Andrew Ryan v. Office of the Comptroller (SPR 20201154)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records July 27, 2020 SPR20/1154 Parris Kyriakakis, Esq. Records Access Officer and Asst. General Counsel Office of the State Comptroller One Ashburton Place, 9th Floor Boston, MA 02108 Dear Attorney Kyriakakis: I have received the petition of Andrew Ryan of the Boston Globe appealing the response of the Office of the Comptroller (Office) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). Mr. Ryan requested categories of data pertaining to Commonwealth employees, specifically: “employee name, title, department name, agency name, annual salary, hourly rate, most recent date of hire, date of most recent pay increase, whether they are union or nonunion, whether they are full-time or part-time, race or ethnic group, and gender.” The Office responded on July 7, 2020 by providing responsive records, but withheld gender, ethnicity, and race data under Exemptions (a), (b), (c), and (n) of the Public Records Law. Unsatisfied with the Office’s response, Mr. Ryan petitioned this office and this appeal, SPR20/1154, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Parris Kyriakakis, Esq. SPR20/1154 Page 2 July 27, 2020 The Office’s response The Office responded to Mr. Ryan on July 7, 2020, providing responsive information, and indicating that it is withholding data regarding race, ethnic group, and gender, pursuant to Exemptions (a), (b), (c), and (n) of the Public Records Law. The Office provided a supplemental response on July 23, 2020, providing additional explanation regarding its exemption claims. Exemption (a) Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, §7 (26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977). This office cannot order disclosure of records if a statute mandates nondisclosure. Gen. Chem. Corp. v. Dep't of Envtl Quality Eng' g, 19 Mass. App. Ct. 287 (Mass. App. Ct. 1985). This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. In its July 23rd response, the Office refers to guidelines that it has promulgated pursuant to G. L. c. 66, § 20, which provides, in pertinent part: …the comptroller shall make available guidelines on how agencies using these systems may access and disclose public records to ensure that data that is exempted or prohibited from disclosure is not wrongfully disclosed and the security of the system is maintained.

Parris Kyriakakis, Esq. SPR20/1154 Page 3 July 27, 2020 G. L. c. 66, § 20. The Office additionally cites G. L. c. 66A, the Fair Information Practices Act, and G. L. c. 214, § 1B, which establishes a statutory right to privacy, in support of its position. None of the statutes cited by the Office “specifically or by necessary implication” exempt records from disclosure. See G. L. c. 4, § 7(26)(a). Accordingly, I find the Office has not met its -- burden to withhold the responsive data under Exemption (a). Exemption (b) Exemption (b) permits the withholding of: records that are related solely to internal personnel rules and practices of the government unit, provided however, that such records shall be withheld only to the extent that proper performance of necessary government functions requires such withholding G. L. c. 4, § 7 (26)(b). There are no authoritative Massachusetts decisions interpreting Exemption (b). The general purpose of the cognate federal exemption, however, is to relieve agencies of the burden of assembling and maintaining for public inspection matters in which the public cannot reasonably be expected to have a legitimate interest. For Exemption (b) to apply in Massachusetts, a records custodian must demonstrate not only that the records relate solely to the internal personnel practices of the government entity, but also that proper performance of necessary government functions will be inhibited by disclosure. With respect to Exemption (b), the Office states that “[t]he gender, race and ethnic data requested by the Globe is related to the Commonwealth’s internal personnel practices.” The Office further explains that “[t]ypically, departments acquire this information through a form at the time of hire that asks an application to designate their gender, race and ethnicity. This form is only used for the purpose of completing EEO-1 or EEO-4 reports, which are submitted to the Equal Employment Opportunity Commission (EEOC) in response to regulations and reporting requirements.” The Office suggests that “requiring public disclosure of individual’s personal data may inhibit the Commonwealth’s ability to collect this information in the future” because “[i]f employees are told that the information they provide will be made public, they may elect not to complete the form….” Despite the Office’s additional explanation, I find it has not met its burden to show how the responsive data relates “solely to internal personnel rules and practices of the government unit,” nor has it shown how performance of its necessary government function requires such withholding. Therefore, I find the Office has not met its burden to withhold the responsive data under Exemptions (b).

Parris Kyriakakis, Esq. SPR20/1154 Page 4 July 27, 2020 Exemption (c) The Office additionally cites the privacy clause of Exemption (c) in support of its withholding of the responsive data. Exemption (c) permits the withholding of: personnel and medical files or information; also any other materials or data relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy G. L. c. 4, §7 (26)(c). Exemption (c) contains two distinct and independent clauses, each requiring its own analysis. Globe Newspaper Co. v. Boston Retirement Bd., 388 Mass. 427, 432-33 (1983). Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Attorney Gen., 391 Mass. 1, 9 (1984); Attorney Gen. v. Assistant Comm’r of Real Property Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case by case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties in a law-abiding and efficient manner. Id. at 292. In its response, the Office asserts that “[i]information about an employee’s gender, race and ethnic group designation is highly personal, particularly as the information in the state

Parris Kyriakakis, Esq. SPR20/1154 Page 5 July 27, 2020 payroll system may not align with how the individual currently identifies; thus disclosure has potential to cause embarrassment and pain.” The Office’s response “acknowledges that there is a public interest in the disclosure of gender, race and ethnicity data for Commonwealth employees to prevent discrimination and promote a diverse workforce” but argues that “the aggregate data provided to the Globe by [the Office] is sufficient to achieve these goals.” Finally, the Office suggests that the compilation of the requested data implicates a “greater privacy interest” than the individual pieces of data would in isolation. I find the Office has not met its burden to demonstrate how disclosing the gender, ethnicity, and race data would result in personal embarrassment to an individual of normal sensibilities; how this data is an intimate detail of a highly personal nature; and it has not addressed whether the same information is available from other sources. Id; see also Boston Globe Media Partners, LLC v. City of Boston, Suffolk Sup. Ct., No. 2014-03952, at 8 (May 9, 2016) (finding that “an employee’s race and ethnicity are not of a ‘personal nature,’ or the ‘kind of private facts that the Legislature intended to exempt from mandatory disclosure). Therefore, the Office has not established that there are strong privacy interests associated with this data. With respect to the public interest in disclosing this information, the Superior Court has found that “[t]he purpose of obtaining race and ethnicity data is to prevent discrimination and promote a diverse workforce by ensuring that the City provides equal access to opportunity to all individuals, regardless of their race or ethnicity. The court does not find that the Legislature sought to shield from public scrutiny information that is collected for the very purpose of protecting the rights of the public.” Boston Globe Media Partners, LLC, No. 2014-03952, at 9. Given the public interest in this information, I find that in light of the balancing test referenced in PETA, the Office has not met its burden to withhold gender, race and ethnicity data under Exemption (c). See PETA, 477 Mass. at 291. Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7 (26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what

Parris Kyriakakis, Esq. SPR20/1154 Page 6 July 27, 2020 degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” PETA, 477 Mass. at 289-90. The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. The Office argues that the requested data constitute “quasi-identifiers or indirect identifiers,” which “by themselves do not identify a specific individual but can be aggregated and linked with other information to identify data subjects.” The Office argues that release of this data, along with the already-produced employment data, “could result in a significant cyber security risk.” I find the Office has not met its burden to demonstrate how the gender, ethnic, and race data “resembles the records listed as examples in the statute” as required by PETA. Further, the Office has not provided “sufficient factual heft” to conclude that a reasonable person would agree that disclosure of the gender, race, and ethnicity data is “likely to jeopardize public safety or cyber security” as required by Exemption (n). Conclusion Accordingly, the Office is ordered to produce a response to Mr. Ryan in a manner consistent with this order, the Public Records Law and its Regulations as soon as practicable. A copy of any such response must be provided to this office. Sincerely, Rebecca S. Murray Supervisor of Records cc: Andrew Ryan