Are deleted emails that exist only on a disaster recovery server subject to release under the Arkansas FOIA?
Plain-English summary
A citizen filed an Arkansas FOIA request with the Pulaski County Circuit Court for "a copy of all emails, including backup copies" for Circuit Judge Leon Johnson and his staff. Judge Johnson's office had no email archive of its own. The Pulaski County Circuit/County Clerk ran a disaster recovery system (DRS) for the courts' and Clerk's office email. The DRS was not designed to retrieve individual emails; it was designed to allow the office to rebuild yesterday's data in the event of a catastrophe. The DRS continuously overwrote older snapshots, and pulling specific historical emails out of it would have required spinning up virtual servers for each snapshot, querying them individually, and migrating the extracted content into an environment that mimicked the live email server. The Clerk's office did not have software, hardware, or expertise to do that. The estimated cost was substantial.
Judge Johnson asked the AG three questions about how the FOIA applies to that situation. AG Leslie Rutledge gave answers that pointed in the same direction (DRS data probably does not have to be disclosed) but offered two independently sufficient legal bases for that conclusion.
The first reason: DRS data probably is not a "public record" under the FOIA in the first place, because it is not "kept" in the way the statute uses that term. A.C.A. § 25-19-103(5)(A) defines a public record as a writing or electronic data "required by law to be kept or otherwise kept." A shredded paper document is not "kept" even though, in principle, an expert could reassemble it. DRS data is analogous: it still exists in some sense, but only in a disaggregated, disorganized form designed for total system restore, not for retrieving individual messages. The Tenth Circuit had already applied the same logic to federal FOIA in Stewart v. U.S. Dept. of Transp., 554 F.3d 1236 (2009), refusing to require an agency to search backup tapes because doing so was "impossible, impractical, or futile" given the tapes' purpose. A Pulaski County Circuit Court had reached the same result in Kiesling-Daugherty v. Villines (Nov. 2014), holding that the DRS database did not "fall within the parameters of the FOIA."
The second reason, independent of the first: even if DRS data were considered "kept" and therefore a public record, the FOIA does not require disclosure unless the record is "readily convertible with the custodian's existing software" (A.C.A. § 25-19-105(d)(2)(B)). The custodian here would have had to rebuild virtual servers, run individual queries, and migrate output into a usable environment, all with software and equipment the Clerk's office did not own. That is not "readily" anything. The Electronic Records Study Commission's commentary, which the AG quoted, recommends that custodians release electronic information "in the form requested when they are capable of doing so, with presently available resources, without undue effort or expense." Restoring an entire DRS snapshot to extract individual emails fails that test.
Because neither reasoning route leads to disclosure, the practical answer to Question 2 ("are DRS emails subject to release?") is no.
Question 3 asked whether disclosure would be governed by A.C.A. § 25-19-109, which controls "special requests for electronic information" and gives custodians discretion over how to handle non-standard data requests, including charging fees. The AG explained that § 25-19-109 only applies to records that are public records but not "readily available" or "readily convertible." If a court takes the first line of reasoning (DRS data is not a public record at all), then § 25-19-109 does not apply, because the statute presupposes a public record. If a court takes the second line of reasoning (DRS data is a public record but not readily convertible), then § 25-19-109 does apply, and the custodian has discretion over delivery and pricing.
Currency note
This opinion was issued in 2015. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.
Background and statutory framework
A.C.A. § 25-19-103(5)(A) defines "public record" as electronic or paper information "required by law to be kept or otherwise kept" that "constitute[s] a record of the performance or lack of performance of official functions." All three elements (the medium, the keeping, and the function) must be met. The "kept" element is the operative one in this opinion.
A.C.A. § 25-19-105 contains the disclosure rules. Subsection (d)(1)(A) allows a custodian to decline to make copies if the equipment to do so does not exist. Subsection (d)(2)(B) allows requesters to ask for a record in "any format to which it is readily convertible with the custodian's existing software." When conversion is not ready, the request moves into A.C.A. § 25-19-109, which governs special electronic-information requests and allows the custodian discretion over delivery method and fees.
The Electronic Records Study Commission was a legislative working group that produced a December 15, 2000 report on FOIA electronic-records issues. The Commission's "Principle Eight," quoted in this opinion, sets the touchstone the AG applied: "Custodians should release electronic information in the form requested when they are capable of doing so, with presently available resources, without undue effort or expense, provided the request reasonably describes the records."
Two cases shape the analysis. Pulaski County v. Arkansas Democrat-Gazette (2007) held that not every email on a public employee's public computer is a "public record"; the court remanded for in-camera review to determine which emails reflected the performance of official functions. That case left the "kept" question for later. Stewart v. U.S. Dept. of Transp. (10th Cir. 2009) is federal authority on the same backup-tape question, holding that searching backup tapes to comply with a federal FOIA request would be "impossible, impractical, or futile" because the tapes are "not organized for retrieval of individual documents or files, but rather for purposes of disaster recovery." Kiesling-Daugherty v. Villines is the Arkansas trial court ruling that anticipated this opinion's bottom line.
Common questions
Why are disaster recovery backups different from a regular email archive?
The two systems exist for different reasons. An email archive is designed to let users find old messages later (typically with search and retrieval interfaces). A disaster recovery system is designed to let an organization rebuild its environment after a catastrophic failure, by capturing complete system states at regular intervals. A DRS is not organized around individual records; it captures the whole environment as one big snapshot, and is continuously overwritten as new snapshots come in. Asking a DRS for a specific email is like asking a junkyard for one specific bolt.
Does an Arkansas public employee have to keep emails for FOIA purposes?
The opinion does not directly answer that. Records retention rules are governed elsewhere (the state records retention schedules and the rules of the Arkansas Records Management Division). What the opinion answers is the narrower question: if an email no longer exists in any accessible location, but might still be reconstructable from a disaster recovery snapshot, is the agency required to reconstruct it? The answer is no.
What if the requester is willing to pay the reconstruction cost?
A.C.A. § 25-19-109 would come into play if a court treats DRS data as a public record that is not readily convertible. The custodian has discretion to disclose after agreeing with the requester on a fee. The opinion notes the Commission's commentary suggested the fee could cover the agency's "undue effort or expense." Whether to take the fee and do the work is the custodian's call, not the requester's.
Did this opinion settle Arkansas law on disaster recovery?
The AG opinion is persuasive, not binding. It identified an Arkansas trial court decision (Kiesling-Daugherty v. Villines) that reached the same result, and federal authority (Stewart, 10th Cir. 2009) on the same question. There was no Arkansas Supreme Court decision on point when this opinion was issued. The Supreme Court remains free to take a different view if a case presents the issue.
Does the analysis change if the agency does have a separate, searchable email archive?
Yes. The opinion is specifically about disaster recovery backups that are not organized for individual record retrieval. An agency with a separate searchable archive holds those emails as public records subject to the regular FOIA, and they have to be produced (subject to the usual exemptions). The custodian cannot ignore an active archive just because it also has a DRS.
Has the FOIA been amended on this point since 2015?
Verify current Arkansas FOIA provisions before relying on this opinion. The statutory framework cited (A.C.A. § 25-19-103, -105, -109) is in continuing use, but the specific definitions and convertibility rules may have been refined by subsequent amendments or court decisions.
Citations
Statutory framework: A.C.A. § 25-19-103(5)(A) (definition of public record); A.C.A. § 25-19-105(d)(1)(A) (no obligation to copy without equipment); A.C.A. § 25-19-105(d)(2)(B) (readily convertible standard); A.C.A. § 25-19-109 (special electronic information requests).
Cases: Pulaski County v. Arkansas Democrat-Gazette, Inc., 370 Ark. 435, 260 S.W.3d 718 (2007) (in-camera review for which emails are public records); Stewart v. U.S. Dept. of Transp., 554 F.3d 1236 (10th Cir. 2009) (federal FOIA does not require backup-tape searches); Partne A. Kiesling-Daugherty v. Judge Floyd "Buddy" Villines, et al., 60CV-14-4180 (Pulaski County Circuit Court, Nov. 14, 2014) (Pulaski County trial court ruling that the DRS does not fall within FOIA).
Other authority: Report of the Electronic Records Study Commission & Recommendations for Amendments to the Arkansas Freedom of Information Act (Dec. 15, 2000), including "Principle Eight."
Prior AG opinions on § 25-19-109: 2009-186, 2006-093.
Source
Original opinion text
STATE OF ARKANSAS
THE ATTORNEY GENERAL
LESLIE RUTLEDGE
Opinion No. 2014-137
March 17, 2015
The Honorable Leon Johnson
Circuit Judge
Sixth Judicial District, First Division
401 West Markham Street, Room 420
Little Rock, Arkansas 72201
Dear Judge Johnson,
You have asked for an opinion on how the Arkansas Freedom of Information Act
(FOIA) applies to data stored on the disaster recovery system (DRS) for you and
your staff. You provide substantial background for your request. Because much of
this background is important to the opinion, I will quote from it at length:
My office has received an FOIA request from a citizen that asks for
"a copy of all emails, including backup copies" for myself and my
staff. To my understanding, there are no "backup copies" or archives
of emails for my office. However, the Pulaski County
Circuit/County Clerk maintains a disaster recovery system which
contains emails of both the Pulaski County Circuit Courts' and the
Clerks' Office employees. This is not an archive of emails, but a
copy of the email server maintained for disaster recovery purposes
only. In the event of a catastrophic event, the sole purpose of the
disaster recovery system is to reproduce the previous day's business
so that there is no disruption of public service. Furthermore, the
disaster recovery system is continuously overwritten. It is not
designed, nor is the Clerk's Office equipped, to pull individual
emails that may have been deleted or lost. In essence, the Clerk can
provide what is currently being "kept" by each employee in their
email account with little or no effort. Basically, the only information
that could be obtained by access to the disaster recovery system
would be those emails that were deleted. Further, the disaster
recovery system is not in place to store public records.
You then explain what would be required to retrieve information from the disaster
recovery tapes:
In order to make the data contained on the system available pursuant
to the FOIA, the Clerk would be required to build a "virtual server"
for each "snapshot" of data contained on the disaster recovery
system. At that point, each virtual server would have to be queried in
order to retrieve the emails that have been requested pursuant to the
FOIA. Once queried, the extracted information must be transferred
to the same environment as the live server (or a server would have to
be purchased and the environment mimicked) in order for the
information to be accessible. While it is theoretically possible for the
courts and the Clerk to see no interruption of service while the
extraction is taking place, it would be impossible to say with
absolute certainty that the live servers and the disaster recovery
system would not sustain damage if there was interaction between
the two. The costs to Pulaski County in order to carry out this
retrieval would be substantial (license fees, hardware/software, etc.).
With this background in mind, you ask three questions:
- Are deleted emails of public officials or employees considered
"kept" pursuant to A.C.A. § 25-19-103(5)(A), merely because
they may exist on a disaster recovery server? Or are deleted
emails, by their nature, to be considered "not otherwise kept" by
an employee who makes a conscious decision to delete it? - Are emails that are stored for only disaster recovery purposes
subject to release pursuant to the FOIA? - Based on the fact scenario above, would a decision to provide the
requested information be considered summarizing, compiling, or
tailoring electronic data in a particular manner or medium to
which it is not readily convertible as set out in A.C.A. § 25-19-
109? Would this information be considered as information that
the custodian would not be required to copy because necessary
duplicating equipment does not exist as set out in A.C.A. § 25-
19-105(d)(1)(A)? Or would the information be considered not
readily convertible because the Clerk's Office does not have the
means, without purchase of additional equipment, thereby
making it not subject to the FOIA?
RESPONSE
The FOIA requires custodians to disclose nonexempt "public records" in response
to requests for them. A public record is, among other things, (1) a writing or
electronic information, (2) that is "required by law to be kept or otherwise kept,"
(3) that "constitute[s] the performance or lack of performance of official
functions." Given this definition, it is my opinion that emails stored on a disaster
recovery system (DRS) are not considered "public records" because they are likely
not "kept," as the FOIA uses the term. But even if we assume that DRS data is
"kept" (and that it otherwise qualifies as a public record), it is my opinion that the
FOIA does not require its disclosure because, as explained below, DRS data is not
"readily convertible." Accordingly, the answer to your second question is "no," in
my opinion, either because DRS data is not considered a public record, or
(alternatively), because it is not readily convertible. If a court were to employ the
former analysis (i.e. that DRS data is not a public record) then, in response to your
third question, the court would hold that A.C.A. § 25-19-109 does not apply
because the statute only address occasions when a public record is not "readily
available" or "readily convertible." But if the court employed the latter analysis
(i.e. that DRS data is a public record that is not readily convertible), then section
25-19-109's would apply.
DISCUSSION
I will address all three of your questions together.
The FOIA does not clearly address these questions, nor have they been addressed
by any Arkansas appellate court. There are also no previous Attorney General
Opinions addressing these questions. Nevertheless, there are several reasons to
think that an email being stored only on a disaster recovery system is probably not
required to be disclosed under the FOIA, either because (1) such data is not being
"kept" as the FOIA employs that term, which means that the data is not a public
record in the first instance; or (2) alternatively, though such data might be
considered "kept," the manner in which such data is stored renders it not readily
available/convertible, which means that section 25-19-105 does not require its
disclosure. In either case, it is my opinion that the FOIA does not require the
disclosure of data that is stored only on a disaster recovery system (DRS).
Under the FOIA, the term "public record" is a term of art. It refers to (1) "writings,
recorded sounds, films, tapes, electronic or computer-based information, or data
compilations in any medium" that are (2) "required by law to be kept or
otherwise kept" and (3) "that constitute a record of the performance or lack of
performance of official functions that are or should be carried out by" an entity
that is subject to the FOIA. The emails stored on a DRS clearly meet the first
element, and this opinion will assume that the emails meet the third element.
Thus, the threshold question for our purposes is whether the emails on a DRS are
considered "kept" for purposes of the FOIA.
The FOIA does not define what is meant by the term "otherwise kept," nor have
Arkansas appellate courts construed the term. But analogizing to paper records can
shed light on when electronic records are no longer kept. Thus, we can start
analyzing the term "otherwise kept" by establishing a spectrum on which to map
whether paper records are clearly kept. On one end of the spectrum, a paper
document is clearly kept when it is being actively used by someone or is sitting on
someone's desk and will be used soon. On the other end of the spectrum, it seems
clear that a paper document is not "otherwise kept" when it has been shredded.
Before analogizing to electronic records, it is important to note that when a paper
record has been shredded, it is possible, though not practicable, to reconstruct
the paper record. One could hire an expert with specialized equipment to
reconstruct the document. Yet such a process would likely be expensive and very
time consuming. Thus, even though it would be possible to reconstruct the
shredded paper document, it seems clear that a shredded document is not
"otherwise kept" for purposes of the FOIA.
Electronic records can be mapped on the same spectrum. On one end of the
spectrum, an electronic document is clearly kept when it is being actively used
(e.g. the employee is typing an email), or it is sitting on someone's electronic
desktop and will (or might) be used soon (e.g. a dispatched email being stored in
an employee's "sent" folder). When electronic data exists only on a DRS, that data
is analogous to the shredded paper document. This analogy holds for at least two
reasons. First, the data (like the shredded paper) still exists in some sense, though
only in a disaggregated, disorganized manner that is not designed for retrieving
individual documents. One federal court of appeals relied on just this point when it
refused to require a federal agency to search backup tapes to comply with an FOIA
request because such a search was "impossible, impractical, or futile" since the
files were "not organized for retrieval of individual documents or files, but rather
for purposes of disaster recovery." Second, and also like the shredded paper, it is
technically possible to retrieve the data and attempt to reassemble it. But, as your
background facts indicate, that process would probably be expensive, time
consuming, and would likely require outside expertise. Given the similarities
between shredded paper records and data on a DRS, it seems reasonable to
conclude that data on a DRS is not "kept" as that term is used in the FOIA.
In my opinion, however, there is an even stronger line of reasoning to support the
conclusion that the FOIA does not require DRS data to be disclosed. As explained
below but summarized here: (1) custodians must disclose public records in the
format requested if the requested data is readily convertible; (2) any request for
DRS data necessarily includes an implied request for the DRS data to be
converted; (3) given current technology, such data is seldom "readily" convertible;
(4) therefore, it follows (a) that the FOIA does not require the disclosure of DRS
data and (b) that requests for DRS data are best handled as special requests for
electronic information, which are governed by section 25-19-109.
The FOIA authorizes requesters to seek a copy of a public record "in any format to
which it is readily convertible with the custodian's existing software." The FOIA
defines "format" as "the organization, arrangement, and form of electronic
information for use, viewing, or storage." Thus, custodians are sometimes
required to convert an electronic record into the format the requester seeks. But
when such a conversation cannot be "readily" accomplished, the custodian is not
obligated to disclose the record. Instead, the FOIA request becomes governed by
section 25-19-109, which (among other things) allows custodians the discretion
whether to disclose such documents after agreeing with the requester on a fee.
In my opinion, and as your background facts show, any request for DRS data
necessarily includes an implied request to convert the DRS data from its existing
format into a format that renders individual files readable, searchable, and
disclosable. This would also apply when a requester sought an entire DRS backup
tape, as opposed to specific files on the tape. This is because, as noted above,
DRS data is not maintained or organized for the ready retrieval of individual
documents. Rather, DRS data, by its nature, is designed to be a complete system
restore in the event of a catastrophe. Accordingly, any request for DRS data
necessarily includes an implied request that the data be converted, thereby
enabling the custodian to read and retrieve individual files.
As your background facts show, it is technologically possible to convert DRS data
into a readable, searchable, and discloseable form. However, making such a
conversion requires specialized software and knowledge, and (potentially)
significant amounts of time and money. In my opinion, DRS data is seldom
"readily" convertible with a public custodian's existing software and equipment.
No Arkansas appellate court has construed the term "readily convertible," nor has
any previous Attorney General opinion. Nevertheless, the Electronic Records
Study Commission provided some helpful commentary explaining what they
meant when they suggested the "readily convertible" standard:
In many cases, it is relatively easy and cost-free to transfer an
electronic record from one medium to another or to convert it from
one common format to another. . . . This versatility can facilitate
access to public records and increase public convenience in their use.
However, agencies have limited resources and responding to FOIA
requests is typically not the responding authority's primary
mission. . . . In other words, the user convenience opportunities of
electronic records can only be taken so far without unduly imposing
upon agencies' time and manpower.
After noting these competing interests, i.e. that electronic records are, in some
senses, easier to disclose than paper records, while (in other senses) more
difficult, the Commission proposed a general principle to help balance the
interests:
Seeking to balance these competing considerations, the Commission
first developed Principle Eight, which states in pertinent part:
"Custodians should release electronic information in the form
requested when they are capable of doing so, with presently
available resources, without undue effort or expense, provided the
request reasonably describes the records."
While the Commission's principle is not positive law, I believe it (together with
the Commission's commentary) would be highly persuasive to an Arkansas court
that was directly addressing whether DRS data is subject to disclosure. In fact, at
least one Arkansas trial court has specifically held that DRS data is not subject to
disclosure, though the basis for that holding is not entirely clear. Your
background facts describe a process that clearly seems to entail "undue effort" and
"expense." Thus, certainly in your case, and probably in most cases, a court
would hold that DRS data is not "readily convertible."
Therefore, if a court were to follow this alternative line of reasoning, it would
conclude (a) that the FOIA does not require the disclosure of DRS data and (b)
that requests for DRS data are best handled as special requests for electronic
information, governed by section 25-19-109.
We can summarize all the foregoing reasoning into two categories, each leading to
the conclusion that DRS emails are not required to be disclosed: the FOIA does
not require the DRS data to be disclosed either (1) because such data is not kept,
or (2) alternatively, because such data is kept but not readily convertible.
With this reasoning in place, we can now turn directly to your questions. The first
question asks whether DRS data (specifically emails) are considered "kept" for
purposes of the FOIA. As explained above, the answer to this question is not
entirely clear, though it is my opinion that a court would probably consider the
information not "otherwise kept."
The second, and broader, question asks whether DRS emails are "subject to
release under the FOIA." If a court followed either of the two foregoing lines of
reasoning, then the answer to this question would be "no." Under the first line of
reasoning, the basis for that answer would be that the DRS emails are not
considered public records in the first place. Under the second line of reasoning, the
basis for that answer would be as follows: (1) custodians must disclose public
records in the format requested if the requested data is readily convertible; (2) any
request for DRS data necessarily includes an implied request for the DRS data to
be converted; (3) given current technology, such data is seldom "readily"
convertible. Therefore, it follows that the FOIA does not require the disclosure of
DRS data.
The third question is whether, given the nature of DRS data, its disclosure would
be governed by section 25-19-109. If a court took the first line of reasoning, then
the answer to this question would be "no." This is because section 25-19-109 only
applies to public records, and the first line of reasoning concludes that DRS data is
not a public record because it is not "kept." But if a court took the second line of
reasoning, then the answer to this question would be "yes."
Assistant Attorney General Ryan Owsley prepared this opinion, which I hereby
approve.
Sincerely,
Attorney General
LR/RO:cyh