AR Opinion No. 2019-0062 October 11, 2019

When my application is FOIA-released, do they need to redact my ZIP code and any unexplained number next to my name?

Short answer: Yes. The AG flagged two missed redactions: the ZIP code (a component of 'home address' under § 25-19-105(b)(13)) and any unexplained number that may be the personnel number (exempt as a computer-security identifier under § 25-19-105(b)(11)).

Apply this to your situation

This page answers the general question as of 2019. Ezel answers yours: what it means for your facts, under current Arkansas law, with citations.

Currency note: this opinion is from 2019
Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.
Disclaimer: This is an official Arkansas Attorney General opinion. AG opinions are persuasive authority but not binding precedent. This summary is for informational purposes only and is not legal advice. Consult a licensed Arkansas attorney for advice on your specific situation.
About this page: The plain-English summary, reader guidance, and Q&A below were written by Ezel based on the official AG opinion. The original opinion (linked on this page) is the authoritative source for any reliance.

Plain-English summary

Lana Fraser, an investigator at the Pulaski County Public Defender's Office, asked the AG to review the custodian's planned release of her job application and resume in response to a FOIA request. The custodian had already redacted some personal information; Fraser objected to the release on privacy grounds.

The AG mostly upheld the release but flagged two redactions the custodian had missed:

  1. ZIP code on the home address. On the first page of the application and the front of the resume, Fraser's home-address ZIP code was unredacted. The AG had long held that "home addresses" under Ark. Code Ann. § 25-19-105(b)(13) (the personal-contact-info exemption) "encompasses all of the component parts of a home address: a street address, city, county, and ZIP Code." So the ZIP code had to come out, just like the rest of the address.

  2. Unexplained number next to her name on each record. The AG observed an unidentified number next to Fraser's name at the bottom of each record. If that was her personnel number (or another personal-identification number used for computer-security functions), it had to be redacted under § 25-19-105(b)(11), which specifically exempts "personal identification numbers" used for those purposes. The custodian had to verify what the number was and redact accordingly.

On the substantive privacy claim, the AG said the same thing as in the parallel Christen Carter opinion (2019-065): job applications are personnel records that are presumptively disclosable, and a general "I object to my privacy being invaded" claim does not flip the Young v. Rice balancing test. Specific items get redacted; the rest comes out.

Currency note

This opinion was issued in 2019. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Why does a ZIP code count as part of the home address?
A: Because § 25-19-105(b)(13) protects the address as a privacy-sensitive piece of contact information. A ZIP code, combined with other identifiers, can pinpoint a residence. The AG's reading (Op. Att'y Gen. 2019-004, 2011-114, 2008-138) treats all components of a home address as exempt.

Q: What if my city is small and my ZIP is the only ZIP in town?
A: Then the ZIP code redaction is doubly important. In a small ZIP, the combination of name + ZIP can effectively identify a household.

Q: How does the personnel number get treated?
A: § 25-19-105(b)(11) exempts "personal identification numbers" used for computer-security functions. The AG (Op. Att'y Gen. 2018-064) had explained that personnel numbers function as authentication identifiers in payroll and HR systems, so they fit (b)(11). Even if the number on Fraser's records turned out to be something else (a temporary tracking number, an applicant ID), the custodian had to figure out what it was and apply the right rule.

Q: Are there other commonly missed redactions in employment files?
A: Driver's license numbers, banking info on direct-deposit forms, beneficiary names on retirement enrollment forms (which can include marital/dependent info under § 25-19-105(b)(13) and (b)(12)), insurance plan choices, and personnel ID numbers wherever they appear. The standard list is long.

Q: Can the custodian fix missed redactions before releasing?
A: Yes. The AG's review function exists exactly to catch issues like this. The custodian was expected to redact the ZIP and personnel number before actually releasing the records.

Background and statutory framework

The standard FOIA personnel-records analysis applies (Ark. Code Ann. § 25-19-105(b)(12), with Young v. Rice balancing). The two missed redactions trigger specific statutory exemptions:

  • § 25-19-105(b)(13): "home addresses" of public employees, interpreted to include all components (street, city, county, ZIP).
  • § 25-19-105(b)(11): "personal identification numbers" used for computer-security functions, including personnel numbers.

The "burden on the resister" rule from Stilley v. McBride, 332 Ark. 306 (1998), means the subject's privacy claim has to be specific. A general objection does not unlock the records.

Citations

  • Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (AG review)
  • Ark. Code Ann. § 25-19-103(7)(A) (public records definition)
  • Ark. Code Ann. § 25-19-105(b)(10) (undercover officers)
  • Ark. Code Ann. § 25-19-105(b)(11) (personal-identification numbers / computer security)
  • Ark. Code Ann. § 25-19-105(b)(12) (personnel records exemption)
  • Ark. Code Ann. § 25-19-105(b)(13) (personal contact info)
  • Pulaski Cty. v. Ark. Democrat-Gazette, Inc., 370 Ark. 435, 260 S.W.3d 718 (2007)
  • Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992)
  • Stilley v. McBride, 332 Ark. 306, 965 S.W.2d 125 (1998)

Source

Original opinion text

Opinion No. 2019-062
October 11, 2019

Lana M. Fraser, Investigator
Pulaski County Public Defender's Office
201 South Broadway
Little Rock, AR 72201

Dear Ms. Fraser:

You have requested my opinion regarding the Arkansas Freedom of Information Act ("FOIA"). Your request, which is made as the subject of the records, is based on Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (Supp. 2017). This subsection authorizes the custodian, requester, or the subject of personnel or employee-evaluation records to seek an opinion from this office stating whether the custodian's decision regarding the release of such records is consistent with the FOIA.

Your correspondence indicates that the Pulaski County Public Defender's Office ("PDO") has received a request for your job application and resume under the FOIA. You have attached a copy of the documents at issue, as redacted by the custodian of records. You make several objections to the records' disclosure, which can be accurately distilled down to an objection based on an invasion of privacy. You ask whether the custodian's decision to release the documents as redacted is consistent with the FOIA.

RESPONSE

My statutory duty is to state whether the custodian's decision is consistent with the FOIA. Having reviewed the records, it is my opinion, based on the definitions and standards discussed below, that the decision to disclose the records, as redacted, is mostly consistent with the FOIA. The custodian must, however, make additional redactions to the records before they can be released.

DISCUSSION

[The opinion's general FOIA framework discussion (sections I and II) is the standard analysis covering the public-records definition and the personnel-records exception with the Young v. Rice balancing test, plus the standard list of per-line redactions including personal contact info, employee personnel numbers, marital status, DOBs, SSNs, medical info, undercover officer info, driver's license info, insurance, tax/payroll info, and banking info.]

III. Application.

It is my understanding that the documents you submitted for my review are your application and resume for a position with Pulaski County. Your objections to the release of these records can be fairly summarized as your interest in personal privacy outweighing the public's interest in disclosure. In my opinion, your objections are not legally sufficient reasons to withhold the records.

Personnel records of public employees are subject to disclosure under the FOIA except "to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy." Regarding job applications, this office has repeatedly indicated that the release of such records rarely rises to such a level. Applying the balancing test for personnel records discussed above would not, in my opinion, tip the balance in favor of withholding the requested documents.

Thus, it is my opinion that the custodian's decision to release the records is consistent with the FOIA for the most part.

While the custodian has mostly complied with the FOIA in redacting certain personal information that cannot be released, I have found at least two additional redactions (and possibly others) that must be made before the records may be released.

On the first page of your application and on the front of your resume, the ZIP Code for your home address must be redacted. It has long been the opinion of this office that the term "home addresses" in the exemption for personal contact information of public employees encompasses all of the component parts of a home address (a street address, city, county, and ZIP Code).

Also, at the bottom of each record, there is an unexplained and unidentified number next to your name. If that number is your personnel number, it must be redacted everywhere it appears on the records. Because personnel numbers presumably aid in providing access to computerized data, they must be redacted because records containing "personal identification numbers" used for computer-security functions are specifically exempt from disclosure under the FOIA.

Sincerely,

LESLIE RUTLEDGE
Attorney General

Get today's answer for your situation

You just read a 2019 opinion on this question. Ezel checks the current Arkansas statutes and case law and answers your specific situation, with citations.

Opens in Ezel Pro. Every answer cites the law it relies on.