Opinion ID: 2356015
Heading Depth: 4
Heading Rank: 2

Heading: Any publicly available information?

Text: ¶ 18 The AGO's primary argument is that it seeks to disclose only publicly available information. Any information that qualifies as publicly available information is exempted from the definition of `nonpublic personal information,' even if the information would otherwise meet the definition of personally identifiable financial information. 15 U.S.C. § 6809(4)(A); 16 C.F.R. § 313.3(n)(1), (2), ( o )(1). The term [ p ] ublicly available information  is defined as any information that you have a reasonable basis to believe is lawfully made available to the general public from: (i) Federal, State, or local government records; (ii) Widely distributed media; or (iii) Disclosures to the general public that are required to be made by Federal, State, or local law. 16 C.F.R. § 313.3(p)(1) (emphasis added). [7] And widely distributed media includes information from a telephone book ... or a [website] that is available to the general public on an unrestricted basis. 16 C.F.R. § 313.3(p)(3)(ii). Because much of the information here is available through the telephone book, web sites, and recorded mortgage filings, the AGO argues that the names and addresses culled from the disputed records, as well as phone numbers and mortgage interest rates in some cases, meet the definition of publicly available information. This information would therefore be exempted from the definition of nonpublic personal information, and the federal restrictions would not apply. We reject the AGO's position. ¶ 19 The key is the FTC rule's use of the word you in the definitions of [ p ] ublicly available information  and [ r ] easonable basis.  16 C.F.R. § 313.3(p)(1), (2). The term [ y ] ou  means each `financial institution'... over which the [FTC] has enforcement jurisdiction pursuant to [the GLBA]. 16 C.F.R. § 313.3(q). This definition expressly excludes any `other person,' id., which, in turn, is defined as third parties that are not financial institutions, but that receive nonpublic personal information from financial institutions with whom they are not affiliated, 16 C.F.R. § 313.1(b). Ameriquest is a you, and the AGO is an other person. Only a youa financial institutioncan form the reasonable basis to believe information is publicly available. ¶ 20 For example, as to names, addresses, and loan information, the FTC rule says, You have a reasonable basis to believe that mortgage information is lawfully made available to the general public if you have determined that the information is of the type included on the public record in the jurisdiction where the mortgage would be recorded. 16 C.F.R. § 313.3(p)(3)(iii)(A) (emphasis added). An other person like the AGO may not make this determination. As to phone numbers, the FTC rule says,  You have a reasonable basis to believe that an individual's telephone number is lawfully made available to the general public if you have located the telephone number in the telephone book or the consumer has informed you that the telephone number is not unlisted. 16 C.F.R. § 313.3(p)(3)(iii)(B). Simply put, only a financial institution can form the reasonable basis necessary to think that information is publicly available. ¶ 21 The FTC's Final Rule statement does not say why it chose this definitional route. See Privacy of Consumer Financial Information, 65 Fed.Reg. 33646. But its choice is consistent with the overall thrust of the federal regulations. The financial institution is allowed to scrutinize a consumer's information for what is publicly available and what is not because the financial institution already has the information, the consumer has consented to the situation, and the financial institution has a business incentive to respect its customers and be careful with their privacy. However, the vetting itself is an intrusion into a consumer's privacy. If a third party holding protected information were allowed to see whether some of the information is publicly available, the third party would have greater reason to rummage through the consumer's information. This would conflict with the carefully drawn limits on a third party's use and redisclosure of the protected information. See 15 U.S.C. § 6802(c); 16 C.F.R. § 313.10(a)(1), .11(c)-(d). Additionally, because a different set of laws might apply to third parties, more information could be inadvertently treated as public. For instance, under the AGO's interpretation, all of the information it controls would be publicly available because PRA requests are [d]isclosures to the general public that are required to be made by Federal, State, or local law. 16 C.F.R. § 313.3(p)(1)(iii). ¶ 22 In sum, any information that meets the definition of nonpublic personal information cannot be recast as exempt publicly available information by the AGO. Only Ameriquest can form the reasonable basis to color the information that way, and nothing suggests that Ameriquest has taken the necessary steps.