By John Fester and James Petrungaro
April 16, 2018
In 2016, the Illinois Appellate Court ruled in Hites v. Waubonsee Valley Community College that electronic databases maintained by public bodies are “public records” under the Freedom of Information Act (“FOIA”) and thus can be the basis of a FOIA request. Parsing between general “searches” of databases and the request for records from existing database “fields,” the Appellate Court in Hites ruled that electronic records in databases must be disclosed (absent a qualifying exemption or undue burden upon the School District) unless the request results in the creation of a “record” not previously maintained. For example, under the reasoning in Hites, a school district payroll database including a “field” containing the salary of every administrator would be subject to disclosure if so requested; however, a request for “the number of administrators earning more than $100,000” would not be subject to disclosure under FOIA if that particular database field does not already exist. Thus, even though the requested information/data could be derived from a search of the database, it was not subject to mandatory disclosure under FOIA because it requires the creation of a new record.
A recent decision from the Appellate Court follows the court’s reasoning in Hites and provides additional guidance for responding to FOIA requests that do not identify specific records or database fields. In Martinez v. Cook County State’s Attorney’s Office, issued on March 12, 2018, the Court once again distinguishes between database queries that produce already existing public records and queries that are tantamount to “research” of public records and which produce newly created public records.
The FOIA dispute began with Martinez’s request for records from the State’s Attorney’s Office (SAO) relating to criminal prosecutions involving the use cell site simulators. These devices help law enforcement to locate, pinpoint and sometimes interfere with cellular communications. Martinez first requested records “for each instance in which information [was] obtained using [stingray] equipment in a criminal prosecution,” including the case identifier, criminal charges at issue, case outcome, stingray evidence used, and certain other information.” (Emphasis added.) The SAO denied the request, first noting that it does not maintain a record identifying which of its thousands of criminal cases specifically relied upon stingray evidence. The SAO also denied the request on the grounds that a search for such instances would be unduly burdensome.
In reviewing whether the SAO complied with FOIA in denying the request, the Appellate Court first ruled that Martinez had not “reasonably described a record.” The court noted that FOIA requires a requester to “reasonably identify” the record being sought and may not simply seek “data, information and statistics” that must be “gleaned generally” or otherwise “extracted” from records maintained for other purposes. Thus, while it was undisputed that the SAO possessed records containing the data Martinez generally sought in his request, because the SAO does not specifically maintain records already cataloged or organized in a form specifically responsive to the request, the SAO was permitted to deny the request. In other words, the Appellate Court determined that querying and compiling the information responsive to Martinez’s request would have required the creation of a new record – a task not required by FOIA.
After the initial request was denied, Martinez attempted to revise and/or narrow his request. Concerning stingray records used in criminal prosecutions related to narcotics and terrorism cases, he requested that the SAO:
“Send an email to every attorney in the SAO and ask each to identify, based on memory, any cases in which evidence was obtained using a stingray.”
Conduct a server-side centralized search of e-mails for “stingray,” “IMSI catcher,” and “cell site simulator” and produce any non-exempt records.
The SAO once again denied the request as unduly burdensome. In reviewing the denial, the Appellate Court quickly dispatched the notion that FOIA requires any polling, questioning or other query of the memories of SAO attorneys to identify specific cases that would have responsive records. Such a request for a “search” and not a “public record” itself, the court held, was not required by FOIA.
Concerning the request for a server-search of emails containing specific keywords, the Appellate Court considered such asearch to be the search of a database. The Court first noted that an electronic search of a public body’s electronic database is the electronic equivalent of “copying” public records. The Appellate Court found that generally, databases and their aggregate data are public records that must be disclosed unless some exemption permits their withholding. The court, however, then held that the request for a search of the database for a particular subset of information that is not otherwise already specifically cataloged by the public body in specific data fields, including general keyword searches, results in the production of a new record that is not required by the FOIA, stating: “A request for a listing or index of a database’s contents that seeks information about those contents, as opposed to the contents themselves, requests a new record.”
It is noteworthy, however, that Appellate Court acknowledged in its opinion that the distinction between a “search” of a database and the production of existing “public records” within a database is a “muddled” gray area. The Court recognizes that the use of databases creates a “tension” between the “well-settled prohibition” on requiring public bodies to create new records and the requirement to make electronic databases available under FOIA. We expect that this area of law will continue to evolve and that until a bright-line rule is established, public bodies are safest leaning towards disclosure instead of withholding.
As both public bodies and the general public become more technologically sophisticated, the frequency of FOIA requests that involve database records will continue to increase. While an analysis of the specific wording of a FOIA request is necessary in every case to determine whether FOIA will require disclosure of the records sought, we provide the following general takeaways from the Appellate Court’s guidance in Hites and Martinez:
FOIA requests must “reasonably describe” a specific public record sought to be disclosed. Requests for all records “showing that…” or requests for information (e.g., “the number of …”) and other similar fishing expedition-type requests should be particularly scrutinized. A request for the results of a search or for general data, information and statistics does not seek a “public record” and thus is not subject to FOIA.
The production of data from existing database fields is the equivalent of copying individual paper records from a cumulative file. Thus, data from electronic databases generally are subject to disclosure under FOIA. However, the request must seek data in a form that already exists pursuant to the business of the public body. The data sought must already be organized in a “field” or other defined data-set, or the search must be one ordinarily performed by the public body. A request to “search” a database or a request seeking all database records containing certain keywords that are not already cataloged is not required by the FOIA.
A District email server is a database. A requester can legitimately seek all emails between John Doe and Jane Roe from a certain timeframe, or already cataloged in a specific folder, or concerning a particular matter identified in the “subject” field. These kinds of requests seek records in a catalog format that is already maintained by the District’s email system (e.g., date, subject matter and username fields). A request for a search of emails containing certain “keywords” in the body, on the other hand, calls for an impermissible search and not a particular public record.
In some cases, the search of a database for a result or answer may be less burdensome (often much less burdensome) than producing actual public records that are sought. It acceptable to the requester, public bodies possess the discretion to offer that option, though it is not required by FOIA.
Databases and their subsets of data in narrowed fields may be public records subject to the FOIA, but the data may nonetheless be exempt pursuant to specified exemptions in the FOIA.