Opinion
Opinion By: Jack Conway, Attorney General; Amye L. Bensenhaver, Assistant Attorney General
Open Records Decision
The question presented in this appeal is whether the Lexington-Fayette Urban County Government ("LFUCG") violated the Open Records Act in denying Jeff Lawless's request for "[a]ll records of transactions relating to the selling or pawning of silver and other items[by two named individuals] . . . ." We do not accept LFUCG's argument that the Division of Police is not the custodian of pawn shop transaction "information transferred to Leads Online as required by police for informational and investigative purposes" pursuant to state and local law; however, we affirm LFUCG's denial of Mr. Lawless's request based on the existence of federal law prohibiting disclosure of "nonpublic personal information" by financial institutions that include pawn shops. Our conclusion is predicated on the understanding that the "transactional information" maintained by Leads Online for the Division of Police includes "non-public personal information" and not just "a report of goods received" KRS 226.070. 1 Resolution of the issue on appeal turns on the application of the privacy provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq. , also known as the Financial Services Modernization Act of 1999 and the Financial Privacy Rule, incorporated into the Open Records Act by KRS 61.878(1)(k), mandating nondisclosure of "[a]ll public records or information the disclosure of which is prohibited by federal law or regulation. "
On July 9, 2013, the Division of Police denied Mr. Lawless's request "because we do not have physical documents to provide you" and referred him "to the pawn shops who would be the custodians of records of those who pawn, sell, or purchase items." Shortly thereafter, Mr. Lawless initiated this appeal. He indicated that when he attempted to obtain records relating to the selling or pawning of goods by two named individuals from pawn shops, the pawn shops advised him that he must obtain the records from the Division of Police. It is his position that "the data is in fact owned by the police department since they are the ones requiring the pawn shops to provide the data . . . [, and] the fact that the data is actually stored on the LeadsOnline.com server is irrelevant."
We agree with Mr. Lawless that transactional information furnished by pawnbrokers to the Division of Police by law, and under threat of fine or imprisonment, constitutes a record of the Division of Police, notwithstanding the fact that the Division has elected to outsource records maintenance and retrieval functions with a private vendor. Nevertheless, Mr. Lawless is foreclosed from accessing records containing the "nonpublic personal information" he seeks by the Gramm-Leach-Bliley Act which identifies pawn brokers as "financial institutions" as that term is broadly defined in the Act. 2
We do not accept LFUCG's argument that the transactional information stored with Leads Online under an agreement with the Division of Police is the "property of Leads Online." Under its service agreement with the Division, Leads Online is designated the Division's agent "for the sole purpose of collecting, maintaining, and disseminating data from participants." Agency Agreement 2.1. 3 Absent state and local law requiring pawnbrokers to furnish transactional information to the appropriate law enforcement agency, and agreements with law enforcement agencies to manage that data on the agencies' behalf, Leads Online has no authority to "collect, maintain, and disseminate data from participants."
In past open records decisions, this office has overruled agency arguments purportedly limiting open records duties by outsourcing records maintenance and retrieval functions to private vendors. 11-ORD-025, p. 2. Thus, in 09-ORD-020 we declared that "a public agency cannot, by means of a contract with a private company, deprive records of their public character" or otherwise evade its statutory duties. See also, 10-ORD-037 and 10-ORD-084. In the latter decision, the Attorney General admonished the agency's attempt to "place records effectively out of reach of the general public behind a technological barrier" erected by agency outsourcing of records maintenance duties. 10-ORD-084, p. 8. Going one step further, in 11-ORD-025 we declared that if a public agency contracts with a private vendor for data management services, and must rely on the vendor to fulfill its open records duties, the agency should "include a provision in the contract to facilitate compliance with the requirements of the . . . Act." 11-ORD-025, p. 3. 4
These decisions are distinguishable in only one significant respect. The outsourced data in the appeal before us is prohibited from disclosure by federal law and thus excluded from public inspection pursuant to KRS 61.878(1)(k). The term "financial institution, " defined at 15 U.S.C. § 6809(3)(A) as "any institution the business of which is engaging in financial activities as described in Section 1843(k) of title 12," 5 has been construed to extend the Gramm-Leach-Bliley Act, and implementing federal regulations, 6 to pawnbrokers. See, e.g., Louisiana Attorney General Opinion 09-0057 at page 8 (addressing, in part, whether pawnbrokers can be required to submit required transactional reports to Leads Online and recognizing that the Gramm-Leach-Bliley Act "places restrictions on disclosure of nonpublic personal information by financial institutions, which appear to include pawn shops .") (Emphasis added.) Some states have gone so far as to enact into law the requirement that pawnbrokers "comply with the provisions of the federal Gramm-Leach-Bliley Act . . . if the pawnbroker is a financial institution as defined in [the Act]." Maine Revised Statute 30-A § 3964-A. Regulation of Pawn Brokers. Although Kentucky law is silent on the application of Gramm-Leach-Bliley to pawnbrokers, the federal act clearly prohibits disclosure of "nonpublic personal information, " defined as "personally identifiable financial information: (i) provided by a consumer to a financial institution; (ii) resulting from any transaction with the consumer or any service performed for the consumer; or (iii) otherwise obtained by the financial institution. " 15 U.S.C. § 6809(4)(A). KRS 61.878(1)(k), operating in tandem with the federal act, requires LFUCG to withhold such information. Its denial of Mr. Lawless's request was proper.
In closing, we note that the public does have an interest in ensuring that the Division of Police is properly executing this statutory duty regardless of whether the Division or its agent, Leads Online, maintains the data.
Zink v. Commonwealth, 902 S.W.2d 825, 829 (Ky. App. 1994). That public interest is, however, trumped by federal law declaring the data private. The Open Records Act, recognizing no difference between requesters or their intended use of the data, yields to that law.
A party aggrieved by this decision may appeal it by initiating action in the appropriate circuit court pursuant to KRS 61.880(5) and KRS 61.882. Pursuant to KRS 61.880(3), the Attorney General should be notified of any action in circuit court, but should not be named as a party in that action or in any subsequent proceeding.
Distributed to:
Jeff LawlessMarcia WoodyardMichael R. Sanner
Footnotes
Footnotes
1 KRS 226.040 requires pawnbrokers to "keep a register of all loans and purchases of all articles . . . show[ing] the dates of all loans or purchases, and the names of all persons who have left any property on deposit as collateral security, or as a delivery for sale." KRS 226.070(1) requires pawnbrokers to make available to the appropriate law enforcement agency "a true and correct written report of all goods received by him or her, whether by pawn or purchase, during the twenty-four hours preceding each report." LFUCG Ordinance No. 197-71 imposes additional requirements, directing pawnbrokers, among others, to "keep a register which . . . shall contain the name, address, and a visible description of the person or persons from whom . . . goods . . . are purchased" and to require the person presenting the goods "to provide a copy of the register . . . to the division of police on a daily basis." Failure to do so is classified as a misdemeanor for which a convicted pawnbroker can be fined up to $ 100.00 or jailed for up to thirty days for each offense. Whereas KRS 226.040 and LFUCG Ordinance No. 197-71 require the collection of personal information, including names, addresses, and visible descriptions, KRS 226.070(1) requires pawnbrokers to make available to law enforcement agencies a "written report of all goods received ." (Emphasis added.) It does not expressly require the submission of personal information by pawnbrokers to law enforcement agencies.
2 In supplemental correspondence directed to this office after Mr. Lawless initiated this appeal, LFUCG invoked four exceptions to the Open Records Act in support of its original denial of his request, namely, KRS 61.878(1)(a), KRS 61.878(1)(c)1., KRS 61.878(1)(h), and KRS 61.878(1)(i). Additionally, LFUCG asserted that "the Division of Police is not the records custodian KRS 61.872(4), and this request does not further the purposes of the Open Records Act." Responding to our KRS 61.880(2)(c) request for legal authority supporting the argument that the transactional information maintained by Leads Online for the Division of Police is private, LFUCG provided us with a copy of the Gramm-Leach-Bliley Act. Although LFUCG did not cite KRS 61.878(1)(k), this federal law is determinative of the issue on appeal. Its primary purpose is "to protect the security and confidentiality of [a financial institution's] customer's nonpublic personal information" and this purpose is achieved by prohibiting disclosure of that information to "nonaffiliated third part[ies]." 15 U.S.C. 6801(a) and 6802(a).
3 The term "participant" is defined as "any person or entity that purchases pre-owned personal property as loan collateral and furnishes data relative thereto to provider for inclusion on provider's website."
4 We also do not accept LFUCG's original argument, restated in supplemental correspondence, that the transactional data "is not in document form and only becomes a document when a police report is filed and a criminal case file exists" and, thus, that it had no "physical document" to provide to Mr. Lawless. The transactional data is a record, "regardless of physical form or characteristics," and thus regardless of whether it has been printed out and filed in a case file or remains electronically stored. KRS 61.870(2). The database in which it is stored, which is managed by Leads Online as the agent of the Division of Police, is the electronic "filing cabinet" for the record though the record has yet to take, and may never take, a physical form. See, e.g., "Guidelines for Responding to Open Records Requests for Public Records in a Database," development and endorsed by the Department for Libraries and Archives, located at http://kdla.ky.gov/recmanagement/DatabasesasPublicRecord.pdf., and cited with approval in 11-ORD-085 and authorities cited therein.
5 23 U.S.C. § 1843(k)(4)(A) identifies "lending, exchanging, transferring, investing for others, or safeguarding money or securities" as one of several "activities that are financial in nature."
6 16 C.F.R. Part 313 ("Privacy of Consumer Financial Information") and 16 C.F.R Part 314 ("Standards for Safeguarding Customer Information").