PRINT VERSION: Attorney General Opinion No. 20-IB12
OFFICE OF THE ATTORNEY GENERAL OF THE STATE OF DELAWARE
Attorney General Opinion No. 20-IB12
March 17, 2020
VIA EMAIL
Mr. Scott Becker
scottjbecker@outlook.com
RE: FOIA Petition Regarding the Delaware Criminal Justice Information System
Dear Mr. Becker:
We write in response to your correspondence alleging that the Delaware Criminal Justice Information System (“DELJIS”) violated Delaware’s Freedom of Information Act, 29 Del. C. §§ 10001-10007 (“FOIA”). We treat your correspondence as a Petition for a determination pursuant to 29 Del. C. § 10005 regarding whether a violation of FOIA has occurred or is about to occur in connection with your records request. As discussed more fully herein, we determine that DELJIS has not violated FOIA as alleged.
BACKGROUND
DELJIS operates, manages, and maintains the computer hardware, software, and communication network for the Criminal Justice Information System (“CJIS”), which comprises several databases compiling a wide range of criminal information.[1] This Petition disputes DELJIS’s response to your request for the following items from CJIS:
A. From calendar year 2015 up to and including calendar year 2018, how many individuals: (1) were arrested and charged with Delaware Code, Title 11, Chapter 5, Subchapter VII, 1442 where the concealed deadly weapon was a firearm. (1a) Exclude the following violations: (1a.1) Delaware Code, Title 11, Chapter 5, Subchapter 2: 631, 632, 633, 634, 635, 636, 770, 771, 772, 773, 774, 781, 782, 783, 783A (1a.2) Delaware Code, Title 11, Chapter 5, Subchapter 3: 801, 802, 803, 826, 832 (1b) All other violations of the Delaware Code can be included. (2) How many individuals were subsequently indicted as described in (1)? (3) How many individuals pleaded guilty to lesser included offenses as described in (1)? (4) How many individuals were convicted of the original charges as described in (1)? How many individuals have become subject to orders pursuant to and described by Delaware Code, Title 10, Chapter 77, 7703 and 7704 since June 27, 2018?[2]
On January 14, 2020, DELJIS denied your request indicating FOIA does not require a public body to create records that do not already exist nor does FOIA require a public body to create new records through a “computer run.”[3] Additionally, DELJIS indicated that these records were exempt as investigatory files compiled for purposes of criminal or civil law enforcement under 29 Del. C. § 10002(l)(3) and are within the definition of “criminal history record information” pursuant to 11 Del. C. Chapters 85 and 86 and 1 Del. Admin. Co. § 1300.
This Petition followed, presenting two arguments why this response was improper under FOIA. First, you contend that public records responsive to your request exist, as the Statistical Analysis Center’s 2014-18 crime report has the offense and arrest data from the State Bureau of Identification, and therefore, under 29 Del. C. § 10002(j), DELJIS “was required to contact other agencies to fulfill [your] request.”[4] Also, you argue that because the request did not seek any individual’s identifying information or investigatory files, DELJIS violated 29 Del. C. § 10002(l)(3) and 29 Del. C. § 10002(l)(4) by refusing access to the requested records.
DELJIS, through its legal counsel, answered the Petition by letter dated January 29, 2020 (“Response”). First, DELJIS argues that it has no obligation to contact another entity to search for records, as FOIA requires a request be submitted to the custodian of records for the “appropriate public body,” and 29 Del. C. § 10002(j), which requires a public body to seek noncustodial records, is inapplicable as this provision does not require DELJIS to request records from a public body “that it does not control.”[5] DELJIS explains that the Statistical Analysis Center (“SAC”) is located within the Criminal Justice Council (“CJC”) and that “DELJIS does not control the CJC, the SAC or the State Bureau of Identification (“SBI”), a unit of the Delaware State Police,” nor does DELJIS have “actual, constructive, or administrative control over any reports prepared by the SAC.”[6] Second, DELJIS asserts that FOIA does not require a public body to create a new record in response to a FOIA request, arguing DELJIS is not required to compile requested data from other records that may exist, including converting data into a new format, creating programming, or conducting a database search using requested search criteria. DELJIS states “[e]ven if DELJIS was able to query its database for these requested fields and return a new document within those parameters, DELJIS is not required to do so under FOIA.”[7] Finally, DELJIS asserts you are not entitled to these records because the records constitute investigatory files, criminal history and arrest records, which are exempt under FOIA. DELJIS argues to the extent the requested records pertain to criminal history and arrest records, they may also be exempt pursuant to 29 Del. C. § 10002(l)(4) and even if DELJIS was obligated to query its records, “the information derived from a search would likely fall within this exception.”[8]
By supplemental submission dated February 28, 2020, DELJIS, through its counsel, clarified two items. First, DELJIS represents “the data sought by Petitioner cannot be provided using existing functions and existing programming nor can data fields in their existing format be provided to Petitioner.”[9] To fulfill your request, DELJIS asserts that it would be required to engage in “extensive computer programming.”[10] DELJIS explains that in order to begin responding to your request it first must query numerous CJIS databases to produce an initial data batch. After extracting this data, DELJIS would then have to undertake a manual review of police reports to capture the property types and correct errors in the search. “DELJIS estimates that it could create a computer program for this search with at least one month of programming costs (approx. 150 hours), followed by costs for a manual review of police narratives or errors in the program.”[11] DELJIS asserts “[d]ata would then need to be de-identified to protect any non-public information.”[12] DELJIS states programming created in response to a previous settlement of the cases involving the Gannett Company’s request for CJIS information was retired years ago and is not capable of capturing the data you seek.[13] Second, DELJIS states that because it cannot produce responsive records to review, it is unable to analyze the privacy interests implicated in the release of such data. DELJIS distinguishes the Gannett cases, noting that DELJIS cannot make the same assessment of the competing privacy interests here, as CJIS does not have the ability to create the requested data without extensive programming. Also, DELJIS asserts the Gannett cases are not precedential as those cases were settled by the parties’ agreement to protect the data through the use of scrambled numbers and to indemnify DELJIS from any claims. Additionally, DELJIS noted that pursuant to 11 Del. C. § 8610, a requesting party may apply for access to certain data which would be approved only for specific purposes within the confines of an agency agreement. DELJIS notes that this process is also available to individuals and agencies for the express purpose of research, evaluative, or statistical activities pursuant to a specific agreement with a criminal justice agency. Finally, DELJIS argues it should not be required to disclose non-conviction data and that certain conviction data once expunged, is also improper to disclose.
DISCUSSION
CJIS maintains voluminous criminal information about the citizens of Delaware, and FOIA does not explicitly exempt all the contents of CJIS from disclosure.[14] When defending a denial of access to the CJIS records, DELJIS carries the burden of proof to justify its denial.[15]
The Petition in this case raises two primary arguments. First, the Petition alleges that records responsive to the request exist and DELJIS violated FOIA by not contacting other agencies to fulfill the request to obtain information purportedly in possession of other agencies. FOIA requires a request for records to be submitted to the custodian of the appropriate public body, and the public body must provide reasonable access to its public records, including its noncustodial records controlled by the public body but not within its possession.[16] DELJIS represents that it does not have any control over reports produced by the SAC, and both SBI and SAC are separate agencies outside of its control. In these circumstances, we find that DELJIS is not required to contact agencies outside of its control for records responsive to your request.
Second, you allege that DELJIS improperly denied your request under 29 Del. C. § 10002(l)(3) and 29 Del. C. § 10002(l)(4) because you do not seek any individual’s identifying information or investigatory files; you only asked for statistical data from the database. FOIA requires citizens be given access to existing public records, including those maintained in an electronic format, but FOIA does not require a public body to answer questions or to create a new document in response to a records request.[17] FOIA does not mandate that a public body undertake computer programming to create a new record in response to a request, nor is a public body required to perform manual inputting of information to create responsive records.[18] However, a simple of exportation of data to a spreadsheet has been found not to constitute creating a new record.[19] This Office must closely examine the specific facts surrounding a request to determine if a request requires a new record be created.[20]
In this case, DELJIS emphasizes that this request cannot be fulfilled using CJIS’s existing functioning or programming. DELJIS states that the request may not be completed by exporting the data fields into an Excel spreadsheet or by otherwise providing the existing data fields in their current format. Instead, responding to the request would require DELJIS to query numerous databases, and after extracting data from the separate databases, DELJIS would have to compile those records and perform a manual review of police reports to capture property types and correct errors. Data then would need to be de-identified to protect non-public information. Although DELJIS submits that it can develop programming to automate certain aspects of this process, we conclude FOIA does not require this. Because DELJIS would be required to query multiple databases and manually compile, sort, and correct this electronic information in order to fulfill your request, we find that this request requires DELJIS to create a new record.
CONCLUSION
For the reasons set forth above, we conclude that DELJIS did not violate FOIA as alleged.
Very truly yours,
/s/ Alexander S. Mackler
_____________________________
Alexander S. Mackler
Chief Deputy Attorney General
cc:
Lisa M. Morris, Deputy Attorney General
Dorey L. Cole, Deputy Attorney General
[1] 11 Del. C. § 8502; DELJIS’s Letter dated Feb. 28, 2020.
[2] Petition.
[3] Id.
[4] Id.
[5] Response.
[6] Id.
[7] Id.
[8] Id.
[9] DELJIS’s Letter dated Feb. 28, 2020.
[10] Id.
[11] Id.
[12] Id.
[13] See, e.g., Gannett Co., Inc. v. Bd. of Managers of the Del. Crim. Justice Info. Sys., 840 A.2d 1232 (Del. 2003); Bd. of Managers of the Del. Crim. Justice Info. Sys. v. Gannett Co., 2005 WL 2660049 (Del. Super. Sept. 6, 2005); Bd. of Managers of the Del. Crim. Justice Info. Sys. v. Gannett Co., 847 A.2d 1123 (Del. Super. 2004); Bd. of Managers of the Del. Crim. Justice Info. Sys. v. Gannett Co., 2003 WL 1579170 (Del. Super. Jan. 17, 2003); Bd. of Managers of the Del. Justice Info. Sys. v. Gannett Co., 808 A.2d 453 (Del. Super. 2002); Bd. of Managers of the Del. Justice Info. Sys. v. Gannett Co., 2001 WL 1752515 (Del. Super. Dec. 28, 2001); Gannett Co. v. Bd. of Managers of the Del. Crim. Justice Info. Sys., 768 A.2d 508 (Del. Super. 1999).
[14] Bd. of Managers of the Del. Justice Info. Sys. v. Gannett Co., 808 A.2d 453, 464 (Del. Super. Sept. 30, 2002) (“If this Court were to deny access to these records absent a demonstrated privacy interest it would be in essence creating a ‘DELJIS record’ exception to disclosure under FOIA that is not evident in the statutory language.”), rev’d on other grounds, Gannett Co., Inc. v. Bd. of Managers of the Del. Crim. Justice Info. Sys., 840 A.2d 1232 (Del. 2003); Del. Op. Att’y Gen. 06-IB17, 2006 WL 2630107, at *8 (Aug. 21, 2006) (“Computerized databases may enhance the concerns about individual privacy, but the courts in the DELJIS litigation did not hold that the entire criminal history database was exempt from disclosure under FOIA, only certain data fields.”).
[15] 29 Del. C. § 10005(c).
[16] 29 Del. C. § 10003(a), (j)(1); see also Parker v. Brady, 2006 WL 306930, at *2 (Del. Super. Jan. 5, 2006) (determining that the Attorney General had no duty to answer a FOIA request, as it “does not have custody or control over the disclosure” of the requested records); Del. Op. Att’y Gen. 17-IB58, 2017 WL 5649344, n. 23 (Nov. 8, 2017) (“To be clear, we do not interpret FOIA to require the Register of Wills to seek out records of another public body, including other departments and divisions within New Castle County that are separate and distinct from the Register of Wills. Of course, to the extent the Register of Wills can easily identify the custodian of certain records, we believe it would be consistent with Sections 10003(d)(1) and (g)(2) and an exercise of good faith for the Register of Wills to identify those public bodies and/or forward your request to them.”); Del. Op. Att’y Gen. 17-IB23, 2017 WL 3426263, at *8 (July 14, 2017) (“However, FOIA does not obligate a public body to request records that it does not control.”).
[17] Del. Op. Att’y Gen. 02-IB18, 2002 WL 32100328, at *1 (Aug. 19, 2002) (“Under FOIA, a public body is not required to create a document that does not exist.”).
[18] Del. Op. Att’y Gen. 18-IB51, 2018 WL 6591816, at *2 (Nov. 20, 2018) (determining that a response requiring “DTI to undertake programming to ‘yield a new dataset’” constitutes the creation of a new record and is not required under FOIA) (citation omitted); Del. Op. Att’y Gen. 17-IB32, 2017 WL 3426272, at *3 (July 25, 2017) (determining that a request requiring the manual inputting of information into a database is the creation of a new record); Del. Op. Att’y Gen. 17-IB11, 2017 WL 2917926, at *1 (Jun. 16, 2017) (“[i]n order to fulfill your request, a third party vendor would be required to engage in computer programming (i.e., ‘write script’), thereby creating a record that does not already exist.”); Del. Op. Att’y Gen. 07-IB19, 2007 WL 4732802, at *4 (Aug. 28, 2007) (“As for the tax billing information you most recently requested, our Office is satisfied that to provide you with such information would require extensive computer programming to create a new public record which FOIA does not require.”); Del. Op. Atty. Gen. 96-IB28, 1996 WL 517455, at *2 (Aug. 8, 1996) (“FOIA does not require a public body ‘to create a record’ where the ‘requested record does not exist,’ nor does FOIA require a public body ‘to compile the requested data from’ other public records that may exist.”) (citation omitted).
[19] Del. Op. Att’y Gen. 17-IB32, 2017 WL 3426272, at *3 (determining that the “mere exportation of existing data to a Microsoft Excel spreadsheet” is not the creation of a new record).
[20] Id. (“Each request for database records under FOIA must be assessed on its specific facts to determine whether the request is asking the public body to create a record, and those assessments may become more difficult over time as technology evolves.”).
<< Back
