If a state agency stores its data in a database owned and operated by a private vendor, can a Delaware FOIA requester force the agency to hand over the database structure?

Plain-English summary

Lee Lifeng Hsu first asked the Delaware Department of Insurance for aggregated insurance claims and complaint data, market conduct examination reports, and related records. After the Department denied that request, he submitted a revised request for a list of databases it owned, used, or maintained and metadata describing database fields and structures. The revised request did not seek substantive data in the metadata.

The Department again said it had no responsive records. Its Deputy Insurance Commissioner swore that third parties owned, managed, and operated the databases and their metadata. The Department's response named State Based Systems (SBS) for complaints and producer licensing, SERFF for rate and form filings, and an Aithent database for fraud data.

The Chief Deputy AG concluded the Department did not violate FOIA. Under 29 Del. C. § 10003(a), an agency must give reasonable access to its public records, but no statute requires it to produce records it does not have. The opinion relied on the Department's sworn affidavit and on Vanella v. Duran for the proposition that an agency cannot be made to disclose what it does not control.

What this means for you

If you're a journalist or researcher trying to pry insurance data out of state regulators

The opinion holds that Delaware FOIA reaches only records a public body possesses or controls, not records housed in systems a third party owns and operates. The Department's affidavit noted that SBS and SERFF are publicly available online through NAIC, but the AG did not treat the existence of those public portals as part of its holding; it rested on the no-possession finding.

If you work in a state agency that uses third-party SaaS for record-keeping

The opinion found no violation based on the Deputy Insurance Commissioner's affidavit that the Department had no responsive records because third parties owned, managed, and operated the databases and their metadata. The Department's response named SBS, SERFF, and Aithent; the sworn statement supplied the basis for the AG's no-records finding.

If you're a Delaware citizen wondering why basic insurance market data isn't on a state website

The Department said SBS houses its complaint and producer-licensing data, SERFF its rate and form filings, and an Aithent database its fraud data. The AG found the Department had no responsive database metadata and was not required to provide records it did not possess or control. The opinion does not decide a request for other insurance data.

If you're an attorney representing a FOIA petitioner in similar circumstances

The opinion treats the agency's sworn affidavit as sufficient to establish non-possession. It holds that the Department "is not obligated under FOIA to provide records it does not possess or control," citing Vanella v. Duran. It cites Judicial Watch, Inc. v. Univ. of Del. for the point that an affidavit may be required to justify a denial in certain circumstances.

Common questions

Q: Does this opinion exempt all database structures from FOIA? A: No. The decision rests on the sworn statement that the Department had no responsive metadata because third parties owned, managed, and operated the databases and their metadata. It does not decide a request involving metadata a public body possesses or controls.

Q: Did the AG decide whether extracting information from a database creates a new record? A: No. The Department raised record creation in its responses, and Hsu disputed that point. The AG resolved the petition on the Department's sworn evidence that it did not possess or control the requested records. The opinion cites Vanella v. Duran for that possession point only.

Q: Could the Department have asked NAIC for the metadata and then turned it over? A: The AG did not examine whether the Department could obtain records from NAIC. It held that the Department was not obligated under FOIA to provide records it did not possess or control.

Q: What is SBS and SERFF, plain English?
A: The Department's response said NAIC manages SBS, which houses its insurance-complaint and producer-licensing data, and SERFF, which houses its rate and form filings. The response said both systems are publicly available online. The opinion does not describe access to their metadata.

Q: Why does the AG cite 18 Del. C. § 2406(a)?
A: The Department also raised that statute, which keeps fraud-investigation records confidential. The AG did not need to reach the fraud-records question because the no-possession finding disposed of the case.

Citations

• 29 Del. C. § 10003(a), public access to records
• 29 Del. C. § 10005(c), public body bears burden to justify denial
• 29 Del. C. § 10002(o)(3), investigatory files exemption (raised but not reached on merits here)
• 18 Del. C. § 2406(a): confidentiality of insurance fraud investigations
• Judicial Watch, Inc. v. Univ. of Del., 267 A.3d 996 (Del. 2021), affidavit standard for FOIA denial
• Vanella v. Duran, 2024 WL 5201305 (Del. Super. Dec. 23, 2024), cited for the possession-or-control point

Source

• Landing page: https://attorneygeneral.delaware.gov/2025/02/28/25-ib13-2-28-25-foia-opinion-letter-to-lee-lifeng-hsu-re-delaware-department-of-insurance/
• Original PDF: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2025/03/Attorney-General-Opinion-No.-25-IB13.pdf

Original opinion text

KATHLEEN JENNINGS
ATTORNEY GENERAL

DEPARTMENT OF JUSTICE
820 NORTH FRENCH STREET
WILMINGTON, DELAWARE 19801

CIVIL DIVISION (302) 577-8400
CRIMINAL DIVISION (302) 577-8500
DIVISION CIVIL RIGHTS & PUBLIC TRUST (302) 577-5400
FAMILY DIVISION (302) 577-8400
FRAUD DIVISION (302) 577-8600
FAX (302) 577-2610

OFFICE OF THE ATTORNEY GENERAL OF THE STATE OF DELAWARE
Attorney General Opinion No. 25-IB13
February 28, 2025

VIA EMAIL
Lee Lifeng Hsu
[email protected]

RE:

FOIA Petition Regarding the Delaware Department of Insurance

Dear Mr. Hsu:
We write in response to your correspondence alleging that the Delaware Department of Insurance violated Delaware's Freedom of Information Act, 29 Del. C. §§ 10001-10008 ("FOIA"). We treat your correspondence as a Petition for a determination pursuant to 29 Del. C. § 10005 of whether a violation of FOIA has occurred or is about to occur. For the reasons set forth below, we determine that the Department did not violate FOIA by denying access to the requested records.

BACKGROUND
On December 11, 2024, you submitted your first request to the Department seeking various data records related to insurance claims and complaints in Delaware. The request notes that it was inspired by a report produced by the Insurance Information Institute and the National Association of Insurance Commissioners ("NAIC") that highlights significant trends in this area. You seek to understand the specifics for Delaware. The request sought aggregated data for all insurance claims categorized by insurance type and with respect to homeowners' insurance, sought the number of homeowner insurance policies issued, number of homeowner insurance claims filed, aggregated consumer complaint data (including the nature of the complaint and resolution status), water intrusion claims and complaints, market conduct examination reports, and summary of enforcement actions. The following day, the Department denied access to the requested records, stating the Department is not required to answer questions or to create new reports or records. In

addition, the response stated, "[a]s an accommodation, please be advised that the Department has no responsive records to the FOIA request."1 On December 20, 2024, you submitted a revised request, noting that given modern database systems, neither extracting information based on specific criteria, querying an existing database, nor providing raw data constitutes creating a new record. You requested the following: 1.

2.

A list of the names of all databases owned, used, or
maintained by the Department in connection with insurance
matters. . . .
Metadata for the databases related to insurance complaints, fraud, auto insurance, and homeowner insurance. This metadata includes only the names and structures of the data fields (e.g., database names, table names, and field names) and does not contain any substantive data. . . .2

The Department responded on January 9, 2025, reiterating that FOIA does not require a public body to answer questions or to create new reports or records. The Department also noted that to the extent you seek insurance complaints in the second item, those records are exempt pursuant to 29 Del. C. § 10002(o)(3), and fraud investigatory records are exempt pursuant to 18 Del. C. § 2406(a). Finally, the Department stated, as an accommodation, it has no records responsive to this revised request. This Petition followed. In the Petition, you allege that your revised request was reasonable and in compliance with FOIA's standards. You contend the metadata and database descriptions do not fall under the cited exemptions for investigatory files and confidentiality, nor do they contain substantive investigatory data. Further, you assert that the Department's refusal to provide even basic database descriptions is an overbroad application of the exemptions and is inconsistent with the Delaware Supreme Court's guidance favoring transparency. You request that this Office review the December 20, 2024 FOIA request. On February 11, 2025, the Department, through its legal counsel, replied to the Petition and enclosed the affidavit of its Deputy Insurance Commissioner ("Response"). The affidavit states that the Deputy Commissioner adopts the facts and arguments in the Response. The Deputy Commissioner specifically attests that "the Department has no records responsive to the FOIA request because the databases and their respective metadata which house Department data are owned, managed, and operated by third parties."3 The Response states that the NAIC owns, 1

Petition.

2

Id.

3

Response, Aff. of Deputy Insurance Commissioner dated Feb. 11, 2025. The Response also states that the "Department databases related . . . 'to insurance complaints, fraud, auto insurance, and homeowner insurance' are all owned, operated, and managed by third parties." 2

operates, and manages State Based Systems ("SBS") which houses all the Department's data specific to insurance complaints and producer licensing; SBS is publicly available online. The Department asserts that NAIC also owns, operates, and manages the Systems for Electronic Rates and Forms Filing ("SERFF"), which houses all the Department's data and forms related to premium rate and form filings with respect to, among others, auto and home insurance; SERFF is publicly available online. The Department says that Aithent, another third-party provider, owns, operates, and manages the database that houses the Department's fraud data. Because the Department does not own, operate, or manage these databases, the Department asserts that it "does not have possession of and has no records with respect to any metadata from those databases."4

DISCUSSION
FOIA requires that citizens be provided reasonable access to and reasonable facilities for the copying of public records.5 The public body has the burden of proof to justify its denial of access to records.6 In certain circumstances, a sworn affidavit may be required to meet that burden.7 In this case, the Department provided its Response under oath and named the databases associated with your request.8 The Department provided a sworn statement from the Deputy Insurance Commissioner that "the Department has no records responsive to the FOIA request because the databases and their respective metadata which house Department data are owned, managed, and operated by third parties."9 The Department is not obligated under FOIA to provide records it does not possess or control.10 On the basis of this sworn evidence, we find that the Department did not violate FOIA by denying access to the requested records.

4

Response.

5

29 Del. C. § 10003(a).

6

29 Del. C. § 10005(c).

7

Judicial Watch, Inc. v. Univ. of Del., 267 A.3d 996 (Del. 2021).

8

We note that, although the Department denied the first item in your request for the list of databases, the Department, in this Response, references the three databases related to your request that the Department uses. See supra note 3. 9

Response, Aff. of Deputy Insurance Commissioner dated Feb. 11, 2025.

10

Vanella v. Duran, 2024 WL 5201305, at *6 (Del. Super. Dec. 23, 2024). 3

CONCLUSION
For the foregoing reasons, we conclude that the Department did not violate FOIA by denying access to the requested records.

Very truly yours,

__________
Daniel Logan
Chief Deputy Attorney General

cc:

Kathleen P. Makowski, Deputy Attorney General
Dorey L. Cole, Deputy Attorney General