The failure to comply with a records request for email metadata will cost a Washington city more than half a million dollars in statutory and attorney's fees, a Washington Superior Court judge recently decided. On June 28, 2013, the judge ordered the City of Shoreline to pay $538,555 after the Washington Supreme Court ruled that metadata associated with public records is subject to disclosure under the state's open records law.
O'Neill v. City of Shoreline arose after Beth O'Neill requested a copy of an email and its accompanying metadata to find out its original sender. The email, criticizing the city council, had been read aloud at one of the council's meetings and wrongly attributed to O'Neill. Although Shoreline provided O'Neill with a paper copy of the email and metadata from forwarded copies of the email, it never provided O'Neill's specific records request -- that of the metadata associated with the original email, including the sender and recipient information. The recipient, Shoreline Deputy Mayor Maggie Fimia, said she must have inadvertently destroyed it, as Shoreline was unable to find the deleted email and its associated metadata in her email folder. After the Washington Supreme Court found that the metadata was a public record, the court remanded the case to the trial court, granting Shoreline the opportunity to inspect Fimia's home computer hard drive for the metadata "only because Fimia used her personal computer for city business." The trial court, however, found that Shoreline had failed to conduct an adequate search of the hard drive, "resulting in the permanent loss of the requested public record," and that Shoreline and Fimia "violated their statutory duty to provide Plaintiffs the fullest assistance in handling their records requests."
In determining that metadata fell within the scope of public records laws, the Washington Supreme Court noted the importance of public access to information that relates to government conduct. It stated, "Our broad [public records statute] exists to ensure that the public maintains control over their government, and we will not deny our citizenry access to a whole class of possibly important government information."
With the ruling, Washington became the second state to explicitly establish metadata as within the ambit of state records laws. Arizona did so in a 2009 case, Lake v. City of Phoenix, in which the court overruled a denial of a demoted police officer's request for access to metadata regarding his performance reports, which he believed had been altered after he had reported "serious police misconduct" to his superiors. The Arizona Supreme Court noted that "[w]hen a public officer uses a computer to make a public record, the metadata forms part of the document as much as the words on the page." The court called it illogical and contrary to the openness policy of the law to "conclude that public entities can withhold information embedded in an electronic document . . . while they would be required to produce the same information if it were written manually on a paper public record."
Other states have been increasingly addressing this issue as well, although not yet at binding statewide levels. A New York appellate court and a Philadelphia trial court both found metadata to be requestable records, and a North Carolina department has adopted best practices guidelines regarding the nature and disposition of metadata. The guidelines explicitly mention the probability of metadata's inclusion under the state's broad definition of a public record.
As the states no doubt recognize, metadata plays a significant role in many contexts. In 2012, fugitive John McAfee's location was revealed after journalists posted a picture of him on their website without first turning off the location services on the phone used to take the photo, leaving his longitude and latitude available for the public to see. In addition to location tracking, metadata has the ability to uncover significant information about who is trying to influence public discussion. This was highlighted when metadata from an anonymously submitted PDF revealed that Google had authored the 38-page feedback letter opposing eBay Australia's decision to use only PayPal to accept auction payments. The disclosure showed that the feedback was Google's reaction to the potential exclusion of the use of Google Checkout, rather than a concerned citizen's impression of the company's decision. Metadata's use, however, is not limited to isolated data, such as that from a single document or photo. It can also reveal relationships. A recent MIT project shows the capacity for metadata -- for example, from phone calls or emails -- to uncover personal relationships, whether those relationships are public knowledge or secret.
We know that metadata is powerful, but what exactly is it? Metadata can mean a lot of things, and its various definitions can dictate a wide breadth of outcomes. Generally speaking, metadata has been defined as "data about data." It can include a record's date, location, or creator; the device on which a record was created; the duration of phone calls or web browsing; and much more. The metadata from a Twitter account alone can include multiple personal identifiers, as the Guardian's metadata guide illustrates:
• the user's name, location, language, profile bio information and URL,
• when the account was created,
• usernames and unique identifiers,
• a tweet's location, date, time and timezone,
• a tweet's unique ID and ID of tweet replied to,
• contributor IDs,
• followers, following and favorite counts,
• verification statuses, and
• the application sending the tweet.
With the amount of information embedded in just one account, the intelligence to be gained from sources' metadata is substantial -- as metadata attaches to many services the public uses daily, such as email, phones, word processing documents, PDFs, and online search requests.
The scope of information metadata encompasses and its inconsistent definitions, however, can be problematic in the context of open records laws. Generally, records requesters must describe the records sought with "reasonable specificity." Without a clear definition of what constitutes metadata, people may ask for information rather than identifying a specific record. This makes it difficult to pin down an actual document; because governmental bodies are not compelled to create records that don't already exist, they can deny a request that doesn't sufficiently describe a particular existing record. Additionally, at least one court has found that a record's attached metadata is not inherently part of that record, so any request for a specific document must explicitly include a separate request for metadata if it is desired.
Similarly, many states only require governmental entities to provide a record in the original format in which the entity stores it. Therefore, metadata that may have been attached to a document at some point may not be available if the government does not maintain the document in electronic form. Yet, even if an entity does include and provide electronic data as records, it is unclear how far a metadata request can reach. With the breadth of metadata definitions, it could even be interpreted as allowing a person to request an entire database, an issue the Utah Court of Appeals faced last year but did not ultimately decide.
The goals of open records laws should play a meaningful role when entities determine whether to release metadata attached to public documents. State records statutes frequently exclude drafts from public access so as not to stifle ideas and revisions throughout the legislative process. As metadata can clearly indicate who contributed to what drafts and at what time, records custodians will need to thoroughly evaluate what metadata should remain private to preserve this purpose, which may be a difficult call to make. Custodians will also need to watch out for other metadata that potentially falls outside the scope of records accessible to the public -- such as metadata comprising personal information (such as medical information) that does not appear in the primary record.
With potentially difficult decisions to be made, states can help alleviate confusion about metadata in several ways. The ambiguity surrounding metadata's definition and exactly when -- or if -- it meets the public record classification should prompt legislators to clearly define what constitutes metadata and implement procedures to regulate its collection and preservation. States could explicitly state that metadata is a form of "electronic data," which is often included under statutory definitions of a "record." Further, states that haven't already done so could require that all government records be maintained in their original form, thus preserving any metadata for future requests. Such clarifications would improve the efficiency and understanding of metadata as government records, further promoting the public interest purpose of open records laws.
Rebekah Bradway is an intern at the Digital Media Law Project and a rising 3L at the S.J. Quinney College of Law at the University of Utah.
(Photo courtesy of Flickr user Richard Akerman pursuant to a Creative Commons CC BY-NC 2.0 license.)
