If the only privacy issue left in an Arkansas state employee's personnel file is one Personnel Number on an Employee Master Data Form, does the agency still have to redact it before release?

Plain-English summary

Lisa A. Hill is an Arkansas Real Estate Commission employee. AREC received a FOIA request for her personnel file and proposed a redacted release. Hill, as the records subject, asked AG Leslie Rutledge to review whether the planned release was consistent with the Arkansas FOIA.

The AG concluded the release was generally proper. The only outstanding redaction needed was the "Personnel Number" on a single document entitled "Employee Master Data Form." Because that number provides access to computerized HR data, Ark. Code Ann. § 25-19-105(b)(11) categorically exempts it as a personal identification number used for computer security.

This opinion is the cleanest of the five companion AREC personnel-file opinions issued the same day (2018-059 through 2018-063). AREC's redaction work on Hill's file was nearly complete; only a single field needed attention before release.

Currency note

This opinion was issued in 2018. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

The Arkansas FOIA has been amended since 2018, and the precise list of exemptions in Ark. Code Ann. § 25-19-105 should be confirmed against the current statute before relying on any specific subsection cited here.

Common questions

Why does even a single Personnel Number have to come out?

Because Ark. Code Ann. § 25-19-105(b)(11) is a categorical exemption, not a balancing test. If a number functions as a personal identification number used for computer security, it is exempt regardless of how innocuous it might seem. The AG has been consistent on this in prior opinions cited within this cluster.

What does it mean that the rest of the release is "generally correct"?

It means AREC had already removed the items the AG would normally flag (SSN, home address, tax withholding, etc.) and the remaining file met the FOIA standard. The advisory opinion procedure in § 25-19-105(c)(3)(B)(i) gives every AREC employee whose file is requested an opportunity to have the redactions checked, even when the agency's first pass is already careful.

Why bother getting an AG opinion if there is only one redaction?

Because the AG opinion process gives the employee statutory protection: if the AG signs off, the agency can release in reliance on the opinion. It also protects the agency. AG opinions in Arkansas FOIA matters are persuasive but not binding, but in practice they resolve most disputes without litigation.

Is the Employee Master Data Form generally releasable?

Yes, as a personnel record under § 25-19-105(b)(12), subject to the Young v. Rice balancing test. The personnel number on it must be redacted, but the rest of the form (employment data going to job classification, dates of employment, etc.) is public.

Can the requester ever see the Personnel Number?

Not under FOIA. The exemption is categorical. The number is unlikely to be relevant to any legitimate public-records purpose anyway: it identifies the employee inside a state computer system, not outside.

Background and statutory framework

The framework applied here is the same one that runs through the rest of the May 15, 2018 AREC personnel-files cluster:

• Ark. Code Ann. § 25-19-105(b)(12) and the Young v. Rice balancing test for personnel records generally.
• Ark. Code Ann. § 25-19-105(b)(11) for the categorical exemption of personal identification numbers used for computer security.
• Ark. Code Ann. § 25-19-105(c)(3)(B)(i) for the AG advisory opinion procedure.

The narrow scope of this particular opinion reflects how surgical FOIA review can be when an agency has already done careful redaction work.

Citations

• Ark. Code Ann. § 25-19-105(b)(11) (personal identification numbers used for computer security)
• Ark. Code Ann. § 25-19-105(b)(12) (personnel records exemption)
• Ark. Code Ann. § 25-19-105(b)(13) (employee personal contact information)
• Ark. Code Ann. § 25-19-105(c)(1) (employee evaluation records exemption)
• Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (AG advisory opinion procedure)
• Ark. Code Ann. § 25-19-103(7)(A) (definition of "public records")
• Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992)
• Stilley v. McBride, 332 Ark. 306, 965 S.W.2d 125 (1998)
• Op. Att'y Gen. 2014-094; 2007-070 (Personnel Number redaction precedents)

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

STATE OF ARKANSAS
ATTORN EY GENERAL
LESLI E RUTLEDGE
Opinion No. 2018-063
May 15, 2018
Lisa A. Hill
Arkansas Real Estate Commission
612 South Summit Street
Little Rock, AR 72201
Dear Ms. Hill:
You have requested my opinion regarding the Arkansas Freedom of Information Act ("FOIA"). Your request is based on Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (Supp. 2017). This subsection authorizes the custodian, requester, or the subject of personnel or employee evaluation records to seek an opinion from this office stating whether the custodian's decision regarding the release of such records is consistent with the FOIA. Your correspondence indicates that the Arkansas Real Estate Commission (AREC) has received a request under the FOIA for your personnel file. You have attached a copy of redacted records that AREC intends to release in response to the FOIA request, and you ask whether the decision to release the records is consistent with the FOIA. 1 RESPONSE My statutory duty is to state whether the custodian's decision is consistent with the FOIA. In my opinion, the decision to disclose the records at issue is generally correct, but a further redaction is necessary in order for the release of the records 1 Although you have not voiced any paiticular objection, I gather you object to the records' release. And I take it that your objection is not based on the propriety or impropriety of the redactions that have been made. I have therefore focused my review on determining whether any further redactions, or the withholding of any records in their entirety, are necessary. 323 CENTER STREET. SUITE 200 · LI TTLE ROCK, ARKANSAS 72201 TELEPHONE (501) 682-2007 · FAX (501) 682-8084 ARKANSASAG.GOV Lisa A. Hill Opinion No. 2018-063 Page 2 to be consistent with the FOIA. I will set out the relevant definitions and standards, and I will then identify the additional redaction that is necessary. DISCUSSION I. General standards governing disclosure. A document must be disclosed in response to a FOIA request if all three of the following elements are met. First, the FOIA request must be directed to an entity subject to the act. Second, the requested document must constitute a public record. Third, no exceptions allow the document to be withheld. The first two elements are clearly met. The request was made to the AREC, which is a public entity, subject to the FOIA. And the requested documents plainly meet the FOIA's definition of "public records," i.e., "writings, recorded sounds, films, tapes, electronic or computer-based information, or data compilations in any medium, required by law to be kept or otherwise kept, and which constitute a record of the performance or lack of performance of official functions ... carried out by a public official or employee .... 2 Therefore, in my opinion, the documents at issue are public records and must be disclosed unless some specific exception provides otherwise. II. Exceptions to disclosure. Under certain conditions, the FOIA exempts two groups of items normally found in employees' personnel files.3 For purposes of the FOIA, these items can usually be divided into two mutually exclusive groups: "personnel records"4 or "employee 2 Ark. Code Ann.§ 25-19-103(7)A) (Supp. 2017). 3 This office and the leading commentators on the FOIA have observed that personnel files usually include: employment applications; school transcripts; payroll-related documents such as information about reclassifications, promotions, or demotions; transfer records; health and life insurance forms; performance evaluations; recommendation letters; disciplinary-action records; requests for leave-without-pay; certificates of advanced training or education; and legal documents such as subpoenas. E.g. Op. Att'y Gen. 97-368; John J. Watkins, Richard J. Peltz- Steele & Robert Steinbuch, THE ARKANSAS FREEDOM OF INFORMATION ACT 205-06 (Arkansas Law Press, 6th ed., 2017). 4 Ark. Code Ann.§ 25-19-105(b)(12): "It is the specific intent of this section that the following shall not be deemed to be made open to the public under the provisions of this chapter ...
[p]ersonnel records to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy." Lisa A. Hill Opinion No. 2018-063 Page 3 evaluation or job performance records."5 The test for whether these two types of documents may be released differs significantly. When custodians assess whether either of these exceptions applies to a particular record, they must make two determinations. First, they must determine whether the record meets the definition of either exception. Second, assuming the record does meet one of the definitions, the custodian must apply the appropriate test to determine whether the FOIA requires that record be disclosed. Personnel-records exception. In my opinion, the relevant potential exception in this case is the one for "personnel records." I will therefore limit my discussion to that exception. The FOIA does not define the term "personnel records," but this office has consistently opined that "personnel records" are all records other than employee evaluation and job performance records that pertain to individual employees.6 Whether a particular record meets this definition is, of course, a question of fact that can only be definitively determined by reviewing the record itself. If a document meets this definition, then it is open to public inspection and copying except "to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy."7 While the FOIA does not define the phrase "clearly unwarranted invasion of personal privacy," the Arkansas Supreme Court, in Young v. Rice,8 has provided some guidance. To determine whether the release of a personnel record would constitute a "clearly unwarranted invasion of personal privacy," the Court applies a balancing test that weighs the public's interest in accessing the records against the individual's interest in keeping them private. The balancing takes place with the scale tipped in favor of disclosure. 9 5 Ark. Code Ann. § 25-19-105( c )(1 ): "Notwithstanding subdivision (b )(12) of this section, all employee evaluation or job performance records, including preliminary notes and other materials, shall be open to public inspection only upon final administrative resolution of any suspension or termination proceeding at which the records form a basis for the decision to suspend or terminate the employee and if there is a compelling public interest in their disclosure." 6 See, e.g., Ops. Att'y Gen. 2015-072, 99-14 7; Watkins, et al., at 202. 7 Ark. Code Ann.§ 25-19-105(b)(12) (Supp. 2017). 8 308 Ark. 593, 826 S.W.2d 252 (1992). 9 Watkins, et al., at 208. Lisa A. Hill Opinion No. 2018-063 Page 4 The balancing test elaborated by Young v. Rice has two steps. First, the custodian must assess whether the information contained in the requested document is of a personal or intimate nature such that it gives rise to a greater than de minimis privacy interest. Jo If the privacy interest is merely de minimis, then the thumb on the scale favoring disclosure outweighs the privacy interest. Second, if the information does give rise to a greater than de minimis privacy interest, then the custodian must determine whether that interest is outweighed by the public's interest in disclosure. J 1 Because the exceptions must be narrowly construed, the person resisting disclosure bears the burden of showing that, under the circumstances, his privacy interests outweigh the public's interests. 12 The fact that the subject of any such records may consider release of the records an unwarranted invasion of personal privacy is irrelevant to the analysis because the test is objective.13 Whether any particular personnel record's release would constitute a clearly unwarranted invasion of personal privacy is always a question of fact.14 Even if a document, when considered as a whole, meets the test for disclosure, it may contain discrete pieces of information that have to be redacted. Some items that must be redacted include:

• Personal contact information of public employees, including personal telephone numbers, personal e-mail addresses, and home addresses (Ark. Code Ann.§ 25-19-105(b)(13));
• Employee personnel number (Ops. Att'y Gen. 2014-094; 2007-070);
• Marital status of employees and information about dependents (Op. Att'y Gen. 2001-080);
• Dates of birth of public employees (Op. Att'y Gen. 2007-064); 10 Young, 308 Ark. at 598, 826 S.W.2d at 255. 11 Id., 826 S.W.2d at 255. 12 Stilley v. McBride, 332 Ark. 306, 313, 965 S.W.2d 125, 128 (1998). 13 E.g., Ops. Att'y Gen. 2016-055, 2001-112, 2001-022, 94-198; Watkins, et al., at 207. 14 Ops. Att'y Gen. 2006-176, 2004-260, 2003-336, 98-001. Lisa A. Hill Opinion No. 2018-063 Page 5
• Social security numbers (Ops. Att'y Gen. 2006-035, 2003-153);
• Medical information (Op. Att'y Gen. 2003-153);
• Any information identifying certain law enforcement officers currently working undercover (Ark. Code Ann.§ 25-19-105(b)(10));
• Driver's license numbers (Op. Att'y Gen. 2007-025);
• Insurance coverage (Op. Att'y Gen. 2004-167);
• Tax information or withholding (Ops. Att'y Gen. 2005-194, 2003-385);
• Payroll deductions (Op. Att'y Gen. 98-126); and
• Banking information (Op. Att'y Gen. 2005-194).
  III. Application.
  Having reviewed the records, it is my opinion that they are all properly classified as personnel records. Additionally, the public interest in disclosure is sufficiently strong to warrant the records' disclosure under the above standard applicable to personnel records. Therefore, in my opinion, the records must be released. In my opinion, however, the following additional information must be redacted in order for the release of the records to be consistent with the FOIA:
  • The document entitled "Employee Master Data Form" includes a "Personnel Number." This number presumably provides access to computerized data. It must therefore be redacted because records containing "personal identification numbers" used for computer security functions are specifically exempt from disclosure under the FOIA. 15 In conclusion, the custodian's decision to disclose the records at issue is generally correct. But a further redaction must be made in order for the release of the records to be consistent with the FOIA. Sincerely,
  ~~_,,.//a7
  LESLIE RUTLEDGE
  Attorney General
  15 Ark. Code Ann.§ 25-19-lOS(b)(l l).