June 9, 2003
The staff of the Committee on Open Government is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the information presented in your correspondence.
I have received your thoughtful letter in which you raised the following question:
"Was it appropriate for OMH to share records or personal information as defined by section 92 of the Public Officers Law with the Archdiocese of New York, when the data subject has the civil service title 'chaplain' at one of the Agency's facilities, and the Archdiocese is the official endorsing agency for the chaplain."
You indicated that the question arose in relation to an advisory opinion rendered in February by David Treacy of this office in which it was suggested that the authority of the Office of Mental Health (OMH) to share information with church officials was "questionable", and that the disclosure by OMH might have constituted "an unwarranted invasion of personal privacy."
In brief, allegations were made about a chaplain employed by OMH at an OMH psychiatric hospital concerning conduct on hospital grounds which, if proven, would be relevant to church officials in assessing the chaplain's fitness to continue in that capacity. You wrote that it is the position of OMH that "...disclosure of information to the Archdiocese is necessary to achieve the Agency's stated policy goal of providing freedom of choice of religion to patients; to ensure that this staff chaplain continues to meet Civil Service Law and ecclesiastic requirements; and to ensure the continued health and safety of the patients OMH serves."
You added that:
"The job description and title of chaplain are products of the Civil Service Law and the Department of Civil Service. The Department of Civil Service promulgates classification standards which contain the qualifications for every civil service title. The qualifications for chaplain are found in the classification standard for Occupation Code 8281000, and include in part the following: 'Although competitive examinations are not held for this class [i.e. chaplains], candidates must have ecclesiastical endorsement from the official endorsing agency of the chaplain's faith or denomination.'"
You enclosed both the classification standard and the ecclesiastic endorsement.
The disclosure to the Archdiocese was made, according to your letter:
"...pursuant to section 96(b) of the Public Officers Law, which permits disclosure of records or personal information to those who contract with the Agency, when such a disclosure is necessary to operate a program specifically authorized by law. In this case, the Archdiocese and the Agency enjoy a contractual relationship requiring the frank and confidential exchange of information which relates to the Archdiocese' role as ecclesiastical endorser, and which is necessary for the continuation of the provision of pastoral care for patients of the Catholic faith."
In consideration of the foregoing, you asked that I review and revise the advisory opinion rendered in February.
In this regard, first, I believe that it is worthwhile to reiterate general points offered in the opinion of February 13.
As you are aware, the Personal Privacy Protection Law (Public Officers Law, Article 6-A, §§91-99) deals in part with the disclosure of records or personal information by state agencies concerning data subjects. A "data subject" is "any natural person about whom personal information has been collected by an agency" [Personal Privacy Protection Law, §92(3)]. "Personal information" is defined to mean "any information concerning a data subject which, because of name, number, symbol, mark or other identifier, can be used to identify that data subject" [§92(7)]. For purposes of that statute, the term "record" is defined to mean "any item, collection or grouping of personal information about a data subject which is maintained and is retrievable by use of the name or other identifier of the data subject" [§92(9)].
With respect to disclosure by state agencies, §96(1) of the Personal Privacy Protection Law states that "No agency may disclose any record or personal information", except in conjunction with a series of exceptions that follow. One of those exceptions involves a situation in which a record is "subject to article six of this chapter [the Freedom of Information Law], unless disclosure of such information would constitute an unwarranted invasion of personal privacy as defined in paragraph (a) of subdivision two of section eighty-nine of this chapter." Section 89(2-a) of the Freedom of Information Law states that "Nothing in this article shall permit disclosure which constitutes an unwarranted invasion of personal privacy as defined in subdivision two of this section if such disclosure is prohibited under section ninety-six of this chapter." Consequently, if a state agency cannot disclose records pursuant to §96 of the Personal Privacy Protection Law, it is precluded from disclosing under the Freedom of Information Law; alternatively, if disclosure of a record would not constitute an unwarranted invasion of personal privacy and if the record is available under the Freedom of Information Law, it may be disclosed under §96(1)(c).
For reasons expressed in the February opinion, it has been advised that unsubstantiated allegations pertaining to a public employee may be withheld under the Freedom of Information Law, for disclosure of records reflective of such allegations would constitute an unwarranted invasion of personal privacy.
The issue, however, involves the relationship between OMH and the Archdiocese and whether the disclosure by OMH to the Archdiocese was permitted by §96(1)(b) of the Personal Privacy Protection Law. That provision authorizes a state agency to disclose personal information pertaining to a data subject:
"to those officers and employees of, and to those who contract with, the agency that maintains the record if such disclosure is necessary to the performance of their official duties pursuant to a purpose of the agency required to be accomplished by statute or executive order or necessary to operate a program specifically authorized by law..."
The foregoing pertains to situations in which an agency discloses personal information to its own officers or employees who need the information in order to carry out their legal duties or to operate a program established by law, or to "those who contract with" the agency and carry out those functions on behalf of the agency.
It is my understanding that there is no written instrument or document that may be characterized as a contract into which OMH and the Archdiocese or church officials have entered. It is your contention, however, based on our conversation, that a contractual relationship has in effect been created over the course of years between OMH and the Archdiocese.
If your contention is accurate, that there is a de facto contract between OMH and the Archdiocese, I would agree that disclosure of personal information pertaining to the chaplain to the Archdiocese would have been permitted. On the other hand, however, if there is no contract and if it cannot be established that de facto contract exists, again, I believe that disclosure to a third party without consent by the data subject would be of questionable legality.
As you are aware, the advisory jurisdiction of the Committee on Open Government involves statutes pertaining to access to and the disclosure of records and information maintained by or for government agencies subject to the Freedom of Information and Personal Privacy Protection Laws. Determining or advising that a contractual relationship may exist between OMH and the Archdiocese involves a matter beyond the jurisdiction or expertise of this office; such finding in my view must be made by an entity other than this office.
In sum, the propriety of the disclosure under §96(1)(b) of the Personal Privacy Protection Law is, in my view, dependent on the nature of the relationship between OMH and the Archdiocese, and that issue cannot be determined by the Committee.
I regret that I cannot be of greater assistance.
Robert J. Freeman