Can an Arkansas FOIA custodian use whiteout to redact, and is redacting an entire driver's license image proper?
Plain-English summary
Mr. Sanders, a former Little Rock Police Department employee, learned that someone had submitted a FOIA request for his personnel file. As the subject of the records, he asked the AG to review the City of Little Rock's release decision. The custodian had classified the file as personnel records (correct) and intended to release with redactions. The AG found two problems with how the redactions were done.
Problem 1: Whiteout is the wrong redaction tool. FOIA at A.C.A. § 25-19-105(f)(3) says the amount of information deleted must be indicated on the released portion, and where technically feasible, at the place of deletion. Whiteout makes it impossible to tell where the deletions were or how much text was removed. The custodian needed to use a blackout-style redaction (a black box at the location of the deleted material) so the requester can see what was redacted and how much.
Problem 2: Over-redaction of the driver's license. The custodian redacted the whole image of Sanders's driver's license. Only four fields are exempt: license number, date of birth, home address, and expiration date. (Arkansas licenses expire on the licensee's birthday, so the expiration date would also reveal the date of birth.) Everything else on the license, including name, license class, and photo, must be released unredacted unless another exemption applies.
Possible third issue: "person id" entry. On page 5 of the records, an entry labeled "person id" should be checked. If that number qualifies as a "personal identification number" within A.C.A. § 25-19-105(b)(11), it must be redacted. The AG could not tell from the records alone whether the number qualifies, so the custodian needs to confirm.
This opinion is also a useful general statement of how Arkansas FOIA's redaction-procedure rule works: redactions must be visible and quantified, not invisible.
What this means for you
FOIA records custodians
Stop using whiteout. Switch to blackout. The black box at the location of each redaction tells the requester two things FOIA requires: where the deletion was made and how much was removed. Whiteout, blank lines that compress the text, or simply leaving the redacted material out of a re-typed copy all fail the rule.
When a personnel file contains an image of a driver's license, do not redact the whole image. The exempt fields under prior AG opinions are the license number, date of birth, home address, and expiration date. Block out only those fields. The name, photo, license class, and other non-exempt content stays.
Watch for fields labeled with internal-system names like "person id," "operator id," or "employee number." If the number is a personal identification number issued to the individual (especially one tied to identity verification), redact under § 25-19-105(b)(11) and -105(b)(12). If it is just an internal database key with no identity-verification function, it is likely not a PIN. When in doubt, redact and let the requester challenge.
Subjects of FOIA personnel-records requests
If your former employer is releasing your personnel file, you can ask the AG (under § 25-19-105(c)(3)(B)(i)) to review whether the release decision is consistent with FOIA. Common things to flag:
- Whether the records have been classified correctly (personnel record, evaluation record, or law enforcement investigative record).
- Whether the redactions show where and how much was removed (FOIA requires this).
- Whether more or less than the right amount has been redacted.
- Whether truly exempt items (PINs, home address, dates of birth, medical information, social security numbers) have been left in.
The AG's review is your only fast administrative remedy. You file with a copy to the custodian, and the AG decides quickly. If the custodian disagrees with the AG's opinion, the next step is court.
Note that being the subject of records and finding the release "embarrassing" or "unwelcome" does not, by itself, block disclosure. The privacy test is objective. But procedural and over-redaction errors are real grounds for challenge.
FOIA requesters
When you receive records back with whiteout, blank pages, or compressed text where redactions live, push back. The released portion must indicate the amount of information deleted and (where feasible) the place. Ask the custodian to re-release using blackout-style redaction so you can see scope of the redaction.
If a driver's license image was returned fully redacted, ask for a re-release with only the four exempt fields blacked out.
City and county attorneys advising local custodians
Train your records personnel on the redaction-procedure rule. Many custodians treat redaction as "make the exempt material disappear," which fails FOIA. The correct mental model is "show that material was removed, show how much, but not the content." Black box, then release. Whiteout is fine for a working draft, not for a FOIA response.
Common questions
My agency uses whiteout because we don't have software that does black redaction. Is that an excuse?
No. The FOIA rule says "if technically feasible, at the place in the record where the deletion was made." Drawing a black rectangle by hand on a paper copy is technically feasible. The rule is not waived by the absence of redaction software.
The requester complained the redactions are not visible. Can I just retype the document with the redacted text removed?
Not by itself. The released portion must "indicate the amount of information deleted." Re-typing without indicating where and how much was removed fails the rule. If you are re-typing, mark the redactions with bracketed length markers like "[REDACTED, 12 characters]" or insert visible black blocks.
The personnel record contains an image of the employee's driver's license. Can I redact it entirely?
No. Only license number, date of birth, home address, and expiration date are exempt. Photo, name, license class, restrictions, and other content must be released. The expiration date is exempt because Arkansas licenses expire on the licensee's birthday, so the expiration date would reveal the protected date of birth.
What about social security numbers, medical information, and addresses?
SSNs and medical information have separate exemptions and should be redacted. Home addresses of public employees are typically exempt under PIN/home-address protections. Work addresses are not. Phone numbers depend on whether they are work or personal.
The records mention an "OPS number" or "case number." Is that a personal identification number?
Probably not. Internal case-tracking numbers are not personal identification numbers in the FOIA sense. PINs are numbers issued to the individual that function as identity verification (driver's license number, SSN, employee ID used for system access). Internal case IDs that just refer to the matter are not PINs.
As a former employee, do I have any extra rights here?
You can ask the AG to review the release decision under § 25-19-105(c)(3)(B)(i). That is the same right granted to the custodian and the requester. Your status as the subject does not, however, give you a veto over disclosure. Even if you object, properly classified personnel records may still be released after the Young v. Rice balancing test runs its course.
Background and statutory framework
Arkansas FOIA distinguishes between personnel records (A.C.A. § 25-19-105(b)(12)) and employee evaluation/job performance records (A.C.A. § 25-19-105(c)(1)). Personnel records use the Young v. Rice balancing test (privacy interest vs. public interest, scale tipped toward disclosure). Evaluation records use a four-part test (suspension or termination, administrative finality, relevance, compelling public interest).
The redaction-procedure rule, A.C.A. § 25-19-105(f)(3), requires that "the amount of information deleted shall be indicated on the released portion of the record and, if technically feasible, at the place in the record where the deletion was made." This rule applies regardless of which exemption supports the redaction. It exists so requesters can see scope of withholding and challenge over-redaction.
Two driver's license-related opinions support the four-fields rule: Op. 2011-081 holds that license number, date of birth, home address, and expiration date are exempt; everything else on the license is not. The expiration date is exempt because Arkansas licenses expire on the licensee's birthday.
Personal identification numbers are exempt under § 25-19-105(b)(11). Op. 2015-057 illustrates the analysis. The PIN exemption captures numbers tied to individual identity, not internal case-tracking IDs.
The subject-request mechanism in § 25-19-105(c)(3)(B)(i) is unique to certain employee-related records. The custodian, the requester, or the subject of the records may seek an AG opinion. The AG's opinion is persuasive but not binding; the next step is judicial review.
Citations
- A.C.A. § 25-19-103(7)(A) (definition of public records)
- A.C.A. § 25-19-105(b)(11) (personal identification numbers exemption)
- A.C.A. § 25-19-105(b)(12) (personnel records exemption)
- A.C.A. § 25-19-105(c)(1) (employee evaluation records exemption)
- A.C.A. § 25-19-105(c)(3)(B)(i) (subject's right to AG review)
- A.C.A. § 25-19-105(f)(3) (redaction-procedure rule)
- Young v. Rice, 308 Ark. 593, 826 S.W.2d 252 (1992) (balancing test)
- Stilley v. McBride, 332 Ark. 306, 965 S.W.2d 125 (1998) (burden on party resisting disclosure)
- Ark. Att'y Gen. Ops. 2016-055, 2015-072, 2015-057, 2011-081, 2001-112, 2001-022, 97-368, 94-198
Source
Original opinion text
Opinion No. 2023-078
August 22, 2023
Mr. Alexander Sanders
c/o Ms. Theresa Morris, Assistant City Attorney
City of Little Rock
500 West Markham Street, Suite 310
Little Rock, Arkansas 72201
Dear Mr. Sanders:
You have requested my opinion regarding the Arkansas Freedom of Information Act ("FOIA"). Your request, which is made as the subject of the records, is based on A.C.A. § 25-19-105(c)(3)(B)(i). The FOIA authorizes the custodian, requester, or the subject of certain employee-related records to seek an opinion from this office stating whether the custodian's decision regarding the release of such records is consistent with the FOIA.
You say that someone has submitted a FOIA request for your personnel file from the Little Rock Police Department, your previous employer. The custodian has classified your personnel file as personnel records and intends to release them with redactions. You ask whether the custodian's decision to disclose these records is consistent with the FOIA.
RESPONSE
Having reviewed the records at issue, it is my opinion that the custodian's decision to release the redacted records is partially consistent with the FOIA. The custodian's redaction method is inconsistent with the FOIA, and some of the information in the records should not be redacted.
DISCUSSION
-
General rules. A document must be disclosed in response to a FOIA request if all three of the following elements are met. First, the FOIA request must be directed to an entity subject to the act. Second, the requested document must constitute a public record. Third, no exceptions allow the document to be withheld. Here, the first two elements are met. The request was made to a city police department, which is a public entity and is subject to the FOIA. And the documents I reviewed are public records.
-
Exceptions to disclosure. The FOIA contains two exemptions for two groups of documents normally found in employees' personnel files. For purposes of the FOIA, these items can usually be divided into two mutually exclusive groups: "personnel records" or "employee evaluation or job performance records." The test for whether these two types of documents may be released differs significantly. When custodians assess whether either of these exceptions applies to a particular record, they must first decide whether the record meets the definition of the relevant exception and then apply the appropriate test to determine whether the FOIA requires that record be disclosed. Because the records at issue here are all personnel records, I will confine my analysis to that exemption.
While the FOIA does not define the term "personnel records," this office has consistently opined that "personnel records" are all records other than "employee evaluation or job-performance records" that pertain to individual employees. Whether a particular record meets this definition is a question of fact that requires one to review the record itself.
A personnel record is open to public inspection and copying except "to the extent that disclosure would constitute a clearly unwarranted invasion of personal privacy."
While the FOIA does not define the phrase "clearly unwarranted invasion of personal privacy," the Arkansas Supreme Court has provided some guidance. In Young v. Rice, the Court applied a balancing test that weighs the public's interest in accessing the records against the individual's interest in keeping them private. The balancing test, which takes place with the scale already tipped in favor of disclosure, has two steps. Under the first step, the custodian must assess whether the information contained in the requested document is of a personal or intimate nature such that it gives rise to a greater than minimal privacy interest. If it is only minimal, then the privacy interest will not overcome the fact that the scale is already tipped in favor of disclosure, and the record must be disclosed. But if the privacy interest is more than merely minimal, the custodian moves to the second step when he or she must determine whether the privacy interest is outweighed by the public's interest in disclosure.
Because the exceptions must be narrowly construed, the person resisting disclosure bears the burden of showing that, under the circumstances, his privacy interests outweigh the public's interests. The fact that the subject of the records may consider release of the records an unwarranted invasion of personal privacy is irrelevant to the analysis because the test is objective.
- Application. The custodian has properly identified the documents in your personnel file as personnel records because they pertain to you and do not evaluate your job performance. Even so, a disclosable document may contain discrete pieces of information that must be redacted to avoid a clearly unwarranted invasion of personal privacy.
Importantly, the FOIA establishes a specific procedure for redacting public records: "The amount of information deleted shall be indicated on the released portion of the record and, if technically feasible, at the place in the record where the deletion was made." Here, the custodian has used a tool to whiteout the deleted material, and this makes it difficult to determine where deletions were made and how much information was deleted. The proper way to redact the exempt information would be to use a tool to blackout the deleted material. To comply with the FOIA, the custodian should change the manner in which these redactions have been made.
In addition, there are a few instances of too much information being redacted. On page 1 of the submitted records, the custodian has incorrectly deleted your whole driver's license, when only your driver's license number, date of birth, home address, and expiration date are exempt.
Finally, the entry on page 5 for "person id" may need to be redacted. If this number qualifies as a "personal identification number," then it must be redacted under A.C.A. §§ 25-19-105(b)(11) and -105(b)(12).
Assistant Attorney Jodie Keener prepared this opinion, which I hereby approve.
Sincerely,
TIM GRIFFIN
Attorney General