responsive and responsible to the public, and when the public is aware of governmental actions … . The legislature therefore declares that government is the public’s business, and that the public, individually and collectively and represented by a free press, should have access to the records of government in accordance with the provisions of this article.”
2 Section 87(1)(b) of the FOIL requires each agency of the State government to promulgate rules regarding the availability of records and procedures to be followed. These must include, without limitation, times and places of record availability, persons from whom records may be obtained, and a schedule of fees for copies.
Section 87(2) sets out a list of exemptions, i.e., categories of records as to which the agency may deny access. Section 87(2)(b) exempts records or portions thereof that “if disclosed would constitute an unwarranted invasion of personal privacy under the provisions of subdivision two of section eighty-nine of this article.” Section 89(2)(b)
3 states: “An unwarranted invasion of personal privacy includes, but shall not be limited to:
- (i) disclosure of employment, medical or credit histories or personal references of applicants for employment;
- (ii) disclosure of items involving the medical or personal records of a client or patient in a medical facility;
- (iii) sale or release of lists of names and addresses if such lists would be used for commercial or fundraising purposes;
- (iv) disclosure of information of a personal nature when disclosure would result in economic or personal hardship to the subject party and such information is not relevant to the work of the agency requesting or maintaining it; or
- (v) disclosure of information of a personal nature reported in confidence to an agency and not relevant to the ordinary work of such agency; or
- (vi) information of a personal nature contained in a workers’ compensation record, except as provided by section one hundred ten-a of the workers’ compensation law.”
Section 89(2)(c) states: “Unless otherwise provided by this article, disclosure shall not be construed to constitute an unwarranted invasion of personal privacy pursuant to paragraphs (a) and (b) of this subdivision:
- when identifying details are deleted;
- when the person to whom a record pertains consents in writing to disclosure; or
- when upon presenting reasonable proof of identity, a person seeks access to records pertaining to him.”
And § 89(2-a) provides: “Nothing in this article shall permit disclosure which constitutes an unwarranted invasion of personal privacy as defined in subdivision two of this section if such disclosure is prohibited under section ninety six of this chapter.”
4In 2007, the New York Court of Appeals, New York State’s highest court, had reason to opine on the privacy exception in the FOIL in
Data Tree v. Romaine.
5 Plaintiff was in the business of collecting various types of public real estate records from county recorders across the country and making them available online for a fee.
6 Defendant was the Clerk of Suffolk County, New York. One issue was whether the FOIL required defendant to produce records requested by plaintiff. Plaintiff requested copies of various real estate records over a period of several years. It asked for the records in “TIFF images or images in the electronic format regularly maintained by the County, on CD-ROM or other electronic medium regularly used by the County. If electronic images are not maintained, then in microfilm format.” The Clerk denied the request, and on plaintiff’s administrative appeal the County Attorney also denied it,
inter alia,
7 because disclosure would be an unwarranted invasion of personal privacy due to the volume of records requested and the commercial nature of plaintiff’s business. Moreover, the records were available for copying from computer terminals in the Clerk’s office.
The trial court agreed, noting that many of the documents were available at the Clerk’s office or on its website. The intermediate appellate court affirmed, holding that the Clerk had met his burden of showing “in plausible fashion” that disclosure would involve an unwarranted invasion of personal privacy. Therefore, according to that court, plaintiff was obligated to show the claim of exemption was erroneous or that the Clerk acted arbitrarily or capriciously. There was no such showing. The court believed the Clerk may have viewed the request as one for data mining, which seemed to the court to give the Clerk a more solid basis for rejection. The right to copy public records did not require extraordinary agency efforts to provide them without regard to statutorily mandated obligations to protect privacy. Accordingly, it held the refusal correct, in part because of the desire to protect privacy.
The Court of Appeals began by noting that the statute requires an agency to make its records publicly available unless an exemption applies, that exemptions are to be interpreted narrowly, and that the agency has the burden of showing that an exemption applies. The Clerk relied partly on the “unwarranted invasion of personal privacy” exemption of § 87(2)(b). The court held unanimously that, to meet this burden, the Clerk must show that the records fall squarely within a FOIL exemption by articulating a specific justification for denial. The FOIL does not require a requestor to show any particular need or purpose, and plaintiff’s commercial motives were irrelevant here.
8 Because some of the records may contain private information such as SSNs and birth dates, the court concluded that a question of fact existed as to whether the privacy exemption applied. But even if it does, the Clerk may be required to provide a redacted version.
9 The court remanded to determine (from in-camera inspection of a representative sample of records, if necessary) whether the records contained information exempt from disclosure and, if so, whether it could be redacted.
Finally, the court noted that privacy concerns may exist as to information contained in the electronic format requested by plaintiff. “If such information cannot be reasonably redacted from the electronic records, then such records may not be subject to disclosure under FOIL.” The court remitted the matter to the trial court to consider these issues in assessing whether the Clerk must provide the records in an electronic format requested by plaintiff.
Footnotes — § 24.10:
1 NY Public Officers Law, Art. 6, §§ 84–90.
2 NY Public Officers Law, Art. 6, § 84.
3 Section 89(2)(a) provides: “The committee on public access to records may promulgate guidelines regarding deletion of identifying details or withholding of records otherwise available under this article to prevent unwarranted invasions of personal privacy. In the absence of such guidelines, an agency may delete identifying details when it makes records available.”
4 Section 96 provides:
§ 96. Disclosure of records.
(1) No agency may disclose any record or personal information unless such disclosure is:
(a) pursuant to a written request by or the voluntary written consent of the data subject, provided that such request or consent by its terms limits and specifically describes:
(i) the personal information which is requested to be disclosed;
(ii) the person or entity to whom such personal information is requested to be disclosed; and
(iii) the uses which will be made of such personal information by the person or entity receiving it; or
(b) to those officers and employees of, and to those who contract with, the agency that maintains the record if such disclosure is necessary to the performance of their official duties pursuant to a purpose of the agency required to be accomplished by statute or executive order or necessary to operate a program specifically authorized by law; or
(c) subject to disclosure under article six of this chapter, unless disclosure of such information would constitute an unwarranted invasion of personal privacy as defined in paragraph (a) of subdivision two of section eighty-nine of this chapter; or
(d) to officers or employees of another governmental unit if each category of information sought to be disclosed is necessary for the receiving governmental unit to operate a program specifically authorized by statute and if the use for which the information is requested is not relevant to the purpose for which it was collected; or
(e) for a routine use, as defined in subdivision ten of section ninety-two of this article; or
(f) specifically authorized by statute or federal rule or regulation; or
(g) to the bureau of the census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title XIII of the United States Code; or
(h) to a person who has provided the agency with advance written assurance that the record will be used solely for the purpose of statistical research or reporting, but only if it is to be transferred in a form that does not reveal the identity of any data subject; or
(i) pursuant to a showing of compelling circumstances affecting the health or safety of a data subject, if upon such disclosure notification is transmitted to the data subject at his or her last known address; or
(j) to the state archives as a record which has sufficient historical or other value to warrant its continued preservation by the state or for evaluation by the state archivist or his or her designee to determine whether the record has such value; or
(k) to any person pursuant to a court ordered subpoena or other compulsory legal process; or
(l) for inclusion in a public safety agency record or to any governmental unit or component thereof which performs as one of its principal functions any activity pertaining to the enforcement of criminal laws, provided that, such record is reasonably described and is requested solely for a law enforcement function; or
(m) pursuant to a search warrant; or
(n) to officers or employees of another agency if the record sought to be disclosed is necessary for the receiving agency to comply with the mandate of an executive order, but only if such records are to be used only for statistical research, evaluation or reporting and are not used in making any determination about a data subject.
(2) Nothing in this section shall require disclosure of:
(a) personal information which is otherwise prohibited by law from being disclosed;
(b) patient records concerning mental disability or medical records where such disclosure is not otherwise required by law;
(c) personal information pertaining to the incarceration of an inmate at a state correctional facility which is evaluative in nature or which, if disclosed, could endanger the life or safety of any person, unless such disclosure is otherwise permitted by law;
(d) attorney’s work product or material prepared for litigation before judicial, quasi-judicial or administrative tribunals, as described in subdivisions (c) and (d) of section three thousand one hundred one of the civil practice law and rules, except pursuant to statute, subpoena issued in the course of a criminal action or proceeding, court ordered or grand jury subpoena, search warrant or other court ordered disclosure.
6 Examples of the types of records are deeds, mortgages, liens, judgments, releases, and maps.
7 The discovery aspects of this case are discussed in 4 D. Bender,
Computer Law § 9.05[1] (LexisNexis Matthew Bender 2010).
8 The court noted, however, that motive is not always irrelevant. Public Officers Law § 87(2)(b)(iii) includes as an “unwarranted invasion of personal privacy” the “sale and release of lists of names and addresses if such lists would be used for commercial or fund-raising purposes”. But the court held that provision inapplicable here because plaintiff’s purpose in seeking the list was not to solicit business, but rather to sell access to the records online.
9 N.Y. C.L.S. Pub. Off. § 89(2)(c)(1).