Opinion ID: 2829245
Heading Depth: 1
Heading Rank: 5

Heading: Risk of Identity Theft

Text: Applying Section 552.102 and adopting a new balancing test articulated by the U.S. Supreme Court in Department of the Air Force v. Rose , 425 U.S. 352, 372 (1976), the Court holds that the state employees’ privacy interests substantially outweigh the public interest in disclosure. ___ S.W.3d ___. A. The Sky Is Not Falling: The Court’s Characterization of the Privacy Interest at Stake Is Overstated. Section 552.102 excepts from disclosure information in a personnel file “the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” Tex. Gov’t Code § 552.102. The Rose test, adopted today by this Court, balances an individual’s privacy claims against the public interest in disclosure. Rose , 425 U.S. at 372. Because Congress only excepted from disclosure information that constitutes a “clearly unwarranted” invasion of privacy, federal courts have noted that the balance of disclosure interests should be tilted in favor of disclosure and creates a “heavy burden” for an agency invoking the exception. E.g., Morley v. Cent. Intelligence Agency , 508 F.3d 1108, 1128 (D.C. Cir. 2007) (noting that the CIA had the burden to show withholding is necessary under the federal Freedom of Information Act (FOIA) Exemption 6 for records pertaining to a deceased CIA officer, and no privacy interest was articulated); Wash. Post Co. v. U.S. Dep’t of Health & Hum. Servs . , 690 F.2d 252, 275 (D.C. Cir. 1982). The Court jumps on the bandwagon of a number of other states, or federal trial courts, that have held that birth date information may constitute a clearly unwarranted invasion of personal privacy. While I am sensitive to the privacy rights of public employees and understand the concern of the Court, I believe the Court’s reasoning is misguided for three fundamental reasons. First, the Legislature has not protected dates of birth of public employees from disclosure. Birth dates by themselves are not private or damaging. 5 The Court and the parties have recognized as much. And the Restatement of Torts recognizes as much. Restatement (Second) of Torts § 652D cmt . b (“Thus there is no liability for giving publicity to facts about the plaintiff’s life that are matters of public record, such as the date of his birth . . . .”). And even the U.S. Supreme Court has recognized as much, reasoning that information that is “not intimate” such as “place of birth, date of birth, date of marriage, employment history, and comparable data” may be restricted only in the disclosure of a “personnel” or “medical” file that itself would be a clearly unwarranted invasion of personal privacy. U.S. Dep’t of State v. Wash. Post Co. , 456 U.S. 595, 600 (1982). “‘[C] ongress also made clear that nonconfidential matter was not to be insulated from disclosure merely because it was stored by an agency in its “personnel” files.’” Id. at 601 (quoting Rose , 425 U.S. at 372). The Court points to no evidence that disclosure of birth dates would be offensive to a reasonable person, would cause harm, or would lead to personal harm. Instead, the Court holds, much more tenuously, that disclosure is harmful because birth date information, “taken together” with other information, may “be used to facilitate identity theft,” or may be used to locate a Social Security number, which may be used to facilitate identity theft. ___ S.W.3d ___ (quoting Hearst Corp. v. State , 882 N.Y.S.2d 862, 875 (N.Y. Sup. Ct. 2009)). In other words, the harm is not in the disclosure of the birth date, but in the possibility that some evildoer may use a birth date to gain other information (such as a social security number) which he or she then may use to commit identity theft. Never before has the Court held that information is not subject to disclosure under the PIA because the information may lead to other information that may be used to cause harm. By that logic, much information of a personal nature would be immune from disclosure—names of public employees, dates of employment, home addresses. This sort of information, taken together with other information, might lead to the employee’s social security number and possibly to identity theft. While the state has outlawed identity theft, and individuals may sue when others misappropriate their private data, the Court should not allow subversion of the open-government policies of the PIA under the risk that some of the public information may later be misused. As written, FOIA Exemption 6 (substantially identical to section 552.102) likely only protects the information itself, not its derivative uses or problems down the line. Perhaps FOIA would be a more sensible law if the Exemption applied whenever disclosure would “cause,” “produce,” or “lead to ” a clearly unwarranted invasion of personal privacy—though the practical problems in implementing such a provision would be considerable. That is not, however, the statute Congress enacted. Since the question under 5 U.S.C. § 552(b )( 6) is whether “disclosure” would “constitute a clearly unwarranted invasion of personal privacy”; and since we have repeatedly held that FOIA’s exemptions “‘must be narrowly construed,’” it is unavoidable that the focus, in assessing a claim under Exemption 6, must be solely upon what the requested information reveals, not upon what it might lead to . That result is in accord with the general policy of FOIA, which we referred to in United States Dept. of Justice v. Reporters Committee for Freedom of Press , 489 U.S. 749, 771 (1989) that the particular purposes for which a request is made are irrelevant. U.S. Dep’t of State v. Ray , 502 U.S. 164, 180–81(1991) (Scalia, J., concurring) (emphasis added) (citations and quotations omitted). Birth date information is not highly intimate or embarrassing; birth dates are not generally included in “the type of information that a person would ordinarily not wish to make known about himself or herself.” Assoc. Press. v . U.S. Dep’t of Def. , 554 F.3d 274, 292 (2d Cir. 2009). If it had been raised, the text of section 552.102 does not require consideration of derivative harm. Interestingly, the Texas Identity Theft Enforcement and Protection Act requires businesses to take reasonable steps to protect “sensitive personal information” collected or maintained by the business in the regular course. Tex. Bus. & Com. Code § 521.052. Sensitive personal information is generally an individual’s name combined with any one or more of the following: social security number, driver’s license number or government-issued identification number, or account, credit card or debit card number. Id. § 521.002(a )( 2). The Legislature has not extended this obligation to dates of birth. Id. 6 Notifications to others required by the Identity Theft Act for breaches of computer security apply only when sensitive personal information is reasonably believed to have been acquired by an unauthorized person. Id. § 521.053. Again, the Legislature did not include dates of birth in the same risk category with sensitive personal information. Second, the support relied on by the Court is far from conclusive. The Court repeats general statements about birth date information but cites to and provides no real data supporting the proposition that birth date information truly leads to identity theft, or that the disclosure of someone’s birth date, in and of itself, has caused any person to be the victim of identity theft. The Court points to a study from Carnegie-Mellon University in which researchers were able, with 60% accuracy , to determine the first six digits of a person’s Social Security number when given the person’s date and location of birth, for persons born after 1989 . ___ S.W.3d ___ (citing Alessandro Acquisti & Ralph Gross, Predicting Social Security Numbers From Public Data , 106 Proc. Nat’l Acad. Sci. 10975 (2009)). Other scholarly and media reports and court cases cited by the Court repeat the findings of the Acquisti and Gross study, or make general statements that compilation of data can be more helpful to identity thieves than data spread out through multiple sources, or that simply assert that birth dates may lead to more private data. Neither the Court nor the Comptroller cite any study positively demonstrating that release of birth date information with a person’s name, without a social security number, makes it significantly more likely that the person will be the victim of identity theft. And neither cites any study evidencing an identity theft that began through birth date information being disclosed in a public database. Credible studies indicate that dates of birth are not the sin qua non of identity theft. The most common form of identity theft arises from credit card theft or check fraud, and the least common form arises from stolen social security numbers or other personal information. Herb Weisbaum , Identity Theft Problem: The Facts Behind the Fear , MSNBC ( Oct. 21, 2010, 7:42 AM) http://www.msnbc.msn.com/id/39763386/ns/business-consumer_news/ (last visited Dec. 1, 2010) (recognizing a recent report that the “most common form of identity theft is . . . ‘old-fashioned credit card theft or check fraud,’” with nearly all respondents to the survey recognizing that their identity theft was due to stolen or misused credit or debit cards, and that a hijacking of an identity using a “Social Security number and other basic information” is the “least common form of identity fraud”). A recent study published by the United States Federal Trade Commission reports that a thief’s use of a social security number with a new name and false date of birth currently accounts for 80–85 percent of all identity fraud. Lanny Britnell , Identity Theft America, The Changing Face of Identity Theft , at 1, available at http://www.ftc.gov/os/comments/creditreportfreezes/534030-00033.pdf; see also Synovate, Federal Trade Commission—2006 Identity Theft Survey Report 30 (Nov. 2007), available at http://www.ftc.gov/os/2007/11/SynovateFinalReportIDTheft2006.pdf (recognizing that 56 percent of victims did not know how their information was stolen, and of the 43 percent of victims who did, many knew the thief personally, had their identities stolen through a purchase or other transaction, from a wallet, from a company that had the information, from hacking, “phishing,” the mail, or some other way). The Attorney General’s office indicated its strong desire to eliminate identity theft, but candidly acknowledged at argument that there is “no firm evidence” that disclosure of birth dates facilitates identity theft and confirmed that the PIA is not intended to prohibit illegal use of data. The information here is public information, and the connection between the information being disclosed and the actual harm sought to be prevented is too tenuous to support the judicial restrictions on disclosure of the public’s information proffered by the Court when that same public information has been shown to have positive benefits. Finally, the privacy interest at stake here is lower than the Court makes it out to be because much if not most of the information at issue has been distributed by the state for years—in some instances for a fee. Texas sells personal information under the Motor Vehicle Records Disclosure Act, including names, addresses, dates of birth and driver’s license numbers, to businesses, insurance companies, private investigatory agencies and other third parties, for a number of specified purposes. See Tex. Transp. Code §§ 730.007, .011 (permitting agencies to disclose the personal information and to charge “reasonable fees for such disclosure”); Ryan McNeill, ID Theft vs. Public Record at A1 (reporting that “private companies spent nearly $50 million during the last fiscal year” buying Texas drivers’ data). To the extent that Texas government employees have driver’s licenses, it is likely that their dates of birth have either already been released by a Texas governmental agency or sold to private entities, or both. Even though the Transportation Code section has been in place for nearly 13 years, there is no evidence submitted indicating that information disclosed through that mechanism has been a hotbed of identity theft. The State has sold similar information on Texans with driver’s licenses for years, suggesting that arguments that the same information about a subset of Texans will greatly increase the possibility of identity theft ring hollow. This Act regulates the use of motor vehicle information and allows disclosure of birth dates of all Texas drivers, whether public or private employees, to many private parties capable of disguising their true identities. And an authorized recipient of this personal information is authorized to resell or redisclose that information for permitted purposes. Tex. Transp. Code § 730.013(b). 7 It is ironic that the Court cuts off free access by the public under the PIA to the same public information that is being sold under the Transportation Code. B. The News Has Established a “Sufficient Reason” for the Disclosure. When personal privacy interests are at stake, the second part of the Rose balancing test is whether the requestor has established a “sufficient reason for the disclosure.” See Nat’l Archives & Records Admin. v. Favish , 541 U.S. 157, 172 (2004). The requesting party must establish “that the public interest sought to be advanced is a significant one, an interest more specific than having the information for its own sake. Second, the citizen must show the information is likely to advance the interest. Otherwise, the invasion of privacy is unwarranted.” Id. The Court holds that the News loses under the balancing test because it “has produced no evidence supporting government wrongdoing [and therefore] the public interest in disclosure is negligible.” ___ S.W.3d ___ (citation omitted). I disagree; the public interest in the information is demonstrated. The News argues that it wishes to use the date of birth information to determine whether particular governmental employees who work in or near children are convicted felons or sex offenders. The News asserts a two-fold need for birth dates: first, to determine whether governmental entities are employing sex offenders or felons in jobs that may put children or the public at large at risk, and second, to confirm the identity of a particular governmental employee who may have a criminal record. The News advises that some 2,000 employees of the State of Texas have the same first and last name. It is reasonable and desirable that the media check the identities of these employees before publishing unflattering facts about them. The News further advises that, through its research, it was able to disclose in an article that over 250 employees of the Texas Youth Commission were convicted felons. See McNeill, ID Theft vs. Public Record , at A1. These are legitimate and productive uses of dates of birth. No one doubts that citizens of this state have a right to know the names of those who work for them in government. Neither party, nor the Court, disputes that the News has the right to such names, and the names are easily available, in electronic form, on various governmental websites and other databases. See, e.g. , Capitol Complex Telephone System (CCTS) Directory, http://www.dir.state.tx.us/ccts/directory/index.html (last visited Dec. 1, 2010) (listing the names, titles, and telephone numbers of employees working in or near the Capitol). On the other hand, no one argues that state employees give up all of their privacy rights simply by working as an unelected public servant. But the disclosure of the birth dates in this case may actually help preserve government workers’ privacy, by ensuring that any organization—media, political, watchdog, financial, governmental, or otherwise—does not falsely accuse those governmental employees of being persons they are not. This is different from the data that the government collects about non-governmental employees. Cf. U.S. Dep’t of Justice v. Reporters Comm. for Free Press , 489 U.S. 749, 773 (1989) (concerning a FOIA request for criminal records of an individual investigated by the FBI). The information at issue may actually prevent mistaken identities and will help keep the government accountable for those they hire. But fundamentally, under the summary judgment procedures, the Court errs by requiring evidence in the record that the News had no reason to provide in the first place. At the trial court in her summary judgment motion, the Comptroller argued that section 552.101 excepted birth dates from disclosure under Industrial Foundation and the Texas common law. Although the Comptroller mentioned that other courts had applied a balancing test, she did not request that one be applied to the facts here. Likewise, at the court of appeals, the Comptroller once again argued that section 552.101 excepts public employees’ birth dates from disclosure under common law and constitutional concepts. Rose , and the balancing test now adopted by the Court, was not cited as a basis for the Comptroller’s position before the court of appeals issued its opinion. The Comptroller cited section 552.102 only in her reply brief at the court of appeal to support the position that sections 552.101 and 552.102 “protect the same privacy interests.” There was no need for the News to submit any evidence for the trial court summary judgment proceedings showing a “significant” public interest that the information is “likely to advance.” ___ S.W.3d ___ (citing Favish , 541 U.S. at 172). We cannot expect a party to present evidence for a standard unknown, unargued , and unapplied below—another reason we enforce our waiver rules. E.g. , Pirtle v. Gregory , 629 S.W.2d 919, 920 (Tex. 1982) (per curiam ) (noting that a party should not “surprise his opponent on appeal by stating his complaint for the first time”). At a minimum, this Court should remand the case to the trial court for the parties to develop the record and argue the balancing test under the new standard. Tex. R. App. P . 60.2(f), 60.3 (providing that this Court may remand for further proceedings in light of changes in the law or in the interest of justice); Boyles v. Kerr , 855 S.W.2d 593, 603 (Tex. 1993) (“We have broad discretion to remand for a new trial in the interest of justice where it appears a party may have proceeded under the wrong legal theory. Remand is particularly appropriate where the losing party may have presented his or her case in reliance on controlling precedent that was subsequently overruled.” ( citations omitted)). Here, the successful party at trial relied on a standard that the Court has now abandoned. Certainly the News should have an opportunity to make its case under the new formula. For these reasons, I would not decide this case under section 552.102 and the Court’s balancing test. As discussed below, under the issue asserted by the Comptroller, birth dates are not confidential under section 552.101.