Director, Department of Information Technology v. Freedom of Information Commission

874 A.2d 785, 274 Conn. 179, 33 Media L. Rep. (BNA) 2128, 2005 Conn. LEXIS 218

• Court: Supreme Court of Connecticut
• Decided: June 21, 2005
• Docket: SC 17262
• Status: Published

Opinion

Opinion

VERTEFEUILLE, J.

The plaintiff, the director of the department of information technology of the town of Greenwich (town), appeals from the trial court’s judgment dismissing his administrative appeal from a final decision of the named defendant, the freedom of information commission (commission). In its decision, the commission ordered the plaintiff to provide the complainant, Stephen Whitaker, 1 with copies of certain computerized data from the town’s geographic information system (GIS). We affirm the judgment of the trial court.

The trial court relied on the following relevant facts from the administrative record. In December, 2001, Whitaker submitted a written request to the town’s board of estimate and taxation, asking for a copy of all GIS data concerning orthophotography, arc info coverages, structured query language server databases, and all documentation created to support and define coverages for the arc info data set. 2 His request was forwarded to the plaintiff, who subsequently denied Whitaker’s request, claiming that the data was exempt from disclosure under the Freedom of Information Act (act), General Statutes § 1-200 et seq. Specifically, the plaintiff claimed that the data requested by Whitaker was exempt from disclosure pursuant to General Statutes § 1-210 (b) (5) (A), 3 which provides an exemption from disclosure for trade secrets, and § 1-210 (b) (20), 4 which exempts from disclosure information that would compromise the security of an information technology system. Whitaker subsequently filed a complaint with the commission, claiming that the plaintiff refused to provide him with a copy of the town’s computerized GIS records that he requested. The commission held a hearing in January, 2002, at which it found that the information requested by Whitaker was not exempt because it did not constitute either a trade secret within the meaning of § 1-210 (b) (5) (A), or the type of information that would pose a threat to the security of the town’s information technology system within the meaning of § 1-210 (b) (20). Accordingly, the commission issued a final decision in November, 2002, in which it ordered the plaintiff to disclose the requested records, excluding only medical information and social security numbers, should any appear in the requested data.

The plaintiff subsequently appealed from the commission’s decision to the trial court, which concluded, after a hearing, that the plaintiff had failed to substantiate his claim that the requested records were exempt from disclosure. Specifically, the trial court found that the plaintiff had failed to provide any specific evidence that would demonstrate that disclosure of the requested data would compromise the security or integrity of the town’s information technology system. Further, the trial court found that the records did not constitute trade secrets within the meaning of § 1-210 (b) (5) (A), because the requested data was merely a computerized compilation of the town’s records that otherwise could be obtained by requesting the information piecemeal from various individual town departments. The trial court therefore dismissed the plaintiffs appeal. The plaintiff appealed from the trial court’s judgment to the Appellate Court, and we thereafter transferred the appeal to this court pursuant to General Statutes § 51-199 (c) and Practice Book § 65-1.

On appeal, the plaintiff claims that the trial court improperly determined that the commission was correct in concluding that the data requested by Whitaker was not exempt pursuant to § 1-210 (b) (5) (A), (19) and (20). The plaintiff first argues that No. 02-133, § 1, of the 2002 Public Acts (P.A. 02-133) 5 amended § 1-210 (b) (19) 6 to broaden the public safety exemption such that the data requested by Whitaker were exempt from disclosure, and the legislative history surrounding the enactment of the public act demonstrates that it was intended to address exactly this type of case. 7 Thus, the plaintiff claims that the commission improperly failed to apply the expanded exemption in this case. The plaintiff further claims that, although the act does not expressly require a balancing of the government’s and the public’s interests, the trial court failed to weigh appropriately the public’s interest in disclosure against the town’s public safety interest, and that the trial court improperly required the plaintiff to present statistical data showing a correlation between the disclosure of GIS data and a threat of criminal or terrorist activity. The plaintiff also contends that the requested GIS data satisfies the requirements of the trade secret exemption to the act in § 1-210 (b) (5) (A), because the data constitutes a compilation that derives intrinsic economic value by not being readily ascertainable by those wishing to obtain economic value from its use. Finally, the plaintiff claims that the disclosure of the requested GIS data would compromise the integrity of the town’s information technology system, possibly exposing it to computer hackers, which in turn would create a security risk for the town.

The commission counters that the policy of the act favors free access to government records, and, although the commission’s final decision and the trial court’s memorandum of decision did not discuss at length P.A. 02-133, § 1, both the commission and the trial court considered the public act in analyzing the existence of any threat to public safety posed by the disclosure of the requested data. Further, the commission claims that the trial court correctly balanced any possible safety risk against the public’s right to access the requested data, and the trial court did not require statistical data correlating criminal and terrorist activity with disclosure, but, rather, merely observed that such correlation data would have been a method by which the plaintiff could have met his burden of showing the existence of a safety risk. The commission also argues that the right to information under P.A. 02-133, § 1, includes the right to access the data in the same computerized form that the government agency itself uses. In addition, the commission claims that disclosure of the requested GIS data will not reveal any exempt trade secrets in violation of § 1-210 (b) (5) (A), because the plaintiff is not engaged in a trade and is not protecting secrets of such a trade. The commission further argues that there is no evidence that the disclosure of the GIS data presents a security threat to the town’s information technology system within the meaning of § 1-210 (b) (20). We agree with the commission, and, accordingly, we affirm the judgment of the trial court.

By way of background, we cite briefly the policy of the act and the burden of a party claiming exemption from disclosure under the act. The act “makes disclosure of public records the statutory norm.” (Internal quotation marks omitted.) Chairman, Criminal Justice Commission v. Freedom of Information Commission, 217 Conn. 193, 196, 585 A.2d 96 (1991). “[I]t is well established that the general rule under the [act] is disclosure, and any exception to that rule will be narrowly construed in light of the general policy of openness expressed in the [act]. . . . [Thus] [t]he burden of proving the applicability of an exception [to disclosure under the act] rests upon the party claiming it.” (Citation omitted; internal quotation marks omitted.) Ottochian v. Freedom of Information Commission, 221 Conn. 393, 398, 604 A.2d 351 (1992).

As a preliminary matter, we set forth the applicable standard of review. “[T]he present case involves applying the well settled meaning of [the exemptions laid out in] § 1-210 (b) ... to the facts of this particular case. The appropriate standard of judicial review, therefore, is whether the commission’s factual determinations are reasonably supported by substantial evidence in the record taken as a whole.” Rocque v. Freedom of Information Commission, 255 Conn. 651, 659-60, 774 A.2d 957 (2001).

I

We begin by addressing whether the trial court improperly failed to consider the applicability of P.A. 02-133, § 1, to the records sought by Whitaker. The plaintiff claims that the trial court did not apply § 1-210 (b) (19) as amended by P.A. 02-133, § 1, and it improperly failed to remand the matter to the commission to determine whether the requested records were exempt under the public act. The commission counters that the trial court properly considered the applicability of P.A. 02-133, § 1. We agree with the commission. In setting forth the standard of review applicable to the commission’s decision, the trial court explicitly referenced § 1-210 (b) (19), as amended, and it analyzed whether the requested GIS data were exempt due to public safety concerns. The trial court decision thereby implicated § 1-210 (b) (19) and (20), both of which subdivisions provide exemptions from disclosure under certain circumstances when public safety is at risk. Accordingly, contrary to the plaintiffs claim, the trial court did consider the amended version of § 1-210 (b) (19). 8

Section 1-210 (b) (19) sets forth the procedure through which a state or municipal agency may pursue an exemption from disclosure under the act when there are reasonable grounds to believe that disclosure would pose a safety risk to any person or government-owned facility. When there are reasonable grounds to believe disclosure may pose a risk to public safety, “[s]uch reasonable grounds shall be determined . . . with respect to records concerning any executive branch agency of the state or any municipal, district or regional agency, by the Commissioner of Public Works, after consultation with the chief executive officer of the agency . . . .” General Statutes § 1-210 (b) (19) (A). In the present case, the plaintiff specifically argues that he was not afforded the opportunity to have the requested GIS data reviewed by the commissioner of public works in order to ascertain whether its disclosure would pose a safety risk within the meaning of § 1-210 (b) (19) as amended. The plaintiff claims that the trial court was remiss in not remanding the matter to the commission so that the commissioner of public works could conduct such a review. We disagree.

Although § 1-210 (b) (19) does not specifically provide which party is to seek a public safety determination by the commissioner of public works, we conclude that the plaintiff bore the burden of seeking such a determination. It is axiomatic that the burden of proving the applicability of any exemption in the act rests with the party claiming the exemption. See Ottochian v. Freedom of Information Commission, supra, 221 Conn. 398. Here, that is the plaintiff. It follows that the plaintiff, therefore, was obligated to seek a public safety determination from the commissioner of public works in support of his claim that the GIS records were exempt from disclosure. Moreover, we note that the floor debate in the legislature regarding the passage of P.A. 02-133, § 1, described the law as providing that municipalities, certain state agencies, public service companies, telecommunication companies and water utilities may apply for permission to keep sensitive documents from the public. 45 H.R. Proc., Pt. 15, 2002 Sess., pp. 4580-81. The use of the word “apply” makes clear the legislative intent that the party claiming a public safety exemption must seek the determination from the commissioner. The plaintiff never sought the required consultation with the commissioner of public works. Nor did he at any time request that the trial court remand the case so that the public works commissioner could make a public safety determination. Accordingly, we conclude that the plaintiffs first claim on appeal is unavailing.

II

We turn next to the plaintiffs assertion that the trial court improperly failed to balance the town’s interest in public safety with the public’s right to disclosure under the act, and that the trial court improperly required the plaintiff to present statistical data correlating criminal or terrorist activity with the disclosure of GIS data. The commission responds that the trial court did balance appropriately the town’s interest in public safety with the public’s right to accessible information, and that the trial court did not “require” the plaintiff to produce statistical data. We conclude that the trial court was not required to undertake any balancing to resolve the public safety exemption and that the trial court did not require that the plaintiff submit statistical data.

The following additional facts are relevant to the resolution of this issue. At the hearing before the commission, Peter J. Robbins, the town’s chief of police, testified generally about his concerns regarding the potential threat to the safety of the town’s residents if the requested GIS data were to be disclosed. Robbins testified that, “[b]ecause of [the town’s] affluence [it is] frequently targeted for criminal activity . . . .’’He further testified that the town’s proximity to the Merritt Parkway, Interstate 95, and the waterfront made the town an inviting target for professional thieves. When asked how the disclosure of the GIS data would assist in such criminal activities, Robbins responded, “that type of information can certainly have a severe impact on the community,” and that he thought that “it also can provide some serious risk for homeowners because that access . . . would provide overhead views of structures, the footprints of those structures, fence lines, the topography, in some cases it may, depending on when those photos were taken from the air, could reveal some security measures that individual homeowners have put in place.” Robbins further testified that the GIS data might be used to carry out identity theft or disturb the privacy of public figures who live in the town, or it could be used to interfere with the safety and security of town residents or to allow someone to compromise the police radio system and communications network.

In assessing whether this testimony was sufficient to establish the existence of a legitimate public safety risk, the trial court observed that “[t]here is no nexus between [Robbins’] opinion and the ultimate conclusion. More importantly, [the] plaintiff fails to provide through [Robbins’] testimony any specific statistical data that correlates criminal activity or potential terrorist type activity with disclosure of GIS data. Additionally, no specific evidence was provided to demonstrate how disclosure of the requested data would compromise the security or integrity of the GIS.”

As we noted previously, “[t]he burden of proving the applicability of an exception [to disclosure under the act] rests upon the party claiming it.” (Internal quotation marks omitted.) Ottochian v. Freedom of Information Commission, supra, 221 Conn. 398. In particular, “[t]his burden requires the claimant of the exemption to provide more than conclusory language, generalized allegations or mere arguments of counsel. Rather, a sufficiently detailed record must reflect the reasons why an exemption applies to the materials requested.” New Haven v. Freedom of Information Commission, 205 Conn. 767, 776, 535 A.2d 1297 (1988). With regard to weighing the interests of a party claiming an exemption against the public’s interest in disclosure, this court has stated that “within the language itself of the [act], the legislature has [already balanced] the public’s right to know and the private needs for confidentiality. . . . Therefore, neither the [commission] nor the courts are required to engage in a separate balancing procedure beyond the limits of the statute.” (Citation omitted; internal quotation marks omitted.) Chairman, Criminal Justice Commission v. Freedom of Information Commission, supra, 217 Conn. 200-201.

The exemptions provided in § 1-210 (b) of the act incorporate the judgment of the legislature with regard to balancing the public interest in disclosure of records with the need for confidentiality- As the passage of P.A. 02-133, § 1, demonstrates, the legislature adjusts the balance between the right to know and the need for confidentiality as circumstances change. The text of § 1-210 (b) (19), as amended, does not require the courts to conduct any balancing in order to determine the applicability of that exemption. The silence on this issue is in contrast to exemptions where such a balancing explicitly is required, such as, for example, § 1-210 (b) (1). We find no merit to the plaintiffs unsupported claim that the trial court’s judgment should be reversed for the court’s failure to undertake a balancing of public interest disclosure against necessary confidentiality when the statute providing the exemption does not require such a balancing.

We further conclude, contrary to the plaintiffs contention, that the trial court did not require specific statistical data correlating criminal and terrorist activity with the disclosure of GIS data. The trial court stated that it did not find convincing the generalized testimony by Robbins as the plaintiffs sole evidence to support his argument that the release of the GIS data would pose a legitimate public safety concern. Such generalized claims of a possible safety risk do not satisfy the plaintiffs burden of proving the applicability of an exemption from disclosure under the act. See New Haven v. Freedom of Information Commission, supra, 205 Conn. 776. In explaining why it was not convinced by Robbins’ testimony at the commission hearing, the trial court stated that the town did not present any evidence through the police chief to establish a nexus between his opinion and the conclusion that the release of the data would pose a safety risk. In doing so, the trial court merely suggested that one way of demonstrating the safety risk would have been through the use of statistical data correlating criminal or terrorist activity with the disclosure of GIS data. The trial court similarly suggested that the plaintiff could have provided evidence demonstrating how the disclosure of GIS data would compromise the security or integrity of GIS. Nowhere in its opinion, however, did the trial court require the plaintiff to provide such statistical data to prove a correlation between criminal or terrorist activity and the disclosure of GIS data. Accordingly, the trial court did not improperly impose an inappropriate burden on the plaintiff.

Ill

Finally, we address the issue of whether the trial court properly found that the plaintiff failed to meet his burden of proof to show that the requested GIS data were exempt under the act because disclosure would either reveal a trade secret within the meaning of § 1-210 (b) (5) (A), or pose a threat to the security of the town’s information technology system within the meaning of § 1-210 (b) (20). The plaintiff contends that the requested documents fall within the definition of a trade secret under the act because the GIS database derives its economic value from not being available to members of the public, such as Whitaker, who may use the information for their own economic gain. The plaintiff further claims that the requested information falls within the § 1-210 (b) (20) security exemption under the act because its disclosure would pose a security risk to the town’s information technology system. The commission counters that neither exemption applies to the records sought in this case. We agree with the commission.

As we have noted previously, the party claiming an exemption from disclosure under the act has the burden of proving its applicability, and in order to meet that burden, the party claiming the exemption must provide more than general or conclusory statements in support of its contention. See Chairman, Criminal Justice Commission v. Freedom of Information Commission, supra, 217 Conn. 196; New Haven v. Freedom of Information Commission, supra, 205 Conn. 776.

To qualify for an exemption within the meaning of § 1-210 (b) (5) (A), the requested records must constitute a trade secret within the meaning of the act, which is defined as “information, including formulas, patterns, compilations, programs, devices, methods, techniques, processes, drawings, cost data, or customer lists that (i) derive independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from their disclosure or use, and (ii) are the subject of efforts that are reasonable under the circumstances to maintain secrecy . . . .” In order to qualify for a trade secret exemption under § 1-210 (b) (5) A), “[a] substantial element of secrecy must exist, to the extent that there would be difficulty in acquiring the information except by the use of improper means.” (Internal quotation marks omitted.) Dept, of Public Utilities v. Freedom of Information Commission, 55 Conn. App. 527, 532, 739 A.2d 328 (1999). The requested GIS data in the present case, however, is readily available to the public, and, accordingly, it does not fall within the plain language of § 1-210 (b) (5) (A) as a trade secret. As the trial court noted, the GIS database is an electronic compilation of the records of many of the town’s departments. Members of the public seeking the GIS data could obtain separate portions of the data from various town departments, where that data is available for disclosure. The requested GIS database simply is a convenient compilation of information that is already available to the public. The records therefore fail to meet the threshold test for trade secrets, that the information is not generally ascertainable by others.

We turn now to the plaintiffs claim that the trial court improperly found that the plaintiff did not meet his burden of proof that the records were exempt under § 1-210 (b) (20). That subsection provides an exemption to disclosure for “[r]ecords of standards, procedures, processes, software and codes, not otherwise available to the public, the disclosure of which would compromise the security or integrity of an information technology system . . . .” General Statutes § 1-210 (b) (20). The trial court found that the plaintiff did not meet his burden in attempting to show that the requested disclosure would compromise the security of the town’s entire information technology system. As the trial court noted, the plaintiff did not present any specific evidence to demonstrate how the disclosure of the requested GIS data would compromise the overall security of the town’s information technology system. The plaintiff testified that he was concerned about the vulnerability of the town’s network to a security breach should the network become available to the public. In support of this concern, the plaintiff stated that computer firewalls are not foolproof, and that the firewalls of “[m]any high security agencies” had been breached. The plaintiff, however, did not provide specific examples of such security breaches, or evidence that any such breaches had been caused by the disclosure of GIS data.

We agree with the trial court that the plaintiff failed to meet his burden to show that the security or integrity of the town’s information technology system would be compromised by disclosure of the GIS data. Accordingly, the evidence presented in this case was insufficient to establish that the requested GIS data were exempt from public disclosure under the act.

The judgment is affirmed.

In this opinion the other justices concurred.

1 Whitaker is also named as a defendant in this appeal. For purposes of clarity, we refer to him by name.

2 Orthophotography consists of high resolution photographic images of the town taken from aircraft flying overhead. Arc info coverages are data compiled by the town for its use with the GIS software, including points, lines, and polygons depicting road center lines, building footprints, possibly water and sewer lines, planned fiber optic networks, and survey points, which can be overlaid on the orthophotography. The structured query language server databases consist of data compiled by the town for use in its tax assessment databases, which includes information about property ownership, assessed value, prior assessed value, and addresses. The support documentation consists of records of when the data was input, what source was used, who input the date, the accuracy of the data, and how often the data is updated. During testimony before the trial court, the data was summarized as a “composite” of maps of individual and commercial properties and high resolution aerial photographs of the town.

3 General Statutes § 1-210 (b) provides in relevant part: “Nothing in the Freedom of Information Act shall be construed to require disclosure of . . .

“(5) (A) Trade secrets, which for purposes of the Freedom of Information Act, are defined as information, including formulas, patterns, compilations, programs, devices, methods, techniques, processes, drawings, cost data, or customer lists that (i) derive independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from their disclosure or use, and (ii) are the subject of efforts that are reasonable under the circumstances to maintain secrecy . . . .”

We note that since December, 2001, when Whitaker first sought disclosure of the requested information, § 1-210 has been amended several times, however, subsection (b) (5) (A) has remained virtually unchanged. For purposes of clarify, we refer herein to the current revision of the statute.

4 General Statutes § 1-210 (b) provides in relevant part: “Nothing in the Freedom of Information Act shall be construed to require disclosure of . . .

“(20) Records of standards, procedures, processes, software and codes, not otherwise available to the public, the disclosure of which would compromise the security or integrity of an information technology system . . . .”

We note that since December, 2001, when Whitaker first sought disclosure of the requested information, § 1-210 has been amended several times, however, subsection (b) (20) has remained virtually unchanged. For purposes of clarity, we refer herein to the current revision of the statute.

5 Public Act 02-133, § 1, added to § 1-210 (b) (19) a list of factors to be considered in determining whether reasonable grounds exist to believe that disclosure of records may result in a safety risk.

6 General Statutes § 1-210 (b) provides in relevant part: “Nothing in the Freedom of Information Act shall be construed to require disclosure of . . .

“(19) Records when there are reasonable grounds to believe disclosure may result in a safety risk, including the risk of harm to any person, any government-owned or leased institution or facility or any fixture or appurtenance and equipment attached to, or contained in, such institution or facility, except that such records shall be disclosed to a law enforcement agency upon the request of the law enforcement agency. Such reasonable grounds shall be determined (A) with respect to records concerning any executive branch agency of the state or any municipal, district or regional agency, by the Commissioner of Public Works, after consultation with the chief executive officer of the agency; (B) with respect to records concerning Judicial Department facilities, by the Chief Court Administrator; and (C) with respect to records concerning the Legislative Department, by the executive director of the Joint Committee on Legislative Management. As used in this section, ‘government-owned or leased institution or facility’ includes, but is not limited to, an institution or facility owned or leased by a public service company, as defined in section 16-1, a certified telecommunications provider, as defined in section 16-1, a water company, as defined in section 25-32a, or a municipal utility that furnishes electric, gas or water service, but does not include an institution or facility owned or leased by the federal government, and ‘chief executive officer’ includes, but is not limited to, an agency head, department head, executive director or chief executive officer. Such records include, but are not limited to:

“(i) Security manuals or reports;

“(ii) Engineering and architectural drawings of government-owned or leased institutions or facilities;

“(in) Operational specifications of security systems utilized at any government-owned or leased institution or facility, except that a general description of any such security system and the cost and quality of such system, may be disclosed;

“(iv) Training manuals prepared for government-owned or leased institutions or facilities that describe, in any manner, security procedures, emergency plans or security equipment;

“(v) Internal security audits of government-owned or leased institutions or facilities;

“(vi) Minutes or records of meetings, or portions of such minutes or records, that contain or reveal information relating to security or other records otherwise exempt from disclosure under this subdivision;

“(vii) Logs or other documents that contain information on the movement or assignment of security personnel at government-owned or leased institutions or facilities;

“(viii) Emergency plans and emergency recovery or response plans; and

“(ix) With respect to a water company, as defined in section 25-32a, that provides water service: Vulnerability assessments and risk management plans, operational plans, portions of water supply plans submitted pursuant to section 25-32d that contain or reveal information the disclosure of which may result in a security risk to a water company, inspection reports, technical specifications and other materials that depict or specifically describe critical water company operating facilities, collection and distribution systems or sources of supply . . . .”

In addition to the changes effected by P.A. 02-133, § 1, subsection (b) (19) of § 1-210 was further amended in 2003. See Public Acts, Spec. Sess., June, 2003, No. 03-6, § 104. For purposes of clarity, we refer herein to the current revision of the statute.

7 Public Act 02-133, § 1, was enacted in October, 2002, as part of the state’s effort to bolster security in the wake of the September 11, 2001 terrorist attacks. See 45 H.R. Proc., Pt. 15, 2002 Sess., p. 4579. The public act was not in effect at the time of the proceedings before the commission, but it took effect in October, 2002, shortly before the commission issued its final decision. The plaintiff did not amend his answer before the commission to request an exemption under the public act, and, hence, the plaintiff did not formally inject the newly amended § 1-210 (b) (19) into the proceedings.

8 We note that the plaintiff did not expressly mention § 1-210 (b) (19) in his posttrial brief to the trial court. Rather, the first mention of that statutory section was made by the commission in its brief to the trial court. In addition to his failure to raise the section on which he now relies, the plaintiff did not file a motion for articulation when the trial court issued its decision without discussing in detail the applicability of the exemption of § 1-210 (b) (19) as amended by P.A. 02-133, § 1. Although the trial court’s consideration of § 1-210 (b) (19) provides a record sufficient to preserve the claim, the appropriate remedy for the plaintiff’s dissatisfaction with the trial court’s failure to elaborate would have been to file a motion for articulation. See, e.g., McLaughlin v. Bronson, 206 Conn. 267, 277, 537 A.2d 1004 (1988).