Revealing a public employee's home ZIP code held to be an unwarranted invasion of personal privacy for the purposes of New York State's Freedom of Information Law

Petitioner [Plaintiff] filed a Freedom of Information Law [FOIL] request with the New York State Department of Civil Service [DCS] seeking a document containing the (1) full name, (2) home zip code, (3) hire date, (4) labor organization, (5) bargaining unit and (6) payroll deduction type of all state employees in Classified Service.* DCS supplied Plaintiff with all the requested data except employees' home zip codes and payroll deduction type, explaining that DCS:

1. does not maintain data concerning payroll deduction type; and

2. withheld the employee's home zip codes pursuant to Public Officers Law §§87(2)(b) and 89(7) and Governor Cuomo's Executive Order No. 183.** 

Following an unsuccessful appeal to DCS's FOIL appeals officer, Plaintiff initiated a CPLR Article 78 proceeding challenging the partial denial of his FOIL request and seeking a court order requiring DCS to disclose the requested zip codes. Supreme Court, among other things, concluded that neither the Public Officers Law nor Executive Order 8 No. 183 barred release of the zip codes, and granted so much of the petition as requested such data. DCS appealed the Supreme Court's ruling.

The Appellate Division, noting that "FOIL generally requires government agencies to make available for public inspection and copying all records subject to a number of exemptions" and that the "exemptions set forth in the statute are interpreted narrowly in order to effect the purpose of the statutory scheme," then addressed DCS's refusal to disclose the zip codes of the employees requested by Plaintiff.

The Court said the DCS had satisfied its statutory obligation to fully explain its determination in the administrative appeal by stating that the "disclosure of name and zip code pairings would invade employee privacy to an unwarranted degree, citing statutes that protect personal identifying information of the public generally and state workers in particular."  The Appellate Division then observed that DCS's burden was to articulate a "particularized and specific justification" for its denial but this obligation "did not arise until [Plaintiff] commenced this CPLR Article 78 proceeding."

In its effort to meet this burden DCS cited two statutory exemptions: one prohibiting release of records protected by a state or federal statute, specifically the statute providing that FOIL does not require the disclosure of, among other things, home addresses of public employees and a second permitting agencies to "deny access to records or portions thereof that ... if disclosed would constitute an unwarranted invasion of personal privacy."

The court opined that in "our current, highly technological environment, using a zip code or other partial address information directly matched with an individual's name could readily facilitate access to that person's complete home address." Thus, said the Appellate Division, the "FOIL rule that we interpret exemptions from disclosure narrowly" does not require that courts disregard the "commonsense understanding of legislative intent." Conceding "the somewhat novel nature" of its determination - that a zip code is the functional equivalent of an address for FOIL purpose," the Appellate Division said that it found that exemption applicable in the instant situation.

In considering this alternate grounds -- whether disclosing a home zip code paired with an employee's name would constitute "an unwarranted invasion of personal privacy under the provisions of  Public Officers Law §89(2)]", the court explained that this privacy exception includes eight categories that are per se unwarranted invasions of privacy and then noted that unwarranted invasions of privacy "shall not be limited to" those listed (see Public Officers Law § 89[2] [b]).

In the absence of proof establishing the applicability of one of the specifically-enumerated categories, the Appellate Division said courts "evaluate whether disclosure would constitute an unwarranted invasion of personal privacy 'by balancing the privacy interests at stake against the public interest in disclosure of the information'."

On one side of the equation is the public interest in disclosure of government records while the other side of the equation is the interests of state employees in not having their home zip codes, along with their names and job information, released to members of the public.

Citing Massaro v New York State Thruway Authority, 111 AD3d at 1003, the court said "An unwarranted invasion of personal privacy has been characterized as that which would be offensive and objectionable to a reasonable person of ordinary sensibilities" Here DCS "particularly and specifically justified its denial" when it stated that the correlation of names and home zip codes invaded employee privacy, and offered to release a summary or de-identified employee zip codes upon receipt of a new FOIL request. Plaintiff, however, declined to accept this offer tendered by DCS.

Observing the personal privacy exemption "would have little meaning if [individuals or] entities could circumvent [it] by gaining access to only the names [of public employees] and then linking them to a home address, the Appellate Division concluded that the policy concerns underlying the personal privacy exemption are no less implicated under that scenario," noting that it had earlier affirmed a denial of disclosure where the requested "records, when combined with other readily available information, ... could identify or lead to the identification of" information protected under a FOIL exemption," rejecting "(e)ven the partial disclosure of an address" because it could be used, with other information," to identify an individual.

As to special protections for state employee records, the Appellate Division concluded that Legislature's enactment of Public Officers Law §89(7) indicates its desire to protect public employees from harassment at home and here the release of home zip codes "would constitute an unwarranted invasion of personal privacy under these circumstances."

Finding that DCS had met its burden of proving that the requested zip codes are exempt from disclosure under FOIL, the Appellate Division ruled that Supreme Court erred in ordering the disclosure of such data and reversed so much the lower court's order that required DCS to disclose the zip code data requested by Plaintiff.

* §40 of the New York State Civil Service Law provides that the Classified Service "shall comprise all offices and positions not included in the unclassified service. The offices and positions in the classified service of the state and of its civil divisions shall be divided into four classes, to be designated as the exempt class, the non-competitive class, the labor class, and the competitive class."

** See 9 NYCRR 8.183, Protecting the Personal Privacy of Public Sector Workers.

The decision is posted on the Internet at: http://www.nycourts.gov/reporter/3dseries/2021/2021_01113.htm. 

 

Municipal and school district audits issued during the week ending February 19, 2021

New York State Comptroller Thomas P. DiNapoli announced the following municipal and school district audits were issued during the week ending February 19, 2021.

Click on the text highlighted in color to access the complete audit report

MUNICIPAL AUDITS

New York State Comptroller Thomas P. DiNapoli today announced the following local government and school district audits have been issued.

 

Village of Red Hook – Information Technology (Dutchess County) Officials did not adequately secure and protect the village’s information technology (IT) systems against unauthorized use, access and loss. The board also did not adopt required or sufficient IT policies, provide users with IT security awareness training, or develop a disaster recovery plan. Officials were unaware that employees were accessing websites for nonbusiness purposes because they did not routinely monitor employee Internet use. The IT consultant’s responsibilities were not defined and officials did not have a formal contract with the consultant. In addition, sensitive IT control weaknesses were communicated confidentially to officials.

 

Village of Pittsford – Audit Follow-Up Letter (Monroe County) In a previous report issued in July 21, 2017, auditors identified problems with the board’s oversight over the village’s financial operations. When auditors revisited the village in August 2020 to review progress, they found limited corrective actions had occurred. Of the seven audit recommendations, one recommendation was fully implemented, four recommendations were partially implemented and two recommendations were not implemented.

 SCHOOL DISTRICT AUDITS

Honeoye Falls Lima Central School District – Access Controls (Livingston County, Monroe County and Ontario County)   District officials did not ensure user access controls were appropriate and secure. Officials did not adopt key information technology (IT) security policies, resulting in increased risk that data, hardware and software may be lost or damaged by inappropriate use or access. Officials also did not regularly review network user accounts and permissions to determine whether they were appropriate or needed to be disabled.

In addition, sensitive IT control weaknesses were communicated confidentially to officials. Due to the COVID-19 pandemic, with the district‘s increased reliance on a remote learning environment and administrative operations, protecting IT assets is critical.

 

The authority of an administrative agency's to adopt regulations to implement legislation

Regulations of the Office of Victim Services [OVS], as amended in January 2016, limited attorneys' fee awards for crime victim claimants to the costs incurred on applications for administrative reconsideration or appeal and on judicial review.* The question presented to the Court of Appeals [Court] in this appeal was whether these regulations, as amended, were in conflict with the authorizing statute** or were otherwise irrational.  

Citing Consolidated Edison Co. of New York v Department of Environmental Conservation, 71 NY2d 186, the Court said that administrative agencies have "all the powers expressly delegated to [them] by the Legislature" and are "permitted to adopt regulations that go beyond the text of [their] enabling legislation, so long as those regulations are consistent with the statutory language and underlying purpose." 

Although "an administrative agency may not, in the exercise of [its] rule-making authority engage in broad-based public policy determinations ... [t]he cornerstone of administrative law is ... the principle that the Legislature may declare its will, and after fixing a primary standard, endow administrative agencies with the power to fill in the interstices in the legislative product by prescribing rules and regulations consistent with the enabling legislation."

Further, the Court said it has long recognized that "where flexibility is required to enable an administrative agency to adapt to changing conditions, it is sufficient if the Legislature confers broad power upon the agency to fulfill the policy goals embodied in the statute, leaving it up to the agency itself to promulgate the necessary regulatory details."

The standard for judicial review of those regulatory details "'is whether the regulation has a rational basis and is not unreasonable, arbitrary or capricious." Where the legislature has left to an agency's discretion the determination of "what specific standards and procedures are most suitable to accomplish the legislative goals," the agency's rule making powers, "[i]f reasonably designed to further the regulatory scheme, ... cannot be disturbed by the courts unless the provision is arbitrary, illegal or runs afoul of the enabling legislation or constitutional limits ... regardless of [the court's] assessment of the 'wisdom' of the agency's approach."

The Court explained that the regulations as amended by OVS "are fully consistent with the governing statutory language and purpose," and thus are "within OVS's authority, and rational." Notwithstanding the Petitioners' argument and the dissent's reasoning to the contrary, the Court concluded that the statute, when read as a whole, grants OVS the authority to determine whether attorneys' fees are "reasonable."

Noting that "there may be other valid ways in which OVS could have defined 'reasonable' attorneys' fees," the definition in the amended regulations is rational and the application of those regulations to deny the Petitioners' fee applications "was not arbitrary and capricious."

Finding that the regulations as amended by OVS were consistent with the statutory language and OVS had "appl[ied] its special expertise in a particular field to interpret [that] statutory language," the Court held that OVS' determination was entitled to deference and, reversing the decision of the Appellate Division, reinstated the judgement of the Supreme Court.

* See 9 NYCRR §§525.3, 525.9

** Executive Law Article 22,

The text of the decision of the Court of Appeals is posted on the Internet at:
http://www.nycourts.gov/reporter/3dseries/2021/2021_01091.htm.