When my personnel file gets requested under FOIA, can the records custodian forget to redact things like my employee ID number?

Plain-English summary

David Westbrook, a Pulaski County employee, asked the AG to review the custodian's proposed release of his personnel file in response to a FOIA request. He had several objections.

The AG's review found the custodian had mostly done the right thing but missed at least two redactions. On two pages documenting accrued leave compensation, Mr. Westbrook's employee identification number had not been removed (though it had been redacted on other pages). Employee personnel numbers function as identifiers used to access computerized data, so they are squarely within the exemption at Ark. Code Ann. § 25-19-105(b)(11) for "personal identification numbers" used in computer-security functions.

The opinion also walked through the proper classification of the records:

• Most documents were personnel records. Items like applications, salary changes, leave records, and similar paperwork run through the Young v. Rice "clearly unwarranted invasion of personal privacy" test (Ark. Code Ann. § 25-19-105(b)(12)). The presumption is disclosure, with redactions for specific privacy-sensitive items (personal contact info, dates of birth, SSNs, medical info, etc.).

• Two documents were employee-evaluation records. A "Personnel Appointment or Status Change" document and a "Supplemental Report" met the Thomas v. Hall three-part test (created by employer, to evaluate, detailing performance). They run through the four-part test for evaluation-record disclosure (Ark. Code Ann. § 25-19-105(c)(1)): suspension or termination, finality, basis, compelling public interest. The AG could not say for certain how those evaluation records should be handled because the custodian had not laid out which prongs the records satisfied. The AG's analysis assumed the custodian had made determinations on those points.

The opinion is useful for two practical reasons: (1) it puts the personnel-number redaction firmly in the (b)(11) computer-security exemption rather than the more general "Op. Att'y Gen. tradition," giving custodians a statutory hook; and (2) it confirms that a single "personnel file" can contain a mix of personnel records and evaluation records, each subject to its own classification and test.

Currency note

This opinion was issued in 2019. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Why is an employee personnel number considered a security item?
A: Because it is the identifier the agency's computer systems use to authenticate access to records about that employee. Once the number is public, anyone calling in or impersonating the employee has a starter credential. Section 25-19-105(b)(11) exempts "personal identification numbers" used for computer-security functions; the AG read the personnel number as falling there.

Q: Where else does the personnel number appear?
A: In addition to leave-compensation paperwork, the same number typically shows on payroll records, benefits enrollment, ID cards, and login systems. Custodians have to scan all of those.

Q: How do I know if a document in my personnel file is a "personnel record" or an "evaluation record"?
A: Personnel records are the catch-all for everything other than evaluation/job-performance records. Evaluation records are anything created by or at the employer's behest to evaluate the employee, detailing performance. Disciplinary letters and investigation reports are evaluation records. Routine HR paperwork is usually personnel.

Q: Does the four-part test ever let evaluation records out?
A: Yes, when all four prongs are met: there was a suspension or termination, the discipline is final, the records formed a basis for it, and the public has a compelling interest. The compelling-interest prong typically requires more than a generic public concern in good government, often a specific public controversy involving the agency.

Q: What if the custodian disagrees with my objections?
A: Then either party (custodian, requester, or subject) can ask the AG to review under § 25-19-105(c)(3)(B)(i), as Mr. Westbrook did. The AG's opinion is not binding, but it carries weight.

Background and statutory framework

The Arkansas FOIA's two-tier exemption structure for employee files:

• Tier 1 (personnel records, § 25-19-105(b)(12)): open unless disclosure is a "clearly unwarranted invasion of personal privacy." Young v. Rice, 308 Ark. 593 (1992), supplies the two-step balancing test. The thumb is on the scale toward disclosure. Stilley v. McBride, 332 Ark. 306 (1998), puts the burden on the person resisting disclosure.

• Tier 2 (employee evaluation/job performance records, § 25-19-105(c)(1)): open only if all four prongs are met (suspension/termination, finality, basis, compelling public interest). Thomas v. Hall, 2012 Ark. 66 (2012), adopted the AG's three-part definition of these records.

Per-line redactions under § 25-19-105(b)(13) (personal contact info), (b)(11) (personal-identification numbers used for computer security), and (b)(10) (undercover law-enforcement identifying info) apply regardless of which test the document goes through.

The "shed light on the workings of government" framing for personnel-records analysis comes from earlier AG opinions cited in the body.

Citations

• Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (AG review)
• Ark. Code Ann. § 25-19-103(7)(A) (public-records definition)
• Ark. Code Ann. § 25-19-105(b)(10) (undercover officer info)
• Ark. Code Ann. § 25-19-105(b)(11) (personal-identification numbers / computer security)
• Ark. Code Ann. § 25-19-105(b)(12) (personnel records exemption)
• Ark. Code Ann. § 25-19-105(b)(13) (personal contact info)
• Ark. Code Ann. § 25-19-105(c)(1) (employee-evaluation records)
• Pulaski Cty. v. Ark. Democrat-Gazette, Inc., 370 Ark. 435, 260 S.W.3d 718 (2007)
• Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992)
• Stilley v. McBride, 332 Ark. 306, 965 S.W.2d 125 (1998)
• Thomas v. Hall, 2012 Ark. 66, 399 S.W.3d 387

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

Opinion No. 2019-066
November 7, 2019

David C. Westbrook
c/o Mary Ann Zakrzewski
Human Resources Director
Pulaski County Human Resources
201 S. Broadway, Suite 100
Little Rock, AR 72201

Dear Mr. Westbrook:

You have requested my opinion regarding the Arkansas Freedom of Information Act ("FOIA"). Your request, which is made as the subject, is based on Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (Supp. 2017). This subdivision authorizes the custodian, requester, or the subject of certain employee-related records to seek an opinion from this office stating whether the custodian's decision regarding the release of such records is consistent with the FOIA.

Your correspondence indicates that Pulaski County Human Resources ("PCHR") has received a request under the FOIA for your personnel file. You have attached several documents that the custodian has identified as responsive to the request and that she intends to release with redactions. You question the propriety of this proposed release and ask whether the decision to release the records as redacted is consistent with the FOIA.

RESPONSE

Having reviewed the records, it is my opinion, based on the definitions and standards discussed below, that the custodian's ultimate decision to release the records as redacted is mostly consistent with the FOIA. However, my review has uncovered additional redactions that must be made before the records' release.

DISCUSSION

I. General standards governing disclosure.

A document must be disclosed in response to a FOIA request if all three of the following elements are met. First, the FOIA request must be directed to an entity subject to the act. Second, the requested document must constitute a public record. Third, no exceptions allow the document to be withheld.

The first two elements appear to be met. The request was made to PCHR, which is a public entity and is subject to the FOIA. Moreover, the request appears to pertain to public records. Because the records are held by a public entity, they are presumed to be public records, although that presumption is rebuttable. Accordingly, the analysis proceeds to the third element, that is, whether any exceptions preclude disclosure.

II. Exceptions to disclosure.

Under certain conditions, the FOIA exempts two groups of items normally found in employees' personnel files. For purposes of the FOIA, these items can usually be divided into two mutually exclusive groups: "personnel records" or "employee evaluation or job performance records." The test for whether these two types of documents may be released differs significantly.

When custodians assess whether either of these exceptions applies to a particular record, they must make two determinations. First, they must determine whether the record meets the definition of either exception. Second, assuming the record does meet one of the definitions, the custodian must apply the appropriate test to determine whether the FOIA requires that record be disclosed. In this instance, the custodian has not made clear her determination of how the records at issue should be classified. It is apparent from the face of the records, however, that most of the records are properly classified as personnel records, while two records are properly classified as employee evaluations.

a. Personnel-records exception.

The first of the two most relevant potential exceptions is the one for "personnel records," which the FOIA does not define. But this office has consistently opined that "personnel records" are all records other than "employee-evaluation or job-performance records" that pertain to individual employees. Whether a particular record meets this definition is a question of fact that can only be definitively determined by reviewing the record itself. If a document meets this definition, then it is open to public inspection and copying except "to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy."

While the FOIA does not define the phrase "clearly unwarranted invasion of personal privacy," the Arkansas Supreme Court, in Young v. Rice, has provided some guidance. To determine whether the release of a personnel record would constitute a "clearly unwarranted invasion of personal privacy," the Court applies a balancing test that weighs the public's interest in accessing the records against the individual's interest in keeping them private. The balancing takes place with the scale tipped in favor of disclosure.

The balancing test elaborated by Young v. Rice has two steps. First, the custodian must assess whether the information contained in the requested document is of a personal or intimate nature such that it gives rise to a greater than de minimis privacy interest. If the privacy interest is merely de minimis, then the thumb on the scale favoring disclosure outweighs the privacy interest. Second, if the information does give rise to a greater than de minimis privacy interest, then the custodian must determine whether that interest is outweighed by the public's interest in disclosure. Because the exceptions must be narrowly construed, the person resisting disclosure bears the burden of showing that, under the circumstances, his privacy interests outweigh the public's interests. The fact that the subject of records may consider release of the records an unwarranted invasion of personal privacy is irrelevant to the analysis because the test is objective. Whether any particular personnel record's release would constitute a clearly unwarranted invasion of personal privacy is always a question of fact.

Additionally, a requester's identity or motive for making a request under the FOIA is generally irrelevant as to whether a non-exempt public record must be released. Again, the test under the FOIA for the release of personnel records asks whether, as an objective matter, the records in question shed light on the workings of government for the general public. This ordinarily precludes the custodian from considering any subjective motives or the identity of a requester when making the determinations whether a record must be disclosed or withheld.

Even if a document, when considered as a whole, meets the test for disclosure, it may contain discrete pieces of information that have to be redacted. Some items that must be redacted include:

• Personal contact information of public employees, including personal telephone numbers, personal e-mail addresses, and home addresses (Ark. Code Ann. § 25-19-105(b)(13));
• Employee personnel number;
• Marital status of employees and information about dependents;
• Dates of birth of public employees;
• Social security numbers;
• Medical information;
• Any information identifying certain law enforcement officers currently working undercover (Ark. Code Ann. § 25-19-105(b)(10));
• Driver's license number and photocopy of driver's license;
• Insurance coverage;
• Tax information or withholding;
• Payroll deductions; and
• Banking information.

b. Employee-evaluation exception.

The second potentially relevant exception is for "employee-evaluation or job-performance records," which the FOIA likewise does not define. But the Arkansas Supreme Court has adopted this office's view that the term refers to any records (1) created by or at the behest of the employer (2) to evaluate the employee (3) that detail the employee's performance or lack of performance on the job. This exception includes records generated while investigating allegations of employee misconduct that detail incidents that gave rise to an allegation of misconduct. It also includes records generated for the purpose of detailing the performance or lack of performance of the employee with regard to a specific incident.

If a document meets the above definition, the document cannot be released unless all the following elements have been met:

1. The employee was suspended or terminated (i.e., level of discipline);
2. There has been a final administrative resolution of the suspension or termination proceeding (i.e., finality);
3. The records in question formed a basis for the decision made in that proceeding to suspend or terminate the employee (i.e., basis); and
4. The public has a compelling interest in the disclosure of the records in question (i.e., compelling interest).

The primary purpose of this exception is to preserve the confidentiality of the formal job-evaluation process in order to promote honest exchanges in the employee/employer relationship.

III. Application.

Having reviewed the records, I must note initially that the custodian has provided no information as to how the records at issue were classified. As I stated above, however, it is apparent from the face of the records that most of the records are personnel records, while two records are properly classified as employee-evaluation records. Applying the appropriate test for the disclosure of each type of record, it is my opinion that the ultimate decision to release the records as redacted is consistent with the FOIA for the most part.

While the custodian has mostly complied with the FOIA in redacting certain personal information that cannot be released, I have found at least two additional redactions that must be made before the records may be released. On two pages documenting your accrued leave compensation, I see on each page an instance where your employee identification number has not been redacted (although it has been properly redacted on other records). Because personnel numbers presumably aid in providing access to computerized data, they must be redacted because records containing "personal identification numbers" used for computer-security functions are specifically exempt from disclosure under the FOIA.

Sincerely,

LESLIE RUTLEDGE
Attorney General