Legal Arrangements for Use and Control of Real-Time Data (2011)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

36 The requested GIS data in the present case, however, is sure pursuant to a request even if the requester intends readily available to the public, and, accordingly, it does to use the information for commercial purposes. Even a not fall within the plain language of § General Statutes copyrighted database may have to be disclosed unless Section1-210(b)(5)(A) as a trade secret. As the trial there is a specific exemption. However, in at least two court noted, states the courts have held that a requester must sign [T]he GIS database is an electronic compilation of the re- an end-user agreement so as to restrict the further dis- cords of many of the town's departments. Members of the tribution or use of a database. public seeking the GIS data could obtain separate por- tions of the data from various town departments, where VIII. POST-SEPTEMBER 11 SECURITY ISSUES AND that data is available for disclosure. The requested GIS PUBLIC ACCESS TO TRANSIT REAL-TIME DATA database simply is a convenient compilation of informa- tion that is already available to the public. The records The issue considered in this part of the digest re- therefore fail to meet the threshold test for trade secrets. garding legislation since the terrorist attacks of Sep- 451 (emphasis supplied) tember 11, 2001 (9/11), and disclosure of real-time data There is authority holding that trade secrets are not is the reverse of what has been discussed previously. subject to disclosure under public records disclosure That is, the issue is whether a public transit agency laws. In State ex. Rel. Cummer v. Pace,452 the court held may refuse to disclose real-time data because of its con- that records concerning the operation of the municipal cerns regarding public safety and security, including docks and terminals of the city concerning, inter alia, concerns about the possible use of such information by the routing of property were not subject to disclosure terrorists. According to one commentator, the states under the law providing for inspection of public records and localities would be prudent to establish policies for because the disclosure of such information would vio- posting information and possibly "rethink some of the late the Interstate Commerce Commission's rules pro- Web postings, particularly those potentially involving tecting trade secrets. It has been held also that com- the lives and safety of their residents, including, for 455 puter data purchased by the legislature with public example, the location of key infrastructure systems." funds for use in legislative redistricting constituted a Several cases have addressed the question of trade secret owned by the vendor that prepared it and whether information collected by a locality should not 453 was exempt from disclosure as a public record. Fi- be disclosed because disclosure would threaten a town's nally, at least one court has held that a state's Public or county's safety or security. In Dir., Dep't of Informa- Records Act "protects a broader range of information tion Technology of the Town of Greenwich v. Freedom of than just that covered under the...definition [in] the Information Comm'n,456 the DIT denied a request by an Trade Secrets Act. The Public Records Act protects from individual requester that was directed to the town's disclosure documents in the hands of a public body board of estimate and taxation. The requester sought "a `which contain trade secrets or confidential commercial copy of all [geographic information system or `GIS'] data or financial information....'"454 concerning orthophotography, arc info coverages, struc- In sum, the cases hold that electronic data are not tured query language server databases, and all docu- necessarily protected from disclosure when requested mentation created to support and define coverages for 457 pursuant to a FOIA or FOIL. In two cases the courts the arc info data set." The DIT "claimed that the held that although the data had to be released, the gov- data...was exempt from disclosure pursuant to General ernment could restrict redistribution by requiring a Statutes § 1-210(b)(5)(A), which provides an exemption requester to sign an end-user agreement. Unless there from disclosure for trade secrets, and § 1-210(b)(20), is a specific exemption, data compiled by the govern- which exempts from disclosure information that would ment is not protected as a trade secret from disclosure; compromise the security of an information technology 458 however, information in the possession of the govern- system." ment that if released would reveal a third party's trade In regard to the issue of security, Connecticut's Gen- secrets may be protected from disclosure. eral Statutes Section 1-210(b)(19) provided that the FOIA did not require disclosure of: Guidance Number 19 Records when there are reasonable grounds to believe Depending on the applicable FOIA or FOIL, real-time disclosure may result in a safety risk, including the risk data constitute a record that may be subject to disclo- of harm to any person, any government-owned or leased institution or facility or any fixture or appurtenance and equipment attached to, or contained in, such institution 451 Id. at 195. or facility, except that such records shall be disclosed to a 452 121 Fla. 871, 164 So. 723 (1935). The Municipal Docks and Terminals, when acting as agents for shippers and con- signees, would receive and deliver goods and collect and remit 455 the agreed prices and keep records thereof. Id. at 723­24. Bloom, supra note 150, at 9, nn.102­03 (2006) (footnotes 453 Brown v. Iowa Legislative Council, 490 N.W.2d 551 (Iowa omitted). 456 1992). 274 Conn. 179, 874 A.2d 785 (2005). 457 454 Caldwell & Gregory, Inc. v. Univ. of So. Miss., 716 So. 2d Id. at 182 (footnote omitted). 458 1120, 1122 (Miss. Ct. App. 1998) (citation omitted). Id. at 182­83 (footnotes omitted). 

37 law enforcement agency upon the request of the law en- lic, owners and operators of critical infrastructure, and 459 forcement agency. State, local, and tribal governmental entities, while limit- The Supreme Court of Connecticut agreed with the ing public disclosure of that sensitive information under the Freedom of Information Act...and other laws, rules, trial court that the DIT had failed to seek a public 470 and processes." safety determination from the commissioner of public works as required under the above provision; failed to The CII Act contains provisions exempting from dis- show a potential threat to the town's residents if the closure, either under the Federal FOIA or under any requested GIS data were disclosed; failed to provide state or local disclosure law, any critical infrastructure "statistical data that correlates criminal activity or po- information that is submitted voluntarily to the DHS.471 tential terrorist type activity with disclosure of GIS The CII Act directs DHS to establish uniform proce- data"; and failed to show how disclosure of the data dures for the receipt, care, and storage of such informa- "would compromise the security or integrity of the tion and for the protection of the confidentiality of the 472 GIS."460 information. Under the regulations implementing the An attempted refusal to disclose a GIS basemap on above statutory scheme, "protected CII" was referred to the ground of federal homeland security law also was as "PCII," i.e., "CII that has been validated by DHS."473 unsuccessful in County of Santa Clara v. The Superior The county argued that federal law preempted the 461 Court of Santa Clara County. The trial court had re- CPRA, a question the court did not reach, because it quired the county to disclose its GIS basemap to a re- held that the CII Act was inapplicable: "the County is a quester, the California First Amendment Coalition submitter of CII, not a recipient of PCII."474 (CFAC), which sought a copy under the CPRA.462 The Taken as a whole, this consistent and pervasive regula- court stated that the case "illustrate[d] [the] tensions tory language supports our construction of the relevant between federal homeland security provisions and our provision of the CII Act, United States Code section 463 state's open public record laws." One of the county's 133(a)(1)(E)(i). As we interpret that provision, it draws a distinction between the submission of CII and the receipt arguments was that federal law promulgated under the of PCII. In the hands of the submitter, the nature of the Homeland Security Act of 2002464 protected the informa- 465 information remains unchanged; in the hands of the gov- tion from disclosure. Although the court held that un- ernmental recipient, it is protected from disclosure. 475 der the law the county had to disclose the information, Thus, "the federal statute's prohibition on disclosure it is worthwhile to note, first, the provisions of federal of protected confidential infrastructure information law on which the county relied, and, second, the court's applies only when it has been `provided to a State or analysis in determining why federal law did not apply. local government or government agency....'"476 The court noted that the federal statute at issue was Although the county also asserted a public safety in- the Critical Infrastructure Information Act of 2002 (CII terest in guarding against terrorist threats,477 the court Act),466 part of the Homeland Security Act of 2002 that noted that the trial court found that the dissemination established the Department of Homeland Security of the GIS basemap had not been an overriding concern (DHS).467 Within the DHS, Congress established the because the county had sold it to 18 purchasers.478 The Office of Intelligence and Analysis and the Office of In- court held: frastructure Protection,468 which are responsible, inter alia, for carrying out "comprehensive assessments of Security may be a valid factor supporting nondisclosure. the vulnerabilities of the key resources and critical in- ...But the "mere assertion of possible endangerment does 469 not `clearly outweigh' the public interest in access to these frastructure of the United States...." public records." ...While we are sensitive to the County's At the heart of the CII Act is the protection of critical in- security concerns, we agree with the trial court that the frastructure information (CII), statutorily defined as "in- County failed to support nondisclosure on this ground. 479 formation not customarily in the public domain and re- lated to the security of critical infrastructure or protected The Connecticut Supreme Court also rejected the systems...." "The CII Act authorized DHS to accept in- public safety reason as a basis for not disclosing a GIS formation relating to critical infrastructure from the pub- database.480 In both the Dep't of Information Technology 470 Id. at 1313 (citations omitted). 459 Id. at 186. 471 Id. at 1313­14. 460 Id. at 189, 191. 472 Id. 461 170 Cal. App. 4th 1301, 89 Cal. Rptr. 3d 374 (6th Dist. 473 Id. at 1314­15 (citation omitted). 2009). 474 Id. at 1316. 462 CAL. GOV'T CODE § 6250. 475 Id. at 1318 (citation omitted) (footnote omitted). 463 County of Santa Clara, 170 Cal. App. 4th at 1308. 476 Id. (citation omitted). 464 6 U.S.C. § 101 (2009), et seq. 477 Id. at 1327. 465 County of Santa Clara, 170 Cal. App. 4th at 1308. 478 Id. at 1329. 466 Id. at 1313 (citing 6 U.S.C. §§ 131­34). 479 Id. (citations omitted). 467 Id. (citing 6 U.S.C. §§ 101, 111(a)). 480 Dir., Dep't of Information Tech. of the Town of Greenwich 468 Id. (citing 6 U.S.C. § 121(a)). v. Freedom of Information Comm'n, 274 Conn. 179, 874 A.2d 469 Id. (citing 6 U.S.C. § 121(d)(2), (5)). 785 (2005).