Legal Issues Concerning Transit Agency Use of Electronic Customer Data (2017)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

52 First, it is difficult to predict how the courts would rule on privacy claims in the absence of any judicial precedent holding that technology that collects loca- tional and other personal data on individuals violates a right to privacy at common law.686 Second, violations of privacy by transit agencies collecting customers’ electronic data would have to have been intentional, as mere negligence ordinarily will not suffice.687 Third, in some states a violation of privacy must have been caused by “willful or outrageous” conduct.688 Fourth, the common law has not recog- nized a cause of action for a violation of privacy resulting from a disclosure of data collected on indi- viduals when they are “on the public streets.”689 There are various defenses to a claim for intru- sion, including that the plaintiff did not intend to keep the information private, that under the circum- stances the plaintiff did not have a reasonable expec- tation of privacy, or that the plaintiff voluntarily and without any coercion consented to the disclosure.690 In Doe v. DiGenova,691 a federal court in the District of Columbia held that there is no claim for intrusion when an intrusion is reasonable under the circum- stances or when an intrusion is not “serious.” Finally, in the event of an unintentional release of personal data, there may be a good faith defense that may also be codified in some state statutes. For example, Iowa Code Section 22.10(3) does not permit an award of damages against an agency when the agency shows that it made reasonable efforts to prevent disclosure or “had good reason to believe and in good faith believed” that it was complying with the statute.692 XIII. DISCLOSURES OF DATA UNDER THE FEDERAL OR A STATE FOIA OR EQUIVALENT LAW A. The Federal FOIA and Release of Personal Data Transit agencies are interested in whether the customer electronic personal data that they collect personnel file to the media, thus violating the plaintiff ’s right to privacy.680 Although the State, its agencies, and officials who are sued in their official capacities are usually immune from claims under North Carolina law, the court held that the action was allowable because of the plaintiff’s allegations of malice and bad faith on the part of the NCDOT officials.681 Therefore, the defendants were not “entitled to [a] dismissal of plaintiff’s claims for tortious invasion of privacy on the basis of official capacity immunity.”682 D. Claims for Appropriation or False Light Because they are mentioned in the Restatement, privacy claims based on misappropriation or false light will be noted briefly. For a plaintiff to make a claim for misappropriation or false light, a plaintiff’s information must have been revealed to the public by the media, the same element that is usually required for a claim for a public disclosure of private facts.683 E. Applicability to Transit Agencies of a Common-Law Right to Privacy In the absence of constitutional or statutory reme- dies, tort law must be used to remediate a violation of a claimed right to privacy.684 No cases were located for the digest, however, in which a transit customer sued a transit agency for an invasion of privacy because of the agency’s collection, use, disclosure, or retention of customers’ electronic personal data. Moreover, no agency that responded to the survey reported having received any such claims. One commentator, discussing privacy issues possibly implicated by transportation agencies’ use of intelli- gent transportation systems (ITS) technology, argues that there are several problems with attempting to use the common law of torts for a privacy violation arising out of the use of such technology.685 680 Id., 155 N.C. App. at 466–467, 574 S.E.2d at 82. 681 Id., 155 N.C. App. at 480–481, 574 S.E.2d at 91. 682 Id., 155 N.C. App. at 481, 573 S.E.2d at 91. The court also held that the plaintiff’s complaint was sufficient to state (1) § 1983 claims for federal substantive due process and equal protection violations for injunctive relief against indi- vidual defendants in their official capacities and for damages in their individual capacities; (2) state substan- tive due process and equal protection claims for injunc- tive relief against individual defendants in their official capacities; (3) a breach of contract claim against the State, NCDOC, and individual defendants in their official and individual capacities; and (4) ...invasion of privacy, gross negligence, and civil conspiracy against individual defendants in their individual capacities. Id., 155 N.C. App. at 484, 574 S.E.2d at 93. 683 Ayres, supra note 656, at 998, 1000 (footnote omitted). 684 Douma & Deckenbach, supra note 196, at 295. 685 Dorothy J. Glancy, Privacy and Intelligent Transpor- tation Technology, 11 santa clara coMPuter & high tech. L.J. 151, 179 (1995). 686 Id. 687 Id. 688 Id. at 180. 689 Garry, Douma & Simon, supra note 203, at 104 (citing Kendra Rosenberg, Location Surveillance by GPS: Balanc- ing an Employer’s Business Interest with Employee Privacy, 6 wash J. l. tech. & arts 143, 150–54 (2010)). 690 Ayres, supra note 656, at 995 (footnotes omitted). 691 Doe v. DiGenova, 642 F. Supp. 624, 632 (D. D.C. 1986), aff’d in part, remanded in part on other grounds, Doe v. Stephens, 271 U.S. App. D.C. 230, 851 F.2d 1457 (1988) (holding that under the Privacy Act, Doe was entitled to an order prohibiting the release of records). 692 iowa coDe § 22.10(3)(b)(2) (2016).

53 nature” from disclosure “if public disclosure…would constitute a clearly unwarranted invasion of an individual’s privacy.”700 Similar to Michigan’s FOIA, the Illinois FOIA prohibits inspection and copying of “[p]rivate information, unless disclosure is required by another provision of [the Illinois FOIA], a state or federal law or court order.”701 The Illinois FOIA provides that personal information contained in public records may not be inspected or copied if the disclosure would constitute “a clearly unwarranted invasion of personal privacy” unless the subject of the information consents in writing to the disclo- sure.702 In addition, in Illinois, “information specifi- cally prohibited from disclosure by federal or State law or rules and regulations implemented by federal or State law” may not be disclosed.703 New York and Wisconsin have similar exemptions.704 Second, state FOIAs or the equivalent may exempt records that are specifically prohibited from disclosure by laws other than the state’s FOIA or other public records disclosure law. In Pennsylvania, “[a] record of information[] identifying an individual who applies for or receives social services” may not be disclosed.705 In Bullock v. Southeastern Pennsylvania Transportation Authority,706 a case decided by the Office of Open Records,707 Bullock requested the Southeastern Pennsylvania Transportation Authority’s (SEPTA) Americans with Disabilities Act paratransit reports, including medical assessments, records, and written results and recommendations.708 Because paratransit services “are social services[] and…all the records requested relate to the application for, evaluation of and eligibility for the services,” the requested records were exempt from disclosure.709 are subject to a FOIA or other state public records disclosure law. The Federal Freedom of Information Act of 1966693 creates a strong presumption of public access to agency records.694 Documents that are not required to be published by an agency are subject to disclo- sure unless the information falls within one of nine exemptions.695 Unless a request for government data is protected from disclosure by an exemption in the FOIA or by another law, it appears that a request for data may be allowable.696 At least one court has ruled, however, that an agency need not disclose records automatically but must weigh the effects of disclosure and nondisclosure and determine the best course to follow.697 B. State FOIAs or Public Records Disclosure Laws and Customers’ Personal Data Likewise, state statutes that allow for the disclo- sure of data collected by state agencies may include an exemption permitting a transit or other public agency to withhold data. The New York Public Officers Law requires an agency to make available for public inspection and copying all records except those that come within certain exemptions that are similar to the exemptions in the Federal FOIA.698 A threshold question is whether a state FOIA or equiv- alent law applies to political subdivisions of the state or to municipalities that own a transit system. First, an applicable FOIA or public records disclo- sure law may exempt certain personal data from disclosure. In Pennsylvania, it is not necessary to disclose “[a] record, the disclosure of which would be reasonably likely to result in a substantial and demonstrable risk of physical harm to the personal security of an individual.”699 Although Michigan’s FOIA includes a presumption in favor of disclosure, one exemption protects “[i]nformation of a personal 693 5 U.S.C. § 552, et seq. (2016). 694 5 U.S.C. § 552(d) (2016). 695 5 U.S.C. §§ 552(b)(1)–(9) (2016). Subsection (6) states that the section does not apply to “personnel and medical files and similar files the disclosure of which would consti- tute a clearly unwarranted invasion of personal privacy….” 696 5 U.S.C. § 552(a) (2016). 697 Gen. Servs. Admin. v. Benson, 415 F.2d 878, 880 (9th Cir. 1969). 698 N.Y. Pub. off. law § 87(2)(a)–(b) (2016) (stating that an “agency may deny access to records or portions thereof that: (a) are specifically exempted from disclo- sure by state or federal statute; [or] (b) if disclosed would constitute an unwarranted invasion of personal privacy under the provisions of subdivision two of section eighty- nine of this article….”) 699 65 Pa. cons. stat. §§ 67.708(b)(1)(i)–(ii) (2016). See also Dorothy J. Glancy, Privacy on the Open Road, 30 Ohio N.U.L. Rev. 295, 301 (2004), hereinafter referred to as “Glancy.” 700 Mich. coMP. laws serv. § 15.231, et seq. (2016) and see id. § 15.243(a) (2016). See also Mich. Fed’n of Teachers v. Univ. of Mich., 753 N.W.2d 28 (Mich. 2008) (holding that names and addresses of teachers were part of a FOIA privacy exemption and therefore could not be disclosed). 701 5 ill. coMP. stat. 140/7(1)(b) (2016). 702 5 ill. coMP. stat. 140/7(1)(c) (2016). 703 5 ill. coMP. stat. 140/7(a) (2016). 704 See N.Y. Pub. off. § 87(2)(a) (2016) and wis. stat. § 19.36(1) (2016) [eff. until Jan. 1, 2017]. 705 65 Pa. cons. stat. § 67.708(b)(28) (2016). 706 In the Matter of Janice Bullock, Complainant v. Se. Pa. Transp. Auth., Docket No. AP 2010-0343, at 1, herein- after referred to as “In re: Bullock,” https://www.governor. state.pa.us/portal/server.pt/document/828113/20100353_ bullock-septa_pdf (last accessed Sept. 24, 2016). 707 Although final determinations by the Office of Open Records are binding, they are subject to judicial review. See https://www.dced.state.pa.us/public/oor/fd/Final Determination.pdf (last accessed Sept. 24, 2016). 708 In re: Bullock, supra note 706, at 1 (citing 65 Pa. cons. stat. § 67.708(b)(28)). 709 Id. at 3.

54 Finally, another possible exemption is that some states’ agencies may be able to withhold data from the public under a “deliberative process” privilege, an exemption that may be applicable to some data collected and maintained by transit agencies.718 C. Agency Waiver of Privacy Exemption Exemptions under a FOIA or similar legislation may be waived. An agency may waive its FOIA exemption if it freely discloses “confidential infor- mation to a person without restricting that person’s ability to disclose that information.”719 It has been held that if a federal agency voluntarily discloses information that is subject to the FOIA’s delibera- tive process privilege, the agency waives the right to claim later that the information is exempt.720 D. Whether Both FOIA Requests and Discovery Requests May Be Used to Obtain Transit Agencies’ Customers’ Electronic Personal Data Transit agencies may receive a request for a customer’s electronic personal data pursuant to a FOIA or equivalent law or as a discovery request or subpoena in litigation. The use of a FOIA to obtain information as a form of discovery for use in litigation, however, typically is not permitted. Several courts have held that FOIA requests should not be used as a primary means of discovery in civil litigation.721 Indeed, there is some authority that a court will not allow FOIA to be used as a substitute for discovery.722 Another example is Commissioner of Public Health v. Freedom of Information Commission,710 which involved a request by a newspaper for all records associated with a report that a physician had engaged in violations of the applicable standard of care.711 The report included an exhibit with records from the Practitioner Data Bank and the Healthcare Data Bank. The Supreme Court of Connecticut stated that federal statutes and regula- tions “strongly suggest that records” contained in the databases are not subject to disclosure under the FOIA.712 The court held that the Commissioner of Public Health could not disclose records that were received from the Federal Healthcare Data Bank or the Practitioner Data Bank to an unauthorized person unless the records also originated from the agency’s own files and disclosure was required under the Federal or Connecticut’s FOIA.713 A third exemption may be predicated on the possible loss of federal or state funding. In Pennsylvania, it is not necessary to disclose “[a] record, the disclosure of which…would result in the loss of Federal or State funds by an agency or the Commonwealth….”714 Fourth, data may be exempt from disclosure when the data are used for law enforcement purposes. A District of Columbia case, Wemhoff v. District of Columbia,715 involved the secondary uses of road- side-collected data. The plaintiff made a FOIA request for the names and addresses of motorists who received traffic violations because of being photographed by a red light camera. The court’s examination of the relevant provision of the DPPA, discussed supra, focused on the importance of main- taining drivers’ privacy: “This [narrow] construction ensures that individuals’ statutorily recognized rights to the privacy of their motor vehicle records are not sacrificed whenever a litigant raises the possibility of a tenuous connection between the protected information and issues tangentially related to a conceivable litigation strategy.”716 The court denied the request because it was not a “permissive use” within the meaning of the DPPA, and the disclosure would violate the DPPA and District of Columbia law.717 710 311 Conn. 262, 86 A.3d 1044 (Conn. 2013). 711 Id., 311 Conn. at 265–266, 86 A.3d at 1046–1047. 712 Id., 311 Conn. at 280, 86 A.3d at 1055. 713 Id., 311 Conn. at 265, 86 A.3d at 1053–1055. 714 65 Pa. cons. stat. §§ 67.708(b)(1)(i)–(ii) (2016). See also Glancy, supra note 699, at 301. 715 887 A.2d 1004, 1004–1006 (D.C. 2005). 716 Id. at 1011 (citing Pichler v. UNITE, 339 F. Supp. 2d 665, 668 (E.D. Pa. 2004) (internal quotation marks omitted)). 717 Id. at 1012. 718 Shell Oil Co. v. IRS, 772 F. Supp. 202, 203 (D. Del. 1991). 719 Patrick Lightfoot, Waiving Goodbye to Nondisclosure under FOIA’s Exemption 4: The Scope and Applicability of the Waiver Doctrine, 61 cath. u. l. rev. 807, 808 (2012). 720 Shell Oil Co., 772 F. Supp. at 211 (holding that the IRS was required to release information requested by an oil com- pany under FOIA that an IRS employee had previously read at a public meeting because a public reading of the document constituted a waiver of the FOIA exemptions). 721 Mercy Hosp. v. NLRB, 449 F. Supp. 594, 597 (S.D. Iowa 1978) (quoting NLRB v. Sears, Roebuck & Co., 421 U.S. 132 (1975)); Johnson v. U.S. Dep’t of Justice, 758 F. Supp. 2, 4 (D.D.C. 1991) (holding that “FOIA is not a discovery stat- ute”). Scholars likewise argue that a FOIA is meant to address public access to information and not to aid private litigants in litigation. See Robert C. Davis, Discovery in Envi- ronmental Litigation, 25 A.F. L. rev. 168, 176–77 (1985), hereinafter referred to as “Davis”; George K. Chamberlin, Annotation, Use of Freedom of Information Act (5 U.S.C.A. § 552) as Substitute for, or as Means of, Supplementing Discovery Procedures Available to Litigants in Federal Civil, Criminal, or Administrative Proceedings, 57 A.L.R. feD. 903 and 2016 Supp., hereinafter referred to as “Chamberlin.” 722 See, e.g., Renegotiation Bd. v. Bannercraft Clothing Co., 415 U.S. 1, 20, 94 S. Ct. 1028, 1038, 39 L. Ed. 2d 123, 137 (1974).

55 The Supreme Court held in N.L.R.B v. Sears, Roebuck & Co.723 that the purpose of the FOIA is to inform the public about agency action, not to benefit private liti- gants.724 Scholars, moreover, argue that a FOIA is meant to address public access to information, not to aid private litigants in litigation.725 If government data are exempt under a FOIA, however, it is not presumed that the data are thereby privileged within the meaning of the discovery rules.726 When there is a FOIA request, a party’s need for the information is “irrelevant” in contrast to discovery, when a qualified privilege may be asserted and a litigant’s need for the information becomes a key factor in deciding whether to permit the discov- ery.727 Some courts do not allow the government to claim a privilege and withhold data when the data are available to other members of the public.728 In a Texas case, the court held that the fact that a plain- tiff requested documents through the FOIA does not preclude the party “from receiving the same docu- ments through discovery” from the opposing party.729 Finally, as one source observes, agencies may not claim a privilege on behalf of a party whose docu- ments they possess.730 The civil discovery rules require a party to produce only documents that are relevant to the liti- gation;731 however, a party may use a FOIA to obtain data or other records that are irrelevant. E. The Use of Subpoenas to Obtain Data from a Transit Agency In federal practice, Rule 45 of the Federal Rules of Civil Procedure governs the use of subpoenas directed at nonparties in a private litigation. It “is the only discovery device available for obtaining agency records in private litigation and in government litiga- tion to which the agency possessing the desired records is not a party.”732 Under Rule 45, a party must “identify, subpoena, and depose the agency official who possesses or controls the record.”733 State courts have a rule similar to if not identical to Rule 45.734 One source argues that litigants in private litiga- tion should be permitted to use the FOIA for discov- ery and only use subpoenas when records are exempt under the FOIA, because responding to a FOIA request is more convenient for the agency.735 Some federal agencies have argued, however, that they are not subject to Rule 45 subpoenas because under the rule, “a subpoena may only be directed to a ‘person’ and that term does not include federal agencies or its employees.”736 In Securities Exchange Commission v. Biopure Corp.,737 a District of Columbia federal court held that nonparty federal agencies, such as the Food and Drug Administration (FDA), are not obligated to comply with subpoenas because they are not a “person” within the meaning of Rule 45.738 In a later case, however, the 723 421 U.S. 132, 135–136, 95 S. Ct. 1504, 44 L. Ed. 2d 29 (1975). The memoranda in dispute were generated by the Board’s Office of the General Counsel when deciding whether to permit the filing of unfair labor practice com- plaints with the Board. 724 Id., 421 U.S. at 143, 95 S. Ct. 1504, 44 L. Ed. 2d 29. See, however, Reunion, Inc. v. Fed. Aviation Admin., 2010 U.S. Dist. LEXIS 42934, at *1, 2–3, 5 (S.D. Miss. 2010) (holding, when plaintiff sought to obtain certain records from the FAA and the Office of the Secretary of Transportation, that “[u]nder present law there is no statutory prohibition to the use of FOIA as a discovery tool”). 725 See Davis, supra note 721, at 176–77 and Chamberlin, supra note 721. See also Changzhou Laosan Group v. U.S. CBP, 2005 U.S. Dist. LEXIS 7075, at *1 (D.D.C. 2005) (hold- ing that a litigant’s right to information through FOIA is no greater than any other member of the public), reconsidera- tion granted, 374 F. Supp. 2d 129 (D.D.C., June 17, 2005) (holding that documents could be withheld that were sub- mitted voluntarily to protect innocent third parties). 726 Friedman v. Bache Halsey Stuart Shields, Inc., 738 F.2d 136, 144 (D.C. Cir. 1984). See also Vinzant v. United States, 2010 U.S. Dist. LEXIS 65615, at *31 (E.D. La. 2010) (holding that a government agency may not apply FOIA exemptions to discovery requests made in litigation). 727 Friedman, 738 F.2d at 144. 728 Edward A. Tomlinson, Use of the Freedom of Informa- tion Act for Discovery Purposes, 43 MD. l. rev. 119, 168 (1984), hereinafter referred to as “Tomlinson” (discussing Moore-McCormack Lines, Inc. v. I.T.O. Corps, 508 F.2d 945 (4th Cir. 1974) (holding that the government could not claim a privilege for a document accessible to the public) and Firestone Tire & Rubber Co. v. Coleman, 432 F. Supp. 1359 (N.D. Ohio 1976) (holding that the government may not withhold documents from litigants that are available to other members of the public)). 729 Millennium Mktg. Group LLC v. United States, 238 F.R.D. 460 (S.D. Tex. 2010). 730 Tomlinson, supra note 728, at 165. See In re Westinghouse Elec. Corp. Uranium Litig, 76 F.R.D. 47, 59 (W.D. Pa. 1977) (holding that a private party could not object to producing secret documents of the Canadian government that were in their possession, but could seek confidential treatment of the documents). 731 feD. r. civ. Proc., Rule 26(b)(1). 732 Tomlinson, supra note 728, at 143. 733 Id. at 144. 734 See, e.g., Rule 45, Ohio Rules of Civil Procedure (sub- poenas). Rule 45(A)(1)(c) of the Ohio Rules of Civil Procedure states: “A subpoena may not be used to obtain the attendance of a party or the production of documents by a party in dis- covery. Rather, a party’s attendance at a deposition may be obtained only by notice under Civ. R. 30, and documents or electronically stored information may be obtained from a party in discovery only pursuant to Civ. R. 34.” 735 Tomlinson, supra note 728, at 161. 736 See, e.g., Securities Exchange Comm’n v. Biopure Corp., 2006 U.S. Dist. LEXIS 12889, at *1 (D.D.C. 2006). 737 Id. at *5. 738 Id. at *15.