Can a public water utility release customer-usage data after stripping out names, or is the data itself confidential?

Plain-English summary

State Representative Shad Pierce asked whether a custodian could release customer-usage data under Arkansas FOIA after removing information that identifies the customer. The Attorney General answered no: “customer-usage data itself, even when deidentified, is exempt from disclosure.” His answer assumes a custodian at a public water system or municipally owned utility system and records that otherwise qualify as public records.

A.C.A. § 25-19-105(b)(20)(A) lists customer-usage data separately from phone numbers, email addresses, and home and business addresses. The AG reasoned that each part of the exemption must be given effect. Removing a customer's name or address does not remove the separate exemption for usage data.

Pierce also asked whether the custodian had to make those redactions if they would permit release. The AG called that second question moot because redaction does not make the customer-usage data disclosable under FOIA. The opinion does not address aggregate or system-wide statistics.

What this means for you

Public water and municipal utility custodians

First identify whether the request concerns customer-usage data. If it does, this opinion says removing identifying information does not make that data disclosable under A.C.A. § 25-19-105(b)(20)(A). The AG's analysis assumes the utility is a public water system or municipally owned system and that the requested records are otherwise public records. It does not classify any particular aggregate dataset.

FOIA requesters and researchers

Offering to accept customer-usage records without names does not overcome the exemption analyzed here. If your request is for system-wide statistics instead, this opinion supplies no answer on whether those statistics are customer-usage data. Describe the records you seek so the custodian can assess that question.

Customers and private utilities

The opinion does not decide a customer's access to that customer's own records. It also does not analyze a request to a private utility; its answer rests on the statutory categories for public water systems and municipally owned utility systems.

Common questions

Can a utility release a customer's usage data under FOIA after deleting the name and address? No. The AG says customer-usage data is independently listed in the exemption and remains exempt even when other identifying information is removed.

Can the utility release aggregate statistics for all customers? The opinion does not address aggregate or system-wide statistics. Its answer concerns customer-usage data after removal of identifying information.

Must a custodian make redactions before responding?
The AG did not reach that question. It was moot after he concluded that redaction would not permit disclosure of the customer-usage data.

Does the opinion say every utility record is exempt?
No. It analyzes the exemption for customer-usage data and assumes the other threshold FOIA requirements are met. It does not decide whether other kinds of utility records are disclosable.

Background and statutory framework

A.C.A. § 25-19-105(b)(20)(A) covers personal information of current and former customers of public water systems and municipally owned utility systems. The opinion quotes its “without limitation” list: home and mobile phone numbers, personal email addresses, home and business addresses, and customer-usage data. It relies on Ark. Parole Bd. v. Johnson, 2022 Ark. 209, 654 S.W.3d 820, for giving effect to each part of a statute.

Citations

• A.C.A. § 25-19-105(b)(20)(A)
• Ark. Parole Bd. v. Johnson, 2022 Ark. 209, 654 S.W.3d 820
• Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 174 (West 2012)

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

Opinion No. 2023-024

June 12, 2023

The Honorable Shad Pierce
State Representative
40 Harris Trail
Batesville, Arkansas 72501

Dear Representative Pierce:

You have requested my opinion regarding the exception for customer-usage data to the Arkansas Freedom of Information Act (FOIA) in the following instances: 1

Question 1: Upon request for customer-usage data, can a custodian redact identifying information of customers so that the records can be disclosed without violating this exception?
Brief response: No, under the FOIA, customer-usage data itself, even when deidentified, is exempt from disclosure.

Question 2: If the custodian can make those redactions, is the custodian obligated to make the redactions?
Brief response: This question is moot because of my response to Question 1.

DISCUSSION

A document must be disclosed in response to a FOIA request if all three of the following elements are met. First, the FOIA request must be directed to an entity subject to the act. Second, the requested document must constitute a public record. Third, no exceptions allow the document to be withheld.

For purposes of this opinion, I am assuming the custodian referenced in your questions works for a public water system or municipally owned utility system, as those are the two entities referenced in the exception for customer-usage data. 2 I am also assuming the information requested from the

1
I have paraphrased your questions.
2
A.C.A. § 25-19-105(b)(20)(A).

The Honorable Shad Pierce
State Representative
Opinion No. 2023-024
Page 2

custodian constitutes a public record. Thus, the first two elements are met, and I will turn to your questions regarding the exception for customer-usage data.

Question 1: Upon request for customer-usage data, can a custodian redact identifying information of customers so that the records can be disclosed without violating this exception?

The text of the FOIA excludes customer-usage data from disclosure even if other identifying information is removed. The exception for customer-usage data is part of a broader exception for all personal information of former and current customers of public water systems and municipally owned utility systems. 3 To maintain customer privacy, the personal-information exception lists certain customer records that are excluded “without limitation:” (1) home and mobile phone numbers, (2) personal email addresses, (3) home and business addresses, and (4) customer-usage data. 4 Each part of the personal-information exception must be given effect. 5 Because the General Assembly listed customer-usage data separately, redacting the customer-usage data to remove other identifying information does not affect this part of the exception.

Question 2: If the custodian can make those redactions, is the custodian obligated to make the redactions?

This question is moot because of my response to Question 1.

Assistant Attorney General Jodie Keener prepared this opinion, which I hereby approve.

Sincerely,

TIM GRIFFIN
Attorney General

3
Id.
4
Id.
5
See Ark. Parole Bd. v. Johnson, 2022 Ark. 209, 5, 654 S.W.3d 820, 823 (stating that the court will interpret “statutory provisions to make them consistent, harmonious, and sensible in an effort to give effect to every part”); see also Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 174 (West 2012) (“If possible, every word and every provision [of a statute] is to be given effect….None should be ignored. None should needlessly be given an interpretation that causes it to duplicate another provision or to have no consequence.”).