By Harry Hammit
Hammit is publisher of Access Reports, a bi-monthly report on U.S. and Canadian freedom of information legal developments.
A ruling by Judge Rudolph Contreras finding that personally identifying information contained in several FTC complaint databases is protected by Exemption 6 (invasion of privacy), while almost certainly correct based on case law interpretation, still raises interesting questions about the social role government information could or should play in expanding public knowledge. But because nearly any personally identifying information is now routinely withheld under the privacy exemptions, the public value of such information is never seriously considered. And the Supreme Court’s unfortunate conclusion in Reporters Committee that the only public interest in disclosure is whether information sheds light on government activities or operations makes it that much harder to consider any other social value that might come from disclosure of even the most mundane personal information.
The case before Contreras concerned a request from a coalition of public interest groups working primarily with low- income and immigrant populations for information contained in the FTC’s Consumer Sentinel database, an online repository containing millions of consumer complaints about alleged illegal business activity. The databases consist of consumer complaints received by the FTC through its telephone complaint line or complaints received through the agency’s website. The public interest groups apparently were interested in using the data as the basis for their own online review system that would allow consumers to see if businesses had been subject to complaints and post their own reviews of their interactions with businesses. The FTC, however, drew the line at providing any non-business-related personally identifying information and told Contreras that, unfortunately, data fields containing consumer descriptions of their complaints frequently contained personally identifying information making it essentially impossible to disclose those fields without complaint-by-complaint review, which was clearly too burdensome. Not only did the description field frequently contain personal information, complainants often provided personal information about themselves or the business in other data fields as well, making it nearly impossible to write a code that would locate and redact such information. As part of its response to the coalition’s request for the data elements the agency thought could be released, the agency provided a cost estimate from its contractor of $8,581.95 “to develop the custom scripts, extract from reporting [database] format, validate and complete the FOIA request.” The contractor’s estimate was based on 65 hours at $132 an hour. The agency told the requesters that it would administratively close the requests if the coalition did not agree to pay within 10 days. The coalition told the agency not to commence its search and production of the data until resolution of the status of the contested data fields. Ultimately, the coalition filed suit challenging the agency’s privacy claims as well as the contractor’s cost estimate.
To get a handle on how often personal information was included in the wrong data field, the FTC searched for Gmail addresses on the theory that they were primarily used by individuals rather than as business email addresses. Of the 350,000 complaints yielded by the search, the agency reviewed 600 complaints and found 82 percent of them contained further personally identifying information. Contreras noted that “the Court is satisfied that—based on the evidence provided by the FTC, the lack of allegations of bad faith, and the lack of contradictory evidence provided by Plaintiff—the agency has demonstrated a real, and not merely speculative, possibility of personal identifying information in the form of names, addresses, telephone numbers, and email addresses existing in the Company Information Fields.”
Contreras agreed with the agency that both consumer complainants and individuals identified in their business capacity had legitimate privacy interests. Recognizing the coalition’s intent to provide the information to downstream consumers, he pointed out that “this proposed benefit demonstrates the very privacy interest at stake if personally identifying information about an accused individual wrongdoer is released—namely that people will use this information to identify the individual and then make judgments and alter their behavior in regard to the accused based on unverified complaints held by a federal agency. This benefit, moreover, clearly is not the type recognized under FOIA Exemption 6.”
The coalition argued that by submitting complaints online individuals had a diminished expectation of privacy, particularly because the FTC’s privacy policy indicated information could be disclosed under FOIA. But Contreras pointed out that “as the FTC explains, however, consumers are not required to click on, read, or agree to the privacy policy in order to file a complaint. In addition, individuals accused of misconduct in a complaint never see the privacy policy in the first place. Yet, even if all parties involved actually read and consented to the policy, the policy itself represents only a warning, not a waiver of FOIA privacy rights.”
Rejecting the coalition’s claimed benefits from disclosure, Contreras observed that “those benefits do not outweigh the substantial privacy interest of protecting victims and individuals accused of wrongdoing from abuse, harassment, and embarrassment given the very real risk of their being identified and the tenuous connection between their personal information and Plaintiffs’ stated policy goals.” However, Contreras found the agency had not shown why five-digit zip codes should be withheld. He noted that “because the agency provides no evidence suggesting that disclosure of the five-digit zip code actually or potentially affects the likelihood that the complainant will be identified, the Court cannot conclude that such information implicates a substantial privacy interest.”
Turning to the question of whether the agency could be forced to redact the information so that non- exempt information could be disclosed, Contreras noted that “if Plaintiffs sought a smaller, more manageable universe of records and not the twenty million complaints in the Consumer Sentinel database, the solution might be simple: the Court could order the FTC to expend a reasonable amount of resources to identify and redact the exempt personal information from each complaint. The facts and equities of this case, however, compel the Court to conclude that the FTC properly withheld the entire universe of information given the burden of removing the subset of exempt information. . .[H]ere, because the agency aims to protect the private information of citizens by withholding the data fields at issue, and because the manual review needed for redacting such information is unreasonably burdensome, the Court concludes that the FTC properly withheld the data fields under Exemptions 6 and 7(C).” Finally, Contreras rejected the coalition’s challenge to the cost estimate, finding the plaintiffs had failed to provide any evidence suggesting that the estimate was inaccurate. (Ayuda, Inc., et al. v. Federal Trade Commission, Civil Action No. 13-1266 (RC), U.S. District Court for the District of Columbia, Sept. 30)
Editor’s Note: While this case is almost certainly correct based on the case law, the striking inability of non- government groups to make use of government collected information for socially useful purposes severely undercuts the concept of access to government information. Although agencies may withhold such information under FOIA, FOIA does not require agencies to withhold information, it provides a basis for protecting various types of information if the agency chooses to do so. By so frequently choosing to withhold information solely because the statute allows them to do so, agencies have largely removed themselves from any consideration of the social use of government information and instead wrapped themselves in the mantle of non-discretionary application of exemptions.
Filed under: Latest Features