Can an Arkansas state agency release a current employee's personnel file under FOIA, and what has to be redacted before it goes out?

Plain-English summary

The Arkansas Real Estate Commission received a FOIA request for the personnel file of one of its employees, D. Kortney Hinton. Under Ark. Code Ann. § 25-19-105(c)(3)(B)(i), the employee whose records are at issue can ask the AG whether the agency's planned release is consistent with the Arkansas Freedom of Information Act. AREC had already redacted some material and proposed to release the rest. Hinton wanted the AG to look at it.

AG Leslie Rutledge's answer was: yes, the records should generally be released, but two "Hiring Freeze Exception Request" forms still contained the employee's Personnel Number (referenced as "Personnel #" or "Per #"), and those numbers had to be redacted. Personal identification numbers used for computer security access are exempt from disclosure under Ark. Code Ann. § 25-19-105(b)(11).

This opinion is one of five issued the same day (2018-059 through 2018-063) involving substantially identical FOIA reviews of AREC personnel files for different employees. They are the textbook application of the Arkansas FOIA personnel-records balancing test, and useful as a checklist of what state agency HR offices have to scrub before release.

Currency note

This opinion was issued in 2018. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

The Arkansas FOIA's text and structure remain broadly similar, but the section numbering and specific exemptions in Ark. Code Ann. § 25-19-105 have been amended several times since 2018. Anyone running a current FOIA personnel-records review should pull the present version of the statute, recent appellate decisions, and current AG opinions, not rely solely on this one.

Common questions

Are personnel files of public employees normally disclosable in Arkansas?

Yes, with caveats. Arkansas FOIA treats personnel records as public records. They must be released unless disclosure would be a "clearly unwarranted invasion of personal privacy" under Ark. Code Ann. § 25-19-105(b)(12). The Arkansas Supreme Court's Young v. Rice test puts the thumb of the scale in favor of disclosure: only if a record would expose information that genuinely is private and the privacy interest outweighs the public's, can it be withheld.

What is the difference between a "personnel record" and an "employee evaluation record"?

Different exemptions apply. Personnel records get the Young v. Rice balancing test. Employee evaluation or job performance records (Ark. Code Ann. § 25-19-105(c)(1)) are tightly closed: they are released only if there has been a final administrative resolution of a suspension or termination proceeding in which they formed the basis for the decision, and there is a compelling public interest in disclosure. The two categories are mutually exclusive, so misclassifying a document changes the answer.

Why does the AG say Personnel Numbers have to come out?

Because the AG treats the internal employee identification number as a "personal identification number" under Ark. Code Ann. § 25-19-105(b)(11). Internal numbers used for computer security access (logging into HR systems, payroll, etc.) are categorically exempt. The reasoning is the same as protecting an internal user ID: disclosure could help an outsider impersonate the employee in a state computer system.

What other items typically have to be redacted from a state employee's personnel file?

The opinion lists the standard catalog: home addresses, personal phone numbers, personal email addresses, employee personnel numbers, marital status and dependents, dates of birth, Social Security numbers, medical information, undercover law enforcement identifiers, driver's license numbers, insurance coverage, tax withholding, payroll deductions, and banking information. Salary itself is generally disclosable.

Can the employee block release if they object?

No. The opinion says the test is objective: the fact that the employee considers the release an unwarranted invasion of privacy is irrelevant. The privacy interest is measured against the public's interest in access using the Young v. Rice framework, not by the employee's subjective view.

Background and statutory framework

The Arkansas FOIA, Ark. Code Ann. § 25-19-101 et seq., is the primary state public-records law. For personnel records, three statutory pieces are usually in play:

• Ark. Code Ann. § 25-19-105(b)(12): personnel-records exemption with the "clearly unwarranted invasion" test.
• Ark. Code Ann. § 25-19-105(c)(1): the much narrower employee evaluation/job-performance records exemption.
• Ark. Code Ann. § 25-19-105(c)(3)(B)(i): the procedure that lets the employee, requester, or custodian get an AG advisory opinion before release.

The case law backbone is Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992) (the two-step balancing test) and Stilley v. McBride, 332 Ark. 306, 965 S.W.2d 125 (1998) (placing the burden of proving privacy outweighs public interest on the person resisting disclosure).

Citations

• Ark. Code Ann. § 25-19-105(b)(10) (undercover law enforcement)
• Ark. Code Ann. § 25-19-105(b)(11) (personal identification numbers used for computer security)
• Ark. Code Ann. § 25-19-105(b)(12) (personnel records)
• Ark. Code Ann. § 25-19-105(b)(13) (employee personal contact information)
• Ark. Code Ann. § 25-19-105(c)(1) (employee evaluation records)
• Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (AG advisory opinion procedure)
• Ark. Code Ann. § 25-19-103(7)(A) (definition of "public records")
• Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992)
• Stilley v. McBride, 332 Ark. 306, 965 S.W.2d 125 (1998)
• Op. Att'y Gen. 2014-094; Op. Att'y Gen. 2007-070 (employee personnel number redaction)
• Op. Att'y Gen. 2007-064 (date of birth redaction)
• Op. Att'y Gen. 2003-153; Op. Att'y Gen. 2006-035 (Social Security number redaction)

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

Opinion No. 2018-059
May 15, 2018
D. Kortney Hinton
STATE OF ARKANSAS
ATTORN EY GENERAL
LESLIE RUTLEDGE
Arkansas Real Estate Commission
612 South Summit Street
Little Rock, AR 72201-4740
Dear Ms. Hinton:
You have requested my opinion regarding the Arkansas Freedom of Information Act ("FOIA"). Your request is based on Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (Supp. 2017). This subsection authorizes the custodian, requester, or the subject of personnel or employee-evaluation records to seek an opinion from this office stating whether the custodian's decision regarding the release of such records is consistent with the FOIA. Your correspondence indicates that the Arkansas Real Estate Commission (AREC) has received a request under the FOIA for your personnel files. You have attached a copy of redacted records that AREC intends to release in response to the FOIA request, and you ask whether the decision to release the records is consistent with the FOIA.1 RESPONSE My statutory duty is to state whether the custodian's decision is consistent with the FOIA. In my opinion, the decision to disclose the records at issue is generally correct, but some further redactions are necessary in order for the release of the 1 Although you have not voiced any pa1ticular objection, I gather you object to the records' release. And I take it that your objection is not based on the propriety or impropriety of the redactions that have been made. I have therefore focused my review on determining whether any further redactions, or the withholding of any records in their entirety, are necessary. 323 CENTER STREET. SU ITE 200 · LITTLE ROCK. ARKANSAS 72201 TELEPHONE (501) 682-2007 · FAX (501) 682-8084 ARKANSASAG.GOV D. Kortney Hinton Opinion No. 2018-059 Page 2 records to be consistent with the FOIA. I will set out the definitions and standards, and I will then identify the additional redactions that are necessary. DISCUSSION I. General standards governing disclosure. A document must be disclosed in response to a FOIA request if all three of the following elements are met. First, the FOIA request must be directed to an entity subject to the act. Second, the requested document must constitute a public record. Third, no exceptions allow the document to be withheld. The first two elements are clearly met. The request was made to the AREC, which is a public entity, subject to the FOIA. And the requested documents plainly meet the FOIA's definition of "public records," i.e., "writings, recorded sounds, films, tapes, electronic or computer-based information, or data compilations in any medium, required by law to be kept or otherwise kept, and which constitute a record of the performance or lack of performance of official functions ... carried out by a public official or employee .... 2 Therefore, the documents at issue are public records and must be disclosed unless some specific exception provides otherwise. II. Exceptions to disclosure. Under certain conditions, the FOIA exempts two groups of items normally found in employees' personnel files.3 For purposes of the FOIA, these items can usually be divided into two mutually exclusive groups: "personnel records"4 or "employee 2 Ark. Code Ann. § 25-19-103(7)(A) (Supp. 2017). 3 This office and the leading commentators on the FOIA have observed that personnel files usually include: employment applications; school transcripts; payroll-related documents such as information about reclassifications, promotions, or demotions; transfer records; health and life insurance forms; performance evaluations; recommendation letters; disciplinary-action records; requests for leave-without-pay; certificates of advanced training or education; and legal documents such as subpoenas. E.g. Op. Att'y Gen. 97-368; John J. Watkins, Richard J. Peltz- Steele & Robert Steinbuch, THE ARKANSAS FREEDOM OF INFORMATION ACT 205-06 (Arkansas Law Press, 6th ed., 2017). 4 Ark. Code Ann.§ 25-19-105(b)(l2): "It is the specific intent of this section that the following shall not be deemed to be made open to the public under the provisions of this chapter ...
[p ]ersonnel records to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy." D. Kortney Hinton Opinion No. 2018-059 Page 3 evaluation or job performance records."5 The test for whether these two types of documents may be released differs significantly. When custodians assess whether either of these exceptions applies to a particular record, they must make two determinations. First, they must determine whether the record meets the definition of either exception. Second, assuming the record does meet one of the definitions, the custodian must apply the appropriate test to determine whether the FOIA requires that record be disclosed. Personnel-records exception. In my opinion, the relevant potential exception in this case is the one for "personnel records." The FOIA does not define the term "personnel records," but this office has consistently opined that it includes all records other than employee- evaluation and job-performance records that pertain to individual employees.6 Whether a particular record meets this definition is, of course, a question of fact that can only be definitively determined by reviewing the record itself. If a document meets this definition, then it is open to public inspection and copying except "to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy ."7 While the FOIA does not define the phrase "clearly unwarranted invasion of personal privacy," the Arkansas Supreme Court, in Young v. Rice,8 has provided some guidance. To determine whether the release of a personnel record would constitute a "clearly unwarranted invasion of personal privacy," the Court applies a balancing test that weighs the public's interest in accessing the records against the individual's interest in keeping them private. The balancing takes place with the scale tipped in favor of disclosure. 9 5 Ark. Code Ann. § 25-19-105(c)(l): "Notwithstanding subdivision (b)(12) of this section, all employee evaluation or job performance records, including preliminary notes and other materials, shall be open to public inspection only upon final administrative resolution of any suspension or termination proceeding at which the records form a basis for the decision to suspend or terminate the employee and if there is a compelling public interest in their disclosure." 6 See, e.g., Ops. Att'y Gen. 2015-072, 99-147; Watkins, et al., at 202. 7 Ark. Code Ann. § 25-19-105(b )( 12). 8 308 Ark. 593, 826 S.W.2d 252 (1992) 9 Watkins, et al., at 208. D. Kortney Hinton Opinion No. 2018-059 Page4 The balancing test elaborated by Young v. Rice has two steps. First, the custodian must assess whether the information contained in the requested document is of a personal or intimate nature such that it gives rise to a greater than de minimis privacy interest. 10 If the privacy interest is merely de minimis, then the thumb on the scale favoring disclosure outweighs the privacy interest. Second, if the information does give rise to a greater than de minimis privacy interest, then the custodian must determine whether that interest is outweighed by the public's interest in disclosure. 11 Because the exceptions must be narrowly construed, the person resisting disclosure bears the burden of showing that, under the circumstances, his privacy interests outweigh the public's interests. 12 The fact that the subject of any such records may consider release of the records an unwarranted invasion of personal privacy is irrelevant to the analysis because the test is objective. 13 Whether any particular personnel record's release would constitute a clearly unwarranted invasion of personal privacy is always a question of fact. 14 Even if a document, when considered as a whole, meets the test for disclosure, it may contain discrete pieces of information that have to be redacted. Some items that must be redacted include:

• Personal contact information of public employees, including personal telephone numbers, personal e-mail addresses, and home addresses (Ark. Code Ann.§ 25-19-105(b)(13));
• Employee personnel number (Ops. Att'y Gen. 2014-094; 2007-070);
• Marital status of employees and information about dependents (Op. Att'y Gen. 2001-080);
• Dates of birth of public employees (Op. Att'y Gen. 2007-064);
• Social security numbers (Ops. Att'y Gen. 2006-035, 2003-153);
• Medical information (Op. Att'y Gen. 2003-153);
  10 Young, 308 Ark. at 598, 826 S.W.2d at 255.
  11 Id., 826 S.W.2d at 255.
  12 Stilley v. McBride, 332 Ark. 306, 313, 965 S.W.2d 125, 128 (1998). 13 E.g., Ops. Att'y Gen. 2016-055, 2001-112, 2001-022, 94-198; Watkins, et al., at 207. 14 Ops. Att'y Gen. 2006-176, 2004-260, 2003-336, 98-001. D. Kortney Hinton Opinion No. 2018-059 Page 5
• Any information identifying certain law enforcement officers currently working undercover (Ark. Code Ann.§ 25-19-105(b)(10));
• Driver's license numbers (Op. Att'y Gen. 2007-025);
• Insurance coverage (Op. Att'y Gen. 2004-167);
• Tax information or withholding (Ops. Att'y Gen. 2005-194, 2003-385);
• Payroll deductions (Op. Att'y Gen. 98-126); and
• Banking information (Op. Att'y Gen. 2005-194).
  III. Application.
  Having reviewed the records, it is my opinion that they are all properly classified as personnel records. Additionally, the public interest in disclosure is sufficiently strong to warrant the records' disclosure under the above standard applicable to personnel records. Therefore, in my opinion, the records must be released. In my opinion, however, the following additional information must be redacted in order for the release of the records to be consistent with the FOIA:
  • Two documents, each entitled "Hiring Freeze Exception Request," include personnel numbers (one references "Personnel #" and the other references "Per #"). These numbers presumably provides access to computerized data. They must therefore be redacted because records containing "personal identification numbers" used for computer security functions are specifically exempt from disclosure under the FOIA.15 In conclusion, the custodian's decision to disclose the records at issue is generally correct. But some further redactions must be made in order for the release of the records to be consistent with the FOIA. Sincerely,
  ~~~- L /./~7
  LESLIE RUTLEDGE
  Attorney General
  15 Ark. Code Ann. § 25-19-105(b )(11 ).