Mr. Larry Norris, Director Arkansas Department of Correction P.O. Box 8707 Pine Bluff, Arkansas 71611-8707
Dear Mr. Norris:
You have requested an official Attorney General opinion concerning the Sex and Child Offender Registration Act of 1997, which requires the Arkansas Department of Correction to notify certain entities of the imminent release of certain offenders into the community. The Act also requires the release to those entities of certain information and records about the offenders.
Concerning those requirements, you have presented the following questions:
(1) Under A.C.A. § 12-12-913, which is part of the Sex and Child Offender Registration Act of 1997, must the Arkansas Department of Correction (ADC) disclose inmate records that are ordinarily confidential, such as medical records (including HIV status), mental health records, and treatment records (e.g., records reflecting treatment for sexual dysfunction)?
(2) If so, would the ADC be protected from liability for disclosing such information in light of state and federal privacy laws?
(3) If the ADC must disclose such records, should it do so in response to a general request for "all information" that it has concerning an offender, or should it release records that are ordinarily confidential only in response to a specific request for that information?
RESPONSE
Question 1 — Under A.C.A. § 12-12-913, must the Arkansas Department ofCorrection (ADC) disclose inmate records that are ordinarilyconfidential, such as medical records (including HIV status), mentalhealth records, and treatment records (e.g., records reflecting treatmentfor sexual dysfunction)?
It is my opinion that A.C.A. § 12-12-913 does require the ADC to disclose inmate records that are ordinarily treated as confidential. However, the ADC is required to disclose such records only to criminal justice agencies in the state or in any other state of the U.S., or to such agencies of the federal government. The records may also be open to government agencies that are authorized by law to conduct confidential background checks. The ADC is not required to disclose such records to the public.
The ADC's responsibility to disclose information is set forth in A.C.A. § 12-12-913(d)(3), which states:
The Department of Correction and the Department of Human Services shall, in conjunction with the notice provided under § 12-12-914, make available to a local law enforcement agency having jurisdiction all information that the departments' [sic] have concerning the offender, including information on risk factors in the offender's history.
A.C.A. § 12-12-913(d)(3).
A list of the "registration records" that the ADC is required to disclose to other agencies (if the ADC has such records) is set forth in A.C.A. §12-12-908. The list includes records that reflect the following information:
(1) The offender's full name and all aliases that the offender has used or under which the offender has been known;
(2) Age;
(3) Date of birth;
(4) Sex;
(5) Race;
(6) Height;
(7) Weight;
(8) Hair and eye color;
(9) Address of any temporary residence;
(10) Anticipated address of legal residence;
(11) Driver's license number or state identification number, if available;
(12) Social security number;
(13) Place of employment;
(14) Photograph, if not already obtained;
(15) Fingerprints, if not already obtained;
(16) Date of arrest, arresting agency, offense for which convicted or acquitted, and arrest tracking number for each adjudication of guilt or acquittal on the grounds of mental disease or defect;
(17) A brief description of the crime or crimes for which registration is required;
(18) The registration status of the offender as a sexually violent predator or a sex or child offender;
(19) A statement in writing signed by the offender acknowledging that the offender has been advised of the duty to register imposed by this subchapter; and
(20) Any other information that the Arkansas Crime Information Center deems necessary, including, but not limited to, criminal and corrections records, nonprivileged personnel, treatment and abuse registry records, and evidentiary genetic markers.
A.C.A. § 12-12-908.
The foregoing list clearly would include the types of ordinarily confidential records that you have mentioned [such as medical records (including HIV status), mental health records, and treatment records (e.g., records reflecting treatment for sexual dysfunction)]. These types of records are ordinarily considered to be confidential when considered in the context of the Freedom of Information Act (FOIA) (A.C.A. §25-19-101 through -107). The FOIA requires that public records be made available to the public, but makes exceptions for certain types of records, such as those that you mentioned. It is my opinion that because the ADC's responsibilities under A.C.A. § 12-12-913 do not involve the release of records or information to the public, as noted previously, the FOIA and its exemptions are not implicated by the ADC's responsibilities under A.C.A. § 12-12-913.1
Accordingly, the fact that the FOIA treats certain types of records as confidential and exempts them from disclosure to the public does not override the ADC's responsibility to disclose such records to other agencies as required by A.C.A. § 12-12-913.
Question 2 — If so, would the ADC be protected from liability fordisclosing such information in light of state and federal privacy laws?
I cannot opine conclusively in response to this question because of the intensely factual nature of any determination of liability. Liability can arise from a variety of factual situations in which specific information might be improperly disclosed in violation of some legal protection, including constitutional protections. Any conclusion regarding liability would turn entirely on the particular information disclosed, the legal protection that is claimed, and the circumstances under which the disclosure was made.
Nevertheless, to the extent that you have asked specifically about compliance with A.C.A. § 12-12-913 and about specific federal and state protections, it is my opinion that state and federal privacy laws would not operate to impose liability on the ADC for complying with the requirements of A.C.A. § 12-12-913.
I must note first that the Sex and Child Offender Registration Act itself contains a provision concerning immunity.
That provision states:
(a) Public officials, public employees, and public agencies are immune from civil liability for good faith conduct under this subchapter.
(b) Nothing in this subchapter shall be deemed to impose any liability upon or to give rise to a cause of action against any public official, public employee, or public agency for any discretionary decision to release relevant and necessary information, unless it is shown that the official, employee, or agency acted with gross negligence or in bad faith.
A.C.A. § 12-12-920. The question of whether the foregoing provision will be applicable to a given situation will depend on the particular facts of each case.
The only federal privacy law that is potentially implicated by A.C.A. §12-12-913 is the "Federal Privacy Act," which is codified at5 U.S.C. § 552a. It prohibits the release of certain types of information, but applies generally to federal agencies, rather than to state agencies. The one section of the act that does apply to state agencies is Section 7 of the original act [P.L. 93-579], which is set forth in the form of a note to 5 U.S.C. § 552a. It prohibits local agencies from penalizing individuals for refusing to disclose their social security numbers. Because this type of activity is not the subject of A.C.A. § 12-12-913, I conclude that the Federal Privacy Act does not affect A.C.A. §12-12-913, and that, therefore, the ADC's compliance with A.C.A. §12-12-913 does not open the ADC to liability under the Act.2
As discussed in response to Question 1, state privacy protections, which generally take the form of the exemptions under the FOIA, also do not operate to govern the situation described in A.C.A. § 12-12-913. See response to Question 1.
Question 3 — If the ADC must disclose such records, should it do so inresponse to a general request for "all information" that it hasconcerning an offender, or should it release records that are ordinarilyconfidential only in response to a specific request for thatinformation?
For the reasons stated in response to Question 1, it is my opinion that if the ADC receives a general request under A.C.A. § 12-12-913 for "all information" that the ADC has concerning an offender (and if the request is presented by one of the entities to whom the ADC is required to provide records and information), the ADC must disclose even records that would be deemed confidential under the FOIA. As previously discussed, the confidentiality exemptions of the FOIA do not apply to the ADC's responsibilities under A.C.A. § 12-12-913. That statute does not condition the ADC's responsibility to provide information upon whether the request is presented in specific form. Accordingly, I must conclude that the ADC must respond fully to general requests that are presented by entities that are entitled to make such requests.
Assistant Attorney General Suzanne Antley prepared the foregoing opinion, which I hereby approve.
Sincerely,
MARK PRYOR Attorney General
MP:SBA/cyh
1 It should be noted, however, that the FOIA is implicated by the responsibility that is placed on local law enforcement agencies concerning the release of inmate-related information to the public. This office has previously opined concerning the FOIA's interplay with the Sex and Child Offender Registration Act that A.C.A. § 12-12-913 of the Act creates a specific exemption from disclosure under the FOIA, by authorizing the Child Abuse/Rape/Domestic Violence Commission to promulgate guidelines and procedures for the disclosure to the public of information regarding offenders. See Op. Att'y Gen. No. 97-278.
2 It should be noted that this office has consistently opined, relying on the Federal Privacy Act, that public entities who release personnel and other records in response to a request under the FOIA should delete individuals' social security numbers prior to the release of the records. See, e.g., Ops. Att'y Gen. Nos. 95-262; 93-114.