Opinion
Opinion By: Jack Conway, Attorney General; Amye L. Bensenhaver, Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the Personnel Cabinet violated the Open Records Act in partially denying Ed Ramthun's October 31, 2008, request for designated information fields, including employee identification numbers, in electronic format, "of all current employees in all state Executive Branch agencies, for which the Personnel Cabinet performs payroll services." For the reasons that follow, we find that the Cabinet's original response constituted both a procedural and substantive violation of the Act, but that the Cabinet subsequently ameliorated these violations. Although the Cabinet acknowledged past release of the only remaining record in dispute, employee identification numbers, it properly relied on KRS 61.878(1)(a) to deny access to the record given developments in the uses to which the identification numbers are put.
In its November 14, 2008, response, the Cabinet provided Mr. Ramthun with "a CD which contains the names and other data requested for only those employees eligible to be contacted by unions," but excluding "[a]ll constitutional offices, non-merit, supervisors, and Personal Service contract employees . . . ." Citing 95-ORD-151 and 05-ORD-064, the Cabinet withheld employee ID numbers "as they are considered unique identifiers and are protected information under the Kentucky Open Records Act just as Social Security numbers as well as other personal and private information is."
On appeal, Mr. Ramthun questioned the Cabinet's failure to comply with KRS 61.880(1) by including "a statement of the specific exception authorizing the withholding of the record," but primarily focused on the absence of any authority supporting the Cabinet's denial of his request for data as it relates to "constitutional offices, non-merit, supervisors, and Personal Service Contract." Further, he challenged the Cabinet's denial of that portion of his request relating to employee ID numbers, asserting that they "should not be protected from disclosure like Social Security numbers simply because they are a unique identifier," and noting that "as late as February 2008, the Personnel Cabinet provided employee IDs . . . without asserting that the numbers were protected from disclosure under the Act."
It was Mr. Ramthun's position that disclosure of employee IDs would advance the public's right to know that agencies are properly discharging their duties by permitting the public to track the positions and salaries of public employees over time in those cases where employees have common names or their names change due to marriage or divorce. He maintained that access to employee IDs "is necessary to ensure that the government is properly classifying its employees and that the wages, hours, and terms and conditions of government employment comply with the law." Moreover, Mr. Ramthun asserted, disclosure of employee IDs:
is useful to the public in exposing corruption which may occur through the use of "ghost employees" to collect unearned pay by assigning them to more than one position simultaneously . . .[, and] may also allow the public to detect the transfer of an employee from one agency or position to another agency or position due to nepotism, political favoritism or an unlawful purpose . . . .
The "privacy interest a government employee has in her employee ID is minimal," Mr. Ramthun observed, insofar as it is not linked to "personal, financial, medical and other information about an individual the way Social Security numbers are."
In supplemental correspondence directed to this office following commencement of Mr. Ramthun's appeal, the Personnel Cabinet retreated from its position relative to nondisclosure of the requested data relating to "constitutional offices, non-merit, supervisor, and Personal Service Contract," acknowledging its error and agreeing to "waive the programming fees for this request . . . ." 1 The Cabinet did not identify a date certain on which the records would be sent to Mr. Ramthun, but indicated that the Attorney General would be notified when the information was available. On February 3, 2009, the Cabinet notified this office that the additional information had been sent to Mr. Ramthun.
The Cabinet continued to resist disclosure of employee ID numbers, invoking KRS 61.878(1)(a) for the first time, 2 and arguing that "with the implementation of the Kentucky Human Resource Information System (KHRIS) on March 31, 2009, the employee ID will serve as the direct access link to an employee's information." Continuing, the Cabinet observed:
Employee ID numbers are and will be linked to a vast amount of personal, medical, financial, and other information within our personnel system. Mr. Ramthun has never identified any particular reason why the employee identification numbers are important . . . . We respectfully submit that the position numbers that identify where the employee is within an agency's organizational structure should be more than sufficient to [meet his] needs.
. . .
Mr. Ramthun states that employee ID numbers will advance the public's right to know that its government agencies are properly carrying out its duties. The argument supplied [sic] that employee ID numbers will permit the tracking of positions and salaries over a period of time is faulty, as this can be accomplished by a number of other means which do not constitute an invasion of privacy interests. Most notably, this can be accomplished through the use of a position number that each state government position must have. A Master Position Listing (MPOL) for cabinets and agencies provides the specific information that is being sought. The determination of whether government is "properly classifying its employees" and that the "wages, hours and terms and conditions of government employees comply with the law" is not aided by utilizing employee ID numbers. This, too, can be accomplished by a variety of other means, which will not involve an unwarranted privacy invasion as it results through the use of employee ID numbers.
In support of its position, the Cabinet cited a series of open records decisions issued by this office recognizing the propriety of withholding public employee home address, Social Security number, medical records, and marital status, and asserted that under the rule announced in Kentucky Board of Examiners of Psychologists v. Courier Journal and Louisville Times Co., 826 S.W.2d 324 (Ky. 1992), the public's right to know a public employee's ID number "is completely outweighed by the privacy interests involved in this particular situation."
In response to this office's KRS 61.880(2)(c) request for additional information, the Cabinet elaborated on the nature of the "personal, medical, financial, and other information," explaining that KHRIS would contain "an employee's . . . date of birth, banking information (for purposes of direct deposit), payroll deductions (both voluntary and involuntary), and information contained on paycheck stubs, health information (including benefits information, claims, Group Life and Group Health policies, premiums, health-related information of family members), and performance evaluations." As noted, the Cabinet acknowledged prior release of the identification numbers to Mr. Ramthun, but asserted that, as a matter of practice, it withholds them when releasing, for example, personnel action forms. In answer to this office's inquiry concerning security issues arising from previous disclosure, the Cabinet stated:
Employee identification numbers are not the only login information that is necessary to obtain access to KHRIS. Employees will be provided a security password that is also utilized for login purposes. However, much like social security numbers, an employee identification number serves as a crucial piece in potentially accessing confidential information.
In sum, the Cabinet maintained that the information contained in KHRIS enjoys protection under KRS 61.878(1)(a), and that disclosure of the identification numbers would facilitate access to that information in contravention of the employees' privacy interest.
It is the decision of this office that although the Cabinet's prior disclosure of the employee identification numbers was inconsistent with the privacy exception it now seeks to invoke, the Open Records Act is not so inflexible as to preclude a change in practice where a change in circumstance warrants. Such is the case in the instant appeal. Given the impending implementation of the KHRIS system, we believe a heightened privacy interest can now be articulated on behalf of public agency employees that is, in fact, superior to the public's interest in disclosure as articulated by Mr. Ramthun. Because "the question of whether an invasion of privacy is 'clearly unwarranted' . . . can only be determined within a specific context," and the context in which the Cabinet utilizes the identification numbers will dramatically shift as KHRIS is launched, we affirm its denial of this portion of Mr. Ramthun's request. Kentucky Board of Examiners of Psychologists v. Courier-Journal and Louisville Times Co., 826 S.W.2d 324, 327 (Ky. 1992); see also, Cape Publications v. City of Louisville, 191 S.W.3d 10, 12 (Ky. App. 2006) (declaring that "bright line rules permitting or exempting disclosure are at odds with controlling precedent" and resolving the question of access to performance evaluations on "the facts of the case").
In Zink v. Commonwealth of Kentucky, Department of Workers' Claims, above at 829, the Kentucky Court of Appeals characterized a Social Security number as "no less than the keys to an information kingdom as it relates to any given individual," affording "[a]ccess to a wealth of data compiled by both government agencies and private enterprises such as credit bureaus . . . ." Because disclosure of the federally assigned Social Security number "reveals little or nothing about an agency's . . . conduct," the Zink court held that the relevant public interest supporting disclosure . . . [was] nominal at best," id., and affirmed the Department's denial of that portion of the disputed record containing the numbers. The court concluded that the privacy interests implicated "substantially outweigh the negligible Open Records Act related public interest in disclosure. " Id. This holding is mirrored in a line of open records decisions both pre-dating and post-dating Zink. See, e.g., OAG 79-275; OAG 87-37; OAG 90-60; OAG 91-48; 94-ORD-91; 97-ORD-76; 03-ORD-034; 05-ORD-224.
The employee identification numbers at issue in this appeal, along with the yet to be issued security password, will soon represent "the keys to the information kingdom," "touch[ing] upon the personal features of the private lives," of public employees contained in records that reside in the custody of the Cabinet. Zink at 828. Because disclosure of the information will "do little to further the citizens' right to know what their government is doing and, [will] not in any real way subject agency action to public scrutiny," 3 id., we find that the public's interest in access is outweighed by the personal privacy interests implicated by disclosure.
The Board does not indicate under what circumstances the prior release of employee identification numbers occurred. In Baker v. Jones, 199 S.W.3d 749 (Ky. App. 2006), the Kentucky Court of Appeals rejected a claim that the city of Bowling Green waived the exceptions applicable to internal email communications when these emails were inadvertently released to a newspaper. The court reasoned that although "[e]xemptions to disclosure under a public records act are usually fully applicable absent evidence that the public office having custody of the records disclosed the records to the public,' . . . [i]inadvertent or unauthorized release of some material does not result in the waiver of exemptions." Id. at 753, citing 37A Am. Jur.2d Freedom of Information Acts § 73 (2005). This office has so held in a series of open records decisions dating back to 1983. See OAG 83-140 (rejecting estoppel argument "since estoppel is not affected by inadvertent actions or mistakes but only by previous actions by which the contrary has been admitted, implied, or determined"); OAG 90-117 (holding that "public records which have been inadvertently released for inspection by non-custodial persons with access to public records does not prohibit an agency from subsequently denying inspection" ). If, in fact, the employee identification numbers at issue in this appeal were inadvertently disclosed, the Personnel Cabinet is not estopped from invoking KRS 61.878(1)(a), and additional grounds exist for affirming the Cabinet's partial denial of Mr. Ramthun's request.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3) , the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Ed RamthunDinah T. Bevington
Footnotes
Footnotes
1 This ameliorative act was consistent with the view espoused by the Kentucky Court of Appeals in Zink v. Commonwealth, Department of Workers' Claims, 902 S.W.2d 825, 828 (Ky. App. 1994) recognizing that the right of access "does not turn on the purpose for which the request is made or the identity of the person making the request."
- - - - - - - - - - - - - - - - -End Footnotes- - - - - - - - - - - - - - - - -
2 Again the act of including a statement of the exception arguably authorizing nondisclosure ameliorated the procedural violation. Nevertheless, the Cabinet must insure that its written responses to open records requests strictly comply with KRS 61.880(1).
- - - - - - - - - - - - - - - - -End Footnotes- - - - - - - - - - - - - - - - -
3 The Cabinet suggests alternative means by which a requester may track positions and salaries over time, noting, for example, that the same information can be obtained through the Master Position Listing.
- - - - - - - - - - - - - - - - -End Footnotes- - - - - - - - - - - - - - - - -