Summary
considering a violation under the Data Act’s predecessor statute
Summary of this case from Keil v. O'SullivanOpinion
44397 Record No. 800635.
December 3, 1982
Present: All the Justices.
Defendant member of County Board of Supervisors violated Code Sec. 2.1-380(1) of the Privacy Protection Act by disseminating report on police officer to her daughter to serve her private interests, various issues considered.
(1) Statutory Construction Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) Purpose of Chapter (Code Sec. 2.1-378(B) Purpose of Act Stated.
(2) Statutory Construction — Privacy Protection Act — (Code Sections 2.1-377 through 2.1-386) — Act Does Not Render Personal Information Confidential Nor Prohibit Generally its Dissemination but Requires Procedural Steps in Collection, Maintenance, Use, and Dissemination of Data.
(3) Statutory Construction Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) — Definitions [Code Sec. 2.1-379(3)] — Data Subject, Defined.
(4) Statutory Construction — Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) — Definitions [Code Sec. 2.1-379(2)] — Personal Information, Defined.
(5) Statutory Construction — Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) — Definitions [Code Sec. 2.1-379(1)] — Information System, Definition.
(6) Evidence — Statutory Construction — Privacy Protection Act (Code 2.1-377 through 2.1-386) — Supports Conclusion Plaintiff was Data Subject Under Code Sec. 2.1-379(3).
(7) Evidence — Statutory Construction — Privacy Protection Act (Code 2.1-377 through 2.1-386) — Supports Conclusion Personal Information Included in Investigation Report Under Code Sec. 2.1-379(2).
(8) Evidence — Statutory Construction — Privacy Protection Act (Code 2.1-377 through 2.1-386) — Supports Conclusion Personnel Records Kept by Chief of Police Constituted Information System Under Code Sec. 2.1-379(1).
(9) Statutory Construction — Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) — Definitions [Code Sec. 2.1-379(6)] — Agency Includes Any Unit of County Government and Thus County Police Department.
(10) Statutory Construction — Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) — Remedies for Violation of (Code Sec. 2.1-386) — Remedy for Violation is Injunction or Mandamus, Etc.
(11) Statutory Construction — Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) — Burden of Proof — Upon Plaintiff to Establish Lack of Necessity or Improper Purpose for Dissemination in Violation of Code Sec. 2.1-380, Etc.
(12) Evidence — Statutory Construction — Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) — Cities, Counties and Towns — General Powers of Board (Code Sec. 15.1-590) — Duties of County Executive (Code Sec. 15.1-602, et seq.) — Evidence Supports Conclusion that Chief of Police and County Executive Responding to Official Requests.
(13) Evidence — Statutory Construction — Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) — Administration of Systems, Etc. [Code Sec. 2.1-380(1)] — Fails to Establish Lack of Necessity or Improper Purpose for Report by Police Chief and County Executive.
(14) Evidence — Statutory Construction — Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) — Administration of System, Etc. [Code Sec. 2.1-380(1)] — Establishes County Supervisor Violated Code Sec. 2.1-380(1) by Disseminating Information.
(15) Statutory Construction — Privacy Protection Act (Code Sections 2.1-377 through 2.1-386) — Remedies for Violations of (Code Sec. 2.1-386) — Plaintiff Entitled to Prohibiting Injunction Against County Supervisor.
Plaintiff, a county police officer, sued the county and certain county officials for alleged violations of Virginia's Privacy Protection Act of 1976. Plaintiff had previously arrested the daughter of one of the defendants, Humphries, who was also a member of the County Board of Supervisors. Humphries filed a complaint with the police department concerning the officer's conduct during the arrest. An investigation was conducted and a report absolving the officer of wrong-doing was submitted to the Chief of Police, another defendant. The report was placed in the officer's personnel file. Humphries inquired concerning the report, and Noe, the County Executive and a defendant, assuming Humphries was requesting the report in her official capacity, gave Humphries the report. Humphries allowed her daughter to see the report, and the daughter took it to her attorney and another friend. The daughter's attorney attempted to introduce the report into evidence at the daughter's trial. Plaintiff filed suit alleging a violation of the Privacy Protection Act which establishes safeguards of information practice for record-keeping agencies of the Commonwealth. Plaintiff appeals an order dismissing his suit.
1. The purpose of the Privacy Protection Act of 1976 (Code Sections 2.1-377 through 2.1-386) is to ensure safeguards for personal privacy as the result of a record-keeping in the public sector [Code Sec. 2.1-378(B)].
2. The Act does not render personal information confidential nor does it generally prohibit the dissemination of information. The Act requires certain procedural steps to be taken in the collection, maintenance, use, and dissemination of such data.
3. Under the Act, a data subject is a person about whom personal information is indexed or may be located under his name or other identification in an information system [Code Sec. 2.1-379(3)].
4. Personal information is all data describing anything about an individual, including facts relating to education, ancestry, employment record and personal characteristics [Code Sec. 2.1-379(2)].
5. Information system means the total components of a record-keeping process, whether automated or manual, containing personal information about a data subject [Code Sec. 2.1-379(1)].
6. The evidence indicates plaintiff was a "data subject" under Code Sec. 2.1-379(3).
7. The evidence indicates "personal information" was included in the report concerning plaintiff under Code Sec. 2.1-379(2), the contents bearing on his employment record and personal traits.
8. The evidence indicates the personnel records kept by the Chief of Police was an "information system" within the meaning of Code Sec. 2.1-379(1), being a manual record keeping process containing personal particulars on a data subject.
9. "Agency" includes any department of any unit of county government. The Prince William County Police Department is thus an agency within the meaning of Code Sec. 2.1-379(6).
10. The remedy for violation of the Act, as stated in Code Sec. 2.1-386 is an injunction or mandamus, including costs and attorney's fees, against any person or agency which has or is engaged or is about to engage in practices contrary to the Act.
11. The burden is on the plaintiff to establish a lack of necessity or an improper purpose for the dissemination in violation of Code Sec. 2.1-380, there being a presumption that public officials will obey the law and there being nothing in the Privacy Protection Act reversing such presumption or imposing the ultimate burden of proof on the defendants.
12. The evidence supports the conclusion that two of the defendants, Owens and Noe, were responding to legitimate official requests when they disseminated the report. Noe, the County Executive, was responding to a member of the Board of Supervisors under Code Sec. 15.1-590. Owens, the Chief of Police, was responding to his superior, the County Executive, under Code Sections 15.1-602 and 608.
13. Plaintiff's evidence failed to establish a lack of necessity or an improper purpose under Code Sec. 2.1-380(1) for the movement of the report from the Police Department to the County Executive and from the County Executive to the County Board of Supervisors.
14. Plaintiff's evidence established that defendant Humphries (the County Supervisor) violated Code Sec. 2.1-380(1), having disseminated the information within the meaning of Code Sec. 2.1-379(4) and this being unnecessary to accomplish any proper purpose of the Board of Supervisors.
15. Plaintiff is entitled to a prohibitory injunction against Humphries. Code Sec. 2.1-386, authorizing injunctive relief, does not require that the plaintiff prove an adequate remedy at law does not exist and that irreparable injury will occur.
Appeal from a judgment of the Circuit Court of Prince William County. Hon. Charles H. Duff, judge designate presiding.
Affirmed in part, reversed in part, and remanded.
Lowry J. Miller (Miller, Miller and Cyron, on brief), for appellant.
Elizabeth D. Whiting, Deputy County Attorney (T. A. Emerson, County Attorney, on brief), for appellees.
Amicus Curiae: Local 2141, International Association of Fire Fighters. (David Ross Rosenfeld, on brief), for appellant.
Amicus Curiae: Virginia State Association of Professional Firefighters. (Michael S. Shelton; Rhetta M. Daniel; Cohen, Abeloff Staples, P.C., on brief), for appellant.
In this appeal from an order dismissing a county police officer's suit against the county and certain county officials, we must interpret Virginia's Privacy Protection Act of 1976, Code Sec. 2.1-377 through Sec. 2.1-386 (the Act).
Initially, the background, purpose, and provisions of the Act should be examined. In 1974, the General Assembly adopted a resolution directing the Virginia Advisory Legislative Council (VALC) to study and report upon the matter of computer privacy and security. S.J.R. 10, Acts 1974 at 1511. This study was generated by proliferation in the use of automated data processing equipment, especially the electronic computer, that has enabled government and private industry to compile detailed information on individuals in every area of personal activity. Report of the VALC to the Governor and General Assembly of Virginia, 2 House Senate Documents, S. Doc. 27 at 3 (1976). There is widespread concern about infringement on individual privacy resulting from this capacity to collect, order, and disseminate explicit personal information. Id.
Accordingly, a Computer Privacy and Security Committee of the Council studied the subject and in 1976 the VALC recommended legislation on regulation of computer privacy in the public sector only. Action on data systems' safeguards for the private sector was delayed. Id. at 7-8.
The VALC reported:
"It is the intent of the Council that affirmative steps be taken now by the General Assembly to obviate the possibility of the emergence of cradle-to-grave, detailed dossiers on individuals, the existence of which dossiers would, 'at the push of a button,' lay bare to anyone's scrutiny, every detail, however intimate, of an individual's life. Such action by the General Assembly would follow in the lead of the nation's courts which have been active in developing a considerable bOdy of case law firmly establishing privacy as an inherent, inalienable human right." Id. at 7.
Concluding its Report, the VALC said:
"In summary, the Council feels now is the appropriate time to introduce legislation to set a basis for minimum standards for personal data collection, storage, and dissemination in the Commonwealth. The General Assembly would be well advised to avoid potential gross abuse of the power of inter-communicating data banks by setting reasonable, easily implemented standards of conduct. Well managed, responsible, data systems industries and support systems are as essential to the orderly and efficient operation of modern business, industry, and government as uncontrolled, unrestricted gathering of total information dossiers about total populations are antithetical to a free society. The Council is anxious to assure the former and prevent the latter eventuality." Id. at 7.
Subsequently, the Act was adopted by the 1976 General Assembly. Acts 1976, ch. 597. It has been said that the Act "is an important initial step towards safeguarding Virginia citizens against abusive information-gathering practices." 62 Va. L. Rev. 1357, 1358 (1976).
For a discussion of the Act's federal counterpart, the Privacy Act of 1974, 5 U.S.C. § 552a (1977), see Note, The Privacy Act of 1974: An Overview, 1976 Duke L.J. 301.
The stated purpose of the Act is "to ensure safeguards for personal privacy by record-keeping agencies of the Commonwealth and her political subdivisions by adherence to" certain principles of "information practice." Sec. 2.1-378(B). Among the principles enumerated are: no secret personal information system shall be established; the need to collect the information must be clearly established in advance; information must be relevant to the purpose for which it has been collected; it should not be used unless accurate; the individual should be able to learn the purpose for which it is collected and particulars about its use and dissemination; the individual should be permitted to correct or erase inaccurate or obsolete information; and any agency maintaining such data should assure its reliability and prevent its misuse.
The Act contains definitions of certain terms of art employed in the statutes such as "information system," "data subject," and "agency." Sec. 2.1-379. In succeeding sections, the Act imposes administrative requirements on agencies maintaining an information system, Sections 2.1-380 and -381; sets forth rights of data subjects, Sec. 2.1-382; provides for public disclosure of the existence of an information system, Sec. 2.1-383; lists certain exempted information systems, Sec. 2.1-384; prohibits forced disclosure of social security numbers, Sec. 2.1-385; and provides for injunction or mandamus for violations of the Act, Sec. 2.1-386.
This litigation developed in the following manner. On January 30, 1979, appellant Michael L. Hinderliter, the plaintiff below and a county police officer, participated in the arrest of four young adults in Prince William County. One of the persons arrested was the daughter of appellee Alice Humphries, a defendant below. At the time, Humphries was a member of the Prince William County Board of Supervisors.
Within hours of the arrests, Humphries initiated a complaint to the police department about the conduct of Hinderliter and the other officers. According to Humphries, she was acting in her private capacity as a "citizen" and mother, not in her official capacity as a member of the Board. As a result, pursuant to standing orders of the police department, an "internal investigation" was conducted to determine whether the arresting officers acted "properly" so that "corrective action" could be taken if misconduct was disclosed.
The investigation was completed about one month later and the report was submitted to appellee, Colonel George T. Owens, the county's Chief of Police and another defendant below. The report, prepared under the supervision of a Major on the police force, is comprised of about 34 typewritten single-spaced pages. It summarizes in minute detail facts revealed during a police hearing conducted by the Major and during interviews with many witnesses — police officers and private citizens — about the events prior to and during the arrests. The whole incident stemmed from a complaint to the police from the management of a local restaurant about drunk and disorderly conduct at the establishment.
The Major concluded his report by noting that Hinderliter had previously received numerous commendations for his police enforcement and community work, that no prior complaints had been made against the officer, and that Hinderliter "is an aggressive police officer and a good one." The Major recommended, after studying the "entire matter at great length," that the "complaint be considered unfounded and not held against the records of the officers involved." Upon review of the report, Chief Owens agreed with the recommendation. He wrote Hinderliter that the complaint "will not be held against your record." Pursuant to department policy, the report of investigation was placed in Hinderliter's personnel file.
According to the evidence, the police officers' personnel files in Prince William County are maintained under the control and supervision of the Chief of Police. There are separate files on each officer, lodged in the Chief's office, arranged alphabetically by the individual's name. Included within each file is personal background information, promotion data, disciplinary information, fitness reports, commendations, and training records. Chief Owens' unwritten policy was that personal information contained in the personnel files was not available for release to the general public, although the individual officer could review the file at any time.
Subsequently, during the first part of March 1979, Humphries informally inquired of appellee Robert S. Noe, Jr., Prince William County Executive and a defendant below, about the investigation of the January incident. Although the discussion was not during a formal session of the Board, Humphries had made prior official complaints involving county police officers. Noe assumed Humphries in her official capacity wanted a copy of the report of investigation because there had been "some concern" by the Board about allegations against the county police "regarding excessive use of force." Noe then asked Owens for the report. Owens complied with the request because Noe was his "boss" and "he asked for it," although Owens had "no idea" why Noe wanted the report. Noe received the document, which was not in an envelope or other cover and was not marked "confidential" or "for official use only," and had copies made of it. Without reading the report, Noe transmitted a copy to Humphries.
Upon receipt of the report, Humphries assumed it was the response to her January demand for an investigation and a "report back." She did not realize that it was part of the police officer's personnel record or that it was not a public record. Actually, Humphries testified she considered the report public information because it was not marked "confidential" and stated that she had the right and obligation to disseminate the contents.
The report was kept on Humphries' desk at home in her living room. The daughter, who lived with her mother, removed the document and took it to the home of one of the other persons who had been arrested during the incident in question. The daughter then gave the report to her attorney. In July of 1979, apparently during the criminal trial of the charges against the daughter and another in the general district court, the attorney sought unsuccessfully to introduce the document into evidence.
Subsequently, Hinderliter filed in September of 1979 a bill of complaint against Humphries, the County, Noe, and Owens alleging violation of the Act. He sought to enjoin defendants "from disseminating, releasing, transferring, or otherwise communicating in any manner the information and contents" of the report of investigation. Following an ore tenus hearing, the chancellor ruled in favor of defendants, and denied the prayer of the bill in a February 1980 final decree, from which we awarded plaintiff this appeal.
Even though several issues are debated on appeal, the dispositive question is whether, under these facts, dissemination of the report of investigation violates the Act.
Asserting that many of the facts alleged in the report impute to Hinderliter violations of law and unfitness to perform the duties of a police officer, plaintiff focuses on specific sections of the Act which he claims were violated by one or more of the defendants. We will demonstrate that Humphries, who has not appeared on appeal, is the only defendant who violated the Act.
[1-2] As we have already said, the stated purpose of the Act is to ensure safeguards for personal privacy as the result of record keeping in the public sector. This is to be accomplished by obedience to principles of fair information practice. Contrary to the conclusion that is implicit in plaintiff's argument, the Act does not render personal information confidential. Indeed, the Act does not generally prohibit the dissemination of information. Instead, the enactment requires certain procedural steps, noted supra, to be taken in the collection, maintenance, use, and dissemination of such data.
[3-5] In order to understand the provisions of the Act, one must be attuned to the words of art employed. A "data subject" is an individual about whom "personal information" is indexed or may be located under his name or other identification in an "information system." Sec. 2.1-379(3). "Personal information" is all data describing anything about an individual; it includes facts relating to education, ancestry, employment record, and personal characteristics. Sec. 2.1-379(2). The term "information system" means the total components of a record-keeping process, whether automated or manual, containing personal information about a data subject. Sec. 2.1-379(1).
[6-8] Under the evidence in this case, Hinderliter was a "data subject." "Personal information" was included in the report in question because the contents bore on his employment record and personal traits. And the personnel records kept by the Chief of Police, of which the report became a part, qualified as an "information system" because it was a manual record-keeping process containing personal particulars on a data subject.
The term "agency" includes any "department" of any unit of county government. Sec. 2.1-379(6). Thus the Prince William County Police Department is an "agency" as contemplated by the Act.
Against this setting, we examine the specific provisions of the Act that plaintiff claims defendants violated. The only remedy for violation of the Act is set forth in Sec. 2.1-386; it provides for injunction or mandamus, including costs and attorney's fees, against any person or agency "which has engaged, is engaged, or is about to engage in any acts or practices" contrary to the Act.
Plaintiff attacks "dissemination" of the report, not collection or maintenance of the information. Specifically, he contends each defendant violated that portion of Sec. 2.1-380 which requires an agency maintaining an information system that includes personal information to:
"1. Collect, maintain, use, and disseminate only that personal information permitted or required by law to be so collected, maintained, used, or disseminated, or necessary to accomplish a proper purpose of the agency; . . ."
First, plaintiff argues there is no other law "which either permits or requires the Defendants to disseminate the personal information" contained in the challenged report. Second, he says "[t]he Chief of Police failed to establish that the dissemination of the 'Internal Investigation' was necessary to accomplish the purpose of the Police Department or the County Executive." We will assume and not decide plaintiff's first premise is correct. Nonetheless, as to all defendants except Humphries, we reject his second suggestion.
We will examine the burden of proof question and then consider whether dissemination was necessary to accomplish a proper purpose of the agency. The burden was not on the defendants; the burden was on the plaintiff to establish a lack of necessity or an improper purpose for the dissemination. There is a presumption that public officials will obey the law. WTAR Radio-TV v. Virginia Beach, 216 Va. 892, 895, 223 S.E.2d 895,898 (1976). And there is nothing in the Privacy Protection Act that reverses such presumption or imposes the ultimate burden of proof on defendants sued under the Act. See Marsh v. Richmond Newspapers, Inc., 223 Va. 245, 257-58, 288 S.E.2d 415, 422 (1982). Consequently, the presumption stands until rebutted by contrary evidence.
The dissemination of the report must be viewed from the perspective of the "agency" charged with violation of the Act. Plaintiff implicitly argues that circulation of the document was among three independent "agencies": the Police Department, the County Executive, and the county. However, Owens, Noe, and the county argue there was no lateral, agency-to-agency dissemination but the circulation was vertical within the chain of what must be considered a single agency. It is unnecessary for us to decide that sub-issue; thus, we will agree with plaintiff and assume dissemination was from separate agencies: the Police Department to the County Executive, then from the County Executive to the County Board of Supervisors as a unit of government in the person of Humphries in her official capacity.
The evidence demonstrates that from the perspective of Owens and Noe, representing the "agencies" accused of improper distribution, they were responding to legitimate official requests. As to Noe, the demand of him was by a member of the Board of Supervisors, the policy determining body of the County, Code Sec. 15.1-590, in her official capacity upon the subject of law enforcement and police discipline. According to the evidence, there had been continuing concern by county officials about allegations of police brutality and misconduct. As to Owens, the request was from his "boss," the County Executive, who is vested with supervision and control over the police force. Sections 15.1-602 and -608.
Thus, plaintiff's evidence, measured against the presumption, fails to show that as the report moved from Owens to Noe and from Noe to the Board, personified by Humphries in her official capacity as Noe understood her inquiry, there was any violation of Sec. 2.1-380(1); plaintiff did not establish a lack of necessity or an improper purpose for that segment of the dissemination.
In contrast, the evidence clearly shows that Humphries violated the foregoing section of the Act. Having received the report legitimately, she permitted the document to be taken by her daughter. The daughter circulated it to both an attorney (who exhibited it in open court) and at least one of her co-defendants. To "disseminate" under the Act "means to release, transfer, or otherwise communicate information orally, in writing, or by electronic means." Sec. 2.1-379(4). Manifestly, Humphries released private information about the plaintiff in writing. And there is the continuing threat that the information, still under her control, will be distributed further; Humphries maintains it is a public record and that she has an obligation to reveal its contents.
By her own admission, Humphries was acting in her personal capacity as a citizen and a mother. Yet as a public official she should have been circumspect in the handling of such a sensitive document and should have informed herself about any restrictions on its use; a mere inquiry to the County Attorney would have alerted her about the requirements of the Privacy Protection Act.
Thus, the dissemination by Humphries was unnecessary to accomplish any proper purpose of the Board of Supervisors. Rather, the circulation was to serve the private interests of Humphries and her daughter, either to aid the defense of the criminal charge against the daughter, or perhaps to assist in the prosecution of a civil damage suit against the plaintiff as well as other officers involved in the arrests.
Consequently, the plaintiff is entitled to entry of a prohibitory injunction against Humphries only. The statute authorizing the injunctive remedy relieves plaintiff of the normal burden of proving that an adequate remedy at law does not exist and that irreparable injury will occur. WTAR Radio-TV v. Virginia Beach, 216 Va. at 894-95, 223 S.E.2d at 897-98.
Because of the view we take of the case, the evidentiary issue raised by plaintiff has become moot and we need not address plaintiff's contention that other sections of the Act also have been violated. We have carefully examined the argument and determined that either there have been no violations of the provisions relied on, or if there have been violations, the remedy should be by mandamus and not by injunction.
For these reasons, the judgment appealed from in favor of defendants Prince William County, Noe, and Owens will be affirmed. The judgment in favor of defendant Humphries will be reversed and the suit will be remanded for entry of appropriate injunctive relief against her under Code Sec. 2.1-386.
Affirmed in part, reversed in part, and remanded.