June 12, 2003
The staff of the Committee on Open Government is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the information presented in your correspondence.
I have received your letter in which you sought my opinion concerning the propriety of a proposed policy of the Workers' Compensation Board ("the Board") for reporting statistical information in a manner consistent with the Freedom of Information Law, §110-a of the Workers' Compensation Law and other related statutes.
Section 110-a imposes restrictions on the disclosure of information contained in individual case files, and subdivision (4) of that statute provides that:
"It shall be unlawful for any person who has obtained copies of board records or individually identifiable information from board records to disclose such information to any person who is not otherwise lawfully entitled to obtain those records."
Under the proposed policy, information would be described in what you characterized as "range form, so as to group data for entities which have similar statistical characteristics." You indicated that the proposed policy:
"...represents the Board's proposed standard for determining the cut- off point for information which could be used to identify an individual claimant. In developing this policy, the committee recognized that an unusually curious and energetic reader could utilize information published in a Board report along with other public or private information to reveal the identity of a claimant; however, we felt inclined to propose a policy which is geared more towards the reasonably interested reader."
You offered examples in the proposal of the means by which data would be reported, and the proposal states that "whether the data is reported in ranges or individually, the Board should decline to report any statistical information which reflects 5 or fewer units of information."
Since I am unfamiliar with the kinds of statistical data that the Board prepares, I cannot advise as to a specific number that might be cited as a "cut-off point." Nevertheless, I believe that the principles to which you referred in developing the policy are fully appropriate.
A standard appearing in federal regulations pertaining to unrelated records has been cited frequently in an effort to offer advice regarding the protection of personally identifiable information. Specifically, 34 CFR §99.3 was promulgated to implement the Family Educational Rights and Privacy Act ("FERPA", 20 USC §1232g). In brief, FERPA focuses on records pertaining to students and prohibits the disclosure of personally identifiable information without the consent of a parent of a student under the age of eighteen or the student who has attained that age, or under other narrowly delineated circumstances. The regulations define the phrase "personally identifiable information" to include:
"(a) The student's name; (b) The name of the student's parents or other family member; (c) The address of the student or student's family; (d) A personal identifier, such as the student's social security number or student number; (e) A list of personal characteristics that would make the student's identity easily traceable; or (f) Other information that would make the student's identity easily traceable" (34 CFR Section 99.3).
Based upon direction provided by FERPA and the regulations that define "personally identifiable information", references to students' names or other aspects of records that would make a student's identity easily traceable must be withheld in order to comply with federal law.
In my view, the proposed policy should and generally does protect against the disclosure of workers' compensation records that would render a person's identity easily traceable.
As in the care of the federal regulations and your comments regarding the proposed policy, it may not be impossible for an industrious or creative person to identify a claimant, particularly if that person independently possesses personal information that might be used in combination with statistical data to ascertain one's identity. However, so long as this policy reasonably serves to protect personal privacy, I believe that it would be consistent with law and particularly with the intent of §110-a.
I hope that I have been of assistance. If you would like to discuss the matter further, please feel free to contact me.
Robert J. Freeman