3

In the past, I had interactions via email with various boards of my town government. I recently noticed that printouts of these emails were scanned and added to the "meeting package" - a PDF document that is available on the town's website. The printout contains my name, email address, and in some instances my address and home phone number. Google OCR'd the PDF documents and finds them when I search for my email address. (e.g. https://www.town.medfield.net/DocumentCenter/View/2309/BOS-Meeting-Packet-January-29-2019-PDF)

I asked for these documents to be redacted or removed, but I did not get a response and I don't expect any action. Is there a legal basis for this request, or can the town take the position that the correspondence is public record in its entirety? And what entity could help me enforce a request for removal (other than a paid lawyer)?

Comment/Explanation: The initial couple of answers don't seem to address my concern, so here is another attempt to explain. My question is primarily about the level of protection that PII should get from local governments, not about public records. I do contract work for a federal government agency. I have to undergo training annually for Title-9,13,26 protection of citizen data. It appears to me that local town governments should adhere to the same standards, but I was wondering what the legal basis is.

migrated from security.stackexchange.com May 10 at 7:22

This question came from our site for information security professionals.

  • 2
    It depends on your state. – user6726 May 10 at 15:18
  • 1
    @user6726 do tell, in what state is posting an email illegal? – Putvi May 10 at 16:32
  • @Putvi They didn't claim that posting an email is illegal. – Acccumulation May 10 at 18:29
  • That was meant to be in reference to the comment saying it depends on the state. – Putvi May 10 at 18:30
  • If you are Amazon then you would get two business days to squash FOIA requests: washingtonpost.com/local/virginia-politics/…. I suspect if you are an ordinary peon, you get nothing. – emory May 10 at 19:34
3

The general rule is that "public records" must be disclosed unless they are by definition not public records. This study summarizes US public records law on a state by state basis, if the issue is about the US. Taking Massachusetts as an example, the law defines public record here, so if the item is not a public record, it is not required to disclose the item. Clause 26 has a long list of exceptions such as

(j) the names and addresses of any persons contained in, or referred to in, any applications for any licenses to carry or possess firearms issued pursuant to chapter one hundred and forty or any firearms identification cards issued pursuant to said chapter one hundred and forty and the names and addresses on sales or transfers of any firearms, rifles, shotguns, or machine guns or ammunition therefor, as defined in said chapter one hundred and forty and the names and addresses on said licenses or cards ...

(o) the home address and home telephone number of an employee of the judicial branch, an unelected employee of the general court, an agency, executive office, department, board, commission, bureau, division or authority of the commonwealth, or of a political subdivision thereof or of an authority established by the general court to serve a public purpose, in the custody of a government agency which maintains records identifying persons as falling within those categories; provided that the information may be disclosed to an employee organization under chapter 150E, a nonprofit organization for retired public employees under chapter 180, or a criminal justice agency as defined in section 167 of chapter 6.

(p) the name, home address and home telephone number of a family member of a commonwealth employee, contained in a record in the custody of a government agency which maintains records identifying persons as falling within the categories listed in subclause (o).

If the information is not legally a public record, there is no obligation to disclose. There is a general requirement via statute, regulation and court rulings requiring the government to protect personal information, such as this. You can get a list of sources on that topic here. This does not mean that the government body in question can be forced to redact that information, but it is at least possible that there is a (slim) legal basis for requiring them to protect your privacy.

  • Not sure that the commonwealth requirement cited has any provisions that apply to local governments (although those might be located elsewhere in the statutory scheme). It seems limited to state agencies. – ohwilleke May 14 at 1:36
2

You certainly can't (successfully) sue the government for money damages for harm caused by the disclosure or for a fine due to sovereign immunity from tort claims except in the case of certain specific exceptions which would almost never included disclosing private information.

You might be able to get injunctive relief (i.e. a court order requiring the town to redact the information), but you would have to establish a duty to maintain privacy first. The duty to protect personal identifying information arises by statute, and mostly it applies only to specific kinds of information (e.g. health information or educational records) and only to certain kinds of entities (usually not town government).

There might be some state law that requires certain information to be kept confidential by town governments, but unless you can find an applicable statute, you will probably not prevail. Since "my name, email address, and in some instances my address and home phone number" are already present in many public records that the public can access (real property records, voter registration records, court filings, applications for various permits), this is almost surely not protected by any statute.

  • So basically you are giving him a maybe? This is not an answer. – Putvi May 10 at 18:20
  • Can you site a state law that would make them redact the information? He is in Mass. – Putvi May 10 at 18:25
  • 1
    I don't think that one exists for the information he describes. – ohwilleke May 10 at 19:08
-6

I'm sorry, but they can put what they want on their site.

If you talked to someone at the town, they would probably remove your address and phone number though.

  • 2
    I'd disagree - they cannot 'put what they want.' Can they legally put a social security number? Drivers license number? Medical or health information? There are lots of instances of PII that would not be considered legal or "whatever they want." I'd also say that this depends on their state. – mark b May 10 at 16:14
  • @markb well I'm sorry you disagree lol, but there is no law saying they can't. Theres thousands of websites with that info on them. It's not illegal lol. – Putvi May 10 at 16:15
  • 2
    Have you searched for every law in every state? I do believe there are laws restricting 'anything they want' But I guess since it's a government entity, even if there were laws against it they can do whatever they want because they are a government. If that's your basis then please say so. – mark b May 10 at 16:22
  • 1
    @Putvi It would not be unusual for a government agency to be restricted in its disclosure of PII. – cpast May 10 at 16:24
  • 2
    You should be clear what you mean in your answer. There, you say "they can put what they want on their site." A couple people disagreed with that and you replied with, "There are no laws restricting putting an email on a town's website." Either change your answer to reflect the latter response, or rebut the disagreements to the answer you actually gave. – A.fm. May 10 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.