A pile of sensitive personal data from Florida residents is now on the loose online. But it wasn’t leaked from a hack or a breach. It was from a completely legitimate public records dump by the state’s former governor.
As The Verge explains, former Florida governor Jeb Bush and his staff released the messages in a bid for transparency as part of his run-up to a likely presidential campaign in 2016.
The messages, spanning the eight-year period from 1999-2007, cover a huge array of topics, both vague and detailed. And the devil is in those details: many messages contain very specific information about the constituents who wrote or are referenced in them.
That information includes not only names, addresses, e-mail addresses, and sometimes phone numbers, as you might expect, but also in some instances, sensitive personal information like medical data and even Social Security numbers.
Floridians are rightfully concerned that material they sent in confidence is now available on-demand online. And yet, public records are just that: public, designed by their nature to be shared on request.
More and more public data each year is stored in easily-shared digital files. Bush’s gubernatorial oversharing might be the biggest, highest-profile blunder to happen with it so far but it’s not likely to be the last. And that leads to an important question that will only keep getting more important: when public records laws meet private data rules, what wins out? Do individuals have protections?
The answer, frustrating as it may be, is: “it depends.”
In this particular case, Florida has very explicit laws on the books about both keeping public records public and also protecting personal data.
All of the e-mails are, indeed, open public records. The messages from Bush’s official e-mail account even all include a footer reading: “Please Note: Florida has a very broad public records law. Most written communications to or from state officials regarding state business are public records available to the public and media upon request. Your e-mail communications may therefore be subject to public disclosure.”
But, as The Verge explains, Florida law also very clearly exempts Social Security numbers from those disclosure laws. A Florida attorney told The Verge, “It doesn’t matter how an agency or official obtained the information; once obtained it is a public record and the SSNs are confidential and exempt under the law.”
So an SSN received in an official form and one sent in an e-mail are both public records, under Florida law, and both equally required to be kept confidential when the documents are shared.
But that’s just Florida. We’ve got 49 other states, a District, and a handful of territories to contend with, as well as federal law, and the protections are far from even across the board.
Every state handles public records laws differently. And different agencies and offices within each state handle records differently, with a web of public and privileged (confidential) information mixing all over. Court records are not the same as land deeds, which are not the same as DMV information, which is different from comments on proceedings, and so on.
Different public records have different levels of information and are, frankly, different levels of public. Some are in the bottom of locked filing cabinets in the basement behind a sign saying “beware of the leopard,” and some are easily queried online by basically anyone, anywhere.
A 2012 government report (PDF) finds legislation and case law about the privacy of personal information, specifically Social Security numbers, varies hugely around the country. Some areas are protected under federal law (for example, the government can’t print SSNs on any checks they send out), but public records disclosures are entirely a state-level matter.
In the game of politics, Bush’s bulk data drop is a gaffe that’s already fading as the news cycle churns over. For the Floridians whose personal information made a very high-profile splash on the internet, the effects will likely linger much longer.
by Kate Cox via Consumerist
No comments:
Post a Comment