If the only privacy issue left in an Arkansas state employee's personnel file is one Personnel Number on an Employee Master Data Form, does the agency still have to redact it before release?

Plain-English summary

Lisa A. Hill is an Arkansas Real Estate Commission employee. AREC received a FOIA request for her personnel file and proposed a redacted release. Hill, as the records subject, asked AG Leslie Rutledge to review whether the planned release was consistent with the Arkansas FOIA.

The AG concluded the release was generally proper. The only outstanding redaction needed was the "Personnel Number" on a single document entitled "Employee Master Data Form." Because that number provides access to computerized HR data, Ark. Code Ann. § 25-19-105(b)(11) categorically exempts it as a personal identification number used for computer security.

This opinion is the cleanest of the five companion AREC personnel-file opinions issued the same day (2018-059 through 2018-063). AREC's redaction work on Hill's file was nearly complete; only a single field needed attention before release.

Currency note

This opinion was issued in 2018. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

The Arkansas FOIA has been amended since 2018, and the precise list of exemptions in Ark. Code Ann. § 25-19-105 should be confirmed against the current statute before relying on any specific subsection cited here.

Common questions

Why does even a single Personnel Number have to come out?

Because Ark. Code Ann. § 25-19-105(b)(11) is a categorical exemption, not a balancing test. If a number functions as a personal identification number used for computer security, it is exempt regardless of how innocuous it might seem. The AG has been consistent on this in prior opinions cited within this cluster.

What does it mean that the rest of the release is "generally correct"?

It means AREC had already removed the items the AG would normally flag (SSN, home address, tax withholding, etc.) and the remaining file met the FOIA standard. The advisory opinion procedure in § 25-19-105(c)(3)(B)(i) gives every AREC employee whose file is requested an opportunity to have the redactions checked, even when the agency's first pass is already careful.

Why bother getting an AG opinion if there is only one redaction?

Because the AG opinion process gives the employee statutory protection: if the AG signs off, the agency can release in reliance on the opinion. It also protects the agency. AG opinions in Arkansas FOIA matters are persuasive but not binding, but in practice they resolve most disputes without litigation.

Is the Employee Master Data Form generally releasable?

Yes, as a personnel record under § 25-19-105(b)(12), subject to the Young v. Rice balancing test. The personnel number on it must be redacted, but the rest of the form (employment data going to job classification, dates of employment, etc.) is public.

Can the requester ever see the Personnel Number?

Not under FOIA. The exemption is categorical. The number is unlikely to be relevant to any legitimate public-records purpose anyway: it identifies the employee inside a state computer system, not outside.

Background and statutory framework

The framework applied here is the same one that runs through the rest of the May 15, 2018 AREC personnel-files cluster:

• Ark. Code Ann. § 25-19-105(b)(12) and the Young v. Rice balancing test for personnel records generally.
• Ark. Code Ann. § 25-19-105(b)(11) for the categorical exemption of personal identification numbers used for computer security.
• Ark. Code Ann. § 25-19-105(c)(3)(B)(i) for the AG advisory opinion procedure.

The narrow scope of this particular opinion reflects how surgical FOIA review can be when an agency has already done careful redaction work.

Citations

• Ark. Code Ann. § 25-19-105(b)(11) (personal identification numbers used for computer security)
• Ark. Code Ann. § 25-19-105(b)(12) (personnel records exemption)
• Ark. Code Ann. § 25-19-105(b)(13) (employee personal contact information)
• Ark. Code Ann. § 25-19-105(c)(1) (employee evaluation records exemption)
• Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (AG advisory opinion procedure)
• Ark. Code Ann. § 25-19-103(7)(A) (definition of "public records")
• Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992)
• Stilley v. McBride, 332 Ark. 306, 965 S.W.2d 125 (1998)
• Op. Att'y Gen. 2014-094; 2007-070 (Personnel Number redaction precedents)

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

STATE OF ARKANSAS
ATTORN EY GENERAL
LESLI E RUTLEDGE
Opinion No. 2018-063
May 15, 2018
Lisa A. Hill
Arkansas Real Estate Commission
612 South Summit Street
Little Rock, AR 72201
Dear Ms. Hill:
You have requested my opinion regarding the Arkansas Freedom of Information
Act ("FOIA"). Your request is based on Ark. Code Ann. § 25-19-105(c)(3)(B)(i)
(Supp. 2017). This subsection authorizes the custodian, requester, or the subject
of personnel or employee evaluation records to seek an opinion from this office
stating whether the custodian's decision regarding the release of such records is
consistent with the FOIA.
Your correspondence indicates that the Arkansas Real Estate Commission
(AREC) has received a request under the FOIA for your personnel file. You have
attached a copy of redacted records that AREC intends to release in response to
the FOIA request, and you ask whether the decision to release the records is
consistent with the FOIA. 1
RESPONSE
My statutory duty is to state whether the custodian's decision is consistent with the
FOIA. In my opinion, the decision to disclose the records at issue is generally
correct, but a further redaction is necessary in order for the release of the records
1 Although you have not voiced any paiticular objection, I gather you object to the records'
release. And I take it that your objection is not based on the propriety or impropriety of the
redactions that have been made. I have therefore focused my review on determining whether any
further redactions, or the withholding of any records in their entirety, are necessary.
323 CENTER STREET. SUITE 200 · LI TTLE ROCK, ARKANSAS 72201
TELEPHONE (501) 682-2007 · FAX (501) 682-8084
ARKANSASAG.GOV Lisa A. Hill
Opinion No. 2018-063
Page 2
to be consistent with the FOIA. I will set out the relevant definitions and
standards, and I will then identify the additional redaction that is necessary.
DISCUSSION
I. General standards governing disclosure.
A document must be disclosed in response to a FOIA request if all three of the
following elements are met. First, the FOIA request must be directed to an entity
subject to the act. Second, the requested document must constitute a public
record. Third, no exceptions allow the document to be withheld.
The first two elements are clearly met. The request was made to the AREC, which
is a public entity, subject to the FOIA. And the requested documents plainly meet
the FOIA's definition of "public records," i.e., "writings, recorded sounds, films,
tapes, electronic or computer-based information, or data compilations in any
medium, required by law to be kept or otherwise kept, and which constitute a
record of the performance or lack of performance of official functions ... carried
out by a public official or employee .... 2
Therefore, in my opinion, the documents at issue are public records and must be
disclosed unless some specific exception provides otherwise.
II. Exceptions to disclosure.
Under certain conditions, the FOIA exempts two groups of items normally found
in employees' personnel files.3 For purposes of the FOIA, these items can usually
be divided into two mutually exclusive groups: "personnel records"4 or "employee
2 Ark. Code Ann.§ 25-19-103(7)A) (Supp. 2017).
3 This office and the leading commentators on the FOIA have observed that personnel files
usually include: employment applications; school transcripts; payroll-related documents such as
information about reclassifications, promotions, or demotions; transfer records; health and life
insurance forms; performance evaluations; recommendation letters; disciplinary-action records;
requests for leave-without-pay; certificates of advanced training or education; and legal
documents such as subpoenas. E.g. Op. Att'y Gen. 97-368; John J. Watkins, Richard J. Peltz-
Steele & Robert Steinbuch, THE ARKANSAS FREEDOM OF INFORMATION ACT 205-06 (Arkansas
Law Press, 6th ed., 2017).
4 Ark. Code Ann.§ 25-19-105(b)(12): "It is the specific intent of this section that the following
shall not be deemed to be made open to the public under the provisions of this chapter ...
[p]ersonnel records to the extent that disclosure would constitute a clearly unwarranted invasion
of personal privacy." Lisa A. Hill
Opinion No. 2018-063
Page 3
evaluation or job performance records."5 The test for whether these two types of
documents may be released differs significantly.
When custodians assess whether either of these exceptions applies to a particular
record, they must make two determinations. First, they must determine whether
the record meets the definition of either exception. Second, assuming the record
does meet one of the definitions, the custodian must apply the appropriate test to
determine whether the FOIA requires that record be disclosed.
Personnel-records exception.
In my opinion, the relevant potential exception in this case is the one for
"personnel records." I will therefore limit my discussion to that exception. The
FOIA does not define the term "personnel records," but this office has consistently
opined that "personnel records" are all records other than employee evaluation and
job performance records that pertain to individual employees.6 Whether a
particular record meets this definition is, of course, a question of fact that can only
be definitively determined by reviewing the record itself. If a document meets this
definition, then it is open to public inspection and copying except "to the extent
that disclosure would constitute a clearly unwarranted invasion of personal
privacy."7
While the FOIA does not define the phrase "clearly unwarranted invasion of
personal privacy," the Arkansas Supreme Court, in Young v. Rice,8 has provided
some guidance. To determine whether the release of a personnel record would
constitute a "clearly unwarranted invasion of personal privacy," the Court applies
a balancing test that weighs the public's interest in accessing the records against
the individual's interest in keeping them private. The balancing takes place with
the scale tipped in favor of disclosure. 9
5 Ark. Code Ann. § 25-19-105( c )(1 ): "Notwithstanding subdivision (b )(12) of this section, all
employee evaluation or job performance records, including preliminary notes and other materials,
shall be open to public inspection only upon final administrative resolution of any suspension or
termination proceeding at which the records form a basis for the decision to suspend or terminate
the employee and if there is a compelling public interest in their disclosure."
6 See, e.g., Ops. Att'y Gen. 2015-072, 99-14 7; Watkins, et al., at 202.
7 Ark. Code Ann.§ 25-19-105(b)(12) (Supp. 2017).
8 308 Ark. 593, 826 S.W.2d 252 (1992).
9 Watkins, et al., at 208. Lisa A. Hill
Opinion No. 2018-063
Page 4
The balancing test elaborated by Young v. Rice has two steps. First, the custodian
must assess whether the information contained in the requested document is of a
personal or intimate nature such that it gives rise to a greater than de minimis
privacy interest. Jo If the privacy interest is merely de minimis, then the thumb on
the scale favoring disclosure outweighs the privacy interest. Second, if the
information does give rise to a greater than de minimis privacy interest, then the
custodian must determine whether that interest is outweighed by the public's
interest in disclosure. J 1 Because the exceptions must be narrowly construed, the
person resisting disclosure bears the burden of showing that, under the
circumstances, his privacy interests outweigh the public's interests. 12 The fact that
the subject of any such records may consider release of the records an unwarranted
invasion of personal privacy is irrelevant to the analysis because the test is
objective.13
Whether any particular personnel record's release would constitute a clearly
unwarranted invasion of personal privacy is always a question of fact.14
Even if a document, when considered as a whole, meets the test for disclosure, it
may contain discrete pieces of information that have to be redacted. Some items
that must be redacted include:
• Personal contact information of public employees, including personal
telephone numbers, personal e-mail addresses, and home addresses (Ark.
Code Ann.§ 25-19-105(b)(13));
• Employee personnel number (Ops. Att'y Gen. 2014-094; 2007-070);
• Marital status of employees and information about dependents (Op. Att'y
Gen. 2001-080);
• Dates of birth of public employees (Op. Att'y Gen. 2007-064);
10 Young, 308 Ark. at 598, 826 S.W.2d at 255.
11 Id., 826 S.W.2d at 255.
12 Stilley v. McBride, 332 Ark. 306, 313, 965 S.W.2d 125, 128 (1998).
13 E.g., Ops. Att'y Gen. 2016-055, 2001-112, 2001-022, 94-198; Watkins, et al., at 207.
14 Ops. Att'y Gen. 2006-176, 2004-260, 2003-336, 98-001. Lisa A. Hill
Opinion No. 2018-063
Page 5
• Social security numbers (Ops. Att'y Gen. 2006-035, 2003-153);
• Medical information (Op. Att'y Gen. 2003-153);
• Any information identifying certain law enforcement officers currently
working undercover (Ark. Code Ann.§ 25-19-105(b)(10));
• Driver's license numbers (Op. Att'y Gen. 2007-025);
• Insurance coverage (Op. Att'y Gen. 2004-167);
• Tax information or withholding (Ops. Att'y Gen. 2005-194, 2003-385);
• Payroll deductions (Op. Att'y Gen. 98-126); and
• Banking information (Op. Att'y Gen. 2005-194).
III. Application.
Having reviewed the records, it is my opinion that they are all properly classified
as personnel records. Additionally, the public interest in disclosure is sufficiently
strong to warrant the records' disclosure under the above standard applicable to
personnel records. Therefore, in my opinion, the records must be released.
In my opinion, however, the following additional information must be redacted in
order for the release of the records to be consistent with the FOIA:
• The document entitled "Employee Master Data Form" includes a
"Personnel Number." This number presumably provides access to
computerized data. It must therefore be redacted because records
containing "personal identification numbers" used for computer security
functions are specifically exempt from disclosure under the FOIA. 15
In conclusion, the custodian's decision to disclose the records at issue is generally
correct. But a further redaction must be made in order for the release of the
records to be consistent with the FOIA.
Sincerely,
~~_,,.//a7
LESLIE RUTLEDGE
Attorney General
15 Ark. Code Ann.§ 25-19-lOS(b)(l l).