Can an Arkansas FOIA custodian use whiteout to redact, and is redacting an entire driver's license image proper?

Plain-English summary

Alexander Sanders asked the AG to review Little Rock's decision to release redacted records from his former police-department personnel file. The AG said the release decision was partly consistent with Arkansas FOIA. He agreed the records were personnel records, but found problems with the redactions.

The custodian used whiteout, making it hard to see where information had been removed and how much was deleted. A.C.A. § 25-19-105(f)(3) requires the amount removed to be indicated on the released record and, when technically feasible, at the place of deletion. The AG said a blackout tool was the proper method here.

The custodian also removed the entire image of Sanders's driver's license. The AG said only the license number, date of birth, home address, and expiration date were exempt on that image. Finally, an entry labeled “person id” might require redaction if it qualifies as a personal identification number; the opinion did not decide that factual point.

What this means for you

Records custodians

For the file the AG reviewed, whiteout did not adequately show the location and amount of removed material. The AG directed the custodian to change the redaction method and to limit the driver's-license redaction to the four fields he identified. The “person id” entry requires a determination of what that number represents.

Requesters and record subjects

The opinion says the file's personnel records may be released subject to the applicable privacy analysis. It identifies specific redactions that were too broad or insufficiently visible, while leaving the “person id” issue conditional.

Common questions

Can a custodian use whiteout for FOIA redactions?
In this case, the AG said whiteout obscured where and how much was removed and directed the custodian to use blackout instead.

Can the entire driver's-license image be withheld?
The AG said no for this image. He identified the license number, date of birth, home address, and expiration date as exempt.

Must a “person id” entry be redacted?
Only if it qualifies as a personal identification number. The AG said the custodian might need to redact it after making that determination.

Background and statutory framework

The AG applied the personnel-records privacy test in A.C.A. § 25-19-105(b)(12), discussed in Young v. Rice. The redaction procedure appears in § 25-19-105(f)(3). The opinion also cites § 25-19-105(b)(11) for personal identification numbers and earlier AG opinions for the driver's-license fields.

Citations

• A.C.A. § 25-19-105(b)(11)–(12); § 25-19-105(f)(3)
• Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992)
• Ark. Att’y Gen. Ops. 2011-081, 2015-057

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

Opinion No. 2023-078
August 22, 2023
Mr. Alexander Sanders
c/o Ms. Theresa Morris, Assistant City Attorney
City of Little Rock
500 West Markham Street, Suite 310
Little Rock, Arkansas 72201
Dear Mr. Sanders:
You have requested my opinion regarding the Arkansas Freedom of Information Act (“FOIA”). Your request, which is made as the subject of the records, is based on A.C.A.
§ 25-19-105(c)(3)(B)(i). The FOIA authorizes the custodian, requester, or the subject of certain employee-related records to seek an opinion from this office stating whether the custodian’s decision regarding the release of such records is consistent with the FOIA. You say that someone has submitted a FOIA request for your personnel file from the Little Rock Police Department, your previous employer. The custodian has classified your personnel file as personnel records and intends to release them with redactions. You ask whether the custodian’s decision to disclose these records is consistent with the FOIA. RESPONSE Having reviewed the records at issue, it is my opinion that the custodian’s decision to release the redacted records is partially consistent with the FOIA. The custodian’s redaction method is inconsistent with the FOIA, and some of the information in the records should not be redacted. DISCUSSION

1. General rules. A document must be disclosed in response to a FOIA request if all three of the
   following elements are met. First, the FOIA request must be directed to an entity subject to the act. Second, the requested document must constitute a public record. Third, no exceptions allow the document to be withheld. Here, the first two elements are met. The request was made to a city police department, which is a public entity and is subject to the FOIA. And the documents I reviewed are public records. 1

1
The FOIA defines public records as “writings, recorded sounds, films, tapes, electronic or computer-based information, or data compilations in any medium, required by law to be kept or otherwise kept, and that constitute a record of the performance or lack of performance of official functions…carried out by a public official or employee….” A.C.A.§ 25-19-103(7)(A). Mr. Alexander Sanders Opinion No. 2023-078 Page 2

2. Exceptions to disclosure. The FOIA contains two exemptions for two groups of documents
   normally found in employees’ personnel files. 2 For purposes of the FOIA, these items can usually be divided into two mutually exclusive groups: “personnel records” 3 or “employee evaluation or job performance records.” 4 The test for whether these two types of documents may be released differs significantly. When custodians assess whether either of these exceptions applies to a particular record, they must first decide whether the record meets the definition of the relevant exception and then apply the appropriate test to determine whether the FOIA requires that record be disclosed. Because the records at issue here are all personnel records, I will confine my analysis to that exemption. While the FOIA does not define the term “personnel records,” this office has consistently opined that “personnel records” are all records other than “employee evaluation or job-performance records” that pertain to individual employees. 5 Whether a particular record meets this definition is a question of fact that requires one to review the record itself. A personnel record is open to public inspection and copying except “to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy.” 6 While the FOIA does not define the phrase “clearly unwarranted invasion of personal privacy,” the Arkansas Supreme Court has provided some guidance. In Young v. Rice, the Court applied a balancing test that weighs the public’s interest in accessing the records against the individual’s interest in keeping them private. 7 The balancing test, which takes place with the scale already tipped in favor of disclosure, 8 has two steps. Under the first step, the custodian must assess whether the information contained in the requested document is of a personal or intimate nature such that

2
This office and the leading commentators on the FOIA have observed that personnel files usually include: employment applications; school transcripts; payroll-related documents, such as information about reclassifications, promotions, or demotions; transfer records; health and life insurance forms; performance evaluations; recommendation letters; disciplinary-action records; requests for leave-without-pay; certificates of advanced training or education; and legal documents, such as subpoenas. E.g., Ark. Op. Att’y Gen. 97-368; John J. Watkins, et al., THE ARKANSAS FREEDOM OF INFORMATION ACT 205–06 (Arkansas Law Press, 6th ed., 2017). 3 A.C.A. § 25-19-105(b)(12): “It is the specific intent of this section that the following shall not be deemed to be made open to the public under the provisions of this chapter….[p]ersonnel records to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy.” 4 A.C.A. § 25-19-105(c)(1): “[A]ll employee evaluation or job performance records, including preliminary notes and other materials, shall be open to public inspection only upon final administrative resolution of any suspension or termination proceeding at which the records form a basis for the decision to suspend or terminate the employee and if there is a compelling public interest in their disclosure.” 5 E.g., Ark. Att’y Gen. Ops. 2015-072, 99-147; Watkins et al., supra, at 202.
6
Ark. Code Ann. § 25-19-105(b)(12).
7
308 Ark. 593, 826 S.W.2d 252 (1992).
8
Watkins et al. supra, at 208.
Mr. Alexander Sanders
Opinion No. 2023-078
Page 3

it gives rise to a greater than minimal privacy interest. 9 If it is only minimal, then the privacy interest will not overcome the fact that the scale is already tipped in favor of disclosure, and the record must be disclosed. But if the privacy interest is more than merely minimal, the custodian moves to the second step when he or she must determine whether the privacy interest is outweighed by the public’s interest in disclosure. 10 Because the exceptions must be narrowly construed, the person resisting disclosure bears the burden of showing that, under the circumstances, his privacy interests outweigh the public’s interests. 11 The fact that the subject of the records may consider release of the records an unwarranted invasion of personal privacy is irrelevant to the analysis because the test is objective. 12

3. Application. The custodian has properly identified the documents in your personnel file as
   personnel records because they pertain to you and do not evaluate your job performance. Even so, a disclosable document may contain discrete pieces of information that must be redacted to avoid a clearly unwarranted invasion of personal privacy. Importantly, the FOIA establishes a specific procedure for redacting public records: “The amount of information deleted shall be indicated on the released portion of the record and, if technically feasible, at the place in the record where the deletion was made.” 13 Here, the custodian has used a tool to whiteout the deleted material, and this makes it difficult to determine where deletions were made and how much information was deleted. The proper way to redact the exempt information would be to use a tool to blackout the deleted material. To comply with the FOIA, the custodian should change the manner in which these redactions have been made. In addition, there are a few instances of too much information being redacted. On page 1 of the submitted records, the custodian has incorrectly deleted your whole driver’s license, when only your driver’s license number, date of birth, home address, and expiration date are exempt. 14 Finally, the entry on page 5 for “person id” may need to be redacted. If this number qualifies as a “personal identification number,” then it must be redacted under A.C.A. §§ 25-19-105(b)(11) and -105(b)(12). 15

9
Young, 308 Ark. at 598, 826 S.W.2d at 255.
10
Id., 826 S.W.2d at 255.
11
Stilley v. McBride, 332 Ark. 306, 313, 965 S.W.2d 125, 128 (1998).
12
E.g., Ark. Att’y Gen. Ops. 2016-055, 2001-112, 2001-022, 94-198; Watkins et al., supra, at 207.
13
A.C.A. § 25-19-105(f)(3) (emphasis added).
14
Ark. Att’y Gen. Op. 2011-081. Arkansas driver’s licenses expire on the licensee’s birthday.
15
Ark. Att’y Gen. Op. 2015-057.
Mr. Alexander Sanders
Opinion No. 2023-078
Page 4

Assistant Attorney Jodie Keener prepared this opinion, which I hereby approve. Sincerely,

TIM GRIFFIN
Attorney General