State Records Committee Appeal Decision 2023-19

BEFORE THE STATE RECORDS COMMITTEE OF THE STATE OF UTAH

JUDITH ZIMMERMAN, Petitioner, vs.

UTAH DEPARTMENT OF HEALTH AND HUMAN SERVICES (DHHS), Respondent,

DECISION AND ORDER

Case No. 23-19

By this appeal, Judith Zimmerman, requests records allegedly held by Utah Department of Health and Human Services (DHHS).

BACKGROUND

This matter was originally heard by the State Records Committee (“Committee”) on March 16, 2023; however, due to the volume of records subject to Petitioner’s request, the Committee continued the meeting to its regularly scheduled April 20th meeting to give the members more time to review the records in camera. Having reviewed the records in full, the Committee is now prepared to issue its decision. Before doing so, however, a brief recounting of the facts behind this appeal is in order.

FACTS

On February 14, 2022, and April 13, 2022, Petitioner lodged two complaints with the Respondent alleging that three particular individuals’ actions led to privacy violations and constituted other serious misconduct. The Respondent did not acknowledge receipt of the complaints nor any guidance on how to provide further input. Having not heard anything of her complaints and wanting to know what became of them, on November 7, 2022, Petitioner filed a request for records pursuant to the Government Records Access and Management Act (“GRAMA”). Specifically, her request sought any records surrounding the complaints, including any subsequent investigation, findings, and disciplinary action.

On November 22, 2022, the Respondent’s GRAMA coordinator, Dianna Sanchez, responded and denied Petitioner’s request. Ms. Sanchez explained the “records you have requested are records of security measures designed for the protection of persons or property, public or private, and are not subject to GRAMA.” Ms. Sanchez further elaborated that even if the records were subject to GRAMA, “they would be private records concerning a current or former employee.”

On December 2, 2022, Petitioner appealed Ms. Sanchez’s determination to the Respondent’s chief administrative officer (“CAO”). In her appeal, Petitioner attached her original two complaints that were the basis for her GRAMA request and challenged whether the requested records were correctly classified as records of security measures or otherwise private.

The Respondent’s designated CAO responded on December 16, 2022, explaining that because Petitioner’s complaints concern the unlawful release of personally identifiable information, the records surrounding any investigations are security measures designed to protect individuals from having their personally identifiable information unlawfully disseminated. Further, the CAO stated that even if the records were not security measures, they are still protected under the various employment-related protections GRAMA offers.

Petitioner has now appealed to the Committee, challenging the CAO’s decision. On April 20, 2023, the Committee reconvened the hearing to issue its decision. After having carefully considered all evidence presented to the Committee, the Committee issues the following Decision and Order.

ISSUES FOR REVIEW

The Committee is tasked with determining whether the records are “security measures” as described in the GRAMA. And if the records aren’t security measures, then are they protected under the GRAMA and may they be disclosed?

STATEMENT OF REASONS FOR DECISION

Regarding the Respondent’s argument that the records are “security measures” and fall outside of the GRAMA, we disagree. Utah Code § 63G-2-106(1) states “[t]he records of a governmental entity . . . regarding security measures designed for the protection of persons or property, public or private, are not subject to this chapter.” For clarity, the records described in Subsection 106(1) include: “security plans” pertaining to existential threats such as “terrorist activity” and “emergency and disaster response and recover”; “security codes and combinations”; “passes and keys”; “security procedures”; data pertaining to a “public entity’s risk assessment or security audit”; and “building and public works designs.” Utah Code § 63G-2-106(2)(a)-(f). We find that when read in the full context of the statute these items all have the same logical connection: that if the records were disclosed, it could lead to the possibility of physical harm or death, as well as protection of physical government buildings and property. Thus, for us to determine that the records at issue contain “security measures” under Section 106, we would need to find that the information they contain is aimed at protecting the government’s buildings and property or the physical safety of individuals in the event of an existential threat. Upon our review, we see no such information here. Accordingly, we find that the records do not pertain to security measures as described in the statute. As a result, they are subject to the GRAMA.

The Respondent argues that even if the records are not those that Section 106 contemplates, then their access is still restricted because they are classified as private under Utah Code § 63G-2-302. To this, we agree.

First, Subsection 302(2)(a) classifies records as private when records concerning a governmental entity’s employees are not expressly classified as public records under Subsections 63G-2-301(2)(b), 301(3)(o), or 302(1)(b). Upon our review, the information contained in the records triggers neither Subsections 301(2)(b), 301(3)(o), nor 302(1)(b). Utah Code § 302(2)(a). Therefore, we immediately lean toward the records being private under Subsection 302(2)(a).

To be sure, § 63G-2-302(2)(d) classifies records as private if their disclosure would constitute a clear and unwarranted invasion of privacy. Under our authority to weigh the interests between disclosure and non-disclosure (see Utah Code § 403(11)(b)), we find the interests behind disclosure are not compelling enough to encroach upon the privacy of those who are the subjects of the records. As a result, we find that in addition to being private under Subsection 302(2)(a), the records are also private under Subsection 302(2)(d).

And finally, as § 63G-2-403(11)(b) allows the Committee to weigh the interests behind requiring and restricting the records’ disclosure in light of their contents and private nature, we see no compelling reason to order them disclosed.

ORDER

THEREFORE, for the foregoing reasons, Petitioner’s appeal is hereby DENIED.

RIGHT TO APPEAL

A party to a proceeding before the Committee may seek judicial review in District Court of a Committee's Order by filing a petition for review of the Committee Order as provided in Utah Code § 63G-2-404. Utah Code § 63G-2-403(14). A petition for judicial review of a Committee Order "shall be filed no later than 30 days" after the date of the Committee Order. Utah Code § 63G-2-404(1)(a). The petition for judicial review must be a complaint which is governed by the Utah Rules of Civil Procedure and include the Committee as a necessary party and contain the required information listed in Subsection -404(2). Utah Code § 63G-2-404(1) & (2). The court shall make its decision de novo but shall allow introduction of evidence presented to the Committee, determine all questions of fact and law without a jury, and decide the issue at the earliest practical opportunity. Utah Code § 63G-2-404(6). In order to protect parties’ rights on appeal, a party may wish to seek advice from an attorney.

PENALTY NOTICE

Pursuant to Utah Code § 63G-2-403(15)(c), if the Committee orders the governmental entity to produce a record and no appeal is filed, the government entity herein shall comply with the order of the Committee and shall: (1) Produce the record; and (2) File a notice of compliance with the Committee. If the governmental entity ordered to produce a record fails to file a notice of compliance or a notice of intent to appeal, the Committee may do either or both of the following: (1) Impose a civil penalty of up to $500 for each day of continuing noncompliance; or (2) Send written notice of the entity's noncompliance to the Governor. Utah Code § 63G-2-403(15)(d)(i)(B). In imposing a civil penalty, the Committee shall consider the gravity and circumstances of the violation, including whether the failure to comply was due to neglect or was willful or intentional. Utah Code § 63G-2-403(15)(d)(ii).

Entered this 1st day of May 2023

BY THE STATE RECORDS COMMITTEE

Ken Williams
Chair, State Records Committee