Practical obscurity, other privacy arguments deliver blow to media in Mass. FOIA case

The Massachusetts Supreme Judicial Court (SJC) decided a state open records case in mid-June that invites lower courts to substantially broaden privacy exemption from access to information. The case is Boston Globe Media Partners, LLC v. Department of Public Health, No. SJC-12622 (Mass. June 17, 2019) (Lexis).

The Boston Globe is seeking access to a database of state birth, marriage, and death records from the Department of Public Health (DPH). In disagreement with state administrative officers enforcing the open records law, DPH refused access in part, citing statutory protections of personal privacy.  The SJC rejected dispositive motions from both sides, electing to clarify the law and remand for a range of further fact finding.

The case resonates with various problems that have become familiar to privacy law over the last few decades. First, can privacy arise in a compilation of records, when the records are not private one by one?  Second, can privacy preclude disclosure of records in government possession because the records are more about individuals than about the government? Third, how can personal privacy in electronic public records account for an individual's hypothetical privacy interests in the future?

First, the compilation problem arises in that these vital records already are available to the public. Members of the public are allowed to go to  DPH's research room during 11 opening hours each week to view vital records in the electronic database. There are limitations, though. A researcher must search for a name, viewing responsive records only one at a time. Printing is not available, though there is no limitation on copying down information.

At issue legally, then, is whether mere compilation can change the public/private disposition of a record. Historically, the answer to this question was no. Norms of public records law as it developed in the 20th century held that a record should be evaluated within its four corners.

However, that position changed at the federal level, under the federal Freedom of Information Act (FOIA), with the landmark case, U.S. Department of Justice v. Reporters Committee for Freedom of the Press (U.S. 1989). In that early instance of database access, the Supreme Court construed the FOIA contrary to access on various grounds.  The case was an infamous loss for the access NGO Reporters Committee, which filed as amicus on behalf of the Globe in this case.

Among the conclusions of Reporters Committee, the Court embraced the doctrine of practical obscurity: the notion that a record that is hard to find, whether by rifling through paper or by collecting geographically disparate components, may therein preserve a privacy interest against disclosure when compiled electronically with other such records. With its limitations on record access through the research room, DPH means to effect practical obscurity. The SJC was receptive to the argument, and it will remain to the lower court to decide what weight that privacy holds. Practical obscurity has been a thorn in the side of access advocates for the 30 years since Reporters Committee, while it has captivated courts.

Second, the content problem goes to the disputed heart of access law, its purpose. In Reporters Committee and subsequent cases, the federal courts embraced the cramped position that the purpose of access law is to reveal "what government is up to." Thus when records contain personal information, access opponents ground resistance in statutory purpose without even needing to rely on privacy exemptions.

Access advocates have argued powerfully against this position, especially in the states. Simply knowing what information government is collecting about individuals seems an important priority in the digital age. And the limited purpose argument ignores the plain theoretical position that government records are public records simply by virtue of ownership or possession, because ours is a government of the people. 

On this score the SJC was more solicitous of a broad construction. The state law expressly cites the watchdog purpose. Nevertheless, the Court reasoned that the statute more broadly means to further public interests, which may require disclosure even of personally identifying information in public possession. At the same time, the Court observed that public interests may weigh against disclosure, acknowledging personal privacy protection as a public interest. In the instant case, the Court cited only a public interest in record accuracy, as argued by the Globe, to favor disclosure. The balance is left to remand, but the interest of accuracy seems thin relative to the array of privacy arguments deployed by DPH.

That array arises in connection with the third and most contemporary problem, the protection of individuals' hypothetical privacy interests. Here again is a privacy interest that conventional access law would have disregarded. Yet the SJC was solicitous.

This same problem has been much discussed in the internet age in the guise of the right to be forgotten, or right to erasure. If a government entity is obliged to disclose databases upon demand, then it becomes difficult, if not impossible, to withdraw information from the public sphere later. Access absolutists say, so be it. But privacy advocates assert that meritorious processes for correcting or sealing sensitive public records, such as criminal histories or family matters, are undermined by an internet that "never forgets."

Especially with regard to vital records, the SJC spent some ink on the problem of sex changes and the discovery of a person's birth identity. That is a factor rightly weighed into the privacy balance on remand, the Court held. While evincing compassion, the Court's position is sure to rile access advocates. There seems no logical stopping point from the Court's position to the conclusion that all personally identifying information must be protected against disclosure, in case any one person wishes to change identity in the future. That would be a rule ripe for abuse in official hands.

This decision is bad news for access advocates. It invites privacy to the table as a weight co-equal with access, virtually lifting the presumption-of-access thumb from the scale. The government won broad discretion to conceal its activities relative to people.

At the same time, the Court showed itself to be in step with contemporary privacy law. For better and worse, people are looking to government to protect them against abuses of information in the private sector, from identity theft to big data analytics. In the absence of legislation, the courts have been ever more inclined to oblige.

It remains to be seen what price this protection will exact from transparency and accountability of the government itself.