Is every email a public employee sends from their work account automatically a public record under Arkansas FOIA, and can a vague or voluminous request be denied?

Plain-English summary

Arkansas Tech University got a FOIA request for "[a]ll emails and attachments to or from any email address used by ATU employee Loretta Cochran. Time frame is the last year," plus a separate request for her personnel file. The custodian decided to release the records subject to the standard FOIA exemptions and required redactions. Cochran objected on multiple grounds: that the emails weren't public records at all, that the records weren't of public interest, that release would invade her privacy, that the requester had no legitimate purpose, and that the request was too vague and voluminous.

The AG worked through each objection. The headline conclusions:

Are work emails automatically public records? No. Whether an email is a public record depends on whether it "constitute[s] a record of the performance or lack of performance of official functions" under the statutory definition. The custodian, not the AG, decides that case by case. The AG declined to opine on this threshold question because it was outside the scope of the AG's review authority under § 25-19-105(c).

Once an email is a public record, can a personnel-record exemption keep it out of public hands? Maybe, depending on the Young v. Rice balancing test. Personal-information redactions still apply.

Voluminous requests. "Vague, overreaching, and voluminous" was Cochran's complaint. The AG's response: there is no exemption for voluminous requests. The legislature didn't create one. A custodian dealing with a big request can advise the requester within three working days that the search will take time and provide a target completion date.

Notice within 24 hours. Cochran also complained the custodian didn't notify her within 24 hours of receiving the request. The AG declined to address this; FOIA has no compliance office, and the AG isn't authorized to enforce FOIA generally.

Requester's identity and motive. Generally irrelevant. A FOIA request can't be denied because the custodian doesn't like why someone is asking.

FERPA. If certain emails contain student education records protected by FERPA (20 U.S.C. § 1232g), § 25-19-105(b)(2) creates a separate FOIA exemption that mirrors the FERPA protection. The custodian had said FERPA records would be redacted.

What this means for you

Public employees with work email accounts

Not every email you send or receive on a work account is automatically a public record. The test is functional: does the content "constitute a record of the performance or lack of performance of official functions"? Personal correspondence (emails to your spouse about dinner plans, for instance) may not qualify even if it's on a state email server. The Pulaski Cty. v. Ark. Democrat-Gazette case is the foundational authority: an email's "nature and content," not the medium, controls.

What this practically means: you have a partial expectation of privacy in personal email content even on a work account, but it's not absolute. The custodian decides in the first instance, and that's a fact-specific call. To minimize ambiguity, keep personal correspondence out of work email.

If you do have a personal privacy interest in particular emails (say, those discussing health, family, or finances during the pandemic, as Cochran argued), Young v. Rice can support redaction or withholding even if the emails are public records, depending on the balancing.

FOIA custodians at universities and state agencies

The opinion gives you a clear procedure for email FOIA requests:

1. Determine which emails are responsive to the request.
2. For each responsive email, determine whether it is a public record (constitute a record of official functions).
3. For emails that are public records, classify as personnel records or evaluation records and apply the appropriate test.
4. Redact required personal information and any FERPA-protected content.
5. Release the rest.

For voluminous requests, you can advise the requester within three working days that the search will be lengthy and give a target completion date, per the standard cited in Watkins. You cannot deny based on volume alone.

State university staff (FERPA context)

If your work emails contain student education records, those records can be redacted under § 25-19-105(b)(2), which incorporates FERPA's protections into Arkansas FOIA. The custodian has to do the redaction; the existence of FERPA-covered content doesn't shield a whole email or document.

People considering filing a broad FOIA request

You can file a broad request, and the agency cannot reject it just for being big. But the agency can take longer to fulfill it and may negotiate scope with you. If the request is so vague that the custodian cannot locate the records "with reasonable effort," the custodian can object and ask for clarification. Be specific where you can; that speeds things up and reduces friction.

Subjects of FOIA requests

If your records are being requested, you have a notification right but the AG's enforcement authority is limited. The AG cannot order the custodian to do anything, including notify you on a particular timeline. The FOIA's enforcement mechanisms are criminal prosecution (a Class C misdemeanor for negligent violation) and civil suit in circuit court by the affected citizen.

Common questions

Is every email I send from my work account a public record?

Not automatically. The Arkansas Supreme Court in Pulaski Cty. v. Ark. Democrat-Gazette held that the rebuttable presumption of public-record status can be rebutted if the records don't fall within the statutory definition (records of the performance or lack of performance of official functions). The "nature and content" of the email controls.

Can the agency just refuse my voluminous request?

No. There is no FOIA exemption for voluminous requests. The agency can take longer and notify you within three working days that completion will be on a target date. If your request is so vague the agency genuinely cannot locate records, the agency can object on that ground.

What if the requester clearly has a vendetta?

The requester's identity and motive are generally irrelevant. The opinion was emphatic: "neither the Arkansas Legislature nor our appellate courts have allowed custodians to consider the subjective motive of the requester." Even if you suspect harassment, that is not a basis for denial. There is no harassment exemption to FOIA.

Does FERPA shield my emails about students?

Education records protected by FERPA can be redacted under § 25-19-105(b)(2), which incorporates FERPA into FOIA. The custodian must apply the redaction. The existence of student information in an email does not shield the entire email from disclosure; only the FERPA-protected content gets redacted.

What if I disagree with the custodian's decision?

You can file your own lawsuit in circuit court under § 25-19-107 to enforce your rights. You can also try criminal prosecution through the county prosecuting attorney for a negligent FOIA violation under § 25-19-104, but that's used rarely.

Did the custodian have to notify me within 24 hours?

The opinion didn't address this directly because it falls outside the AG's review authority. FOIA does have notice requirements for certain employee-record requests, but enforcement is via litigation, not AG opinion.

Background and statutory framework

Arkansas FOIA defines public records as "writings, recorded sounds, films, tapes, electronic or computer-based information, or data compilations in any medium, required by law to be kept or otherwise kept, and that constitute a record of the performance or lack of performance of official functions ... carried out by a public official or employee," under Ark. Code Ann. § 25-19-103(7)(A).

The Pulaski County case is the leading authority on public-record status for emails. The Arkansas Supreme Court confirmed that the presumption of public-record status is rebuttable. The "nature and content" of an electronic communication, not the device or account it's stored on, determines whether it qualifies. Emails on a public computer that don't relate to the performance of official functions can be excluded from public-record status.

The personnel-records exemption (§ 25-19-105(b)(12)) and evaluation-records exemption (§ 25-19-105(c)(1)) operate the same way they do in other employee-related FOIA opinions: personnel records are released subject to the Young v. Rice balancing test, evaluation records require all four prongs (suspension/termination, finality, basis, compelling interest).

The FERPA exemption (§ 25-19-105(b)(2)) operates separately and incorporates the federal Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, which protects student education records.

For voluminous requests, the leading commentary (Watkins, Peltz-Steele, and Steinbuch) supports the practice of acknowledging the request and providing a target completion date within three working days, rather than denying for volume.

Citations

• Ark. Code Ann. § 25-19-103(7)(A) (public records definition)
• Ark. Code Ann. § 25-19-105(b)(2) (FERPA exemption)
• Ark. Code Ann. § 25-19-105(b)(12) (personnel records)
• Ark. Code Ann. § 25-19-105(b)(13) (required redactions)
• Ark. Code Ann. § 25-19-105(c)(1) (evaluation records)
• Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (AG opinion procedure)
• Ark. Code Ann. § 25-19-104 (criminal penalties)
• Ark. Code Ann. § 25-19-107 (civil enforcement)
• 20 U.S.C. § 1232g (FERPA)
• Pulaski Cty. v. Ark. Democrat-Gazette, Inc., 370 Ark. 435 (2007)
• Young v. Rice, 308 Ark. 593 (1992)
• Stilley v. McBride, 332 Ark. 306 (1998)
• Thomas v. Hall, 2012 Ark. 66
• Watkins, Peltz-Steele & Steinbuch, The Arkansas Freedom of Information Act (6th ed. 2017)

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

Opinion No. 2021-068
August 10, 2021
Loretta F. Cochran, Ph.D.
Associate Professor of Management
College of Business, RTH 441
Arkansas Tech University
106 West O Street
Russellville, AR 72801

Dear Professor Cochran:

You have requested my opinion regarding the Arkansas Freedom of Information Act ("FOIA"). Your request, which is made as the subject of the records, is based on Ark. Code Ann. § 25-19-105(c)(3)(B)(i) (Supp. 2019). This subdivision authorizes the custodian, requester, or the subject of certain employee-related records to seek an opinion from this office stating whether the custodian's decision regarding the release of such records is consistent with the FOIA.

Your correspondence indicates that Arkansas Tech University ("ATU") has received a request under the FOIA for "[a]ll emails and attachments to or from any email address used by ATU employee Loretta Cochran. Time frame is the last year." Additionally, ATU has received a request for "a copy of [your] personnel file."

The custodian has determined that certain records from your ATU personnel file and certain emails from your ATU email address and their attachments are "subject to disclosure to the extent that they are encompassed within the definition of 'public records' set forth in [Ark. Code Ann.] § 25-19-103." However, the custodian has provided assurances that any records "that fall within the exemptions provided by [Ark. Code Ann.] § 25-19-105(b) would be redacted." His correspondence notes that these exemptions would include education records as defined in the Family Educational Rights and Privacy Act of 1974 (20 U.S.C. § 1232g) (FERPA), unless disclosure would be consistent with that act; personnel records to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy; personnel or evaluation records exempt from the FOIA; personal email addresses; personal contact information; home address; and any other application exceptions. Finally, the custodian notes that none of your employee-evaluation or job-performance records will be released, in light of the fact that you have not been suspended or terminated.

You disagree with the custodian's decision to release some of your emails and some of your personnel records, even with the appropriate redactions. Your objections to the release of the records can be summarized as follows: you claim that the requested emails are not public records; that there are alternative means of obtaining any personnel records that are of public interest; that disclosure of certain personnel records would constitute a clearly unwarranted invasion of personal privacy; that the requester does not intend to use the requested records for a legitimate public purpose; that the request is vague, overreaching, and voluminous; and that the custodian made no effort to notify you within 24 hours of receiving the records request. You request my opinion regarding whether the custodian's determinations are consistent with the FOIA.

RESPONSE

My statutory duty is to state whether the custodian's decision regarding the release of personnel or employee-evaluation records is consistent with the FOIA. As I have previously stated, this statutory mandate presupposes that the records in question are "public records" under the FOIA. However, it appears that one of the primary issues in this case is whether the requested emails and their attachments meet the threshold requirement of being "public records" under the FOIA. This question is outside the scope of my statutory authority of review under subsection 25-19-105(c).

Furthermore, because I have not seen any records that would be responsive to the instant FOIA requests, I cannot opine about the releasability of any specific document or the need to redact any specific piece of information from an otherwise releasable document. However, I can state that the custodian's decision to disclose those requested records that meet the definition of "public records" under the FOIA, while withholding records and redacting information as required by subsection 25-19-105(b), appears to be consistent with the FOIA.

With respect to your remaining objections, these are not legally cognizable reasons to withhold non-exempt public records under the FOIA.

DISCUSSION

I. General standards governing disclosure.

A document must be disclosed in response to a FOIA request if all three of the following elements are met. First, the FOIA request must be directed to an entity subject to the act. Second, the requested document must constitute a public record. Third, no exceptions allow the document to be withheld.

The first element is plainly met here. The request was made to ATU, which is a public entity and is subject to the FOIA. Moreover, the request appears to pertain to public records. The records are held by a public entity, and there is a rebuttable presumption that documents kept by an entity subject to the FOIA are public records. If the document is a public record, it must be disclosed unless some specific exception provides otherwise. Accordingly, the analysis proceeds to the third element, that is, whether any exceptions preclude disclosure.

II. Exceptions to disclosure.

III. Application.

Because I have not reviewed the actual records at issue, I am unable to definitively opine about the releasability of any specific document or the need to redact any specific piece of information from an otherwise releasable document. But I can state that the primary issue here appears to be whether many of the requested records, namely your emails and their attachments, constitute public records at all. This decision falls outside the scope of my authority of review under Ark. Code Ann. § 25-19-105(c). It is up to the custodian to review the requested emails and determine whether any specific email is, in fact, a public record as defined by the FOIA. Specifically, the inquiry turns on whether the contents of the email "constitute a record of the performance or lack of performance of official functions." As the Supreme Court has made clear, not every email created on or kept or stored on a public computer is, per se, a public record. Rather, a fact-specific inquiry is necessary to make such a determination.

Once the custodian has decided that a particular record constitutes an employment-related public record, the custodian must make two additional determinations. The first determination is whether the requested record meets the definition of either a personnel record or an employee-evaluation record, and the second is whether the record should be disclosed after applying the appropriate test for that type of record.

In this case, the custodian has stated that none of your employee-evaluation records, including preliminary notes and other materials, will be released because there has been no suspension or termination proceeding. Thus, the only records at issue here are your personnel records, which may include certain emails, along with certain records from your personnel file.

The custodian has stated that protected personal information, such as personal contact information, home address, and personal email addresses, would be redacted from your personnel records prior to release, as required by Ark. Code Ann. § 25-19-105(b). Additionally, the custodian has stated that no personnel records will be released to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy. However, it appears you believe the custodian has incorrectly applied the test and will release some of your personnel records, even if they fail the "clearly unwarranted invasion of personal privacy" test.

Not having seen the records the custodian intends to release, I cannot opine on whether or not the custodian has correctly applied the test. But I can reiterate the analysis that must take place, which this office has previously described:

The first step in the analysis is ... to identify the existence or level of any privacy interest in the documents. If the privacy interest is de minim is, the information is likely disclosable and that is the end of the analysis. If a privacy interest is implicated, the level of the public's interest in the records must be gauged. The Arkansas Supreme Court has indicated that the public interest is measured by "the extent to which disclosure of the information sought would 'shed light on an agency's performance of its statutory duties' or otherwise let citizens know 'what their government is up to.'" If the public interest in this regard is substantial, it will usually outweigh any privacy interest.

You have asserted a substantial personal privacy interest in some of your emails, noting that a number of personal matters appear in your emails as a consequence of the pandemic. You have compared these emails to the records at issue in Young v. Rice, and I agree that you may well have a greater than de minimis privacy interest in some of these emails. The question, then, is whether the public interest in this regard is substantial. If there is no substantial public interest, the emails must be withheld. But if the public interest is substantial, that interest will likely outweigh your privacy interest in the emails.

In sum, some of your emails, even if deemed personnel records, may not be open to copying or inspection if their release constitutes a clearly unwarranted invasion of personal privacy. But, not having seen the emails at issue, I cannot definitely opine in this regard.

I will now address your other objections to the release of your records. You assert that much of the information from your personnel file is available elsewhere. However, as this office has previously opined, "the fact that the requested documents have already been made public or are available through additional research is not a valid basis for denying a request for the records, if the applicable test for their release is met."

You also claim that the request is "vague, overreaching, and voluminous." It is the responsibility of the custodian to determine, in the first instance, which records are responsive to the FOIA request and whether the request is sufficiently specific to enable to locate the pertinent records "with reasonable effort." If the custodian perceives that a request is so vague or broad that it will not permit him to locate the records in a timely fashion, objecting to the request as unreasonable "may be an appropriate first response to the FOIA request." But, as this office has previously opined, the General Assembly "has not created an exception to disclosure for voluminous requests that take extensive time and resources to respond to." Rather, an agency that receives a particularly voluminous request may "advis[e] the requester, within three working days, that the search and compilation process is expected to be lengthy and that completion is anticipated by a certain date."

You also express concern about the requester's identity and reasons for requesting your records. As noted above, a FOIA requester's identity or motive for making the request is generally irrelevant to whether a record must be released. The test under the FOIA for the release of personnel records asks whether, as an objective matter, the records in question shed light on the workings of government for the general public. The custodian's analysis cannot be based on a requester's identity or subjective motive for wanting the record.

With respect to your complaint about the custodian not providing you with notice of the request within 24 hours, this also falls outside the scope of my authority. The FOIA has no provision establishing a state compliance office and does not authorize the Attorney General to enforce compliance with the FOIA.

As a final matter, please note that this opinion does not preclude you from pursuing other legal remedies afforded by the FOIA. The custodian's decision is subject to judicial review under section 25-19-107, which provides for a citizen's appeal to enforce the rights granted by the FOIA. Such an appeal may be made to the Pulaski County Circuit Court or to the circuit court of the residence of the aggrieved party.

Sincerely,

LESLIE RUTLEDGE
Attorney General