Opinion No.

Mr. Larry Norris, Director Arkansas Department of Correction P.O. Box 8707 Pine Bluff, AR 71611-8707

Dear Mr. Norris:

You have requested an Attorney General opinion concerning the release of certain information about inmates on the Arkansas Department of Correction's web site.

You have asked:

Is it permissible for the Arkansas Department of Correction (ADC) to place inmate information on a web site for public access? (This information would include names and aliases, ADC numbers, photographs, physical descriptions, race, date of reception into ADC, facility in which incarcerated, offense, case number, county of conviction, length of sentence, parole/transfer eligibility date, pervious prison sentence information, and pending detainers.)

I cannot give a broad, all-encompassing answer to this question, because there is no general law that governs the publication or confidentiality of all inmate-related information. However, some of the types of information about which you have inquired may be subject to specific confidentiality requirements under various state or federal laws. I will therefore discuss some of the laws that may be applicable. I note that I do not purport to give an exhaustive discussion of all possible laws that may affect this information. I cannot do so without knowing every item of information that may be placed on the web site. For this reason, each item of information must be analyzed to determine whether it falls within the protection of the laws discussed herein or any other laws.

As an initial matter, I note that under A.C.A. § 12-27-113(e), the Arkansas Department of Corrections (ADC) is prohibited from disclosing inmate records and information, except pursuant to administrative regulation or court order. The relevant provision states:

(e) The director shall make and preserve a full and complete record of each and every person committed to the department, along with a photograph of the person and data pertaining to his trial conviction and past history.

(1) To protect the integrity of those records and to insure their proper use, it shall be unlawful to permit inspection of or disclose information contained in those records or to copy or issue a copy of all or part of any record to any person so committed except as authorized by administrative regulation or by order of a court of competent jurisdiction. The regulations shall provide for adequate standards of security and confidentiality of records.

A.C.A. § 12-27-113.

In order to be in compliance with the above-quoted requirement, ADC must have a specific regulation in place that would permit placing the information in question on the web site. ADC must also determine whether the information in question is subject to any court order.

A similar provision governs information about individuals under the supervision of the Department of Community Punishment. See A.C.A. §12-27-128(b)(20). If any inmate is under the supervision of the Department of Community Punishment, the information in the file maintained by the Department on that inmate cannot be disclosed except in accordance with the Department's rules and regulations or by order of a court. Therefore these rules and regulations must be consulted before any information concerning an inmate under the supervision of the Department of Community Punishment is placed on the web site. It will again be necessary for ADC to determine whether the information in question is subject to any court order.

Any information that is authorized to be maintained by the Arkansas Crime Information Center is limited in its accessibility to the public. Although such information can be released to certain agencies for specified purposes, see A.C.A. § 12-12-211 and A.C.A. § 12-12-1008 through -1011, general dissemination of it is prohibited. The pertinent statutory provision states:

Every person who shall release or disclose any information authorized to be maintained and collected under this subchapter to another person known to lack authority to receive such information and any person who willfully obtains that information for purposes not specified by this subchapter shall be deemed guilty of a Class D felony.

A.C.A. § 12-12-212.

The specific information that is "authorized to be maintained and collected" by the Arkansas Crime Information Center is determined by the Supervisory Board of the Arkansas Crime Information Center. See A.C.A. §12-12-207. It will therefore be necessary for ADC to review that body's rules and regulations prior to placing any information on the web site.

Another source of law that may prohibit the disclosure of certain inmate-related medical information is A.C.A. § 20-15-904(c). That statute requires a report to the Department of Health of any positive HIV test. It also requires that such information be treated as confidential. The applicable provision states in pertinent part:

All information and reports in connection with persons suffering from or suspected to be suffering from the diseases specified in this section shall be regarded as confidential by any and every person, body, or committee whose duty it is or may be to obtain, make, transmit, and receive such information and reports.

A.C.A. § 20-15-904(c).

If ADC is required to receive information concerning an inmate's positive HIV test, that information may not be placed on the web site.

Certain federal laws may be applicable to your question. For example, under the "Federal Privacy Act," (5 U.S.C. § 552a), it would be advisable not to disclose inmates' social security numbers. That act prohibits the release of certain types of information, but applies generally to federal agencies, rather than to state agencies. The one section of the act that does apply to state agencies is Section 7 of the original act [P.L.93-579], which is set forth in the form of a note to 5 U.S.C. § 552a. It prohibits local agencies from penalizing individuals for refusing to disclose their social security numbers. This office has consistently opined, relying on the Federal Privacy Act, that social security numbers should not be released. See, e.g., Ops. Att'y Gen. Nos. 95-262; 93-114. For the reasons set forth in those opinions, it is my opinion the ADC should likewise refrain from placing social security numbers on the web site.

The foregoing are some examples of the types of specific statutory provisions that may prohibit certain inmate-related information from being placed on the web site. In addition, it should be noted that although any information that is not subject to such a specific statutory confidentiality requirement will be deemed a "public record" within the meaning of the Freedom of Information Act (FOIA), A.C.A. § 25-19-101 etseq., it may nevertheless fall within one of the exemptions from disclosure listed in the FOIA itself (such as medical records) and should therefore not be disclosed. The FOIA's exemptions are set forth in A.C.A. § 25-19-105. ADC should consider all information in light of these exemptions prior to placing it on the website.

As a final matter, I must note that even if information is not subject to any statutory confidentiality requirement, an inmate could nevertheless have a constitutional privacy interest in that information. The Arkansas Supreme Court has specifically recognized that the constitutional right of privacy can supersede the specific disclosure requirements of the Freedom of Information Act, at least with regard to the release of documents containing constitutionally protectable information. SeeMcCambridge v. City of Little Rock, 298 Ark. 219, 766 S.W.2d 909 (1989). The McCambridge court held that a constitutional privacy interest applies to matters that: (1) an individual wants to and has kept confidential; (2) can be kept confidential but for the challenged governmental action in disclosing the information; and (3) would be harmful or embarrassing to a reasonable person if disclosed. The court further held that if these attributes apply to the matters in question, it must then be considered whether the governmental interest in disclosure under the Act (i.e., the public's legitimate interest in the matter) outweighs the individual's privacy interest in their non-disclosure. This is a difficult right to establish, and it will clearly be more difficult for an inmate than it would be for a person who has never been convicted of a crime. Nevertheless, ADC must consider this issue in determining what information to disseminate.

Assistant Attorney General Suzanne Antley prepared the foregoing opinion, which I hereby approve.

Sincerely,

MARK PRYOR Attorney General

MP:SA/cyh