Would a school board be liable under FOIA if a remote member’s security breach exposed closed-session information?

Plain-English summary

In 2019, South Carolina's Attorney General said a school board would not become liable for a security breach solely because disclosed information had been discussed in executive session. FOIA's exemptions and executive-session rule let a public body withhold or privately discuss certain material; they did not themselves create a special duty to keep that material confidential. The question concerned a proposed Beaufort County School Board policy allowing electronic participation.

The opinion did not treat every disclosure as harmless. If a breach exposed information confidential for some other reason, a claimant might assert contract or negligence claims. The AG said the South Carolina Tort Claims Act and legislative immunity could limit liability in many scenarios, but the opinion could not decide the many possible fact patterns. It also cautioned that privileged material, including attorney-client communications, raised separate concerns.

Currency note

This opinion was issued in 2019. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Did FOIA itself make a board liable whenever executive-session information leaked? A: No. The AG said FOIA created no special confidentiality duty simply because information was exempt from disclosure or discussed in closed session.

Q: Did the opinion rule out all liability for a remote-access breach? A: No. It said contract or negligence claims could arise if otherwise confidential material was exposed, depending on the facts.

Q: Could one board member alone waive attorney-client privilege? A: The AG cited authority that waiver belonged to the public body as a whole.

Q: Did the AG decide whether Beaufort’s planned electronic-participation policy was safe? A: No. It addressed the legal effect of a hypothetical breach and left particular claims and facts unresolved.

Background and statutory framework

The district's counsel asked about potential liability from remote participation in an executive session. The AG relied on a South Carolina Supreme Court decision holding that FOIA's exemptions did not impose a duty not to disclose. It then distinguished liabilities arising under other law and discussed statutory and common-law limits on government liability without resolving a particular security incident.

Citations and references

• S.C. Code Ann. § 30-4-40 and S.C. Code Ann. § 30-4-70: FOIA exemptions and executive sessions.
• S.C. Code Ann. § 15-78-40 and S.C. Code Ann. § 15-78-60: Tort Claims Act provisions discussed by the AG.

Source

• Landing page: https://www.scag.gov/opinions/opinions-archive/october-21-2019/
• Original PDF: https://www.scag.gov/wp-content/uploads/2019/10/CartledgeW-OS-10408-FINAL-Opinion-10-21-2019-02120925xD2C78-02126037xD2C78.pdf

Original opinion text

Best-effort transcription from a scanned PDF. Minor errors may remain — the linked PDF is authoritative.

ALAN WILSON
ATTORNEY GENERAL

October 21, 2019

Wendy Bergfeldt Cartledge, Esq.
General Counsel

Beaufort County School District
Post Office Drawer 309
Beaufort, SC 29901-0309

Dear Ms. Cartledge:

Attorney General Alan Wilson has referred your letter to the Opinions section. The request letter reads as follows:

The Beaufort County Board of Education (the “Board") is in the process of reviewing and revising Board policies and has had the first reading on the policy involving Electronic Participation in Board meetings and has requested that I, on its behalf, seek an expedited opinion regarding whether the Board has any liability if confidential information discussed in Executive Session is disclosed due to a security breach resulting from electronic participation by an individual Board member.

Law/Analysis

It is this Office’s opinion that the Board would not be liable if information it discussed in an executive session becomes disclosed by a security breach solely because it was discussed in an executive session. The S.C. Freedom of Information Act (“S.C. FOIA”) does not create a special duty of confidentiality for items which a public body may exempt from disclosure, S.C. Code Ann. § 30-4-40, or for information that is discussed in a meeting closed to the public in executive session, S.C. Code Ann. § 30-4-70. If otherwise confidential materials are disclosed as the result of a hypothetical security breach, potential breach of contract or negligence claims could be asserted against the Board. While this opinion cannot comprehensively discuss the myriad of ways such claims may ultimately be presented and resolved, the South Carolina Tort Claims Act, S.C. Code Ann. §§ 15-78-10 to —220, and common law principles of legislative

• immunity would apply in many such scenarios to limit the Board’s liability.

RemBerT C. DENNIS BUILDING © POST OFFICE BOX 11549 » COLUMBIA, SC 29211-1549 « TELEPHONE 803-734-3970 © FACSIMILE 803-253-6283

Wendy Bergfeldt Cartledge, Esq.
Page 2
October 21, 2019

In Bellamy v. Brown, 305 S.C. 291, 408 S.E.2d 219 (1991), the South Carolina Supreme Court held that the S.C. FOIA does not create a duty of confidentiality. Bellamy was fired from her position as Executive Director of the Horry County Council on Aging (“HCCOA”). After she was fired, two members of the board of the HCCOA made comments to a reporter which included details of the board’s deliberations in executive session. 305 S.C. at 292, 408 S.E.2d at 219-220. Bellamy alleged a breach of a S.C. FOIA duty of confidentiality under S.C. Code Ann.
§§ 30-4-40(a)(1),(2) and 30-4-70(a)(1). Section 30-4-40(a)(1) allows a public body to exempt trade secrets from disclosure under the S.C. FOIA. See Campbell v. Marion Cty. Hosp. Dist., 354 S.C. 274, 281-287, 580 S.E.2d 163, 166-170 (Ct. App. 2003) (construing trade secrets exception to S.C. FOIA). Similarly, Section 30-4-40(a)(2) allows a public body to exempt “information of a personal nature where the public disclosure thereof would constitute unreasonable invasion of personal privacy.” Finally, Section 30-4-70(a) permits a public body to hold a meeting closed to the public, in executive session, for the following reasons:

(1) Discussion of employment, appointment, compensation, promotion, demotion, discipline, or release of an employee, a student, or a person regulated by a public body or the appointment of a person to a public body; however, if an adversary hearing involving the employee or client is held, the employee or client has the right to demand that the hearing be conducted publicly. Nothing contained in this item shall prevent the public body, in its discretion, from deleting the names of the other employees or clients whose records are submitted for use at the hearing.

(2) Discussion of negotiations incident to proposed contractual arrangements and proposed sale or purchase of property, the receipt of legal advice where the legal advice relates to a pending, threatened, or potential claim or other matters covered by the attorney-client privilege, settlement of legal claims, or the position of the public agency in other adversary situations involving the assertion against the agency of a claim.

(3) Discussion regarding the development of security personnel or devices. (4) Investigative proceedings regarding allegations of criminal misconduct. (5) Discussion of matters relating to the proposed location, expansion, or the

provision of services encouraging location or expansion of industries or other businesses in the area served by the public body.

Wendy Bergfeldt Cartledge, Esq.
Page 3
October 21, 2019

(6) The Retirement System Investment Commission, if the meeting is in executive session specifically pursuant to Section 9-16-80(A) or 9-16-320(C).

S.C. Code Ann. § 30-4-70. The Bellamy Court found the United States Supreme Court’s holding in Chrysler Corp. v. Brown, 441 U.S. 281 (1979), that exceptions under the federal FOIA cannot be used to enforce the confidentiality of records, persuasive and applicable by analogy to the S.C. FOIA. The Bellamy Court stated “the essential purpose” of the federal FOIA and S.C. FOIA are the same and concluded:

[T]he exemptions from disclosure contained in §§ 30-440 and —70 do not create a duty not to disclose. These exemptions, at most, simply allow the public agency the discretion to withhold exempted materials from public disclosure. No legislative intent to create a duty of confidentiality can be found in the language of the Act. We hold, therefore, that no special duty of confidentiality is established by the FOIA.

305 S.C. 291, 295, 408 S.E.2d 219, 221 (1991); see also Herald Pub. Co. v. Barnwell, 291 S.C. 4, 12, 351 S.E.2d 878, 883 (Ct. App. 1986) (“The [S.C. FOIA] contains no language prohibiting
... the publication of proceedings conducted in an executive session.”). Therefore, according to the holding in Bellamy, the Board would not be liable if information it discussed in an executive session becomes disclosed by a security breach solely because it was discussed in an executive session.

If otherwise confidential materials are disclosed as the result of a hypothetical security breach, breach of contract or negligence claims could be asserted against the Board. The South Carolina Tort Claims Act (“TCA”), S.C. Code Ann. §§ 15-78-10 —220, and common law principles of legislative immunity would likely limit the Board’s liability under many scenarios for such a security breach and resulting disclosures. In Repko v. County of Georgetown, 424 S.C. 494, 499, 818 S.E.2d 743, 746 (2018), the South Carolina Supreme Court discussed a county’s liability in regards to a complaint that it “negligently and grossly negligently failed to comply with or enforce its rules, regulations and written policies ...” The Court explained that in negligence actions, it must be determined, as a matter of law, whether the defendant owes a duty of care to the plaintiff. 424 S.C. at 500, 818 S.E.2d at 747; see also Hendricks v. Clemson Univ., 353 S.C. 449, 456, 578 S.E.2d 711, 714 (2003) (discussing creation of “an affirmative legal duty”). The Court held, however, that “even if such a duty was created [as to Repko], the County is immune from liability to Repko under ... the TCA.” Id. The TCA is the “exclusive civil remedy available for any tort committed by a government entity...” Health Promotion Specialists, LLC v. S.C. Bd. of Dentistry, 403 S.C. 623, 635, 743 S.E.2d 808, 814 (2013). The TCA states, “The State, an agency, a political subdivision, and a governmental entity are liable for their torts in the same manner and to the same extent as a private individual under like circumstances, subject to the limitations upon liability and damages, and exemptions from

Wendy Bergfeldt Cartledge, Esq.
Page 4 .
October 21, 2019

liability and damages, contained herein.” S.C. Code Ann. § 15-78-40. The TCA then lists forty exceptions to this waiver of sovereign immunity. See S.C. Code Ann. § 15-78-60. Several of these exceptions include per se immunity, such as for legislative action or inaction in subsection (1), while others contain a gross negligence standard. The Repko Court held that “when an applicable exception to the waiver of immunity contains a gross negligent standard, that gross negligence standard must be read into all other applicable exceptions that do not contain a gross negligence standard.” 424 S.C. at 504, 818 S.E.2d at 749 (emphasis in original). Therefore, the TCA may well provide either per se immunity to the Board or apply a gross negligence standard of care in those scenarios where confidential information is disclosed from a security breach. Moreover, the South Carolina Supreme Court has repeatedly held that, in addition to the TCA, the common law principles of legislative immunity continue to shield “members of legislative bodies for acts in the performance of their duties.” Richardson v. McGill, 273 S.C. 142, 146, 255 S.E.2d 341, 343 (1979); see also Health Promotion Specialists, LLC, 403 S.C. at 637, 743 S.E.2d at 815 (stating the TCA has not “supplanted” the doctrine of legislative immunity).

Conclusion

As is discussed more fully above, it is this Office’s opinion that the Board would not be liable if information it discussed in an executive session becomes disclosed by a security breach solely because it was discussed in an executive session. The S.C. Freedom of Information Act (S.C. FOIA”) does not create a special duty of confidentiality for items which a public body may exempt from disclosure, S.C. Code Ann. § 30-4-40, or for information that is discussed in a meeting closed to the public in executive session, S.C. Code Ann. § 30-4-70. Of course, this conclusion does not encourage any breach of confidentiality of an executive session particularly where longstanding privileges such as that of attorney-client are involved. The South Carolina Supreme Court has held that only the public body, as a whole, can authorize the waiver of attorney-client privilege. Wilson v. Preston, 378 S.C. 348, 359, 662 S.E.2d 580, 585 (2008) (“[T]he Council, as a whole, is authorized to release that information and has to waive the privilege before an individual council member can review privileged documents.”). Generally speaking, the body itself, or a majority thereof, rather than one member, should make the decision to waive confidentiality.

If otherwise confidential materials are disclosed as the result of a hypothetical security breach, potential breach of contract or negligence claims could be asserted against the Board. While this opinion cannot comprehensively discuss the myriad of ways such claims may ultimately be presented and resolved, the South Carolina Tort Claims Act, S.C. Code Ann. §§ 15-78-10 —220, and common law principles of legislative immunity would apply in many such scenarios to limit the Board’s liability.

Wendy Bergfeldt Cartledge, Esq.
Page 5
October 21, 2019

Sincerely,

Matthew Houck
Assistant Attorney General

REVIEWED AND APPROVED BY:

Sbeft D. Cook -
Solicitor General