Interesting Public Records Act Case
From Silverman v. Ariz. Well being Care Value Containment Sys., determined Thursday by the Arizona Courtroom of Appeals (in an opinion by Chief Choose Kent E. Cattani, joined by Choose Cynthia J. Bailey and Vice Chief Choose David B. Gass):
This public information case presents a slim subject of probably broad import. Arizona legislation doesn’t require a public entity to create any new report in response to a public information request. However does utilizing encryption to redact non-disclosable data saved in an digital database essentially represent creation of a brand new report? We maintain that it doesn’t.
This idea is especially vital in a case like this one, during which the general public entity makes use of non-disclosable information as a vital a part of its database construction (because the relational keys linking totally different tables). Thus, requiring the company to make use of a one-way cryptographic hash operate to redact the non-disclosable information—substituting a novel hashed worth that masks protected data with out destroying its operate within the database—is critical to make sure a requestor receives, to the extent attainable, a duplicate of the actual report. And since such encryption solely hides a restricted facet of the report—with out including to, aggregating, analyzing, or altering any of the underlying data—it doesn’t create something new and doesn’t consequence within the creation of a brand new report. Accordingly, and for causes that observe, we reverse the superior courtroom’s dismissal of the journalists’ public information lawsuit at subject right here and remand for additional proceedings in line with this opinion….
The Arizona Well being Care Value Containment System (“AHCCCS”) oversees the Arizona Lengthy-Time period Care System (“ALTCS”). Appellants Amy Silverman, Alex Devoid, and TNI Companions (d/b/a Arizona Day by day Star) are journalists researching points associated to providers for Arizonans with developmental disabilities, together with these providers supplied by ALTCS. Appellants are in search of public information from AHCCCS to be taught what elements have an effect on eligibility choices throughout the ALTCS utility and screening course of.
In February 2020, Appellants submitted a public information request for information in AHCCCS’s databases for a number of classes of data supplied in or associated to ALTCS purposes. Appellants acknowledged that healthcare-related data must be de-identified to adjust to privateness guidelines beneath the Well being Insurance coverage Portability and Accountability Act (“HIPAA”). Noting that the requested information is likely to be contained in a number of tables, Appellants requested that, for de-identified information, AHCCCS “embrace a novel identifier, similar to a hash key, to interchange” data obligatory to tell apart totally different people’ information. Appellants’ request expressly didn’t ask AHCCCS to “be a part of tables collectively … or to conduct any sort of study on the info,” supplied any present relational keys remained intact….
Appellants finally sued beneath the Arizona public information act, and here is how the courtroom of appeals analyzed this:
Underneath Arizona legislation, “[p]ublic information and different issues within the custody of any officer shall be open to inspection by any particular person always throughout workplace hours.” This statutory mandate displays Arizona’s sturdy presumption in favor of open authorities and disclosure of public paperwork. Public coverage favors subjecting company motion “to the sunshine of public scrutiny” and making certain that residents are “knowledgeable about what their authorities is as much as.”
A requestor is usually entitled to overview a duplicate of the “actual report,” even one maintained in an digital format, topic to redactions obligatory to guard towards dangers to privateness, confidentiality, or the most effective pursuits of the state. Thus, upon request, a public entity should search its digital databases to determine and produce responsive information. However the entity needn’t tally, compile, analyze, or in any other case present data about the knowledge contained in present public information, which might in impact create a brand new report in response to the request. Neither is the entity required to compile the info in a kind extra helpful to a requestor….
Utilizing a one-way cryptographic hash operate to substitute a novel hashed worth for protected data doesn’t add to or change any of the underlying data (a lot much less mixture or analyze the info); it simply hides a restricted facet of it. Redaction-by-encryption doesn’t create something new, however moderately represents a better-tailored redaction course of that eliminates solely data that’s in actual fact protected….
We acknowledge that redaction-by-encryption is totally different than conventional redaction-by-deletion (or redaction-by-obscuring-text-behind-a-black-box), and it might solely be possible within the context of electronically saved information. However when public information are saved in that format, variations occasioned by newer types of information storage could name for variations in how the info is disclosed. For instance, embedded metadata is an inherent a part of a public report maintained in an digital format, though such metadata was nonexistent and successfully meaningless for a similar report saved on paper. Accordingly, making use of redaction-by-encryption as a extra tailor-made type of redaction (even when made attainable solely by digital storage) serves to make sure that the requestor receives entry to the “actual report” to the best extent attainable.
Probably the most analogous authority construing the federal Freedom of Data Act (“FOIA”) bears this out. [Details omitted. -EV]
We be aware that redaction-by-encryption doesn’t entitle Appellants to something greater than the general public report because it really exists….
Accordingly, to the extent the tables and fields within the present databases (pre-redaction) should not in actual fact linked—and the report is just not clear on that subject—AHCCCS is just not required to create new hyperlinks to serve Appellants’ functions. However to the extent the hyperlinks exist pre-redaction, all Appellants’ criticism seeks, and what they’re doubtlessly entitled to, is preservation of these hyperlinks that kind a part of the “actual report.” …
To make certain, the journalists’ request could finally show unduly burdensome given the size of information concerned, and redaction (by encryption and in any other case) could finally show inadequate to adequately anonymize the info given the kind of information requested. However these questions require evidentiary growth and have to be thought of on their details, not as questions of legislation….
Plaintiffs are represented by Arizona State’s First Modification Clinic, and particularly by attorneys Jake Karr (who orally argued the case, and who’s now on the NYU Know-how Legislation & Coverage Clinic), Gregg P. Leslie, and Zachary R. Cormier, and legislation college students Jack Prew-Estes, Jake Nelson, Maria McCabe, and Vanessa Stockwill.
