Public Records in a Computerized Network Environment: Privacy Implications: Speech at the First Amendment Coalition Conference

Speech by Beth Givens, Director, Privacy Rights Clearinghouse
First Amendment Coalition Conference
Panel: "Ain't Nobody's Business But My Own: Privacy Versus the Right to Know"

My job this morning is to talk about the privacy side of the balancing act that exists between access and privacy. I find myself in considerable conflict over the privacy/access issue. My first career is librarian, and as you probably know, librarians are proponents and pioneers of access.

I now work for the Center for Public Interest Law at the Univ. of San Diego School of Law. The Center has worked hard over its history of 15 years to shine light on the activities of government, in particular California state agencies, commissions and boards. I strongly believe in the mission of the Center.

BUT for the past three years, I have directed the Privacy Rights Clearinghouse, which is a project of the Center. We do research on the effects of technology on privacy. We also operate a toll-free hotline for California consumers who call us and ask questions about protecting their privacy or who make complaints about what they perceive as privacy abuses. We average 10,000 calls per year to the hotline, and have talked to most of those callers in person (as opposed to voice mail).

Through our research and what we have learned from talking with these thousands of people, we are keenly aware of the many ways people can be harmed by information run amok ...

• for example, when information about them is compiled and used inappropriately;
• and when information that is erroneous, incomplete or misleading is used as the basis for making important decisions -- like a car or home loan, a job, or an apartment to rent.

Before launching into a discussion of some of the ways I see information running amok, I want to list six trends that I think have some bearing on these issues.

First, it goes without saying, but I'll say it anyway. Computer and telecommunications technologies are advancing at breakneck speed. Their information-processing power is allowing the collection, compilation, analysis and dissemination of massive amounts of data, at ever decreasing costs.

Second, we are seeing increased public access to computerized public records via telecommunications networks. This is a wonderful development, which we have Jim Warren to thank for, along with Assemblywoman Debra Bowen, and a lot of dedicated public servants.

A third trend. While government records have been increasingly computerized over the past 3 decades, department by department and agency and agency, we are now seeing major efforts in California and elsewhere to JOIN those records together into information networks. Some examples:

• School records from kindergarten through college.
• Social service records across several agencies.
• Public health records that are kept by various local, state and federal agencies.
• Likewise the Judicial Council of California has a goal to develop a statewide computer network of court records from all levels of the court system.

This trend toward merging of data sources applies to the private sector as well. There are major efforts in place right now to join medical records systems together into gigantic networks spanning many health care providers and health insurance companies. Again, this is happening in California as well as the other states.

A fourth trend is the blurring of distinctions between public and private data. Data from public records appear on credit reports. Likewise, government agencies such as the IRS gather information from some private sector sources -- like credit reports.

The burgeoning information industry is acquiring data from both public and private sector sources, merging and repackaging them and then selling them on the marketplace. CDB Infotek is one of those companies, headquartered in Santa Ana -- another is Information Resources in Fullerton. Look in the Yellow Pages under 'investigators' and you'll see dozens of small companies that subscribe to the information services provided by these larger information clearinghouses.

Just to give you a flavor of the kinds of services offered by information brokers, sometimes called information resellers, let me read from the pamphlet of one of the major companies, CDB Infotek.

"A personal computer, an ordinary phone line, and simple modem puts you in command of our vast array of public record information. Access to literally hundreds of millions of regional and national records can be yours in minutes"

Here are a few quotes from the CDB Infotek price sheet:

Social Security number $11.00

Registered voter profile $25.00

Neighborhood search $18.00

Superior court records $5-20 per court searched, depending on the county.

A fifth trend, not surprisingly, is a dramatic increase in the public's concern about privacy. A 1994 Louis Harris Poll found that 84% of respondents were very or somewhat concerned about privacy issues. This is up from 67% in 1978. Nearly 80% of survey respondents say that consumers have lost all control over personal information.

A sixth, and final, trend is significant societal degeneration on all fronts -- families in disarray, education losing its effectiveness, a rising crime rate, and a crumbling physical infrastructure.

We seem to have lost the collective will to deal with these problems at their roots by tackling the causes of poverty and alienation. So what's the answer? Well in many cases, information technology is seen as the answer.

Can't keep up with the growing case load in the public health system? Develop a statewide data base in which all the information about a client is in one handy place. Same thing with public school records and with social service data.

Need to reform the welfare system -- and collect child support payments from all those deadbeat parents? Then develop a nationwide data base that maintains records, including Social Security numbers, on all new hires -- in order to locate the deadbeat parents and garnish a portion of their wages.

What's the answer to illegal immigration? You guessed it, a national ID system, based on the development of another data base.

Has gun-related violence gotten out of control? Develop a national database to be used by gun dealers that contains information about violent criminals. Add to this database information about people who are mentally unstable and have other characteristics that would preclude them from owning guns.

You get the picture.

Given these trends, in particular the trend toward merging data from several information systems, all indicators seem to point to a surveillance society -- where access to a great deal of information about each and every citizen is used for social control. At this point, I don't see many -- if any -- indicators pointing in any other direction.

Now let's get back to public records and the topic for this panel.

The reason that public records are public is unassailable: so we can keep an eye on OUR government.

• Public records provide notice to all members of society of the official actions taken by government.
• They also provide notice of the "official" status of individuals and property.
• In short, public records promote government accountability.

Making public records accessible to citizens via computer networks is a powerful way to arm people with the tools to keep government accountable.

But public records also have a great deal of information about individuals in them. And that's why privacy advocates have significant concerns about how public records are used.

Computerization of records alters the balance between access and privacy that has existed in paper and microfiche records. Let me give some examples of how the balance is tipped.

1. 1. The ease of computer searches makes it possible to discover information on a casual basis, such as fishing trips, looking for information that might show culpability.
       
   2. When bits and pieces of information are gathered from several sources, the brevity of some of those pieces can be misleading. Clarifying information might not be included in the digest of information that is made available. Updated information may also not be provided, for example acquittals and dismissals. How can we be assured that the information brokers, mentioned earlier, are up to date on their data compilations?
       
   3. Compilations of many disparate pieces of information could compromise the personal or financial security of individuals. We're seeing a dramatic increase of cases of identity theft on the Clearinghouse hotline -- when credit card numbers, Social Security numbers, driver's license numbers and other pieces of identifying information such as mother's maiden name are obtained by an unscrupulous person and then used to impersonate their victim and spend their money.
       
   4. Compiling public records information from several sources allows all that assorted data to be sifted and sorted in many different ways. In a sense, brand new records are created. And the types of uses that can be made of these 'new' records goes far beyond the original public policy reason for collecting them.
       
   5. Presently in California, compilations of criminal history information are considered confidential records, only available to law enforcement and a few others, as specified in the Penal Code. Policymakers have seen the value in protecting this information and limiting access to it. But the computerization of court indexes allows commercial vendors to produce VIRTUAL rap sheets, criminal histories that are little different from what the California law says should be a confidential document.

The purpose of court indexes is to facilitate case location, one by one. But when the computerized indexes are merged and sorted by individual name, then what is created is essentially a criminal history, which is considered a confidential document under California law.

Here is a paragraph from a recent California court decision, the Westbrook case in Los Angeles Municipal Court.

There is a qualitative difference between obtaining information from a SPECIFIC docket or on a SPECIFIED individual, [and] from obtaining docket information on EVERY person against whom criminal charges are pending in the municipal court. ... It is the AGGREGATE NATURE of the information which makes it valuable to respondent; it is that same quality which makes its dissemination constitutionally dangerous." [emphasis added] (Westbrook v. Los Angeles Co. et al., 27 Cal. App. 4th 157 (1994))

The plaintiff was Robert Westbrook, a vendor of criminal background information doing business as Crimeline. He wanted to purchase computer tapes from the LA Municipal Court System in order to process it and resell it to interested parties. Typically, purchasers of such information are commercial information brokers, private investigators and employment background check firms.

The court ruled against Westbrook in the case, citing privacy considerations. In addition, the court said that Westbrook's use of the data over time could amount to the creation of virtual "rap sheets" on individuals. However, contrary to the Westbrook case, other courts have NOT PREVENTED unfettered access to and use of computerized public records in the aggregate.

Use of computers to aggregate public records and make them accessible through telecommunications networks makes another undesirable scenario likely -- that of citizens avoiding contact with government agencies and courts so as not to have any information about them easily accessible to others.

The previous California Secretary of State Tony Miller observed that many people do not vote because they do not want their name, address, party affiliation and other information publicly available. That is why his office promoted legislation last year that would make the home address confidential. That legislation passed.

By the way, we have heard ample evidence from callers to our hotline to support the Secretary of State's observation.

There is the very real possibility that the continued growth of information services that compile public records from many sources will result in the chilling effect of people choosing not to take part in public life, not offering themselves as witnesses in cases, or serving on juries. If the result of such participation in public life is to lengthen one's electronic dossier and make more and more personal information available to whoever wants to buy it, then it is likely that people will avoid those situations where personal information about them is gathered.

The last point I want to make about the negative effects of aggregating public records information through the power of computers is the loss of "social forgiveness." In a surveillance society, there is no social forgiveness. Your conviction on graffiti vandalism at age 19 will still be there at age 29 when you're a solid citizen trying to get a job and raise a family.

There are precedents for restricting the amount of access to various informational histories. One is the rap sheet -- or criminal history -- which in California is confidential, not public. And another, on the private sector side, is the credit report. Documentation of a bad payment history can only be kept on the books for 7 years -- and a bankruptcy for 10 years. In this way, societal institutions are allowing the possibility "starting over."

I've listed several undesirable effects of aggregating public records information in computer systems. What's the answer to these issues?

Some people -- the privacy fundamentalists -- say "just don't collect the information in the first place."

Others say, don't allow government agencies to sell it to the information brokers for them to merge the records and then re-sell them.

Another solution which has been broached is placing restrictions on the KINDS of uses made of public records. Don't allow secondary uses that deviate from the original public policy reason for gathering that information. Information about individuals obtained by government is usually obtained through coercion, or in order to obtain some government service. The individual usually has no choice in the matter. The argument is made, therefore, that such information should only be disclosed when there is a policy justification for that disclosure.

Some say the Social Security number is the culprit because it's the one key identifier that allows the linking of one database with another, and another and another. And it's a number that we receive at birth. They would argue that the SSN not be collected on government records -- except those it was meant for, specifically the Social Security Administration and tax authorities. In addition, they would propose that private sector entities also not be allowed to use it for their recordkeeping purposes.

There is probably some merit to each of these arguments.

The challenge we have is to develop information policies that maintain the spirit of public records -- shining the light on government operations -- while at the same time giving individuals some control over uses of their personally identifiable information when those uses go beyond the original public policy purpose for collecting that information.

My conclusions on the best way to do this are not yet fully formed. Our deliberations in the Privacy and Access Subcommittee of the Judicial Council's Court Technology Committee (of which I am a member) will no doubt affect how my thoughts on this matter evolve.

But at this time, I am verging toward the need for some kind of regulation of the information broker industry -- much like how the credit reporting industry is regulated. The purpose would be to:

• Allow the subjects of all that data to have access to information compilations.
• Allow individuals to have erroneous records corrected.
• Allow them to add information that explains misleading or incomplete information.
• Notify individuals when another entity has inquired about their particular record.
• Such regulation would also require that data compilations be kept up to date and that there be limits on the number of years compilations can be kept.

In short, the growing information industry should abide by a code of fair information principles, much like those codified in the Fair Credit Report of 1970, which governs how our financial histories are used. Such a code would include principles like

• Notice and disclosure.
• Access to records.
• Right to have errors corrected.
• Limitations on the number of years negative information can be held.
• And the requirement that such records are held in a secure environment.

We can look to several other countries for models in setting up such codes -- West Germany, the Netherlands, and New Zealand for example. Going into detail on specifics of establishing such codes is beyond the scope of my presentation, but I just want to point out that other countries are significantly ahead of the United States in giving citizens some control of the uses of their personal information.

That concludes my remarks.

To summarize. The privacy issues I've outlined are very real and they aren't going away. At the same time, we are seeing the promise of increased access to government records through computerization and online networks. Our challenge is to develop information policies that maintain the spirit of public records -- that is, shining the light on government practices -- while at the same time preventing the formation of a surveillance society. The answer lies in giving citizens some measure of control over their personal information through the development of a code of fair information practices that would be followed by private sector information brokers.

Thank you.