Ryan Kath v. Department of Conservation and Recreation (SPR 20170434)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor ofR ecords April 14, 2017 SPR17/434 Bridget Connelly, Esq. Assistant General Counsel Department of Conservation and Recreation 251 Causeway Street, Suite 600 Boston, MA 02114-2119 Dear Attorney Connelly: I have received the petition of Ryan Kath of WBZ-TV WSBK Boston appealing the response of the Department of Conservation and Reservation (Department) to a request for public records. G. L. c. 66 § IOA; see also 950 C.M.R. 32.08(1). Specifically, Mr. Kath requested a list of all web sites and/or domains accessed on a Department computer by an identified employee in the Department's Western Regional Office from January 1, 2017 through January 27, 2017. The Department denied Mr. Kath's request on February 14th claiming the internet browser history is not a "public record" under the definition of a public record in the Massachusetts Public Records Law, and if it is a public record, it is exempt pursuant to Exemptions (e) and (f) of the Public Records Law. Mr. Kath petitioned this office. The requested information and the Department's February 14th response was the subject of a prior appeal. See SPRI 7/232 Determination of the Supervisor of Records (March 7, 2017). In my March J1h determination, I found that the Department did not meet its burden of specificity in withholding the information under Exemptions (e) and (f) of the Public Records Law. The Department was instructed to provide a more detailed response regarding the request and Department's denial. On March 30t\ the Department provided a more detailed response. Given that the Department's personnel investigation was completed, it rescinded its Exemption (f) claim to withhold the information. However, the Department has asserted that the requested "list of internet websites and/or domains visited by the former employee" is not a record as defined by the Public Records Law, and if it is a public record, the information is exempt pursuant to Exemption (e). Mr. Kath appealed the Department's March 30th response. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre• pre@sec.state.ma.us

Bridget Connelly, Esq. SPR17/434 Page2 April 14, 2017 The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § lOA(d); 950 C.M.R. 32.03(4). "Public records" is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § lO(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). Department's Response - Browser History is not a Public Record In its March 30th response, the Department writes, "[W]e recognize that the Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records." G. L. c. 66, § lOA(d); 950 C.M.R. 32.03(4). "However, the web browsing data sought is not a public record to begin with because it is not made or received by a public employee." Browser histories on their own, the Department posits, are not records made or received by an officer or employee of the government entity. Further, you state that internet browser histories are constantly changing, machine readable files that are automatically generated, based on the user's activities, by the web browser program being used. It is the Department's belief that the information only exists because it is automatically created by the computer software, not the employee, and therefore not a public record. In Massachusetts, the definition of a public record is "broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee ... " The browser history was created on a government-owned computer by a government employee, and but for the employee's use of the computer the information would not have been created. Therefore, I find that the internet browser history falls under the statutory definition of a public record, subject to public disclosure. Exemption (e) The Department next argues that if the Supervisor of Records finds that the internet browser history is a "public record" subject to disclosure, it should be withheld pursuant to Exemption (e) of the Public Records Law. Exemption (e) applies to: notebooks and other materials prepared by an employee of the commonwealth which are personal to him and not maintained as part of the files of the governmental unit G. L. c. 4, § 7 (26)(e).

Bridget Connelly, Esq. SPRl 7/434 Page 3 April 14, 2017 The exemption may not be applied by custodians of records to withhold materials intended for communication or preservation. Records are protected from mandatory disclosure by Exemption (e) only if they meet the two criteria of the exemption. The first criterion of Exemption (e) limits its application to work-related records that can be characterized as "personal" to the employee, such as personal reflections on work-related activities and notes created by an employee to assist him/her in preparing reports for other employees or for the files of the governmental entity. Notes that have been shared by the employee may not be considered to be "personal" pursuant to Exemption (e ) . The second criterion of Exemption ( e) requires that the notes not be kept in a government file. Under the exemption, "files of the governmental unit" excludes working files that are transitory in nature. Such files lack the permanent nature of a government file. Therefore, the retention of materials in such a working file would not bar the application of Exemption ( e) and the records custodian may withhold from disclosure any personal notes that were not shared with others and were not part of such a governmental file. The Department's March 30th letter states, "[B]rowser histories generated by individual user devices are 'personal' to the employee as that term is used under the Public Records Law. Rather, it distinguishes those work-related records that are personal to a particular employee from those records that are maintained as part of the governmental entity's files." The Department posits that browser histories may only be accessed using the "key" of the employee's ID and a personal network password, are personal to each particular employee and the Department does not maintain browser histories in a central government file. Browser history, the Department believes, is analogous to a handwritten list of websites visited throughout the workday in order to assist an employee in conducting his or her work, not sharing the list with others, and not storing the list in the government entity's file. The Department states that browser history is simply a digital version of a handwritten list of websites visited. The Department has not met its burden in demonstrating how the entire list of websites visited by an employee constitutes personal reflections prepared by an employee on work-related activities or notes created by an employee to assist him/her in preparing reports for other employees or for the files of the governmental entity. This is especially unclear given the Department's argument that this list is not created by the employee at all. Therefore, I find the Department has not met its burden in establishing the internet browser history may be withheld pursuant to Exemption ( e) of the Public Records Law.

Bridget Connelly, Esq. SPR17/434 Page 4 April 14, 2017 Order Accordingly, I find that the requested employee internet browser history is a public record subject to disclosure. The Department is ordered to provide Mr. Kath with the responsive record in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response that may accompany the record must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma. us. Sincerely, Rebecca S. Murray Supervisor of Records cc: Ryan Kath