Can a Delaware FOIA request force a state agency to write custom database queries and review thousands of police reports to compile statistics that don't already exist?

Official title

20-IB12 3/17/2020 FOIA Opinion Letter to Mr. Scott Becker re: FOIA Complaint Concerning the Delaware Criminal Justice Information System

Plain-English summary

Scott Becker asked DELJIS, the Delaware Criminal Justice Information System, to produce statistics for 2015 through 2018 about firearm-related concealed-deadly-weapon arrests, indictments, plea outcomes, and convictions, with several specific exclusions. DELJIS denied the request on two grounds: that producing the numbers would require it to create a new record (which FOIA does not compel), and that the underlying data fell within the criminal-history exemption. Becker also argued DELJIS should have contacted other agencies (the State Bureau of Identification and the Statistical Analysis Center) that he believed already had related data.

The AG agreed with DELJIS. DELJIS had no obligation under Delaware FOIA to seek out records held by other agencies it does not control. And because answering Becker's request would have required DELJIS to query several databases, manually review police narratives, correct errors, and de-identify results, the work crossed the line from producing existing records to building a new one. The opinion estimated that even just the programming side would have taken about 150 hours.

Currency note

This opinion was issued in 2020. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Background and statutory framework

DELJIS operates the computer hardware, software, and network for CJIS, a set of databases compiling criminal information across Delaware. Its enabling statute is 11 Del. C. § 8502, and it shares space with confidentiality rules under 11 Del. C. Chapters 85 and 86 and 1 Del. Admin. Code § 1300.

Two FOIA principles drove the result:

1. The "no new record" rule. Under prior AG opinions, FOIA requires public bodies to give access to existing public records but does not require them to answer questions, compile data from multiple sources, write programming, or manually input data to create a new record. A simple Excel export of existing data is fine; a fresh aggregation that requires database programming is not. The AG cited a string of opinions, including 17-IB11, 17-IB32, 18-IB51, and 96-IB28.

2. The "noncustodial records" rule. 29 Del. C. § 10003(a) and (j)(1) require a public body to give access to records it has and to noncustodial records under its control. But it does not require a public body to chase down records held by separate agencies it does not administer. Parker v. Brady, 2006 WL 306930 (Del. Super. 2006), confirmed that point.

DELJIS also pointed to 11 Del. C. § 8610, which sets up a separate research-access process for criminal-history data through agency agreements. The AG did not need to reach the criminal-history exemption (29 Del. C. § 10002(l)(3) and (l)(4)) because the new-record reasoning resolved the petition.

Common questions

Q: If the data is sitting in a database, isn't asking for it the same as asking for any other public record?
A: According to this opinion, no. The AG distinguished between exporting an existing field or table to a spreadsheet (allowed under the prior 17-IB32 opinion) and writing custom queries that join multiple tables, applying additional filters, manually correcting errors, and de-identifying output. The first is access to existing records. The second produces a new dataset, which the AG concluded FOIA does not compel.

Q: Could Becker have gotten the statistics another way?
A: The opinion noted that 11 Del. C. § 8610 establishes a separate process for research, evaluative, or statistical access to CJIS data, with an agency agreement and approved purposes. That track, rather than FOIA, was the AG's pointer for statistical research access at the time.

Q: Why didn't DELJIS have to ask SBI or the Statistical Analysis Center for the data?
A: Because, as the AG accepted, DELJIS does not control either of those entities. The Statistical Analysis Center sits inside the Criminal Justice Council, and the State Bureau of Identification is part of the Delaware State Police. Under FOIA, a public body's duty extends to records under its custody or control, not records of separate agencies that happen to have related information.

Q: Did this opinion say DELJIS could never be required to compile statistics?
A: It did not go that far. The AG reaffirmed that each request must be assessed on its specific facts and noted that what counts as creating a new record may shift as technology evolves. The decisive facts here were the multi-database query, the manual police-narrative review, and the de-identification step.

Q: What about the Gannett litigation, which involved CJIS data and seemed to favor disclosure?
A: DELJIS argued, and the AG accepted, that Gannett was settled through a stipulated arrangement using scrambled identifiers and an indemnity, not as a binding precedent that DELJIS must produce comparable datasets in every later case. The 2002 Superior Court decision, 808 A.2d 453, also recognized that not every CJIS field is automatically exempt, but the dispositive question in 20-IB12 was the new-record point, not exemption.

Citations

• 29 Del. C. §§ 10001-10007 (Delaware FOIA)
• 29 Del. C. § 10002(j) (noncustodial records)
• 29 Del. C. § 10002(l)(3) (investigatory files exemption)
• 29 Del. C. § 10002(l)(4) (criminal files exemption)
• 29 Del. C. § 10003(a) and (j)(1) (access duties)
• 29 Del. C. § 10005 and § 10005(c) (FOIA petition; public body burden of proof)
• 11 Del. C. § 8502 (DELJIS authority)
• 11 Del. C. § 8610 (research access to criminal-history data)
• 11 Del. C. Chapters 85 and 86; 1 Del. Admin. Code § 1300 (criminal-history record information)
• 11 Del. C. § 1442 (carrying a concealed deadly weapon)
• Gannett Co., Inc. v. Bd. of Managers of the Del. Crim. Justice Info. Sys., 840 A.2d 1232 (Del. 2003)
• Bd. of Managers of the Del. Justice Info. Sys. v. Gannett Co., 808 A.2d 453 (Del. Super. 2002)
• Parker v. Brady, 2006 WL 306930 (Del. Super. Jan. 5, 2006)

Source

• Landing page: https://attorneygeneral.delaware.gov/2020/03/17/20-ib12-3-17-2020-foia-opinion-letter-to-mr-scott-becker-re-foia-complaint-concerning-the-delaware-criminal-justice-information-system/
• Original PDF: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2020/03/Attorney-General-Opinion-No.-20-IB12.pdf

Original opinion text

PRINT VERSION: Attorney General Opinion No. 20-IB12

OFFICE OF THE ATTORNEY GENERAL OF THE STATE OF DELAWARE

Attorney General Opinion No. 20-IB12

March 17, 2020

VIA EMAIL

Mr. Scott Becker

[email protected]

RE: FOIA Petition Regarding the Delaware Criminal Justice Information System

Dear Mr. Becker:

We write in response to your correspondence alleging that the Delaware Criminal Justice Information System ("DELJIS") violated Delaware's Freedom of Information Act, 29 Del. C. §§ 10001-10007 ("FOIA"). We treat your correspondence as a Petition for a determination pursuant to 29 Del. C. § 10005 regarding whether a violation of FOIA has occurred or is about to occur in connection with your records request. As discussed more fully herein, we determine that DELJIS has not violated FOIA as alleged.

BACKGROUND

DELJIS operates, manages, and maintains the computer hardware, software, and communication network for the Criminal Justice Information System ("CJIS"), which comprises several databases compiling a wide range of criminal information. [1] This Petition disputes DELJIS's response to your request for the following items from CJIS:

A. From calendar year 2015 up to and including calendar year 2018, how many individuals: (1) were arrested and charged with Delaware Code, Title 11, Chapter 5, Subchapter VII, 1442 where the concealed deadly weapon was a firearm. (1a) Exclude the following violations: (1a.1) Delaware Code, Title 11, Chapter 5, Subchapter 2: 631, 632, 633, 634, 635, 636, 770, 771, 772, 773, 774, 781, 782, 783, 783A (1a.2) Delaware Code, Title 11, Chapter 5, Subchapter 3: 801, 802, 803, 826, 832 (1b) All other violations of the Delaware Code can be included. (2) How many individuals were subsequently indicted as described in (1)? (3) How many individuals pleaded guilty to lesser included offenses as described in (1)? (4) How many individuals were convicted of the original charges as described in (1)? How many individuals have become subject to orders pursuant to and described by Delaware Code, Title 10, Chapter 77, 7703 and 7704 since June 27, 2018? [2]

On January 14, 2020, DELJIS denied your request indicating FOIA does not require a public body to create records that do not already exist nor does FOIA require a public body to create new records through a "computer run." [3] Additionally, DELJIS indicated that these records were exempt as investigatory files compiled for purposes of criminal or civil law enforcement under 29 Del. C. § 10002(l)(3) and are within the definition of "criminal history record information" pursuant to 11 Del. C. Chapters 85 and 86 and 1 Del. Admin. Co. § 1300.

This Petition followed, presenting two arguments why this response was improper under FOIA. First, you contend that public records responsive to your request exist, as the Statistical Analysis Center's 2014-18 crime report has the offense and arrest data from the State Bureau of Identification, and therefore, under 29 Del. C. § 10002(j), DELJIS "was required to contact other agencies to fulfill [your] request." [4] Also, you argue that because the request did not seek any individual's identifying information or investigatory files, DELJIS violated 29 Del. C. § 10002(l)(3) and 29 Del. C. § 10002(l)(4) by refusing access to the requested records.

DELJIS, through its legal counsel, answered the Petition by letter dated January 29, 2020 ("Response"). First, DELJIS argues that it has no obligation to contact another entity to search for records, as FOIA requires a request be submitted to the custodian of records for the "appropriate public body," and 29 Del. C. § 10002(j), which requires a public body to seek noncustodial records, is inapplicable as this provision does not require DELJIS to request records from a public body "that it does not control." [5] DELJIS explains that the Statistical Analysis Center ("SAC") is located within the Criminal Justice Council ("CJC") and that "DELJIS does not control the CJC, the SAC or the State Bureau of Identification ("SBI"), a unit of the Delaware State Police," nor does DELJIS have "actual, constructive, or administrative control over any reports prepared by the SAC." [6] Second, DELJIS asserts that FOIA does not require a public body to create a new record in response to a FOIA request, arguing DELJIS is not required to compile requested data from other records that may exist, including converting data into a new format, creating programming, or conducting a database search using requested search criteria. DELJIS states "[e]ven if DELJIS was able to query its database for these requested fields and return a new document within those parameters, DELJIS is not required to do so under FOIA." [7] Finally, DELJIS asserts you are not entitled to these records because the records constitute investigatory files, criminal history and arrest records, which are exempt under FOIA. DELJIS argues to the extent the requested records pertain to criminal history and arrest records, they may also be exempt pursuant to 29 Del. C. § 10002(l)(4) and even if DELJIS was obligated to query its records, "the information derived from a search would likely fall within this exception." [8]

By supplemental submission dated February 28, 2020, DELJIS, through its counsel, clarified two items. First, DELJIS represents "the data sought by Petitioner cannot be provided using existing functions and existing programming nor can data fields in their existing format be provided to Petitioner." [9] To fulfill your request, DELJIS asserts that it would be required to engage in "extensive computer programming." [10] DELJIS explains that in order to begin responding to your request it first must query numerous CJIS databases to produce an initial data batch. After extracting this data, DELJIS would then have to undertake a manual review of police reports to capture the property types and correct errors in the search. "DELJIS estimates that it could create a computer program for this search with at least one month of programming costs (approx. 150 hours), followed by costs for a manual review of police narratives or errors in the program." [11] DELJIS asserts "[d]ata would then need to be de-identified to protect any non-public information." [12] DELJIS states programming created in response to a previous settlement of the cases involving the Gannett Company's request for CJIS information was retired years ago and is not capable of capturing the data you seek. [13] Second, DELJIS states that because it cannot produce responsive records to review, it is unable to analyze the privacy interests implicated in the release of such data. DELJIS distinguishes the Gannett cases, noting that DELJIS cannot make the same assessment of the competing privacy interests here, as CJIS does not have the ability to create the requested data without extensive programming. Also, DELJIS asserts the Gannett cases are not precedential as those cases were settled by the parties' agreement to protect the data through the use of scrambled numbers and to indemnify DELJIS from any claims. Additionally, DELJIS noted that pursuant to 11 Del. C. § 8610, a requesting party may apply for access to certain data which would be approved only for specific purposes within the confines of an agency agreement. DELJIS notes that this process is also available to individuals and agencies for the express purpose of research, evaluative, or statistical activities pursuant to a specific agreement with a criminal justice agency. Finally, DELJIS argues it should not be required to disclose non-conviction data and that certain conviction data once expunged, is also improper to disclose.

DISCUSSION

CJIS maintains voluminous criminal information about the citizens of Delaware, and FOIA does not explicitly exempt all the contents of CJIS from disclosure. [14] When defending a denial of access to the CJIS records, DELJIS carries the burden of proof to justify its denial. [15]

The Petition in this case raises two primary arguments. First, the Petition alleges that records responsive to the request exist and DELJIS violated FOIA by not contacting other agencies to fulfill the request to obtain information purportedly in possession of other agencies. FOIA requires a request for records to be submitted to the custodian of the appropriate public body, and the public body must provide reasonable access to its public records, including its noncustodial records controlled by the public body but not within its possession. [16] DELJIS represents that it does not have any control over reports produced by the SAC, and both SBI and SAC are separate agencies outside of its control. In these circumstances, we find that DELJIS is not required to contact agencies outside of its control for records responsive to your request.

Second, you allege that DELJIS improperly denied your request under 29 Del. C. § 10002(l)(3) and 29 Del. C. § 10002(l)(4) because you do not seek any individual's identifying information or investigatory files; you only asked for statistical data from the database. FOIA requires citizens be given access to existing public records, including those maintained in an electronic format, but FOIA does not require a public body to answer questions or to create a new document in response to a records request. [17] FOIA does not mandate that a public body undertake computer programming to create a new record in response to a request, nor is a public body required to perform manual inputting of information to create responsive records. [18] However, a simple of exportation of data to a spreadsheet has been found not to constitute creating a new record. [19] This Office must closely examine the specific facts surrounding a request to determine if a request requires a new record be created. [20]

In this case, DELJIS emphasizes that this request cannot be fulfilled using CJIS's existing functioning or programming. DELJIS states that the request may not be completed by exporting the data fields into an Excel spreadsheet or by otherwise providing the existing data fields in their current format. Instead, responding to the request would require DELJIS to query numerous databases, and after extracting data from the separate databases, DELJIS would have to compile those records and perform a manual review of police reports to capture property types and correct errors. Data then would need to be de-identified to protect non-public information. Although DELJIS submits that it can develop programming to automate certain aspects of this process, we conclude FOIA does not require this. Because DELJIS would be required to query multiple databases and manually compile, sort, and correct this electronic information in order to fulfill your request, we find that this request requires DELJIS to create a new record.

CONCLUSION

For the reasons set forth above, we conclude that DELJIS did not violate FOIA as alleged.

Very truly yours,

/s/ Alexander S. Mackler

Alexander S. Mackler

Chief Deputy Attorney General

cc:

Lisa M. Morris, Deputy Attorney General

Dorey L. Cole, Deputy Attorney General

[1] 11 Del. C. § 8502; DELJIS's Letter dated Feb. 28, 2020.

[2] Petition.

[3] Id.

[4] Id.

[5] Response.

[6] Id.

[7] Id.

[8] Id.

[9] DELJIS's Letter dated Feb. 28, 2020.

[10] Id.

[11] Id.

[12] Id.

[13] See, e.g., Gannett Co., Inc. v. Bd. of Managers of the Del. Crim. Justice Info. Sys. , 840 A.2d 1232 (Del. 2003); Bd. of Managers of the Del. Crim. Justice Info. Sys. v. Gannett Co. , 2005 WL 2660049 (Del. Super. Sept. 6, 2005); Bd. of Managers of the Del. Crim. Justice Info. Sys. v. Gannett Co., 847 A.2d 1123 (Del. Super. 2004); Bd. of Managers of the Del. Crim. Justice Info. Sys. v. Gannett Co., 2003 WL 1579170 (Del. Super. Jan. 17, 2003) ; Bd. of Managers of the Del. Justice Info. Sys. v. Gannett Co. , 808 A.2d 453 (Del. Super. 2002); Bd. of Managers of the Del. Justice Info. Sys. v. Gannett Co. , 2001 WL 1752515 (Del. Super. Dec. 28, 2001); Gannett Co. v. Bd. of Managers of the Del. Crim. Justice Info. Sys., 768 A.2d 508 (Del. Super. 1999).

[14] Bd. of Managers of the Del. Justice Info. Sys. v. Gannett Co. , 808 A.2d 453, 464 (Del. Super. Sept. 30, 2002) ("If this Court were to deny access to these records absent a demonstrated privacy interest it would be in essence creating a 'DELJIS record' exception to disclosure under FOIA that is not evident in the statutory language."), rev'd on other grounds , Gannett Co., Inc. v. Bd. of Managers of the Del. Crim. Justice Info. Sys. , 840 A.2d 1232 (Del. 2003); Del. Op. Att'y Gen. 06-IB17, 2006 WL 2630107, at *8 (Aug. 21, 2006) ("Computerized databases may enhance the concerns about individual privacy, but the courts in the DELJIS litigation did not hold that the entire criminal history database was exempt from disclosure under FOIA, only certain data fields.").

[15] 29 Del. C. § 10005(c).

[16] 29 Del. C. § 10003(a), (j)(1); see also Parker v. Brady , 2006 WL 306930, at 2 (Del. Super. Jan. 5, 2006) (determining that the Attorney General had no duty to answer a FOIA request, as it "does not have custody or control over the disclosure" of the requested records); Del. Op. Att'y Gen. 17-IB58, 2017 WL 5649344, n. 23 (Nov. 8, 2017) ("To be clear, we do not interpret FOIA to require the Register of Wills to seek out records of another public body, including other departments and divisions within New Castle County that are separate and distinct from the Register of Wills. Of course, to the extent the Register of Wills can easily identify the custodian of certain records, we believe it would be consistent with Sections 10003(d)(1) and (g)(2) and an exercise of good faith for the Register of Wills to identify those public bodies and/or forward your request to them."); Del. Op. Att'y Gen. 17-IB23, 2017 WL 3426263, at 8 (July 14, 2017) ("However, FOIA does not obligate a public body to request records that it does not control.").

[17] Del. Op. Att'y Gen . 02-IB18, 2002 WL 32100328, at *1 (Aug. 19, 2002) ("Under FOIA, a public body is not required to create a document that does not exist.").

[18] Del. Op. Att'y Gen. 18-IB51, 2018 WL 6591816, at 2 (Nov. 20, 2018) (determining that a response requiring "DTI to undertake programming to 'yield a new dataset'" constitutes the creation of a new record and is not required under FOIA) (citation omitted); Del. Op. Att'y Gen . 17-IB32, 2017 WL 3426272, at 3 (July 25, 2017) (determining that a request requiring the manual inputting of information into a database is the creation of a new record); Del. Op. Att'y Gen. 17-IB11, 2017 WL 2917926, at 1 (Jun. 16, 2017) ("[i]n order to fulfill your request, a third party vendor would be required to engage in computer programming (i.e., 'write script'), thereby creating a record that does not already exist."); Del. Op. Att'y Gen. 07-IB19, 2007 WL 4732802, at 4 (Aug. 28, 2007) ("As for the tax billing information you most recently requested, our Office is satisfied that to provide you with such information would require extensive computer programming to create a new public record which FOIA does not require."); Del. Op. Atty. Gen. 96-IB28, 1996 WL 517455, at *2 (Aug. 8, 1996) ("FOIA does not require a public body 'to create a record' where the 'requested record does not exist,' nor does FOIA require a public body 'to compile the requested data from' other public records that may exist.") (citation omitted).

[19] Del. Op. Att'y Gen . 17-IB32, 2017 WL 3426272, at *3 (determining that the "mere exportation of existing data to a Microsoft Excel spreadsheet" is not the creation of a new record).

[20] Id. ("Each request for database records under FOIA must be assessed on its specific facts to determine whether the request is asking the public body to create a record, and those assessments may become more difficult over time as technology evolves.").