Opinion
Opinion By: Andy Beshear, Attorney General; Michelle D. Harrison, Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the Kentucky State Police ("KSP") violated the Open Records Act in denying the August 3, 2017, request of Investigative Data Reporter Justin Price, The Courier-Journal , for "[a]n electronic copy of the Uniform Citation File database and all its publicly available fields. 1 ..." By letter dated August 9, 2017, KSP advised Mr. Price that "citations contain information of a personal nature, including social security numbers, personal phone number[s], operator license numbers, and dates of birth, the disclosure of which would constitute a clearly unwarranted invasion of personal privacy" 2 and would therefore have to be redacted under KRS 61.878(1)(a). KSP further indicated that "the citation database contains citations for juvenile offenders. Any law enforcement documents pertaining to juvenile offenders are confidential pursuant to KRS 610.320(3) and 610.340[.]" 3 In addition, KSP argued that it "does not have a mechanism in place to generate an electronic database, report or listing containing only the information that is subject to public disclosure" nor is KSP "required to create a list or record containing specific data sets to satisfy the parameters of an open records request." KSP cited prior decisions by the Office of the Attorney General in support of this position.
To further justify its denial, KSP stated to Mr. Price that "[a]ny attempt to provide paper copies of these records to you would create an undue burden upon the agency, in that the KSP would be required to print and manually review the records to remove juvenile offender citations and redact personal identifying information for hundreds of thousands of citations per year for each year for a ten (10) year period." For example, KSP stated, "there are approximately 663,000 citations which may have more than one page for the calendar year of 2016 alone, with an anticipated [ten-year] citation count of over 6,000,000 documents." KSP denied Mr. Price's request pursuant to KRS 61.872(6). 4
By letter directed to KSP on August 14, 2017, Mr. Price noted that in determining which fields of information to request, he consulted the Kentucky State Police Records Retention Schedule , "which indicates that your agency must compile the information detailed in citations issued for criminal or traffic offenses throughout the [C]ommonwealth for statistical analysis. " 5 Mr. Price asserted that KSP "indeed maintains an electronic database with tabular-structured fields of these records. Certain fields, also known as columns, like 'address' and 'social security, ' contain information exempt from" the Open Records Act. However, Mr. Price "did not request those specific fields, or columns, or any others that contain exempt information." Mr. Price further clarified that he did not request "paper copies of electronic records[.] Additionally, [the Open Records Act does] not require [KSP] to convert electronic records from their original electronic format to another file format, and printing a database would almost certainly necessitate file conversion." Mr. Price reiterated that he was "asking for the electronic database containing uniform citation data. We are only asking for publicly disclosable fields, or columns, and ask that [KSP] have its database administrator or whomever manages the database duplicate the database and remove the fields we did not" request.
By letter directed to KSP on October 18, 2017, Mr. Price again requested a copy of the "The Uniform Citation File Database" in "its original electronic format. " Mr. Price acknowledged that "KSP is not obligated to convert this record into another format, including pdfs for printing. KSP is obligated to provide this record in its original form. Exclude fields, or 'columns, ' that include the following personal information defined within the scope of KRS 61.931(6); Social Security and driver's license numbers." 6 In a timely written response, KSP again declined to honor Mr. Price's request for the identical reasons it originally provided. 7
By letter directed to KSP on November 7, 2017, Jon L. Fleischaker of Kaplan Johnson Abate & Bird LLP, counsel for the Courier-Journal in this matter, elaborated upon his client's position. He correctly summarized existing legal authority, including prior decisions by the OAG and the Guidelines for Responding to Open Records Requests for Public Records in a Database, issued by the Kentucky Electronic Records Working Group and publicly accessible on the Kentucky Department for Libraries and Archives ("KDLA") website at https://kdla.ky.gov/records/recmgmtguidance/Documents/DatabaseasPublicR… The decisions upon which Mr. Fleischaker relied establish the following salient points:
. a public agency database is "unquestionably a public record" within the meaning of KRS 61.870(2);
. the existing duty to redact information per KRS 61.878(4) does not relieve a public agency of its obligation to produce non-exempt information contained in the database as redacting information is not equivalent to creating a new record;
. public records must be maintained in a manner that facilitates efficient and cost-effective retrieval of public records, i.e. , exempt information should be "easily separable."
Mr. Fleischaker asserted that 08-ORD-080, the referenced Guidelines, and the prior experience of KSP in defending its denials of requests that were appealed under KRS 61.880(2) "provided KSP with ample notice that it must comply with requests for an entire database by exporting the data in standardized electronic formats, redacting exempt data as necessary." His understanding is "that the data in the database could be easily exported to an electronic format such as [E]xcel or CSV, and the non-responsive columns of data could then be masked (or deleted) from the document" provided to his client. If KSP is unable to export these fields of data from the Uniform Citation File database, while separating exempt data, Mr. Fleischaker contended, "KSP's recordkeeping practices themselves violate the letter and spirit of the Open Records Act. " Having received no response, Mr. Fleischaker initiated this appeal on behalf of the Courier-Journal by letter dated January 31, 2018.
Upon receiving notification of Mr. Fleischaker's appeal from this office, Staff Attorney Cody Weber restated the original arguments made by KSP verbatim, emphasizing "KSP is not required to create a list or record containing specific data sets to satisfy the parameters of this request." The Courier-Journal's contention "that KSP can simply extract the data and then redact columns or rows in an excel file or CSV to remove personal information is incorrect," Mr. Weber asserted, "and not a current capability of KyOPS records management solution." Mr. Weber attached the February 12, 2018, affidavit of KyOPS Coordinator Steve Roadcap in support of his agency's position. "KyOPS is the record[s] management solution that would be considered what the Appellant calls the 'Uniform Citation File database. ' Further, as also detailed on the affidavit, any data extract from KyOPS that would allow for personal information such as social security numbers and home addresses to be removed or redacted would require new design and development work that would be considered a new project, resulting in the creation of a new record."
The record on appeal did not contain adequate information for this office to answer the dispositive question of whether complying with Mr. Price's request(s) would require KSP to create a new record as opposed to redacting information that KSP has commingled with non-exempt information contained in the subject database, i.e. , an existing record, as required under KRS 61.878(4). Pursuant to KRS 61.880(2)(c) and 40 KAR 1:030 Section 3, this office asked KSP to provide additional information to assist us in reaching a correct resolution of this matter. Our questions and the responses of KSP appear below (italicized):9
1) In what format or language is the "Uniform Citation File database, " i.e. , the KyOPS "records management solution" containing uniform citations, currently maintained; for example, is the format SQL?
The citation records are stored in a Microsoft SQL Server Database Repository .
2) How does KSP export data from the subject database for the purpose of compiling the statistical data published in Crime in Kentucky and Traffic Accident Facts Report (annual publication referenced in The Justice and Public Safety Cabinet Records and Retention Schedule , Records Series 00059, Uniform Citation File)?
The information published in the yearly Crime In Kentucky publications is compiled from 79 established custom reports utilizing SAP Crystal Reports software in conjunction with the Crime and Citation Data Repositories .
3) How does KSP discharge its duty under KRS 61.878(4), of separating any exempt material from the non-exempt material in the database?
4)By what capability or mechanism can you currently export the database, in whole or in part, and in which format, such as Excel or CSV? Once exported, what redacting capability do you have?
5) When you export data from the current database, are you required to redact fields from each individual citation or do you have the capability to redact entire fields of information, i.e. , social security numbers, etc.
Recognizing as a threshold issue that a "database is unquestionably a 'public record' as that term is defined at KRS 61.870(2)," the Attorney General has addressed the issue of public access to governmental databases a number of times. See 02-ORD-148 (Kentucky Fair and Exposition Center employee database) ; 05-ORD-129; 10-ORD-061; 11-ORD-176; 12-ORD-028. The majority of these decisions involved requests for specific fields of information maintained in the subject database, as opposed to requests for the entire database, and the public agency's discretion per KRS 61.874(3) to decline such a request in the absence of a pre-existing query, filter, or sort capable of extracting the specific information sought. See 06-ORD-148; 12-ORD-028. In 03-ORD-214, for example, the Attorney General was asked to determine whether the Kentucky Tobacco Settlement Trust Corporation had properly denied a request for the database containing the Phase II payments from 2002, identifying the quantities used in calculating the payments (indicating tobacco quota owned or tobacco grown), and requiring manipulation of that data. The Corporation erred in denying the request entirely, but satisfied its duty under the Act by providing the records in standard format as defined at KRS 61.874(2)(b); it was not obligated to tailor the format to satisfy the parameters of the request. Relying upon 03-ORD-004 (disclosure of existing database, with appropriate redactions to protect identifying information relating to individual recipients of Medicaid, was not unreasonably burdensome under KRS 61.872(6)), this office held that the Corporation discharged its duty under the Act by making the entire database available in the format in which it was regularly maintained. 03-ORD-214, p. 9 (citations omitted); 16-ORD-139. This office reaches the same result here.
KRS 61.874(3) speaks directly to this issue. In relevant part, KRS 61.874(3) provides that, " If a public agency is asked to produce a record in a nonstandardized format, or to tailor the format to meet the request of an individual or group, the public agency may at its discretion provide the requested format and recover staff costs as well as actual costs incurred." (Emphasis added.) In construing KRS 61.874(3), the Attorney General has consistently observed that "[a]lthough they are not required to do so, public agencies may agree to extract electronically stored information to conform to the parameters of an open records request and in so doing, incur 'actual costs' in addition to media and mechanical processing costs . . . that could properly be passed along to the requester." 01-ORD-158, p. 4 (agency was not required to comply with request for compilation of statistical data not already maintained). Compare 05-ORD-116 (given its "duty to make government more accessible by providing access to public records at a nonprohibitive charge, and its admission that a query currently exists that is capable of extracting [the requested] information from its database . . . the Personnel Cabinet subverted the intent of the [Act] by attempting to impose [a programming charge]"); 09-ORD-197 (record on appeal confirmed existence of a query, filter, or sort capable of extracting the specific information being sought and KSP was therefore required to treat request "as a standard request under KRS 61.874(3)[,]" and fulfill the request in either the minimum standard format, or its native format per KRS 61.874(2)(b)). This position mirrors the holdings in a line of decisions dating back to 95-ORD-82, recognizing that it is within the discretion of a public agency to tailor the format of records to conform to the parameters of a specific request, and to recoup both staff and actual costs in the event that it affirmatively exercises that discretion. 99-ORD-68; 02-ORD-148; 05-ORD-129; 06-ORD-148; 07-ORD-162; 11-ORD-085.
Mr. Price did not ask KSP to reformat its existing database nor did he ask the agency "to tailor the format to satisfy his particular needs, but instead asks[ed] for a copy of the database in its entirety (following permissible redactions) . It is therefore not within the discretion of [KSP] to deny his request per KRS 61.874(3)." 06-ORD-148, p. 7. As noted, the Uniform Citation File database is a "public record" within the meaning of KRS 61.870(2) and is therefore subject to provisions of the Open Records Act; consequently, "it is incumbent on the [KSP] to provide Mr. [Price] with a copy upon request." Id. , pp. 6-7. The fact only members of law enforcement have accessed information contained in the database thus far has no bearing on the analysis, nor does the fact KSP did not anticipate a member of the public requesting access when it designed the database. KSP has not cited any legal authority that would justify restricting access to largely public information contained in the citations to law enforcement only. KSP may redact any information that is exempt under KRS 61.878(1)(a) or (1)(l)(incorporating KRS 610.320 and 610.340), but "is obligated to so notify Mr. [Price] identifying the protected information, citing the applicable exception, and explaining how the exception applies to the information withheld per KRS 61.880(1), redact [ing] or mask[ing] the protected information fields per KRS 61.878(4), and mak[ing] the nonexempt information available" per KRS 61.872(1)." 06-ORD-148, p. 8.
In 95-ORD-82 (copy enclosed), the Attorney General analyzed KRS 61.847(3) as it relates to a public agency's duty to "separate the excepted and make nonexcepted material available for examination" pursuant to KRS 61.878(4). Significantly, this office held that separating excepted material is not equivalent to producing a record in a specially tailored format or nonstandardized format within the meaning of KRS 61.874(3) as required for a public agency to recover staff costs; rather, agencies are required to discharge this duty under KRS 61.878(4) and must bear the cost of redaction. Id. , p. 2; 08-ORD-183. "If it is necessary to separate confidential from non-confidential information in order to permit the inspection, examination, or copying of public information, the [public] agency shall bear the cost of such separation." 95-ORD-82, p. 3. (Citation omitted). See 08-ORD-216 (if redaction method necessitates the creation of two copies, the first copy cannot be treated as a reproduction for which a fee may be assessed, but "must instead be treated as a cost of redaction which the [agency] must bear"); 07-ORD-162; 08-ORD-183; 12-ORD-022; 14-ORD-130; 17-ORD-244. "It is the opinion of this office that the type of storage system in which an agency has chosen to maintain its records does not diminish its duties under the Open Records Act. Accordingly, we believe that [KSP] must discharge its duty under KRS 61.878(4) , and must bear the costs attendant to his duty," if any. 03-ORD-004, p. 10; 98-ORD-33 (Treasurer could not deny access to unclaimed property database on the grounds that exempt and nonexempt information were commingled in the database, and redaction of the exempt information was tantamount to creation of a new record), 02-ORD-148.
KyOPS is the database management system; the underlying data is the record. KSP ultimately acknowledged that "[t]he option currently exists to export the entire uniform citation database in an XML data extract or a Microsoft SWL Server Backup File. Parts of the data repository can be extracted to Microsoft Access, SML, Excel file or Comma delimited text file. These extracts contain both exempted and non-exempted materials." There may be "no current way to export or extract just non-exempted records." (Emphasis added.) However, that fact is not dispositive. KSP is able to "export the entire uniform citation database" into different formats, at which point KSP could perform the necessary redactions to its existing record, i.e. , the subject database. Although KSP asserted that "[w]hen exporting data from the current database [they] would be required to redact fields from each individual citation as [they] do not have the capability to redact entire fields of information[,]" KSP simultaneously admitted that, "[p]arts of the data repository can be extracted to?Excel file or Comma delimited text file." 10 The process of performing the redactions would be analogous to a public agency being required to make a hard copy of an existing public record for the purpose of redacting information contained therein rather than redacting the original record. See 08-ORD-216.
This office respectfully disagrees that "each citation would need to be individually examined to redact exempt information." It is commonly understood that exporting to an Excel or Comma-delimited text file generates the fields of data in a "tabular" format whereby an entire field can be deleted. KSP is not being asked to create a record to satisfy Mr. Price's request. Based upon the foregoing, this office finds that KSP violated the Act in denying Mr. Price's request. Our holding today is not a departure from those decisions recognizing that a public agency such as KSP is not statutorily required to compile information, perform research, or create a list/record in order to comply with a request; instead, our holding comports with prior decisions recognizing that redaction of exempt information by a public agency is not equivalent to creation of a record. KSP is required to separate protected information per KRS 61.878(4) and provide Mr. Price with a redacted copy of the subject database.
Either party may appeal this decision by initiating action in the appropriate circuit court under KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General shall be notified of any action in circuit court, but shall not be named as a party in that action or in any subsequent proceeding.
Footnotes
Footnotes
1 Mr. Price included a list of items that he believed were "publicly available." He derived that list from the description of the "Contents" found in Records Series 00059 on the Kentucky State Police Records Retention Schedule . However, the Schedule merely indicates that Records Series 00059 "may contain" the list of items that Mr. Price set forth. Under "Access Restrictions" for Series 00059, the Schedule provides, "KRS 61.878(1)(a) re personal information; KRS 61.878(1)(h)." Accordingly, some of the information listed may be withheld under KRS 61.878(1)(a).
2 See 17-ORD-258 (copy enclosed) for a summary of the case law that governs application of KRS 61.878(1)(a).
3 See 10-ORD-073 (copy enclosed) for analysis of KRS 610.320(3) in the context of an Open Records dispute. KRS 310.040(3) provides that "[a]ny record obtained pursuant to this subsection shall be used for official use only, shall not be disclosed publicly, and shall be exempt from disclosure under the Open Records Act[.]"
4 KSP is not required to produce hard copies of the citations in order to discharge its duty under KRS 61.878(4), and has chosen to maintain the uniform citations in such a way that exempt and non-exempt information is commingled. Accordingly, KSP has not established with "clear and convincing evidence" that complying with Mr. Price's request would unreasonably burden the agency within the meaning of KRS 61.872(6). In Department of Corrections v. Chestnut, 250 S.W.3d 655, 664 (Ky. 2008), the Court was nevertheless "satisfied that the task of determining what materials are properly subject to an . . . open records request is tedious and time-consuming work," but was not persuaded that the request "automatically constitute[d] an unreasonable burden." Id. at 664. The Court determined that the "winnowing process required of the DOC," to separate excepted materials and make nonexcepted materials available did not "rise to the level of an unreasonable burden under KRS 61.872(6)," as that is an existing statutory obligation under KRS 61.878(4). Id. at 665. Further, the Court noted that the DOC's "method of organizing its files is clearly beyond our purview," but suggested that it could "reorganize its materials in such a manner as to more easily facilitate open records review by inmates, the general public, and DOC personnel." Id. at 665. The agency's "method of organizing its files" did not constitute a legitimate basis for denial. Id. A public agency " should not be able to rely on any inefficiency in its own internal record keeping system to thwart an otherwise proper open records request." Id. (citing KRS 61.8715)(Emphasis added). See 13-ORD-145 regarding application of KRS 61.872(6); compare 11-ORD-144.
5 According to Records Series 00059 on the applicable Retention Schedule, the "Uniform Citation File" documents the "citations issued for criminal or traffic offenses to individuals by law enforcement officers throughout the Commonwealth. . . . The citations are scanned into the agency's KyOPS (Kentucky Open Portal System). In addition, the information is compiled for statistical data and published in Crime in Kentucky and Traffic Accident Facts Report, annual publications produced by the Department."
6 KRS 61.931 relates to "Personal Information Security and Breach Investigations," and the corresponding regulation, codified at 2014 Ky. Acts Ch. 74, sec. 10, provides that "the provisions of this Act shall not impact the provisions of KRS 61.870 to 61.884."
7 In Kentucky New Era, Inc. v. City of Hopkinsville, 415 S.W.3d 76, 85 (Ky. 2013), the Kentucky Supreme Court recognized that "Kentucky's private citizens retain a more than de minimus interest in the confidentiality of the personally identifiable information collected from them by the state." Significantly, the Court rejected the practice of " blanket denials of ORA requests, i.e., the nondisclosure of an entire record or file on the grounds that some part of the record or file is exempt . . . ." Id. at 88 (original emphasis). The Court determined that the City's redaction policy was more accurately "referred to as a 'categorical' one." With regard to "discrete types of information routinely included in an agency's records and routinely implicating similar grounds for exemption," the Court held, "the agency need not undertake an ad hoc analysis of the exemption's application to such information in each instance, but may apply a categorical rule." Id. at 89. The Court found that the privacy interest of the individual with regard to information like that requested "will almost always be substantial, and the public's interest in disclosure rarely so." Id. However, the agency in that case had "complied scrupulously with KRS 61.878(4) by 'making available for examination' the requested records after having separated, in its view, the excepted private information from the nonexcepted public information." Id. at 88 (emphasis added). This office has also had occasion to affirm the "categorical redaction" of identifying information of private individuals pursuant to Kentucky New Era, Inc. in a variety of contexts when, as in this appeal, there was no basis on which to distinguish it. See 14-ORD-067; 14-ORD-108; 14-ORD-123; 14-ORD-178; 16-ORD-120; 15-ORD-093; 16-ORD-188.
8 In relevant part, the Guidelines provide:
In cases where records are requested from a database containing exempt and non-exempt data, the records custodian must redact exempt data and make the non-exempt data available to the requestor. Redacting exempt data is the duty of the agency and is not equivalent to creating a new record or fulfilling a non-standard request . The records custodian cannot charge for programming or staff time required for redaction. It is recommended that databases be designed to facilitate the separation of exempt and non-exempt data.
See Guidelines at p. 3, "Exempt Records." (Emphasis added.)
9 This office also questioned, "What kind of 'design and development work' would be required to enable KSP to export the database and then separate the exempt material from the non-exempt material per KRS 61.878(4)?" Because KSP did not indicate that any efforts would be required that exceed its general duties under the Act, and because its response did not alter the relevant analysis, it was unnecessary to set forth its response to question 6.
10 Comma-separated values," are described as:
"...a delimited text file that uses a comma to separate values? It stores tabular data (numbers and text) in plain text. Each line of the file is a data record. Each record consists of one or more fields, separated by commas." http://en.widipedia.org/wiki/Comma-separat3ed_values. See https://www.data.gov/glossary (citing Wikipedia).