State Records Committee Appeal Decision 2022-61

BEFORE THE STATE RECORDS COMMITTEE OF THE STATE OF UTAH

JUDITH ZIMMERMAN, Petitioner, v.

DEPARTMENT OF HEALTH AND HUMAN SERVICES, Respondent.

DECISION AND ORDER

Case No. 22-61

By this appeal, Judith Zimmerman (“Petitioner”), requests records allegedly held by the Department of Health and Human Services (“Respondent”).

FACTS

To best understand the facts behind this records request, we take a moment to explain the data-sharing agreement that is at the heart of this review. Under Utah law, the Respondent has statutory authorization to enter into data-sharing agreements with third parties. Utah Code Title 26, Chapter 33a et. seq. Under these agreements, the Respondent may provide batches of aggregated personal data to third parties for certain purposes. For instance, if the University of Utah (“University”) was performing a study on hypertension, the University could enter into an agreement with the Respondent to receive a batch of usable data for its study. Although there may be some rare exceptions, the data provided typically does not contain any personal identifiable information. That is, the data provided to third parties in these agreements does not usually contain names and other identifiers associated with the information. Understanding these data-sharing agreements is helpful as a backdrop for this review, but we stress that these agreements are permissible under Utah law. With that background, we turn to the request.

On August 20, 2022, Petitioner submitted a records request to the Respondent under the Government Records Access and Management Act (“GRAMA”) seeking a list of third-party entities and individuals to whom Respondent shared Petitioner’s personal information with during a specified date range. Additionally, Petitioner sought records showing who received her information and if it was reshared; what specific data elements were shared (e.g., name, address, birthdate, diagnostic codes, treatment codes, etc.); and by what authority Respondent shared her information.

On August 23, 2022, the Respondent denied the request, stating that it did not identify the records with reasonable specificity as required by Utah Code section 63G-2-204(1)(a)(ii). The Respondent advised Petitioner to include a “name or position” to search for email records, and also told her that “[i]t would . . . be helpful if you could narrow your request by department.” Respondent’s GRAMA Response, August 23, 2022. Petitioner replied to the Respondent offering to clarify her request rather than appeal, but that invitation went unanswered.

Petitioner appealed to Respondent’s chief administrative officer (“CAO”) on August 23, 2022. Her appeal provided more detail and clarity about the records she sought. The CAO responded on September 9, 2022, in the form of an official Decision and Order in which she formally denied Petitioner’s appeal. The stated reason for the denial was that:

Your appeal does not dispute that your original request lacked reasonable specificity and does not explain why you feel the August 23, 2022 decision was made in error. Rather, your appeal describes the records sought with greater specificity. The appeal looks more like a new request for records.

For the foregoing reasons, I find that your August 20, 2022 request lacked reasonable specificity, and that your request for records in the appeal should be treated as a new request for records.”

Respondent’s Notice of Decision, GRAMA Appeal, 1-2.

The Order then stated that the appeal would be treated as a new request and forwarded to Respondent’s GRAMA coordinator for review.

Petitioner has now appealed to the State Records Committee (“Committee”), challenging the CAO’s decision. On December 15, 2022, the Committee held a hearing during which the parties were allowed to participate. At the hearing, the Committee considered the written materials, oral testimony, and oral arguments of the parties. After having carefully considered all evidence presented to the Committee, the Committee issues the following Decision and Order.

STATEMENT OF REASONS FOR DECISION

The GRAMA states that a person “has the right to inspect a public record free of charge, and the right to take a copy of a public record during normal working hours . . . .” Utah Code § 63G-2-201(1)(a). While the GRAMA requires that an individual identify the records she seeks with “reasonable specificity,” it does not set a clear standard for the governmental entity on how to conduct its search. Utah Code § 63G-2-201(7)(b). When a lack of clarity arises within the GRAMA, our Utah case law supports looking to the Freedom of Information Act for guidance. See e.g., Deseret News Pub. Co. v. Salt Lake County, 2008 UT 26, ¶45 (analyzing the GRAMA’s text against the FOIA’s as they relate to records that could reasonably be expected to interfere with investigations).

Under the FOIA, when a governmental entity receives a records request, its search must be reasonable with the reviewing court looking at the entity’s process, not the result. Trentadue v. F.B.I., 572 F.3d 794, 797-98 (10th Cir. 2009) (citing Weisberg v. Dept. of Justice, 705 F.2d 1344, 1351 (D.C. Cir. 1983)). The issue we must review is not whether remaining records may exist, but whether the entity’s search efforts were adequate. Weisberg, at 1351. If the search is challenged by the records requester, the governmental entity then bears the burden of showing that the search was reasonable. See Truitt v. Dept. of State, 897 F.2d 540, 542 (D.C. Cir.1990). And “reasonableness” is dependent on the circumstances in the case. Weisberg, at 1351. If it’s determined that the governmental entity performed a reasonably adequate search, our Utah Administrative Rules then require the requester to provide sufficient evidence that additional records exist and are in the entity’s possession. Utah Administrative Rule R35-2(2).

At the hearing, the central issue was the reasonableness of the Respondent’s search. To explain its search process, the Respondent had Diana Sanchez, the Respondent’s records officer, and Kyle Lunt, the Respondent’s Director of the Division of Data, Systems, and Evaluation, testify about the search efforts made to locate responsive records. Mr. Lunt testified that the Respondent doesn’t hold a centralized database where Petitioner’s information can be input for a search and records on the third parties who’ve requested her information under a data-sharing agreement are immediately retrieved; nor does the Respondent maintain a list of third parties who request data under the data sharing agreement Instead, Mr. Lunt testified that the Respondent provided Petitioner the relevant data sharing agreements that might have governed the release of her specific information to requesting third parties. However, to be sure that Petitioner’s data was within the data batch provided under those agreements, Mr. Lunt said the Respondent would have to manually go through each data sharing agreement and then search through the batch of information provided under those respective agreements. It was further testified that the Respondent’s record databases are siloed within its individual and respective divisions. With the Respondent being one of the State’s largest agencies, the siloed databases and lack of centralized searching makes these types of record searches and retrieval even more complex.

Ms. Sanchez testified that when she received Petitioner’s request, she found it unclear what Petitioner was actually requesting. Ms. Sanchez then sent the request to her team to see if they could ascertain the intent behind the request. When the team concluded that the request was unclear, Ms. Sanchez reached out to the Division of Technology Services (“DTS”) to see if they could pull any possibly relevant information from when Petitioner was a state employee. DTS responded that they could only find and retrieve limited information.

From the testimony given and the parties filings, the Committee entered into lengthy deliberations, weighing the Respondent’s search process and efforts. From those deliberations and scrutinous examination of the records search, we find that given the circumstances of this particular case - the Respondent’s databases and systems and the nature of the request - the Respondent’s search efforts were reasonable. Additionally, we find that because the law does not require the Respondent to create a record that it doesn’t normally maintain, the Respondent’s search efforts are sufficient. Utah Code § 63G-2-201(8).

Upon finding that a reasonable search was performed, we normally shift the burden back to the petitioner to prove that additional responsive records are in the respondent’s possession. However, the parties do not dispute the existence of records as much as the nature of the request. Therefore, we do not address this issue.

Before issuing our Order, we take a moment to specifically address three issues that made for our lengthy deliberation and, why we believe, the appeal is arguably unnecessary. First, from Ms. Sanchez’s initial denial letter forward, the Respondent continually claimed that Petitioner’s request was not reasonably specific as required by Section 63G-2-204(1)(a)(ii). When Petitioner received Ms. Sanchez’s letter, she offered to clarify her request rather than appeal if it would help. However, her invitation for clarity was not taken.

We understand that the GRAMA does not require the Respondent to open communication lines with a requester and seek to understand her request. However, we remind the Respondent that the legislature’s express desire and intent behind enacting the GRAMA is to “promote the public’s right of easy and reasonable access to unrestricted records,” and “establish fair and reasonable records management practices.” Utah Code § 63G-2-102(3)(a) & (f) (emphasis added on both). Accordingly, we struggle to understand why the Respondent would not seek to comply with the GRAMA’s express intentions and communicate with Petitioner to ascertain the specifics of her request, especially when Petitioner offered to do so, and the Respondent knows that its records management systems on these types of records is problematic.

Secondly, from the testimony given, we can’t help but point out that the Respondent’s records management practices seem out of alignment with what might be considered “fair and reasonable.” After all, if the Respondent enters into data sharing agreements with third parties, as it may do so under the law, it seems well within the realm of imagination that someone will file a GRAMA request desiring to know exactly what Petitioner does: What records of theirs have been shared, and to whom? We think these are understandable records requests which the Respondent should be prepared to fulfill. And while we sympathize with the Respondent’s size as one of the largest agencies in the State, we don’t see that as a viable reason to not put a system in place to adequately handle these types of requests.

Third, as Petitioner goes back to file new GRAMA request(s) for the records she seeks, we advise the Respondent to construe her new requests as distinct and different from the one under review here. The Respondent knows that it has no legal obligation to respond to a records request that “unreasonably duplicates prior record requests from that person.” Utah Code § 63G-2-201(8)(d). However, the Respondent should bear in mind that Petitioner is not a lawyer, and in dealing with a governmental entity that has problematic record management systems within its prodigious infrastructure, she is disadvantaged in knowing how to precisely phrase her request in a way that will produce a valid search, not to mention that she likely has no idea which division or department within the Respondent’s vast infrastructure is holding the records she seeks. How then can she be expected to direct the Respondent’s records custodians where to look for responsive records when they know the internal databases better than her? The Respondent should make every effort to construe her new request(s) as distinctly different from her original, communicate with Petitioner as needed, and work to fulfill the express intentions of the GRAMA.

After all, she is the subject of the records she seeks.

Overall, the testimonies given showed that despite its records management problems, the Respondent’s search efforts were reasonable under the circumstances; however, the testimonies also showed that the Respondent handled Petitioner’s request not only far and away from the intentions laid out in Section 102(3)(a), but unnecessarily awkward. We strongly encourage the Respondent to put better systems in place to handle these types of records requests in a way that aligns with the intent of the statute, and, given the disorderly systems it has, make better efforts to honor Petitioner’s “right to easy and reasonable access” to the records she is subject of. Utah Code § 63G-2-102(3)(a).

ORDER

THEREFORE, for the foregoing reasons, Petitioner’s appeal is hereby DENIED.

RIGHT TO APPEAL

A party to a proceeding before the Committee may seek judicial review in District Court of a Committee's Order by filing a petition for review of the Committee Order as provided in Utah Code § 63G-2-404. Utah Code § 63G-2-403(14). A petition for judicial review of a Committee Order "shall be filed no later than 30 days" after the date of the Committee Order. Utah Code § 63G-2-404(1)(a). The petition for judicial review must be a complaint which is governed by the Utah Rules of Civil Procedure and include the Committee as a necessary party and contain the required information listed in Subsection -404(2). Utah Code § 63G-2-404(1) & (2). The court shall make its decision de novo but shall allow introduction of evidence presented to the Committee, determine all questions of fact and law without a jury, and decide the issue at the earliest practical opportunity. Utah Code § 63G-2-404(6). In order to protect parties’ rights on appeal, a party may wish to seek advice from an attorney.

PENALTY NOTICE

Pursuant to Utah Code § 63G-2-403(15)(c), if the Committee orders the governmental entity to produce a record and no appeal is filed, the government entity herein shall comply with the order of the Committee and shall: (1) Produce the record; and (2) File a notice of compliance with the Committee. If the governmental entity ordered to produce a record fails to file a notice of compliance or a notice of intent to appeal, the Committee may do either or both of the following: (1) Impose a civil penalty of up to $500 for each day of continuing noncompliance; or (2) Send written notice of the entity's noncompliance to the Governor. Utah Code § 63G-2-403(15)(d)(i)(B). In imposing a civil penalty, the Committee shall consider the gravity and circumstances of the violation, including whether the failure to comply was due to neglect or was willful or intentional. Utah Code § 63G-2-403(15)(d)(ii).

Entered this 27th day of December 2022

BY THE STATE RECORDS COMMITTEE

_________________________________________
NANCY DEAN
Acting Chair, State Records Committee