Liability of Transportation Entity for the Unintentional Release of Secure Data or the Intentional Release of Monitoring Data on Movements or Activities of the Public (2016)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

52 government data are exempt under the FOIA, it is not presumed that the information is thereby privi- leged within the meaning of the discovery rules.729 When there is a FOIA request, a party’s need for the information is “irrelevant” in contrast to discov- ery when a qualified privilege is asserted and a liti- gant’s need for the information is a key factor for the court’s consideration.730 CONCLUSION The Supreme Court has not recognized a constitu- tional right to privacy in one’s personal or locational information.731 Thus, it does not appear that the dis- closure of secure data, including an individual’s PII, or of monitoring data would violate a right to privacy under the U.S. Constitution. A privacy right does not implicate the U.S. Constitution unless the asserted privacy right is recognized by the Court as a “funda- mental right” or one that is “implicit in the concept of ordered liberty” that is not outweighed by a compel- ling governmental interest in disclosure.732 As one case has held, even if the government’s dissemina- tion of information injures one’s reputation, the dis- closure does not in and of itself state a cause of action for the violation of a constitutional right. In Lambert, the court stated that there is no pri- vacy interest of a constitutional dimension unless a disclosure of personal information could lead to bodily harm or is of a “sexual, personal, and humili- ating nature….”733 Although the DPPA creates a federal statutory right to privacy for PII collected by state DMVs, even the disclosure of the same PII has been held not to violate a constitutional right to privacy.734 Thus, the government’s disclosure of secure data, such as a person’s Social Security number, has not been held to violate a constitu- tional right to privacy.735 It has been held also that “the Fourth Amendment is not “a general constitutional ‘right to privacy.’”736 In the Katz case, the Supreme Court stated that “what a person knowingly exposes to the public…is not a subject of Fourth Amendment protection.”737 had not received such discovery requests and subpoenas.721 The use of a FOIA or similar statute for the purpose of discovery in litigation typically is not permitted; thus, FOIA requests should not be used as a primary means of discovery in civil litigation.722 Indeed, some courts have held that they will not allow FOIA to be used as a substitute for discovery.723 In N.L.R.B v. Sears, Roebuck & Co.,724 the National Labor Relations Board sought to set aside a district court’s order direct- ing it to disclose certain memoranda to Sears, Roebuck & Co. (Sears) pursuant to the FOIA. The Supreme Court held that Sears’s rights under the FOIA were “neither increased nor decreased by reason of the fact” that Sears claimed a greater interest in the memo- randa than an “average member of the public.”725 The purpose of the FOIA is to inform the public about agency action, not to benefit private litigants.726 In Columbia Packing Co., Inc. v. United States Dept. of Agriculture,727 the First Circuit relied on the Supreme Court’s decision in Sears, Roebuck & Co., in holding that whether a FOIA disclosure is warranted is not affected by a party’s request for documents during discovery.728 Furthermore, if 721 Arkansas DOT, District of Columbia DOT, Indiana DOT, North Dakota DOT, and South Carolina DOT. The Montana DOT’s and the Utah DOT’s responses were “not known.” 722 Mercy Hosp. v. NLRB, 449 F. Supp. 594, 597 (S.D. Iowa 1978) (quoting NLRB v. Sears, Roebuck & Co., 421 U.S. 132 (1975)); Johnson v. United States Department of Justice, 758 F. Supp. 2, 4 (D.D.C. 1991) (holding that “FOIA is not a discovery statute”). Scholars likewise argue that a FOIA is meant to address public access to information and not to aid private litigants in litigation. See Robert C. Davis, Dis- covery in Environmental Litigation, 25 A.F. L. Rev. 168, 176–177 (1985); George K. Chamberlin, Annotation, Use of Freedom of Information Act as Substitute for, or as Means of, Supplementing Discovery Procedures Available to Litigants in Federal Civil, Criminal, or Administrative Proceedings, 57 A.L.R. fed. 903 (2001). 723 See, e.g., Renegotiation Bd. v. Bannercraft Clothing Co., 415 U.S. 1, 20, 94 S. Ct. 1028, 1038, 39 L. Ed. 2d 123, 137 (1974). 724 421 U.S. 132, 135–136, 95 S. Ct. 1504, 44 L. Ed. 2d 29 (1975). The memoranda in dispute were generated by the Board’s Office of the General Counsel when deciding whether to permit the filing of unfair labor practice com- plaints with the Board. 725 Id., 421 U.S. at 143 N 10, 95 S. Ct. 1504, 44 L. Ed. 2d 29. 726 Id., 421 U.S. at 143, 95 S. Ct. 1504, 44 L. Ed. 2d 29. See, however, Reunion, Inc. v. Federal Aviation Administration, 2010 U.S. Dist. LEXIS 42934, at *1, 2–3, 5 (S.D. Miss. 2010) (holding when the plaintiff sought to obtain certain records from the FAA and the Office of the Secretary of Transporta- tion that “[u]nder present law there is no statutory prohibi- tion to the use of FOIA as a discovery tool”). 727 563 F.2d 495 (1st Cir. 1977). 728 Id. at 499 (declining to consider Columbia Packing Corporation’s interest in enlarged discovery in regard to whether to order disclosure under the FOIA). 729 Friedman v. Bache Halsey Stuart Shields, Inc., 738 F.2d 1336, 1344 (D.C. Cir. 1984). 730 Id. 731 Phillips and Kohm, supra note 1, at P4; Garry, Douma, and Simon, supra note 2, at 103. 732 See Lambert, 517 F.3d at 440. 733 Id. 734 Kiminski, 2013 U.S. Dist. LEXIS 157829, at *40 (cita- tion omitted). 735 Lambert, 517 F.3d at 443 (citations omitted). 736 Katz, 389 U.S. at 350, 88 S. Ct. at 510, 19 L. Ed. 2d at 581 (footnotes omitted). 737 Id., 389 U.S. at 351, 88 S. Ct. at 511, 19 L. Ed. 2d at 581 (citation omitted).

53 claim for a violation of a constitutional or statu- tory right to privacy under § 1983. As for state privacy law, at least 10 state constitu- tions have provisions for the protection of an indi- vidual’s right to privacy. Some state constitutions provide and some courts have held that an individu- al’s right to privacy must be balanced against a com- pelling state interest in disclosure. Some state courts have held that an individual has a cause of action for monetary damages for violations of state constitu- tional provisions. However, although some state con- stitutions and state statutes do create privacy rights in data collected and held by government agencies, there seem to be no state laws “that specifically address privacy rights and transportation technolo- gies.”743 In any case, only some states appear to have privacy laws (e.g., California, Minnesota, and Massachusetts) that include a private right of action for damages for a violation of the statute.744 Unless a privacy statute authorizes the recovery of specific or liquidated damages or provides for a civil penalty for a violation, it appears that a plaintiff would have to prove that the release of secure data or monitoring data caused the plaintiff to incur actual damages. Most states do recognize one or more rights to pri- vacy at common law.745 A privacy claim at common law requires that the defendant’s conduct was inten- tional, as mere negligence ordinarily will not suf- fice.746 In some states, a violation of common law pri- vacy must have been the result of “willful or outrageous” conduct. Even when there is a cause of action for a viola- tion of a state common law right to privacy, trans- portation agencies in some states will have sover- eign immunity. As seen, in Axtell, the court held that the intentional disclosure by a state institution of confidential information was not actionable, because the state had retained its immunity under the state tort claims act. However, in the Toomer case, the department did not have immunity because of the plaintiff ’s allegations of malice and bad faith on the part of the Secretary of the DOT who purposely released the plaintiff ’s personnel file and PII.747 Nevertheless, no case was located for the disgest in which a court held a transportation agency liable in tort for an unintentional disclosure of secure data or for an intentional disclosure of monitoring data in a context similar to ITS.748 The Court more recently has stated that individuals using public highways have a diminished expectation of privacy.738 No cases were located for the digest hold- ing that the use of technology to enhance and record the visual observation of motorists’ use of public high- ways violates a constitutional right to privacy. Because a constitutional right in personal or loca- tional data has not been established, it does not appear that a complaint against a transportation agency’s officers or agents for the disclosure of secure data or monitoring data would state a claim under 42 U.S.C. § 1983. Even if government officials, who are acting within their discretionary authority, are sued in their individual capacities for the violation of a constitutional or statutory right, they have quali- fied immunity as long as “their conduct does not vio- late clearly established statutory or constitutional rights of which a reasonable person would have known.”739 Furthermore, one court has gone even fur- ther and held that it would be “unfair to charge an official with knowledge of the law in the absence of a previously decided case with clearly analogous facts.”740 Thus, a disclosure of secure data or monitor- ing data would not appear to state a § 1983 claim for a violation of privacy, because a clearly established constitutional or statutory right to one’s privacy in such data has not been established. Although a violation of the federal DPAA may give rise to a claim under the statute, the courts also have held that a disclosure of the very same data protected by the DPAA does not state a claim under § 1983 for a violation of a constitutional right to privacy. Likewise, in Toomer, the court held that the disclosure of secure data in the form of a former employee’s personnel file did not vio- late a constitutional right to privacy for the purpose of a § 1983 claim.741 However, as seen in Toomer, there may be a violation of the Fourth Amendment and a resulting § 1983 claim when- ever a government official acts with a “high level of culpability, including deliberate indifference, mal- ice, willfulness, and retaliation.”742 Unless there has been egregious, arbitrary action in disclosing an individual’s data, it does not seem that an unin- tentional disclosure of secure data or an inten- tional disclosure of monitoring data would state a 738 Houghton, 526 U.S. at 303, 306, 119 S. Ct. at 1302– 1303, 143 L. Ed. 2d at 417 and Knotts, 460 U.S. at 281, 103 S. Ct. at 1085, 75 L. Ed. 2d at 62. 739 Harlow, 457 U.S. 800, 818, 102 S. Ct. 2727, 73 L. Ed. 2d 396 (1982) (citation omitted) (emphasis added). 740 Borucki, 827 F.2d at 848 (footnote omitted) (citations omitted) (emphasis added). 741 Toomer, 155 N.C. App. at 469, 574 S.E.2d at 84 (citing Kallstrom, supra). 742 Id., 155 N.C. App. at 470, 574 S.E.2d at 84. 743 Douma and Deckenbach, supra note 2, at 309. 744 Id. at 308–09 745 See Phillips v. Smalley Maintenance Services, Inc., 711 F.2d 1524, 1533 (1983) (citations omitted). 746 Dorothy Glancy, supra note 584, at 179. 747 Toomer, 155 N.C. App. at 480–481, 574 S.E.2d at 91. 748 See Dorothy Glancy, supra note 584, at 179.