0

Suppose a state-run organization in Washington state receives a public records request that is broad (but not overly broad). In attempting to fulfill the request, an employee discovers that some electronic records they created and that would typically be responsive to the public records request are accessible to them but not in their possession. As an example: another (private) organization has the records on a private server or private shared drive, the employee has access to that drive due to an oversight by the company, and the employee is aware that the private company has not consented (and would not consent) to their accessing the records for the purpose of fulfilling the records request. Such a scenario would seem to fall in a gray area in which computer trespass law prevents the employee from providing the records but public records law requires the employee to provide them.

Are there specific laws or existing precedent that clarify the public organization's (and the employee's) legal duty in this situation?

2
  • 2
    How did it come to be that records the agency created are no longer in its possession? The law is unlikely to require the agency to go pull those files from a third party's computers without consent, but there may still be an obligation to recoup the records.
    – bdb484
    Aug 23 at 23:05
  • @bdb484 Sorry, this is a hypothetical that came up during records request training, so I don't have actual details. I'm imagining something like this: the public org and private org had a collaborative relationship where the private org shared a google drive or similar in order to provide data to the public org. The public employee then made a document in that shared drive without realizing it (this is quite easy to do in google docs at least, as the location of the documents are not always obvious). The private org then forgets to revoke access, but everyone knows this was a mistake. Aug 24 at 1:00

2 Answers 2

1

We can set aside FOIA which is a federal law and does not apply to Washington state records. The Public Records Act is what matters. Various records kept by the government must be disclosed upon request:

(RCW 42.56.070) Each agency, in accordance with published rules, shall make available for public inspection and copying all public records, unless the record falls within the specific exemptions of subsection (8) of this section, this chapter, or other statute which exempts or prohibits disclosure of specific information or records.

We have to scrutinize the information to see if it is a "Public record", which

includes any writing containing information relating to the conduct of government or the performance of any governmental or proprietary function prepared, owned, used, or retained by any state or local agency regardless of physical form or characteristics. For the office of the secretary of the senate and the office of the chief clerk of the house of representatives, public records means legislative records as defined in RCW 40.14.100 and also means the following: All budget and financial records; personnel leave, travel, and payroll records; records of legislative sessions; reports submitted to the legislature; and any other record designated a public record by any official action of the senate or the house of representatives. This definition does not include records that are not otherwise required to be retained by the agency and are held by volunteers who: (a) Do not serve in an administrative capacity; (b) Have not been appointed by the agency to an agency board, commission, or internship; and (c) Do not have a supervisory role or delegated agency authority.

For the sake of concretization, I assume the information was written and prepared by a government agency. We therefore don't care where it is stored.

The request is made to the agency (not to an individual), and the agency has (by law) published procedures for processing requests (RCW 42.56.040). Perhaps the police officer in Ione (produced "Eye-own", stupid sans serif font doesn't distinguish l and I) issued an e-ticket and discovered that he filed the citation on some unofficial off-site storage facility. He still has to comply with the records request – a separate question is whether he might be punished for improper records maintenance. Storing information off-site does not create an exemption for the disclosure requirement. He cannot be penalized if he tried but failed to obtain a copy for disclosure (RCW 42.56.060).

I guess the scenario is then further complicated by an the record being controlled by some third party which the agency has no control over (me, for example), and I refuse to provide a copy of the record. Then can the government agent hack into my computer in order to obtain the desired information, in satisfaction of the records request? Without a warrant, no, and that is independent of state law (it is illegal to hack into my computer, at the federal as well as state levels).

The main problem is that public records have to be maintained, and can't be offloaded to private locations where they can't be accessed in order to satisfy a public records request.

https://apps.leg.wa.gov/rcw/default.aspx?cite=40.14&full=true

As an example: another (private) organization has the records on a private server or private shared drive, the employee has access to that drive due to an oversight by the company, and the employee is aware that the private company has not consented (and would not consent) to their accessing the records for the purpose of fulfilling the records request. Such a scenario would seem to fall in a gray area in which computer trespass law prevents the employee from providing the records but public records law requires the employee to provide them. See RCW 40.14.020.

2
  • Thanks, lots of good information here! One question: you say that "He cannot be penalized if he tried but failed to obtain a copy for disclosure (RCW 42.56.060)" however, RCW 42.56.060 states that one cannot be held liable "based upon the release of a public record"—does this really apply when the record cannot be produced? Aug 24 at 1:59
  • 1
    That includes the failure to release. You may be aware that enforcement of the Public Records Act is rather toothless, where enforcement actions are possible only if an entity unlawfully refuses to produce. The law never penalizes a person for failing to do the impossible.
    – user6726
    Aug 24 at 4:15
0

FOIA does not permit violating other laws

Alice requests from the government the information blue boxes they posses.

Bob is handling the request and discovers all the files about blue boxes on government servers. He accidentally discovers files about blue boxes on a non-government server about them. Bob should be aware that accessing those files would violate the CFAA, and giving them to Alice would most likely violate contracts and for sure copyright laws.

Bob may only answer the FOIA request with the information he is lawfully in possession of - those that are on government servers.

1
  • Thanks. The only question I have after reading this is whether it matters at all that Bob created some of the records on the non-government servers (i.e., those records are arguably the government's property). Aug 23 at 21:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .