When my personnel file gets requested under FOIA, can the records custodian forget to redact things like my employee ID number?

Plain-English summary

David Westbrook, a Pulaski County employee, asked the AG to review the custodian's proposed release of his personnel file in response to a FOIA request. He had several objections.

The AG's review found the proposed release mostly consistent with FOIA but identified at least two missed redactions. On two pages documenting accrued leave compensation, Mr. Westbrook's employee identification number had not been removed, though it had been redacted on other records. The AG said personnel numbers "presumably aid in providing access to computerized data" and must be redacted under Ark. Code Ann. § 25-19-105(b)(11)'s exemption for personal identification numbers used for computer-security functions.

The opinion also walked through the proper classification of the records:

• Most documents were personnel records. Items like applications, salary changes, leave records, and similar paperwork run through the Young v. Rice "clearly unwarranted invasion of personal privacy" test (Ark. Code Ann. § 25-19-105(b)(12)). The presumption is disclosure, with redactions for specific privacy-sensitive items (personal contact info, dates of birth, SSNs, medical info, etc.).

• Two documents were employee-evaluation records. The custodian had not explained her classifications, so the AG classified the records from their face. In footnote 27 she identified a "Personnel Appointment or Status Change" document and a "Supplemental Report" as evaluation records. She applied the corresponding disclosure test and found the proposed release mostly consistent with FOIA, apart from the missed redactions.

The record shows why a custodian must check each responsive page for required redactions and classify documents individually. The AG found both personnel and evaluation records in the file and identified missed employee-number redactions on two pages.

Currency note

This opinion was issued in 2019. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Why is an employee personnel number considered a security item? A: The AG said personnel numbers presumably aid access to computerized data. Ark. Code Ann. § 25-19-105(b)(11) exempts personal identification numbers used for computer-security functions, so she directed that Westbrook's number be redacted where it remained visible.

Q: Where did the custodian miss Westbrook's number?
A: The AG found one unredacted instance on each of two pages documenting accrued leave compensation. She said the number had been redacted on other records and directed that these additional redactions be made before release.

Q: How do I know if a document in my personnel file is a "personnel record" or an "evaluation record"? A: The AG described personnel records as records other than evaluation or job-performance records that pertain to an employee. Evaluation records are created by or at the employer's behest to evaluate an employee and detail job performance. The AG classified most of Westbrook's records as personnel records and identified two as evaluation records.

Q: Does the four-part test ever let evaluation records out? A: Yes, when all four prongs are met: there was a suspension or termination, the discipline is final, the records formed a basis for it, and the public has a compelling interest. The compelling-interest prong typically requires more than a generic public concern in good government, often a specific public controversy involving the agency.

Q: What if the custodian disagrees with my objections?
A: Ark. Code Ann. § 25-19-105(c)(3)(B)(i) allows the custodian, requester, or subject of covered employee-related records to seek an AG opinion on whether the custodian's release decision is consistent with FOIA. Westbrook requested that review, and the AG identified two additional redactions.

Background and statutory framework

The Arkansas FOIA's two-tier exemption structure for employee files:

• Tier 1 (personnel records, § 25-19-105(b)(12)): open unless disclosure is a "clearly unwarranted invasion of personal privacy." Young v. Rice, 308 Ark. 593 (1992), supplies the two-step balancing test. The thumb is on the scale toward disclosure. Stilley v. McBride, 332 Ark. 306 (1998), puts the burden on the person resisting disclosure.

• Tier 2 (employee evaluation/job performance records, § 25-19-105(c)(1)): open only if all four prongs are met (suspension/termination, finality, basis, compelling public interest). Thomas v. Hall, 2012 Ark. 66 (2012), adopted the AG's three-part definition of these records.

Per-line redactions under § 25-19-105(b)(13) (personal contact info), (b)(11) (personal-identification numbers used for computer security), and (b)(10) (undercover law-enforcement identifying info) apply regardless of which test the document goes through.

The "shed light on the workings of government" framing for personnel-records analysis comes from earlier AG opinions cited in the body.

Citations

• Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (AG review)
• Ark. Code Ann. § 25-19-103(7)(A) (public-records definition)
• Ark. Code Ann. § 25-19-105(b)(10) (undercover officer info)
• Ark. Code Ann. § 25-19-105(b)(11) (personal-identification numbers / computer security)
• Ark. Code Ann. § 25-19-105(b)(12) (personnel records exemption)
• Ark. Code Ann. § 25-19-105(b)(13) (personal contact info)
• Ark. Code Ann. § 25-19-105(c)(1) (employee-evaluation records)
• Pulaski Cty. v. Ark. Democrat-Gazette, Inc., 370 Ark. 435, 260 S.W.3d 718 (2007)
• Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992)
• Stilley v. McBride, 332 Ark. 306, 965 S.W.2d 125 (1998)
• Thomas v. Hall, 2012 Ark. 66, 399 S.W.3d 387

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

Opinion No. 2019-066
November 7, 2019

David C. Westbrook
c/o Mary Ann Zakrzewski
Human Resources Director
Pulaski County Human Resources
201 S. Broadway, Suite 100
Little Rock, AR 72201

Dear Mr. Westbrook:

You have requested my opinion regarding the Arkansas Freedom of Information Act ("FOIA"). Your request, which is made as the subject, is based on Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (Supp. 2017). This subdivision authorizes the custodian, requester, or the subject of certain employee-related records to seek an opinion from this office stating whether the custodian's decision regarding the release of such records is consistent with the FOIA.

Your correspondence indicates that Pulaski County Human Resources ("PCHR") has received a request under the FOIA for your personnel file. You have attached several documents that the custodian has identified as responsive to the request and that she intends to release with redactions. You question the propriety of this proposed release and ask whether the decision to release the records as redacted is consistent with the FOIA.

RESPONSE

Having reviewed the records, it is my opinion, based on the definitions and standards discussed below, that the custodian's ultimate decision to release the records as redacted is mostly consistent with the FOIA. However, my review has uncovered additional redactions that must be made before the records' release.

DISCUSSION

I. General standards governing disclosure.

A document must be disclosed in response to a FOIA request if all three of the following elements are met. First, the FOIA request must be directed to an entity subject to the act. Second, the requested document must constitute a public record. Third, no exceptions allow the document to be withheld.

The first two elements appear to be met. The request was made to PCHR, which is a public entity and is subject to the FOIA. Moreover, the request appears to pertain to public records. Because the records are held by a public entity, they are presumed to be public records, although that presumption is rebuttable. Accordingly, the analysis proceeds to the third element, that is, whether any exceptions preclude disclosure.

II. Exceptions to disclosure.

Under certain conditions, the FOIA exempts two groups of items normally found in employees' personnel files. For purposes of the FOIA, these items can usually be divided into two mutually exclusive groups: "personnel records" or "employee evaluation or job performance records." The test for whether these two types of documents may be released differs significantly.

When custodians assess whether either of these exceptions applies to a particular record, they must make two determinations. First, they must determine whether the record meets the definition of either exception. Second, assuming the record does meet one of the definitions, the custodian must apply the appropriate test to determine whether the FOIA requires that record be disclosed. In this instance, the custodian has not made clear her determination of how the records at issue should be classified. It is apparent from the face of the records, however, that most of the records are properly classified as personnel records, while two records are properly classified as employee evaluations.

a. Personnel-records exception.

The first of the two most relevant potential exceptions is the one for "personnel records," which the FOIA does not define. But this office has consistently opined that "personnel records" are all records other than "employee-evaluation or job-performance records" that pertain to individual employees. Whether a particular record meets this definition is a question of fact that can only be definitively determined by reviewing the record itself. If a document meets this definition, then it is open to public inspection and copying except "to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy."

While the FOIA does not define the phrase "clearly unwarranted invasion of personal privacy," the Arkansas Supreme Court, in Young v. Rice, has provided some guidance. To determine whether the release of a personnel record would constitute a "clearly unwarranted invasion of personal privacy," the Court applies a balancing test that weighs the public's interest in accessing the records against the individual's interest in keeping them private. The balancing takes place with the scale tipped in favor of disclosure.

The balancing test elaborated by Young v. Rice has two steps. First, the custodian must assess whether the information contained in the requested document is of a personal or intimate nature such that it gives rise to a greater than de minimis privacy interest. If the privacy interest is merely de minimis, then the thumb on the scale favoring disclosure outweighs the privacy interest. Second, if the information does give rise to a greater than de minimis privacy interest, then the custodian must determine whether that interest is outweighed by the public's interest in disclosure. Because the exceptions must be narrowly construed, the person resisting disclosure bears the burden of showing that, under the circumstances, his privacy interests outweigh the public's interests. The fact that the subject of records may consider release of the records an unwarranted invasion of personal privacy is irrelevant to the analysis because the test is objective. Whether any particular personnel record's release would constitute a clearly unwarranted invasion of personal privacy is always a question of fact.

Additionally, a requester's identity or motive for making a request under the FOIA is generally irrelevant as to whether a non-exempt public record must be released. Again, the test under the FOIA for the release of personnel records asks whether, as an objective matter, the records in question shed light on the workings of government for the general public. This ordinarily precludes the custodian from considering any subjective motives or the identity of a requester when making the determinations whether a record must be disclosed or withheld.

Even if a document, when considered as a whole, meets the test for disclosure, it may contain discrete pieces of information that have to be redacted. Some items that must be redacted include:

• Personal contact information of public employees, including personal telephone numbers, personal e-mail addresses, and home addresses (Ark. Code Ann. § 25-19-105(b)(13));
• Employee personnel number;
• Marital status of employees and information about dependents;
• Dates of birth of public employees;
• Social security numbers;
• Medical information;
• Any information identifying certain law enforcement officers currently working undercover (Ark. Code Ann. § 25-19-105(b)(10));
• Driver's license number and photocopy of driver's license;
• Insurance coverage;
• Tax information or withholding;
• Payroll deductions; and
• Banking information.

b. Employee-evaluation exception.

The second potentially relevant exception is for "employee-evaluation or job-performance records," which the FOIA likewise does not define. But the Arkansas Supreme Court has adopted this office's view that the term refers to any records (1) created by or at the behest of the employer (2) to evaluate the employee (3) that detail the employee's performance or lack of performance on the job. This exception includes records generated while investigating allegations of employee misconduct that detail incidents that gave rise to an allegation of misconduct. It also includes records generated for the purpose of detailing the performance or lack of performance of the employee with regard to a specific incident.

If a document meets the above definition, the document cannot be released unless all the following elements have been met:

1. The employee was suspended or terminated (i.e., level of discipline);
2. There has been a final administrative resolution of the suspension or termination proceeding (i.e., finality);
3. The records in question formed a basis for the decision made in that proceeding to suspend or terminate the employee (i.e., basis); and
4. The public has a compelling interest in the disclosure of the records in question (i.e., compelling interest).

The primary purpose of this exception is to preserve the confidentiality of the formal job-evaluation process in order to promote honest exchanges in the employee/employer relationship.

III. Application.

Having reviewed the records, I must note initially that the custodian has provided no information as to how the records at issue were classified. As I stated above, however, it is apparent from the face of the records that most of the records are personnel records, while two records are properly classified as employee-evaluation records. Applying the appropriate test for the disclosure of each type of record, it is my opinion that the ultimate decision to release the records as redacted is consistent with the FOIA for the most part.

While the custodian has mostly complied with the FOIA in redacting certain personal information that cannot be released, I have found at least two additional redactions that must be made before the records may be released. On two pages documenting your accrued leave compensation, I see on each page an instance where your employee identification number has not been redacted (although it has been properly redacted on other records). Because personnel numbers presumably aid in providing access to computerized data, they must be redacted because records containing "personal identification numbers" used for computer-security functions are specifically exempt from disclosure under the FOIA.

Sincerely,

LESLIE RUTLEDGE
Attorney General

1
The FOIA defines public records as "writings, recorded sounds, films, tapes, electronic or computer-based information, or data compilations in any medium, required by law to be kept or otherwise kept, and which constitute a record of the performance or lack of performance of official functions ... carried out by a public official or employee ...." Ark. Code Ann. § 25-19- 103(7)(A) (Supp. 2017). 2 Id. 3 See Pulaski Cty. v. Ark. Democrat-Gazette, Inc., 370 Ark. 435, 440-41, 260 S.W.3d 718, 722 (2007) ("the presumption of public record status established by the FOIA can be rebutted if the records do not otherwise fall within the definition found in the first sentence, i.e., if they do not 'constitute a record of the performance or lack of performance of official functions,"' citing Op. Att'y Gen. 2005-095). 4 This office and the leading commentators on the FOIA have observed that personnel files usually include: employment applications; school transcripts; payroll-related documents, such as information about reclassifications, promotions, or demotions; transfer records; health and life insurance forms; performance evaluations; recommendation letters; disciplinary-action records; requests for leave-without-pay; certificates of advanced training or education; and legal documents, such as subpoenas. E.g., Op. Att'y Gen. 97-368; John J. Watkins, Richard J. Peltz- Steele & Robert Steinbuch, THE ARKANSAS FREEDOM OF INFORMATION ACT 205-06 (Arkansas Law Press, 6th ed., 2017).

5
Ark. Code Ann. § 25-19-105(b)(12): "It is the specific intent of this section that the following shall not be deemed to be made open to the public under the provisions of this chapter....
[p]ersonnel records to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy." 6 Ark. Code Ann. § 25-19-105(c)(1): "Notwithstanding subdivision (b)(l2) of this section, all employee evaluation or job performance records, including preliminary notes and other materials, shall be open to public inspection only upon final administrative resolution of any suspension or termination proceeding at which the records form a basis for the decision to suspend or terminate the employee and if there is a compelling public interest in their disclosure." 7 See, e.g., Ops. Att'y Gen. 2015-072, 99-147; Watkins, et al., at 202. 8 Ark. Code Ann. § 25-19-105(b)(12).

9
308 Ark. 593, 826 S.W.2d 252 (1992).
10
Watkins, et al., at 208.
11
Young, 308 Ark. at 598, 826 S.W.2d at 255.
12
Id., 826 S.W.2d at 255.
13
Stilley v. McBride, 332 Ark. 306, 313, 965 S.W.2d 125, 128 (1998). 14 E.g., Ops. Att'y Gen. 2016-055, 2001-112, 2001-022, 94-198; Watkins, et al., at 207. 15 Ops. Att'y Gen. 2006-176, 2004-260, 2003-336, 98-001. 16 Ops. Att'y Gen. 2019-036, 2018-125, 2014-094, 2012-014, 2011-107.

17
See Ops. Att'y Gen. 2019-047, 2018-061.
18
See Ops. Att'y Gen. 2018-087, 2018-061; see also Op. Att'y Gen. 2014-094 (noting that "neither the Arkansas Legislature nor our appellate courts have allowed custodians to consider the subjective motive of the requester."). While the requester's subjective motive cannot be the basis for the decision, it can be considered by the custodian to determine whether it supplies an objective public interest previously unseen. Op. Att'y Gen. 2014-094 at n.8. It should also be noted that the Legislature has not seen fit to include a generalized "harassment" exemption to the release of otherwise disclosable employee-related records. Op. Att'y Gen. 2019-047 (and opinions cited therein).

19
I will refer to this group of records as "employee-evaluation records." 20 Thomas v. Hall, 2012 Ark. 66, 399 S.W.3d 387. See also Ops. Att'y Gen. 2009-067, 2008-004, 2007-225, 2006-038, 2005-030, 2003-073, 98-006, 97-222, 95-351, 94-306, and 93-055. 21 Thomas, 2012 Ark. 66, at 9-10, 399 S.W.3d at 392-93. 22 Op. Att'y Gen. 2001-276. 23 Ark. Code Ann. § 25-19-105(c)(1); Op. Att'y Gen. 2008-065.

24
Watkins, et al., at 238-39 (footnotes omitted).
25
Id. at 237 (noting that "[a]s a practical matter, such an interest is more likely to be present when a high-level employee is involved than when the [records] of 'rank-and-file' workers are at issue"). 26 Cf Op. Att'y Gen. 96-168; Watkins, et al., at 223.

27
The employee-evaluation records are the one with the heading "Personnel Appointment or Status Change" document and the one with the legend "Supplemental Report." See supra n.22 and accompanying text. 28 Op. Att'y Gen. 2018-064. 29 Ark. Code Ann. § 25-19-105(b)(11).