The Administrative Office of the United States Courts
Court Administration Policy Staff
Attn: Privacy Comments, Suite 4-560
One Columbus Circle, N.E.
Washington, D.C. 20544
Re: Comments on Privacy and Public Access to Electronic Case Files
Prepared by the Privacy Rights Clearinghouse and Electronic Frontier Foundation
To the Administration Policy Staff:
The Privacy Rights Clearinghouse and the Electronic Frontier Foundation are pleased to respond to the Judicial Conference's request for comments regarding access to electronic case files. It would be our privilege to participate in a public hearing on this topic should one be held by the Conference.
The Privacy Rights Clearinghouse (PRC) is a nonprofit consumer information and advocacy program based in San Diego, California. The PRC was established in 1992, and since that time, we have counseled thousands of consumers on a variety of privacy-related issues. Issues include identity theft, credit reporting, telemarketing, "junk" mail, Internet privacy, medical records, and workplace issues. The PRC responds to consumers through a hotline, written guides and a web site that is continually updated to include testimony given by the PRC in both state and federal forums on pending privacy legislation and administrative policy. See www.privacyrights.org.
The Electronic Frontier Foundation (EFF) is the leading civil liberties organization working to protect rights in the digital world. Founded in 1990, EFF actively encourages and challenges industry and government to support free expression, privacy, and openness in the information society. EFF is a member-supported organization and maintains one of the most linked-to Web sites in the world. See www.eff.org.
The EFF joins the PRC in submitting these comments to highlight that court proceedings of all types are yet another area in which the law has failed to protect against threats to an individual's privacy in their personal information once that information has been made available electronically.
Electronic Access to Court Files Versus Privacy Interests
The PRC and EFF recognize the long tradition of open access to public court records. However, as principles of open access evolved in constitutional and common law, the state of today's technology could never have been envisioned. The judicial branch is wise to seek to balance the competing interests of maintaining tradition while recognizing the potential harms to fundamental privacy rights as well as security of electronically stored personal data.
We recognize the convenience to the courts and counsel in electronic filing, the need to reduce paper files, and the long-standing principles of public access to court proceedings. However, the PRC and EFF believe the potential for both intangible invasions of privacy by those who have no need to know and more tangible harms such as identity theft outweigh reliance on a system that provides full access to court records electronically. Convenience and storage problems in this electronic age need to be addressed, but hopefully in such a way as to protect not only the public interest by providing access to public records, but to protect privacy interests as well. Accordingly, we hope our comments will help the Conference in its efforts to achieve this balance.
1. Identity Theft
At the core of the PRC's information and education program is the belief that all individuals have the right to control how their personal information is disseminated and used. This right is particularly important when the information at stake is personal financial and medical information likely to be included in civil, criminal or bankruptcy proceeding. The fundamental right to privacy should not be surrendered simply because an individual becomes a party to a court proceeding. Nor should witnesses, particularly victims, have to fear easy electronic access by anyone to their name, address, telephone number, Social Security number, tax returns and much more.
While the loss of control over personal information can be viewed in various ways with any number of results, the crime of identity theft is a most tangible result of the unfettered flow of personal information. The PRC has seen an alarming increase in the number of identity theft victims over the past few years. We have established an auxiliary program aimed exclusively at helping victims of this crime.
It seems appropriate here to share some important facts on the increasing crime of identity theft, which is certain to be fueled by easy, online access to names, addresses, telephone numbers, Social Security numbers, and often personal financial information. First, the variations on identity theft are limited only by the imagination of the thieves involved. It occurs when someone uses bits and pieces of personal information about an individual, often the Social Security number, to represent him or herself as that person for fraudulent purposes.
The thief may use personal information to obtain a credit card, a loan, open utility accounts, rent an apartment or even to complete major transactions such as purchasing a car or a home. Based on information obtained from a 1998 U.S. General Accounting Office report ("Identity Fraud," Report No. GGD-98-100BR, 1998, p.40, www.gao.gov) and the Trans Union credit reporting agency (CRA), the PRC estimates the number of victims of identity theft in 2000 to be 700,000.
A recent study conducted by the PRC in coordination with the U.S. and California consumer organizations U.S.PIRG and CALPIRG (Public Interest Research Groups) describes many of the problems and frustrations experienced by victims of identity theft. This study is available at the PRC web site www.privacyrights.org/ar/idtheft2000.htm. As the study notes, victims of identity theft often spend years restoring their financial health, and in extreme cases, victims are astonished to learn that they have criminal records because an identity thief has committed crimes in their name.
Social Security numbers, credit card numbers, loan account numbers, dates of birth, and bank account numbers represent a gold mine to dishonest individuals as well as the rising number of organized criminal enterprises and gangs that specialize in systematic identity theft. As previously noted, the Social Security number is the key piece of personal information most commonly associated with identity theft. Our experience has shown that a thief, with access to no more than an individual's Social Security number, can obtain a driver's license, open a new credit account, apply for a loan, and/or obtain a copy of the victim's credit report.
The frauds are often made easier due to the willingness of banks and credit card companies to change an address without independent verification. The circumstances we have described illustrate just how easy it now is to assume the identity of another for fraudulent purposes. Still another online resource for thieves in the form of electronic case files could only add to the ever-growing number of victims of identity theft.
2. Potential for Other Frauds
Instant access to highly personal information such as that contained in many court files leaves parties, witnesses, and victims vulnerable to an array of frauds. There is an almost certain prospect that easy online access to personal information will prove a bonanza for not only identity thieves, but predatory businesses such as unscrupulous telemarketers. For example, a plaintiff in a civil action who receives a large award of damages may be an easy target for fraudulent investment scams.
A bankruptcy petitioner or others shown in court files to be heavily in debt with poor credit ratings would be prime targets for fraudulent credit repair services. Other scams directed solely at those in desperate financial straits include the foreclosure scam, described in all its variations by the U.S. Government's Bankruptcy Foreclosure Scam Task Force www.usdoj.gov/ust/fs03.htm. Such scams victimize not only the debtor but the bankruptcy courts as well by clogging the system with fraudulent filings.
3. Unregulated Online Information Brokers
The sale of personal information in the form of "credit headers," direct marketing lists and public records has long been big business. The widespread use of the Internet has meant that virtually anyone can anonymously obtain the most personal details of an individual's life without limitation on how the information is used.
As the Conference is no doubt aware, personal information from public court files is already available online from companies that specialize in selling lists and individual personal information derived from public court records.
- One such company, National Bankruptcy Information, www.bkauthority.com, claims to be able to find "any document with the original case file" which it then "compiles [into] one large database."
- Two other companies also offer, again to anyone, lists of people who have filed for personal bankruptcy. One of these companies, International Technologies, Inc. (www.inft.net) claims its "Financial Hardships" database is "an excellent source for marketing leads."
- A third company, Discreet Research, Inc., www.discreetresearch.com, as well as International Technologies, Inc., offers a number of items of personal information about bankruptcy petitioners, including Social Security number.
There are many more such companies, and ease of access through online availability of entire court files will surely increase the number of companies profiting from the sale of personal financial and other information. Personal information is often used to create profiles of individuals and the more information that is added to an individual's profile, the more that individual is pigeon-holed into a particular demographic - rightly or wrongly. Information from electronic court case files will be one more data-point.
Compounding the problem is that data collectors often view consumer data as their own -- and treat it accordingly. Access to information in profiles then becomes an issue. For example, during the discussions at the Federal Trade Commission's Advisory Committee on Online Access and Security, many of the marketers present felt that it was proper to limit access to consumer information by consumers. In fact, the most restrictive view of the panel would only allow access to personal information collected if the record itself could be changed.
Privacy issues regarding public records become magnified as more and more personally identifiable data are made available on the Internet because the availability of such data allows for more extensive profiling of individuals. Profiling allows corporations to create detailed dossiers about individuals, which can lead to creation of markets for secondary uses of that information that the consumer could never have imagined. Few consumers realize the long-term privacy implications of these profiling practices.
Companies have been constructing very detailed profiles about their customers, storing the information they collect in databases where the information can be analyzed and merged with other databases. Information from court files would be just one other category of information to be used in this way.
We are concerned that sharing and selling of personal information, including the additional data elements needed for the administration of court proceedings and any resulting profiles based on that information, can have detrimental effects regarding activities that we take for granted in a free society, particularly in the area of free expression. Up until recently, we have had the freedom and ability to read and seek out information without being constantly monitored and identified. Now, pieces of information that had little meaning when viewed separately are being aggregated, resulting in extensive profiling of individuals.
For example, the merger of companies Doubleclick and Abacus has given the new single company the ability to merge the online advertising database of one company with the offline direct marketing database of the other, thus combining the offline and online behaviors of consumers into one database. The profiles created from information in the new database, including public records, show a much more detailed view of individual consumer behavior than either of the separate databases could have shown alone.
Adding the personal information found in the public records from court actions, including bank balances, income, and a detailed listing of assets, will only exacerbate the situation. Once consumers become informed of the extensive abilities of corporations to gather and profile consumers' online habits, including records that indicate their level of "financial health," consumers may be less likely to visit particular web sites, engage in e-commerce, or post to newsgroups, particularly if there are negative consequences, such as a potential employer gaining access to that profile and making hiring or firing decisions based on the contents. Even more troubling is the very real likelihood that individuals will seek not to participate in legal proceedings (civil actions) because the full court record will eventually be available via the Internet.
The dangers of profiling are well expressed by Jeffrey Rosen, professor of law at George Washington University and author of The Unwanted Gaze: the Destruction of Privacy in America (Random House, 2000, p. 115):
Privacy. protects us from being objectified and simplified and judged out of context in a world of short attention spans, a world in which part of our identity can be mistaken for the whole of our identity.
The Judicial Conference of the United States cites several cases that illustrate that the right to access is not absolute. In United States Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (1989), the Conference notes that the public interest is defined in Reporters as "shedding light on the conduct of any government agency or official". Id. at 773. The public interest does not include "the right" to acquire information about a particular citizen.
As described above, that is exactly what is occurring right now - companies are acquiring vast amounts of personal, although currently public, information about specific individuals and using that information to market to them. Information brokers use that information for tracking, and identity thieves use it to commit fraud. When weighing the balance between access and privacy of parties and third parties, the concerns discussed above should be taken into account.
Easing the administration of federal court cases may necessitate the creation of a new database containing the data elements necessary for the administration of those cases. The resulting databases will necessarily contain sensitive personal information about individuals that go through a civil, criminal or bankruptcy proceeding. The information kept in the database would include both public and non-public information including bank accounts, credit card account numbers, Social Security numbers, and tax records.
There are some privacy protections associated with information contained in some databases, such as with credit reporting records, but they are generally weak. Without proper safeguards and enforcement, information collected for the ease of administration is also likely to find its way into corporate and information broker databases resulting in unintended uses of the information without the knowledge or consent of the individual.
The general information at the beginning of the Federal Register notice seeking comment on electronic access to bankruptcy files states that "In addition, some trustees and creditors are considering compiling information contained in bankruptcy records electronically for easier administration of bankruptcy issues in which they have a claim. They may also envision some possible commercial use." Are bankruptcy records public records? Yes, but commercial use of that information is not what was envisioned as a protection of the public interest.
4. Inequitable Privacy Protections for Parties and Witnesses
Unrestricted Internet access to entire case files also may mean that parties and witnesses to a court proceeding lose important privacy protections that in other situations are accorded by the executive branch of government. For example, tax returns are closely guarded by the Internal Revenue Service to such an extent that only agency employees who have a need to know are granted access to tax information. Personal information contained in personnel and similar files as well as records of a civil or criminal investigation by an executive branch agency would also be protected as an exemption to the disclosure provisions of the Freedom of Information Act (FOIA). Individuals should not have to surrender privacy rights simply by being, often unwillingly, a party or witnesses to a court proceeding.
We recognize that the judicial branch is not subject to the FOIA or the Privacy Act. However, individuals should not have to give up all rights to privacy because they become a party or witness in a court proceeding.
One other security issue that needs to be addressed with the PACER system is the need to encrypt documents along the way from sender to receiver. Each time a request is made from a web site for a page, or each time an email is sent from one computer to another, copies are made. This is because messages are broken up and sent along the most efficient path (even though it may be a very circuitous route), and then reassembled at the end, the recipient's computer. Anyone along the way can see this data. Encrypting the documents is the best way to ensure that only the intended recipients will see the documents.
Policy Alternatives on Electronic Public Access to Federal Court Case Files
1. Civil Case Files
The PRC and EFF believe that adoption of a combination of alternative 2 and alternative 3 may be the best route toward protecting privacy online although such adoption should require further study. PRC believes the Conference should specify certain kinds of information (rather than entire documents) that will always be excluded from the public file. In our opinion, there can never be an overriding public interest in disclosure of personal information such as an individual's Social Security number. Nor should personal financial information such as account and access numbers, income, debt level, investments and retirement fund balances or detailed medical information be included in the public file.
PRC recognizes the difficulty in identifying every item of information that should be excluded from the public record. Many, such as those we have mentioned, are obvious, while the privacy and security interests in other information may vary depending on the circumstances involved. PRC would, therefore, recommend that the Committee define certain information as always excluded, but also leave discretion to the trial court to make additional exclusions if circumstances warrant.
EFF notes all of the above, but believes that before we can give unqualified support to one alternative or another, First Amendment concerns still need to be factored in.
PRC also supports the concept of "levels of access" to certain electronic case files, particularly while the litigation is ongoing. As the Conference notes, the public access tradition could be maintained under this alternative by having case files available at the courthouse. These should exclude, of course, very sensitive information such as Social Security numbers which we urge the Committee to define as always excluded from the public record.
The PRC recommends that a "levels of access" approach could work as follows: An abstract of the key elements of the case would be available electronically. These would include defendant's and plaintiff's names, the nature of the case, court information, pertinent dates, case status, and so on. The full text of the case would be publicly available at the courthouse, with sensitive personal information such as SSNs redacted as we've discussed above. The complete unredacted case files would be available electronically only to those with a direct stakeholder interest in the case such as attorneys, court administrative personnel, and parties.
Applying a combination of alternatives 2 and 3, information brokers and investigators could still visit the courthouse to accumulate data about recent cases, the parties, and the issues without gaining access to personal data such as Social Security numbers. PRC does not believe alternative 3 alone, as proposed, would provide adequate security and privacy protections. If highly sensitive information such as Social Security numbers is still kept in the public record at the courthouse, the threats to privacy may be less but not eliminated. Information brokers may still gather sensitive information to create databases to sell to others.
PRC strongly urges the Committee not to adopt a procedure that would treat electronic and courthouse access equally (alternative 1). Unlimited Internet access would be a windfall for identity thieves and scam artists who often prey on the elderly, unsophisticated, and economically troubled. Unlike the online information broker, most identity thieves and scam artists are unlikely to take the time and effort to go to the courthouse to gather information needed to commit their crimes.
As with the "levels of access" question, EFF believes that before we could give unqualified support to any of the alternatives, examination of First Amendment issues still need to be addressed. EFF hopes that the Committee will hold hearings on this subject.
PRC does not believe reliance upon protective orders alone will protect personal privacy and limit access to sensitive information. Such a procedure might work quite well in the context of litigation involving corporations seeking, for example, to protect trade secrets or other intellectual property. However, individual litigants who often rely on less experienced counsel as well as pro se litigants are less likely to file a motion for a protective order. Furthermore, an attempt to accomplish safeguards of privacy and security interests through protective orders would unduly burden the parties and the courts to such an extent that such protections could take a back seat to other issues presented by the case.
For those interested in access to public court records for research purposes, published court opinions now and always have been the best source of information about a case. Most opinions include a summary of relevant facts, the arguments put forth by the parties, relevant law and the court's reasoning and conclusions. Thus, information about the most important aspects of a case is already available from a variety of sources. And, of course, there will always be public access to proceedings as long as anyone can walk into a courtroom as a spectator.
If necessary, the Committee should also seek amendments to the Federal Rules of Civil Procedure to account for privacy and security interests.
2. Criminal Case Files
The PRC supports alternative number 1 with regard to criminal case files, that is do not provide electronic public access to full text criminal case files. We agree with the reasoning behind alternative number 1, in particular the threat of harassment of codefendants and obstacles to law enforcement and prosecution efforts. We note, in addition, the threat of harassment or even violence directed at witnesses and victims may make individuals with very important information to convey reluctant to voluntarily come before the court.
3. Bankruptcy Case Files
The PRC and the Electronic Frontier Foundation provided comments to the survey conducted by the Department of Justice, Department of the Treasury, and the Office of Management and Budget in September, 2000 with regard to electronic access to bankruptcy case files.
In summary, we believe the same threats to privacy and potential for illegitimate use of personal information applies to bankruptcy case files as well as civil and criminal case files
4. Appellate Cases
We believe the same access rules should apply to appellate case files and trial court files.
5. Fees
Although comments were not requested on the question of fees for access, we think that the Conference should consider dropping the public access charge of $.07 for downloading and printing, or at least consider further study on the issue. The main reason for the adoption of fees was so that the agency providing access to the requested documents could recover photocopying costs and administrative costs such as locating the file, physically photocopying the document and then re-filing the document back in its proper place.
With electronic records there is minimal cost to the agency. In this case it would be the one-time start up cost of the PACER system. After that, the costs fall solely onto the individual requesting the records with no cost to the agency. The individual requests the document from his/her computer, takes the time to download it, and then prints it using his/her own printer. We believe that the fee provision should be rescinded.
The PRC and EFF appreciate the opportunity to comment on some of the questions raised by the Conference.
Sincerely,
Beth Givens
Director, Privacy Rights Clearinghouse
3100 - 5th Ave., Suite B
San Diego, CA 92103
(619) 298-3396
bethg(at)privacyrights.org
Tena Friery
Research Director, Privacy Rights Clearinghouse
Deborah Pierce
Staff Attorney, Electronic Frontier Foundation
1550 Bryant St., Suite 725
San Francisco, CA 94103
(415) 436-9333 x106
dsp(at)eff.org
