Letter to Florida Courts Concerning Group 2 Privacy Recommendations
[BY EMAIL: e-file@flcourts.org]
February 28, 2006
Florida Supreme Court
500 South Duval Street
Tallahassee, FL 32399-1900
Re: Comments on Privacy, Access and Court Records / Report and Recommendations of the Committee on Privacy and Court Records / Group Two
Dear Honorable Members of the Florida Supreme Court:
The Electronic Privacy Information Center (EPIC) is a public interest research center in Washington, D.C. It was established in 1994 to focus public attention on emerging civil liberties issues and to protect privacy, the First Amendment, and constitutional values. EPIC occupies a unique space in this debate because the organization both advocates for the right of privacy and pursues access to government records under the Freedom of Information Act. EPIC is one of two judicially-recognized entities with "news media" status under the Freedom of Information Act.[1] EPIC is a strong supporter of access to government information. At the same time, the presence of personal information within public records raises serious privacy issues. EPIC previously submitted comments to the Committee in November 2004, detailing how Florida citizens' personal information stored in public records is collected, bought, and sold, free of privacy restrictions.[2]
We applaud the Court and the Committee on Privacy and Court Records for tackling the difficult public policy issues surrounding access to public records. The Florida Report and Recommendations constitutes one of the most progressive and comprehensive approaches to addressing the privacy risks of public records in the nation.
At the outset, we wish to emphasize our principal concern:
The very purpose of public records—the ability of the individual to learn about the government—is turned on its head when the records include excessive personal information. Instead of being citizens' window into government activities, public records are giving the government, law enforcement, and data brokers a window into our daily lives. Without privacy protections, court and other public records will be commodified for commercial purposes unrelated to government oversight.
Court records are becoming the fodder for dossiers on Americans. Currently in Congress, lobbyists from data companies are attempting to place an exemption into privacy legislation that would free data companies from consumer protections, so long as the information they sell is present in a public record. This would mean that companies that traffic in sensitive personal information--including Social Security Numbers--would not have to abide by security safeguards or inform consumers if this information was stolen! The data brokers are banking on the courts to pour personal information into the public record so that it can be sold without privacy safeguards.
Literally, the data brokers are engaging in a circular form of advocacy. They claim that their files do not implicate privacy interests because they are drawn from public records. At the same time, they lobby vigorously in every state and the federal level to increase the amount of personal data in public records. They are dismissing privacy violations as trivial with one hand while using the other to pour data into public records.
Under their approach, a newspaper that published a birth notice (that includes date of birth, full name, and mother's maiden name) would be considered a public record and that information could be freely sold. Babies do not choose to publish this personal information, which is used for credit authentication and other security purposes, but upon birth, public records exemptions already start to erode one's privacy.
As Congress considers legislation to give individuals rights with respect to commercial data brokers, it is imperative to limit the scope of personal information that appears in public records. If, as the Recommendation notes, privacy interests continue to "los[e] ground to economic and law enforcement interests," all personal information in public records will be subject to very little if any privacy protection. This will have wide ranging consequences for individuals who wish to live a life free of identity theft, stalking, profiling, and direct marketing that is driven by the inclusion of personal information in public records.
Indeed, economic and law enforcement interests have merged in many respects to erode privacy rights. Commercial data brokers are independent economic powers in themselves, but also receive support from law enforcement interests that wish to have more and more data on America's citizens.
Specific Comments
Minimization
Minimization is the most important approach to addressing privacy risks associated with public records. We strongly support recommendation 7, and suggest that heightened attention be focused on removing unique identifiers from records. These include the Social Security Number, date of birth (in some populations, date of birth is individually identifiable, and when combined with other information, it can be individually identifiable even in large populations),[3] telephone number (commercial marketers are beginning to track individuals and households by telephone number, because the number is relatively permanent), and home address.
These unique identifiers do little to serve the interest in improving oversight of government functions. They have little, if any, communicative value. Instead, they are used primarily by big business and government to focus in on the individual.
We further recommend that the Court revisit its minimization policy in 10 years to reevaluate what information needs to be collected.
Respectfully Submitted,
Chris Hoofnagle
Electronic Privacy Information Center West Coast Office
944 Market St. #709
San Francisco, CA 94102
415.981.6400
Hoofnagle@epic.org
[1] Elec. Privacy Info. Ctr. v. DOD, 241 F. Supp. 2d 5 (D.D.C. 2003).
[2] Letter from Chris Jay Hoofnagle, Associate Director, Electronic Privacy Information Center, to the Committee on Privacy and Court Records, Nov. 1, 2004, available at http://www.epic.org/privacy/publicrecords/flcomments.pdf.
[3] Carnegie Mellon Professor Latanya Sweeney has demonstrated that anonymous data sets can often be readily "reidentified." In one experiment, Sweeney, using 1990 Census data, demonstrated that individuals often have demographic values that occur infrequently. Since these values occur infrequently, they allow the re-identification of individuals in putatively anonymous datasets. Sweeney found in her report Uniqueness of Simple Demographics in the U.S. Population: "...87% (216 million of 248 million) of the population in the United States had reported characteristics that likely made them unique based only on {5-digit ZIP, gender, date of birth}. About half of the U.S. population (132 million of 248 million or 53%) are likely to be uniquely identified by only {place, gender, date of birth}, where place is basically the city, town, or municipality in which the person resides. And even at the county level, {county, gender, date of birth} are likely to uniquely identify 18% of the U.S. population. In general, few characteristics are needed to uniquely identify a person."