Maryland Attorney General Opinion 97 OAG 095

• Court: Maryland Attorney General Reports
• Decided: December 21, 2012
• Docket: 97 OAG 095
• Status: Published

Opinion

Gen. 97]___ 95 PUBLIC INFORMATION ACT PERSONAL E-MAIL ADDRESSES – NOT CATEGORICALLY EXEMPT FROM DISCLOSURE, BUT CUSTODIAN MAY REASONABLY PETITION FOR A § 10-619 COURT ORDER ALLOWING THE WITHHOLDING OF E-MAIL ADDRESSES THAT DO NOT SHED LIGHT ON GOVERNMENT ACTIVITIES

December 21, 2012

The Honorable J. Douglas Howard, President Board of County Commissioners of Carroll County On behalf of the Board of County Commissioners of Carroll County, you have requested our opinion on two related questions arising under the Public Information Act, Md. Code Ann., State Gov’t §§ 10-601 to 10-630 (“the Act” or the “PIA”). Specifically, you ask whether the County’s custodian of records must grant a PIA request for the e-mail addresses of private citizens who correspond electronically with County officials and employees or sign up for County newsletters, or whether the custodian may refuse to release those e-mail addresses on the grounds that the Commissioners reasonably believe that doing so will harm the public interest. You provided us with the County Attorney’s opinion, which concluded that none of the statutory exemptions from disclosure applies to such e-mail addresses and that the County’s likelihood of success in obtaining a court order to withhold the information under § 10-6191 would be “slight.” We agree with the County Attorney’s conclusion that the County would need leave of court to withhold the personal e-mail addresses it has collected from citizens who have signed up for a newsletter or written letters to County officials or employees; as we explain below, the PIA contains no exemptions for e-mail addresses per se. We slightly diverge, however, from the County Attorney’s assessment of the County’s chance of success in such a lawsuit because we think that a Maryland court might find that the disclosure of personal e-mail addresses in some circumstances intrudes on privacy interests, or discourages citizens from contacting their government, in a way that is unwarranted by the public’s interest in disclosure.

1 Except as otherwise noted, all statutory citations in this opinion refer to Title 10 of the State Government Article of the Maryland Annotated Code (2009 Repl. Vol., 2011 Supp.). 96 [97 Op. Att’y The determinations to be made by an official custodian when considering whether to invoke the § 10-619 procedures are fact- specific and thus do not lend themselves to bright-line rules. Nonetheless, the cases provide some general guidance on when an official custodian might reasonably pursue that course in response to a request for personal e-mail addresses. We write to convey that guidance, as well as to confirm the County Attorney’s conclusion that the PIA does not authorize a custodian to unilaterally withhold e-mail addresses on public interest grounds alone. I Background You indicate that your request was prompted by a situation in which a requester used the PIA process to obtain from the County a large e-mail distribution list of addressees “consisting primarily of citizens with certain policy preferences.” The requester then posted the list on a website. Various addressees protested that their security and identity had been compromised and that they found the website offensive. Some asked to be removed from the County’s e-mail distribution lists. The County’s information technology expert has since advised the Commissioners that e-mail addresses “serve as a ‘key’ to many citizens’ bank accounts; credit card statements; private phone records; and health insurance accounts.” The expert further advised the Commissioners that the disclosure of the e- mail addresses “increased the vulnerability of these citizens to mischief or cyber-theft.” You relate the “firm belief of the Commissioners that e-mail address redaction is appropriate and necessary in order to protect the public interest and promote the free flow of information between elected officials and their constituents . . . .” In compliance with our policy on opinion requests from local governments, you provided the County Attorney’s opinion on whether e-mail addresses contained in correspondence with County officials or compiled in a County database are subject to disclosure under the Act. He concluded that e-mail addresses are subject to disclosure under the PIA because they do not fall within the categories of records and information explicitly excepted from the PIA’s broad and presumptive grant of access to public records. He further explained that the General Assembly’s enactment of a narrow exception for the e-mail addresses of senior citizens, see § 10-617(m)(2), suggests that a broader ex- ception for personal e-mail addresses should not be inferred. The County Attorney noted that the County could temporarily withhold e-mail addresses on the ground that disclosure “would Gen. 97]___ 97 cause substantial injury to the public interest,” see § 10-619, but that it would need leave of court under that provision in order to permanently withhold the e-mail addresses for that reason. Finally, he opined that the County would have only a “slight” chance in court of succeeding on a petition to withhold the e-mail addresses on public interest grounds alone. After you submitted your request, legislation was introduced in the General Assembly to require a custodian to “deny inspection of the part of a public record that includes the electronic mail addresses of individuals who were sent a [certain type of] newsletter from a public official . . . .” The bill, which received an unfavorable vote by the House Health and Governmental Operations Committee, would have applied to newsletters “sent by a mass electronic mailing,” “intended to be for informational purposes only,” and “related to the official duties of the public official.” House Bill 1202, § 1 (2012) (proposing language to be codified at § 10-617(h)) (available at http://mlis.state.md.us/2012rs/billfile/hb1202.htm (last visited Nov. 30, 2012)). The bill was ultimately withdrawn by its sponsor. II Analysis The PIA rests on the principle that “[a]ll persons are entitled to have access to information about the affairs of government and the official acts of public officials and employees.” § 10-612(a). The Court of Appeals has “reiterated on numerous occasions that the PIA reflects the need for wide-ranging access to public records, and therefore, the statute should be construed in favor of disclosure for the benefit of the requesting party.” Ireland v. Shearin, 417 Md. 401, 408 (2010); see also, e.g., Kirwan v. The Diamondback, 352 Md. 74, 81 (1998) (“[T]he provisions of the [PIA] reflect the legislative intent that citizens of the State of Maryland be accorded wide-ranging access to public information concerning the operation of their government.”) (internal quotation marks omitted). The presumption in favor of disclosure is reflected in the Act itself, which directs generally that, “unless an unwarranted invasion of the privacy of a person in interest would result, [the Act] shall be construed in favor of permitting inspection of a public record . . . .” § 10-612(b). There are exceptions to this general rule of disclosure, however, as codified in five sections of the Act. See §§ 10-615 through 10-619; see also Office of the Attorney General v. Gallagher, 359 Md. 341, 343 (2000). These enumerated ex- ceptions delineate certain categories of records and information that variously must, or may, be excluded from public inspection. 98 [97 Op. Att’y Id. Nonetheless, a public record is presumptively available for inspection and copying unless the record (or part of it) is exempt from disclosure under any of the exceptions recognized in the Act. 92 Opinions of the Attorney General 26, 28-30 (2007). The records custodian bears the burden of proving the applicability of the exception that the custodian has claimed as the basis for nondisclosure. Office of the Governor v. Washington Post Co., 360 Md. 520, 545 (2000). A. The First Four Sets of Exceptions to the PIA Disclosure Mandate Offer No Categorical Protection for E-mail Addresses Generally We have previously concluded that an e-mail constitutes a “public record” subject to the PIA. See 81 Opinions of the Attorney General 140 (1996). The e-mail address would thus be subject to disclosure as part of the e-mail unless it fits within one of the five exceptions provided in the Act. Three sets of exceptions—those contained in §§ 10-615 through 10-617— specify the categories of records or information that a custodian must withhold from the public. See generally Maryland Office of the Attorney General, Public Information Manual, at 3-2 through 3-28 (revised 2011) (“PIA Manual”) (available at http:// www.oag.state.md.us/Opengov/pia.htm (last visited Aug. 24, 2012)). Section 10-615 contains exceptions that require the custodian to deny access to records which must be withheld under other law, such as a court order or a statute such as the federal Family Educational Rights and Privacy Act of 1974.2 Section 10- 616 lists several specific categories of records, such as certain adoption records, that must be withheld in their entirety. See, e.g., § 10-616(b). Section 10-617 sets forth the types of information

2 Section 10-615 provides, in part, that “[a] custodian shall deny inspection if . . . by law, the public record is privileged or confi- dential . . . .” The Court of Appeals has explained that the term “law,” for purposes of the section, does not include ordinances enacted by local governments. Police Patrol Sec. Sys. v. Prince George’s County, 378 Md. 702, 714 (2003) (“[T]he General Assembly never intended to give counties the right to create additional or new non-disclosure exceptions not contemplated within the MPIA by declaring information ‘confidential’ in local laws.”). And while the exception for “sociological information,” § 10-617(c), authorizes governmental units—including counties—to issue regulations describing the records that fall within that category, the background you provided does not suggest that the e-mail distribution lists in question would convey information that could be described as “sociological.” Accordingly, we do not believe that the County would be authorized under the PIA to promulgate regulations that would exempt personal e-mail addresses from disclosure pursuant to § 10-617(c). Gen. 97]___ 99 that must be withheld from a record that would otherwise be disclosable; examples include confidential business or financial information. See, e.g., § 10-617(d), (f). Section 10-617(m) shields the e-mail addresses of enrollees of senior citizen centers but does not shield e-mail addresses generally. The fourth set of exceptions, those set forth in § 10-618, also pertains to specified categories of records or information, but the exceptions are discretionary in that they permit a custodian to deny inspection when it would be “contrary to the public interest.” Examples of the records and information covered by the discretionary exceptions in § 10-618 include records of certain investigations and security procedures and the e-mail addresses of students of, or applicants to, public institutions of higher education. See, e.g., § 10-618(f), (j), (m). The County Attorney concluded, and we agree, that none of the statutory exceptions set forth in §§ 10-615 through 10-618 allows custodians to categorically withhold personal e-mail addresses on privacy grounds alone. Put another way, those four sections do not include a “catch-all” protection for personal privacy. Police Patrol Sec. Sys., Inc. v. Prince George’s County, 378 Md. 702, 716-17 (2003); see also Office of the Governor, 360 Md. at 554 (explaining the lack of specific exceptions that would permit a custodian to unilaterally withhold records on the grounds that disclosure would harm the “public interest,” release “personal information,” or constitute an “unwarranted invasion of privacy”); Kirwan, 352 Md. at 88-89 (explaining that the directive in § 10- 612(b) that the PIA be construed to avoid the “unwarranted invasion of privacy” does not create an exception, but rather limits the presumption of disclosure); 61 Opinions of the Attorney General 702, 709-10 (1976) (explaining that a custodian may not unilaterally deny inspection of information on the sole grounds that the “disclosure of names and addresses contained in public records may be commercially exploited or otherwise used in a manner irksome or offensive to the individuals concerned”). That leaves the Act’s fifth type of exception, available under § 10-619, as the only route to a public body’s non-disclosure of personal e- mail addresses on privacy grounds alone. B. Section 10-619: The “Public Interest” Exception, By Leave of Court Section 10-619 permits an official custodian to deny a request when he or she “believes that inspection would3 cause substantial injury to the public interest . . . .” § 10-619(a). This 3 Section 10-619 provides in its entirety:

(continued . . .) 100 [97 Op. Att’y grant of discretion comes with restrictions, the most important of which is that the official custodian may not invoke § 10-619 to deny access to a record without filing an action in circuit court, within ten working days of the denial, for an order permitting the continued denial of access. § 10-619(b). The need to petition to obtain a court order is the defining feature of this exception; the failure to do so may be a misdemeanor under § 10-627 and could subject the official custodian to potential liability “for actual damages that the court finds appropriate.” § 10-623(d)(2). In contrast to the specific exceptions stated in §§ 10-615 through 10-618, § 10-619 potentially applies to every public record subject to the Act. For this reason, § 10-619 has been referred to as the Act’s “catch-all” public interest provision. Bowen v. Davison, 135 Md. App. 152, 165 (2000). It is an exception, however, that is reserved for the “unusual case where a public policy factor should control but none of the specific exemptions applies.” Cranford v. Montgomery County, 300 Md. 759, 776 (1984); see also 63 Opinions of the Attorney General 355, 363 (1978) (observing that the need for § 10-619 is based on the fact that the Legislature “cannot anticipate every situation in

(a) Whenever this Part III of this subtitle authorizes inspection of a public record but the official custodian believes that inspection would cause substantial injury to the public interest, the official custodian may deny inspection temporarily. (b)(1) Within 10 working days after the denial, the official custodian shall petition a court to order permitting the continued denial of inspection. (2) The petition shall be filed with the circuit court for the county where: (i) the public record is located; or (ii) the principal place of business of the official custodian is located. (3) The petition shall be served on the applicant, as provided in the Maryland Rules. (c) The applicant is entitled to appear and to be heard on the petition. (d) If, after the hearing, the court finds that inspection of the public record would cause substantial injury to the public interest, the court may pass an appropriate order permitting the continued denial of inspection. Gen. 97]___ 101 which it is appropriate to refuse to disclose public records”).4 But when the official custodian reasonably believes that a particular disclosure would substantially harm a particular public interest, § 10-619 provides a fairly broad basis on which the official custodian may temporarily withhold a public record pending the court’s ruling. The official custodian should not withhold records under § 10-619 on a generalized basis, however; the courts have required “a particularized justification for withholding each portion of a public record that [a custodian claims] is exempt from public disclosure.” Prince George’s County v. Washington Post Co., 149 Md. App. 289, 310 (2003). Nor should the official custodian invoke § 10-619 routinely, as § 10-619 is a stopgap exception, intended for the “unusual case,” Cranford, 300 Md. at 776, where the broader exceptions do not prevent disclosures that would substantially harm the public interest. C. Personal Privacy as a “Public Interest” Protected By § 10- 619 Section 10-619 does not mention privacy considerations, and the Maryland appellate courts have not addressed whether its “public interest” standard provides protection for personal privacy. The courts have, however, addressed privacy consid- erations in the context of § 10-618, which permits a custodian to withhold certain records when disclosure would be “contrary to the public interest.” In that context, the Court of Special Appeals has treated the unwarranted invasion of privacy as a public interest concern. See City of Frederick v. Randall Family, LLC, 154 Md. App. 543, 573 (2004). More generally, the Court of Appeals has recognized the seven circumstances listed in § 10- 618(f)(2), which pertain to various investigatory and security records, as “illustrative of the concerns that would make disclosure contrary to the public interest,” see Baltimore v. Md. Comm. Against Gun Ban, 329 Md. 78, 96 (1993), and those 4 That the § 10-619 process is reserved for the “unusual case” may explain why the process appears to have been only rarely invoked. It may also be, however, that requesters withdraw their requests in order to avoid the litigation costs that they believe will follow when the agency makes clear its intention to proceed to court. You draw our attention to e-mail correspondence between the Governor’s Office and an unnamed PIA requester where that appears to have occurred. However, § 10-619 does not require the requester to appear in court; it instead entitles the requester to notice and an opportunity to be heard. See § 10-619(b), (c). An official custodian’s intention to pursue the remedy therefore should not be perceived as a threat of litigation against the requester. 102 [97 Op. Att’y enumerated circumstances include the “unwarranted invasion of personal privacy.” § 10-618(f)(2)(iii). Moreover, the Act directs that it is to be construed in favor of permitting inspection of a public record “unless an unwarranted invasion of the privacy of a person in interest would result.” § 10-612(b). Accordingly, the concern you state—that the County’s disclosure of the e-mail addresses of members of the public would result in the harmful dissemination of private information—could properly be evaluated by the official custodian as a potential harm to the public interest when that official is considering whether to temporarily withhold e-mail addresses under § 10-619. D. Weighing the Competing Public Interests of Privacy and Disclosure under § 10-619: The “Balancing Test” The Maryland courts have applied § 10-619 in only two reported decisions, and neither involved the question of when an “unwarranted invasion of privacy” might result in a “substantial injury to the public interest.” See Moberly v. Herboldsheimer, 276 Md. 211 (1975) (applying the exception as then codified at Art. 76A, § 53(f)) and Mayor of Baltimore v. Burke, 67 Md. App. 147 (1986). We therefore must look to the Maryland cases interpreting other provisions of the Act, and, to a certain extent, to the federal cases on requests under the Freedom of Information Act, 5 U.S.C. § 552 (“FOIA”), for documents containing e-mail addresses. 1. Maryland Law In addressing § 10-618—which, like § 10-619, provides for the discretionary withholding of records—the courts have applied a balancing test to determine whether the statutorily-mandated 5 In both cases, the court concluded that the custodian had not established that disclosure would cause a “substantial injury to the public interest.” In Moberly, a publicly-controlled hospital denied a request for records of various salaries and attorneys’ fees. The hospital alleged, among other things, that producing the records would contravene the public interest because the requester wanted the records “to find something for the pruriency of curious ears” and to pursue a “vendetta.” 276 Md. at 227. The Court of Appeals concluded that the allegations about the requester’s motives did not establish an injury to the public interest. Id. at 227-28. In Burke, the city sought leave to withhold records pertaining to a waste water treatment plant on the grounds that disclosure would reveal weaknesses in the city’s position in pending and future litigation. 67 Md. App. at 153. The court held that such a “tactical disadvantage” did not establish a “substantial injury to the public interest.” Id. at 155. Gen. 97]___ 103 interest in disclosure is outweighed by another cognizable interest. See Office of the Governor, 360 Md. at 562 (remanding the case to the circuit court to perform “an in camera review and balancing test . . . to assure proper vindication of the competing interests” in disclosure and executive privilege). The Court of Special Appeals performed such a balancing in Randall Family, LLC, to determine whether disclosure of the customer list, or “black book,” seized from the operator of a “house of assignation” would be “contrary to the public interest” under § 10-618. Weighing in favor of the public’s interest in disclosure was a citizen’s allegation that the police department had improperly used the black book to exert influence on a particular public official. 154 Md. App. at 573-74. On the other side of the balance was that the requested disclosure “might embarrass” the people listed as customers of the house. Id. at 571. The court concluded that “the invasion of [the customers’] privacy in this way cannot be characterized as ‘unwarranted’ when balanced against the public’s right to know and evaluate information of this sort.” Id.; see also Faulk v. State’s Attorney for Harford County, 299 Md. 493, 511 (1984) (holding that the public interest in disclosure was “outweighed by the likelihood that the disclosure of [investigative reports during a criminal proceeding] would disturb the existing balance of relations in criminal proceedings”); 64 Opinions of the Attorney General 236, 241 (1979) (with respect to the public interest determination to be made under § 10- 618, advising that the custodian “must carefully weigh the asserted secrecy interest against the asserted public interest”). Although the Maryland cases are useful for the general proposition that a custodian should weigh a person’s privacy interest against the public interest in disclosure, they do not provide much guidance on what “privacy” is for purposes of the PIA, whether a privacy interest attaches to an individual’s e-mail address, and how an official custodian might identify the public’s interest in the disclosure of an e-mail address.6 The federal cases 6 Maryland’s PIA was likely modeled on either Colorado’s and Wyoming’s public records laws, PIA Manual at 1-2, both of which entitle a custodian to seek judicial relief when the disclosure of records not exempted from those laws would harm the public interest. In those states, too, the few reported cases that address the provision do not provide much guidance on your questions. See Pagel v. Franscell, 57 P.3d 1226 (Wyo. 2002) (affirming the custodian’s determination that the records were shielded by other law; not reaching the alternative claim that disclosure would harm the public interest); Bodelson v. Denver Publ. Co., 5 P.3d 373, 377 (Colo. App. 2000) (stating that “[a] substantial injury to the public interest is not defined in the [Act]” and that “the substantial injury to the public interest exemption contained in § 24-72-204(6)(a) is to be used only in those extraordinary situations which the General Assembly could not have identified in advance”); (continued . . .) 104 [97 Op. Att’y on FOIA, by contrast, do address such questions, and the Maryland courts traditionally turn to FOIA cases when the PIA provision at issue has a counterpart in FOIA. See, e.g., Faulk, 299 Md. at 506; see also Blythe v. State, 161 Md. App. 492, 528 (2005) (referring to certain enumerated exemptions under § 10- 618 as “linguistic clones of7 . . . enumerated dangers under Exemption 7 of the FOIA”). Although federal law does not contain a counterpart to the “substantial injury to the public interest” standard in § 10-619, FOIA does employ the same phrase 8“unwarranted invasion of privacy” that appears in § 10- 612(b). Accordingly, we believe that Maryland courts would look to federal case law for guidance on how to identify circumstances that involve an “invasion of privacy” and when such an invasion is “unwarranted.” See, e.g., Randall, 154 Md. App. at 573 (relying on federal FOIA cases when applying § 10- 618(f)). 2. The Federal Courts’ Identification of the Competing Privacy and Disclosure Interests in E-Mail Addresses and Mailing Lists. The federal courts have developed a body of law on the aspects of “privacy” protected by FOIA and, applying that law, have often found that personal e-mail addresses implicate a privacy interest sufficient to trigger the balancing of the

Freedom Newspapers v. Tollefson, 961 P.2d 1150, 1155-56 (Colo. App. 1998) (holding, in part, that the disclosure of the City employees who had received severance benefits would not cause substantial injury to the public interest in personal privacy). 7 The exceptions, or “exemptions,” from disclosure under FOIA are traditionally referred to by the paragraph of 5 U.S.C. § 552(b) in which they are set out. “Exemption 7” refers to 5 U.S.C. § 552(b)(7). 8 See 5 U.S.C. §§ 552(b)(6) (Exemption 6, stating a broad ex- ception for “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy”); 552(b)(7)(C) (Exemption 7(C), stating a narrower exception for certain law enforcement records, “but only to the extent that the production . . . could reasonably be expected to constitute an unwarranted invasion of personal privacy”). Although the “magnitude” of the privacy interest needed to outweigh the interest in disclosure is higher for Exemption 6 than for Exemption 7(C), the courts use the same test for both exemptions in other respects. United States Dep’t of Defense v. Federal Labor Relations Auth., 510 U.S. 487, 496 n.6 (1994). These provisions allow a custodian of records to unilaterally withhold requested documents on privacy grounds, something the PIA does not allow without subsequently obtaining a court order under § 10-619. Gen. 97]___ 105 competing interests in disclosure and personal privacy under FOIA Exemptions 6 and 7(C). The federal courts have also addressed the extent to which the disclosure of e-mail and postal addresses contained in an agency’s mailing lists and other records serves the public interest in disclosure of information about public business. We did not find reported cases involving FOIA requests for a government agency’s list of e-mail addresses for individuals who have signed up to receive agency notices or newsletters. The Privacy Interest in an E-Mail Address Requested Under FOIA In the context of FOIA, the federal courts have recognized two aspects of an individual’s interest in personal privacy. The first, called the “secrecy” interest, applies to matters “one would prefer to keep hidden from other people because disclosure would be embarrassing or compromising.” Ostergren v. Cuccinelli, 615 F.3d 263, 282 (4th Cir. 2010). Because that interest hinges on secrecy, it diminishes once the matter has been disclosed. Id. The secrecy aspect of privacy is exemplified by the “black book” sought in Randall Family; recognizing that type of privacy interest, the Court of Special Appeals noted that the disclosure of the customers’ names “might embarrass” them. 154 Md. App. at 571. Based on your inquiry, we assume that there is nothing inherently “embarrassing or compromising” about the presence of an e-mail address on the County’s e-mail distribution lists.9 The second aspect of privacy, the “control” interest, is a “conception of privacy whereby one does not mind publicity itself but nonetheless would prefer to control how personal information will be used or handled.” Ostergren, 615 F.3d at 283. As applied by the federal courts, “control privacy” comes into play when, as with a Social Security number, an individual “worr[ies] only about how [the information] will be used—more specifically, about whether some unscrupulous person will steal their identity.” Id.; see also Sherman v. U.S. Dep’t of the Army, 244 F.3d 357,

9 We address your question as to County lists of people who have signed up to receive notices generally, and not the list you mention of people “with certain policy preferences,” as we do not know what that list would have revealed about them or the Government. We note, however, that the presence of an individual’s identifying information on some lists would, if disclosed, cause the individual embarrassment. See Department of State v. Ray, 502 U.S. 164, 177 n.12 (1991) (“[W]hether disclosure of a list of names is a significant or a de minimis threat depends upon the characteristic(s) revealed by virtue of being on the particular list, and the consequences likely to ensue.”) (citation and internal quotation marks omitted). 106 [97 Op. Att’y 365 (5th Cir. 2001) (referring to “informational privacy,” implicated when the disclosure of a person’s name and Social Security number would expose that person to fraud); Nat’l Cable & Telecomms. Ass’n v. FCC, 555 F.3d 996, 1001 (D.C. Cir. 2009) (“It is widely accepted that privacy deals with determining for oneself when, how and to whom personal information will be disclosed to others.”). Control privacy also comes into play when the government has compiled a record from already-public information. Ostergren, 615 F.3d at 283. The Supreme Court articulated that interest in United States Dept. of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749, 753 (1989), when it held that a criminal “rap sheet” implicated a privacy interest despite the fact that the information compiled therein was separately available from other public sources. In so concluding, the court saw “a vast difference between the public records that might be found after a diligent search of courthouse files, county archives, and local police stations throughout the country and a computerized summary located in a single clearinghouse of information.” Id. at 764; see also Fed. Labor Relations Auth., 510 U.S. at 500 (“[A]n individual’s interest in controlling the dissemination of information regarding personal matters does not dissolve simply because that information may [already] be available to the public in some form.”). The privacy concerns you raise—that the disclosure of personal e-mail addresses might expose the address holders to fraud and harassment—pertain to the control aspect of personal privacy. Because “personal privacy” under FOIA has long extended to personal information that an individual has an interest in controlling, the federal courts have often simply treated individual e-mail addresses like other personal contact information and have assumed, without discussion, that disclosure would implicate a personal privacy interest. See, e.g., Electronic Frontier Foundation v. Office of the Director of National Intelligence, 595 F.3d 949, 961 (9th Cir. 2010) (requiring agency to disclose telecommunications lobbyists’ names, but stating that “we can easily envision possible privacy invasions resulting from public disclosure of the e[-]mail addresses”); Performance Coal Co. v. U.S. Dep’t of Labor, 847 F. Supp. 2d 6, 18 (D.D.C. 2012) (referring to personal information such as miners’ cell phone numbers and mine inspectors’ e-mail addresses as implicating “a substantial privacy interest”). Even the “somewhat diminished” privacy interest of government employees includes “an identifiable privacy interest in avoiding disclosures of information that could lead to annoyance or harassment.” Nat’l Day Laborer Org. Network v. U.S. Immigration & Customs Enf. Agency, 811 F. Supp. 2d 713, 747 (S.D.N.Y. 2011) (internal quotation marks omitted); see also Pinson v. Lappin, 806 F. Supp. 2d 230, 234-35 Gen. 97]___ 107 (D.D.C. 2011) (approving 10 the redaction of government employees’ e-mail addresses). This is not to say that the federal court decisions unequivocally recognize a privacy interest in personal e-mail addresses. One federal magistrate, in addressing the discover- ability of information in civil litigation, questioned the assumption that e-mail addresses are “private” information: [C]ommon experience is that most people do not adequately protect from disclosure their birth dates, home addresses or telephone numbers, e-mail addresses, or drivers’ license numbers so as to reasonably call them private or confidential. Instead, that information is regularly disclosed to friends, relatives, vendors, credit card companies, schools, childrens’ [sic] sports teams, on hotel registers, and the like. There is no evidence here that the [Defendants] have maintained this information as private or confidential. Estate of Rice v. City & County of Denver, 2008 U.S. Dist. LEXIS 42381 (D. Colo. May 27, 2008). Nevertheless, the clear majority of the federal cases we have 11 reviewed recognize a privacy interest in personal e-mail addresses.

10 We note that the definitions of “personal information” and “personal record” appearing in §§ 10-611(f) and 10-624(a) of the PIA are not inconsistent with the conclusion that one has a privacy interest in one’s personal e-mail address. Although neither definition mentions e-mail addresses specifically, both definitions are inclusive and encompass information that “identifies an individual.” See §§ 10- 611(f) (“‘[P]ersonal information’ means information that identifies an individual including an individual’s address . . . .”); 10-624(a) (“‘[P]ersonal record’ means a public record that names or, with reasonable certainty, otherwise identifies an individual by an identifying factor such as . . . an address . . . .”). 11 See, e.g., Am. Mgmt. Servs., LLC v. Dep’t of the Army, 842 F. Supp. 2d 859, 864 n.4 (E.D. Va. 2012) (referring to “names or [personal] contact information” as implicating “the individuals’ substantial privacy interest”); Gov’t Accountability Project v. U.S. Dep’t of State, 699 F. Supp. 2d 97, 106 (D.D.C. 2010) (upholding agency’s redaction of personal e-mail addresses of applicants for board positions; stating that “the private individuals mentioned in these records have a clear privacy interest in avoiding the disclosure of their personal email addresses”); Budik v. Dep’t of the Army, 742 F. Supp. 2d 20, 38 (D.D.C. 2010) (affirming redaction of an e-mail address (continued . . .) 108 [97 Op. Att’y In fact, the federal courts have recognized a control interest in contact information even when that information reveals little or nothing about the identity of the person. For example, one federal court has found that the telephone numbers in cell phones of agency employees “constitute information that applies to particular individuals . . . despite the fact that it is unknown from the records which individuals are associated with these numbers.” Nat’l Right to Work Legal Def. & Educ. Found., Inc. v. U.S. Dep’t of Labor, 828 F. Supp. 2d 183, 192 (D.D.C. 2011); see also Strunk v. U.S. Dep’t of State, 845 F. Supp. 2d 38, 45 (D.D.C. 2012) (finding that coded identities of terminal users implicated the users’ privacy interest because they could be used to identify the users). And, in Havemann v. Astrue, the court upheld the denial of personal information that did not directly identify individuals, because the agency established that the disclosure “would permit cross-referencing between all of the data sets [already] released to [the requester], as well as publicly available databases, such that private information can be identified as belonging to a specific individual.” No. ELH-10-1498, 2012 U.S. Dist. LEXIS 136292, at *31 (D.Md. Sept. 24, 2012). The court explained that “an individual’s privacy interest does not diminish merely because several steps are needed to connect private information to the individual’s identity.” Id. at *24. Thus, control privacy also comes into play when the information given to a government agency may be combined with other publicly available information in a way that identifies the person. Although Maryland courts have not explicitly addressed whether “privacy” under the PIA includes the “control” aspect of privacy articulated by the federal courts, we think they would turn to the FOIA law on privacy, as they have turned to the FOIA law on other analogous terms, and recognize that an individual has some degree of a privacy interest in controlling the dissemination

when the signature block in the message had been disclosed; stating that there was no public interest in disclosure “sufficient to outweigh the privacy interest involved”); Nkihtaqmikon v. Bureau of Indian Affairs, 493 F. Supp. 2d 91, 108 (D. Me. 2007) (holding that disclosure of personal e-mail addresses would result in a “clearly unwarranted invasion of personal privacy”) (internal quotation marks omitted); Physicians Comm. for Responsible Medicine v. Glickman, 117 F. Supp. 2d 1, 6 (D.D.C. 2000) (ordering agency to disclose resumes of applicants for advisory board positions, “presumably [to] be redacted to protect personal data such as home addresses, telephone numbers, e- mail addresses, and social security numbers”); Kim v. U.S. Dep’t of Interior, 859 F. Supp. 2d 13 (D.D.C. 2012) (upholding, without discussion, an agency’s redaction of public employee’s personal e-mail address). Gen. 97]___ 109 of his or her personal contact information.12 The questions for the official custodian then become whether that interest is outweighed by the public’s interest in the disclosure of the address, and, if so, whether disclosure would substantially injure the public interest. The Public Interest in Disclosure of Addresses on Distribution Lists and E-Mail Addresses in Other Types of Records Whether an individual’s e-mail address or other contact information conveys information about public business depends, of course, on the context in which the individual provided it. In Electronic Frontier, 595 F.3d 949, which involved a FOIA request for the names and e-mail addresses of telecommunications carriers’ lobbyists who had contacted the agency on behalf of their clients, the court instructed that the e-mail addresses were protected by Exemption 6, but only “when not needed to identify

12 We acknowledge that the court’s statement in Prince George’s County v. Washington Post Co., 149 Md. App. at 326, that “[t]he intent of the MPIA . . . is not to exclude from the public information that had previously been disseminated to or known by the public” would seem to signal a rejection of the concept of control privacy, as it has been described by the federal courts. But the context in which the court made the statement suggests otherwise. There, the custodian sought to withhold a police duty roster comprised of information that “in many instances” had been disseminated in press releases and that the officers lacked the power to control—name, rank, badge number—because they were required to provide it to members of the public on request. Id. at 326-27. Disclosure of that information thus would not have intruded upon either the secrecy interest or the control interest. We also acknowledge that this Office has previously predicted that the disclosure of one’s marital status and other personal information from marriage records would not result in “substantial injury” under the predecessor to § 10-619 when that information is often made public anyway. 61 Opinions of the Attorney General at 708-09. We issued that opinion well before the Supreme Court opined that an individual’s interest in controlling his or her personal information “does not dissolve” because the information is publicly available “in some form,” Fed. Labor Relations Auth., 510 U.S. at 500, and well before the rise of “data brokers” and others who compile personal information on individuals by electronically aggregating bits of information from public and private sources. See Federal Trade Commission, Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers (2012) (available at http://ftc.gov/os/ 2012/03/120326privacyreport.pdf (last visited Dec. 20, 2012)). We believe that these developments may well have rendered obsolete our earlier opinion’s implicit limitation of “privacy” to matters that are secret. 110 [97 Op. Att’y the party communicating with the government . . . .” Id. at 961. The court continued: If, however, a particular email address is the only way to identify the carriers’ agent at issue from the disputed records, such information is not properly withheld under Exemption 6 because this minor privacy interest does not counterbalance the robust interest of citizens’ right to know “what their government is up to.” Id. (quoting Reporters Comm., 489 U.S. at 773) (internal quotation marks omitted, emphasis in original)). As reflected in Electronic Frontier, the public interest in disclosure will likely outweigh privacy interests when the personal e-mail address is the only means of identifying the person who is seeking to influence public policy. When the requested addresses merely appear on government-held lists of people who have signed up to receive information or comply with a registry requirement, however, federal courts have questioned whether the information sheds light on “what the government is up to.” Id. (internal quotation marks omitted). In Bibles v. Oregon Natural Desert Ass’n, 519 U.S. 355, 355-56 (1997), the Bureau of Land Management had denied a private organization’s request for the agency’s mailing list of individuals who had signed up to receive a newsletter. The only asserted public interest in disclosure was the organization’s interest “in knowing to whom the government is directing information . . . so that those persons may receive information from other sources that do not share the [Bureau’s] self-interest in presenting government activities in the most favorable light.” Oregon Natural Desert Ass’n v. Bibles, 83 F.3d 1168, 1171 (9th Cir. 1996). Although the Ninth Circuit Court of Appeals had concluded that that interest outweighed any privacy interest held by those who appeared on the mailing list, the Supreme Court reversed, stating that the requester’s intended use of the records had “no bearing” on whether FOIA required disclosure of the mailing list. Bibles, 519 U.S. at 356. Instead, the Court instructed the lower court to determine whether disclosing the addresses would “‘she[d] light on an agency’s performance of its statutory duties’ or otherwise let citizens know ‘what their government is up to.’” Id. Similarly, in Minnis v. United States Dept. of Agriculture, 737 F.2d 784 (9th Cir. 1984), the Ninth Circuit upheld the denial of a lodging operator’s request for the names and addresses of entrants in a lottery for river access permits. Concluding that “there is little or no public interest served by disclosure of the Gen. 97]___ 111 information sought,” the court noted that the commercial requester had not shown either “that government disclosure of this list is needed to inform the interested public” about accommodations on the river or that “disclosure would help him oversee the lottery’s fairness.” Id. at 786-87; see also Wine Hobby USA, Inc. v. I.R.S., 502 F.2d 133 (3d Cir. 1974) (upholding the denial of an equipment distributor’s request for the names and addresses of people who had registered as producers of wine for family use on the ground that the requester had not established a public interest in disclosure); Lakin Law Firm, P.C. v. Federal Trade Comm’n, 352 F.3d 1122 (7th Cir. 2003) (upholding agency’s refusal to provide law firm with names and addresses submitted by people who had complained about fraudulent billing practices because that information did not bear on the agency’s activities); HMG Marketing Associates v. Freeman, 523 F. Supp. 11, 14 (S.D.N.Y. 1980) (court observing that it finds itself “hard pressed to discern any public interest” in advertiser’s acquisition of the mailing list of people who ordered specially minted silver dollars). One theme that emerges from the federal cases is that the degree to which the disclosure of a list of private e-mail addresses sheds light on government activities depends on who generates the list. For example, a mailing list populated automatically by constituents signing up for a newsletter may reveal much about the constituents’ policy preferences, but it sheds no light on the government’s own conduct. See Electronic Frontier, 595 F.3d at 961 (“‘[I]nformation about private citizens that is accumulated in various governmental files but that reveals little or nothing about an agency’s own conduct is not the type of information to which FOIA permits access.’”) (quoting Forest Serv. Employees for Envtl. Ethics v. U.S. Forest Serv., 524 F.3d 1021, 1025 (9th Cir. 2008)). But if the government were to generate that list itself, through the application of a set of criteria that it devises, the decision to whom to direct its message may reveal much about governmental conduct. We think a Maryland court would find federal cases such as Electronic Frontier, Bibles, and Minnis generally illustrative on when personal information has a bearing on what the government “is up to.” The federal courts’ objective approach to the public’s interest in disclosure is consistent with that taken by Maryland courts, which also look to the interest of the public rather than the motives or needs of the particular requester. See Moberly and Burke, discussed supra at n.5. Applicability of the FOIA Privacy Cases to the PIA Although the federal cases provide useful guidance on how to analyze the competing public interests in privacy and 112 [97 Op. Att’y disclosure, important differences between the PIA and FOIA caution against following the outcomes of federal case law in the same manner. FOIA does not contain an analog to the requirement in § 10-619 that records may be withheld only where the disclosure of the requested records would “cause substantial injury to the public interest.” Instead, the standard for non- disclosure under Exemptions 6 and 7(C) focuses entirely on “personal privacy.” As a result, whenever disclosure implicates even a “very slight” privacy interest, Fed. Labor Relations Auth., 510 U.S. at 500, the burden under federal law shifts to the requester to show that “the public interest sought to be advanced is a significant one,” and that the information is “likely to advance that interest.” Casa de Maryland, Inc. v. U.S. Dep’t of Homeland Security, 409 Fed. Appx. 697, 700 (4th Cir. 2011) (quoting National Archives & Records Admin. v. Favish, 541 U.S. 157, 172 (2004) (internal quotation marks omitted)); see also Yonemoto v. Dep’t of Veterans Affairs, No. 10-15180, 2012 U.S. App. LEXIS 1108, *23-29 (9th Cir. Jan. 18, 2012) (summarizing Supreme Court cases on the balancing test). The PIA does not have this burden-shifting scheme, but instead places the burden squarely on the agency to establish that disclosure would “cause substantial injury to the public interest.” Maryland’s more demanding standard means that federal FOIA precedents are less persuasive with regard to determining the ultimate weight to be accorded the competing interests in privacy and disclosure. So, while FOIA’s broadly-worded exemptions might make “personal identifying information . . . regularly exempt from disclosure,” Lakin, 352 F.3d at 1124, § 10-619 will apply only to the non-routine circumstance in which the specific exceptions created by the General Assembly do not provide the protection needed to avoid a particular and substantial harm to the public interest. The usefulness of the federal cases, then, is not in the outcomes they reach, but in how they describe the relevant privacy and disclosure interests at stake. 3. The Upshot for Official Custodians in Maryland In our view, it would usually be reasonable for the official custodian to infer that some degree of a privacy interest attaches to a personal e-mail address, whether or not the address is associated with information that would embarrass or compromise the individual to whom it belongs. If there is a personal privacy interest in a requested e-mail address, the next step would be to identify the competing public interest in disclosure, as the court did in Randall. In this regard, too, a Maryland court might find persuasive, and we think an official custodian could reasonably turn to, the federal courts’ reasoning on the extent to which e-mail addresses and other contact information, by themselves, shed light on government activities. The official custodian should identify Gen. 97]___ 113 the disclosure interest objectively, without consideration of the requester’s motives or intended use. Finally, the official custodian should evaluate whether the disclosure of the e-mail addresses would “cause substantial injury” to the public interest. This standard might seem hard to meet, but a by-product of the prospect that the government might disseminate one’s personal contact information to others is that people will be reluctant to provide that information. While that by-product might not substantially injure the public interest in all circumstances, we can imagine that in some cases a chilling effect on a person’s willingness to sign up for e-mail notices—such as extreme weather alerts and emergency school closings—could reasonably be deemed a substantial injury to the public interest in the County’s ability to disseminate such notifications. The possibility of such a chilling effect, as well as the security concerns you state, would pose questions of fact for the official custodian, and then the circuit court, to evaluate in gauging the magnitude of the potential harm to the public interest. III Conclusion While the Public Information Act contains exceptions applicable to certain senior citizens’ and students’ e-mail addresses, it does not permit records custodians to unilaterally withhold an e-mail address solely on the grounds that disclosure would substantially harm the public interest. Official custodians may temporarily withhold or partially redact a personal e-mail address on public interest grounds alone, pending a court’s review under § 10-619, when (a) they reasonably believe that the e-mail address either would provide no information about the County government, or, if it does provide such information, that it can be partially redacted to disclose that information, and (b) the circumstances are such that the disclosure would cause “substantial injury” to the public interest. These determinations will depend on the facts of each case. The creation of any categorical exception for e-mail addresses under the PIA, however, is a matter for the General Assembly. Douglas F. Gansler Attorney General Ann MacNeille Assistant Attorney General Adam D. Snyder Chief Counsel Opinions & Advice