Michael L. HINDERLITER
v.
Alice HUMPHRIES, et al.
Record No. 800635.
Supreme Court of Virginia.
December 3, 1982.*685 Lowry J. Miller, Arlington (Miller, Miller & Cyron, Arlington, on brief), for appellant.
Elizabeth D. Whiting, Deputy County Atty. (T.A. Emerson, County Atty., on brief), for appellees.
Amicus curiae Local 2141, Intern. Ass'n of Fire Fighters (David Ross Rosenfeld, Alexandria, on brief), for appellant.
Amicus curiae Virginia State Ass'n of Professional Firefighters (Michael S. Shelton, Rhetta M. Daniel, Cohen, Abeloff & Staples, P.C., Richmond, on brief), for appellant.
Before CARRICO, C.J., and COCHRAN, POFF, COMPTON, THOMPSON, STEPHENSON and RUSSELL, JJ.
COMPTON, Justice.
In this appeal from an order dismissing a county police officer's suit against the county and certain county officials, we must interpret Virginia's Privacy Protection Act of 1976, Code § 2.1-377 through § 2.1-386 (the Act).
Initially, the background, purpose, and provisions of the Act should be examined. In 1974, the General Assembly adopted a resolution directing the Virginia Advisory Legislative Council (VALC) to study and report upon the matter of computer privacy and security. S.J.R. 10, Acts 1974 at 1511. This study was generated by proliferation in the use of automated data processing equipment, especially the electronic computer, that has enabled government and private industry to compile detailed information on individuals in every area of personal activity. Report of the VALC to the Governor and General Assembly of Virginia, 2 House & Senate Documents, S. Doc. 27 at 3 (1976). There is widespread concern about infringement on individual privacy resulting from this capacity to collect, order, and disseminate explicit personal information. Id.
Accordingly, a Computer Privacy and Security Committee of the Council studied the subject and in 1976 the VALC recommended legislation on regulation of computer privacy in the public sector only. Action on data systems' safeguards for the private sector was delayed. Id. at 7-8.
The VALC reported:
"It is the intent of the Council that affirmative steps be taken now by the General Assembly to obviate the possibility of the emergence of cradle-to-grave, detailed dossiers on individuals, the existence *686 of which dossiers would, `at the push of a button,' lay bare to anyone's scrutiny, every detail, however intimate, of an individual's life. Such action by the General Assembly would follow in the lead of the nation's courts which have been active in developing a considerable body of case law firmly establishing privacy as an inherent, inalienable human right." Id. at 7.
Concluding its Report, the VALC said:
"In summary, the Council feels now is the appropriate time to introduce legislation to set a basis for minimum standards for personal data collection, storage, and dissemination in the Commonwealth. The General Assembly would be well advised to avoid potential gross abuse of the power of intercommunicating data banks by setting reasonable, easily implemented standards of conduct. Well managed, responsible, data systems industries and support systems are as essential to the orderly and efficient operation of modern business, industry, and government as uncontrolled, unrestricted gathering of total information dossiers about total populations are antithetical to a free society. The Council is anxious to assure the former and prevent the latter eventuality." Id. at 11.
Subsequently, the Act was adopted by the 1976 General Assembly. Acts 1976, ch. 597. It has been said that the Act "is an important initial step towards safeguarding Virginia citizens against abusive information-gathering practices." 62 Va.L.Rev. 1357, 1358 (1976).[*]
The stated purpose of the Act is "to ensure safeguards for personal privacy by record-keeping agencies of the Commonwealth and her political subdivisions by adherence to" certain principles of "information practice." § 2.1-378(B). Among the principles enumerated are: no secret personal information system shall be established; the need to collect the information must be clearly established in advance; information must be relevant to the purpose for which it has been collected; it should not be used unless accurate; the individual should be able to learn the purpose for which it is collected and particulars about its use and dissemination; the individual should be permitted to correct or erase inaccurate or obsolete information; and any agency maintaining such data should assure its reliability and prevent its misuse.
The Act contains definitions of certain terms of art employed in the statutes such as "information system," "data subject," and "agency." § 2.1-379. In succeeding sections, the Act imposes administrative requirements on agencies maintaining an information system, §§ 2.1-380 and -381; sets forth rights of data subjects, § 2.1-382; provides for public disclosure of the existence of an information system, § 2.1-383; lists certain exempted information systems, § 2.1-384; prohibits forced disclosure of social security numbers, § 2.1-385; and provides for injunction or mandamus for violations of the Act, § 2.1-386.
This litigation developed in the following manner. On January 30, 1979, appellant Michael L. Hinderliter, the plaintiff below and a county police officer, participated in the arrest of four young adults in Prince William County. One of the persons arrested was the daughter of appellee Alice Humphries, a defendant below. At the time, Humphries was a member of the Prince William County Board of Supervisors.
Within hours of the arrests, Humphries initiated a complaint to the police department about the conduct of Hinderliter and the other officers. According to Humphries, she was acting in her private capacity as a "citizen" and mother, not in her official capacity as a member of the Board. As a result, pursuant to standing orders of the police department, an "internal investigation" was conducted to determine whether the arresting officers acted "properly" so that "corrective action" could be taken if misconduct was disclosed.
*687 The investigation was completed about one month later and the report was submitted to appellee, Colonel George T. Owens, the county's Chief of Police and another defendant below. The report, prepared under the supervision of a Major on the police force, is comprised of about 34 typewritten single-spaced pages. It summarizes in minute detail facts revealed during a police hearing conducted by the Major and during interviews with many witnessespolice officers and private citizensabout the events prior to and during the arrests. The whole incident stemmed from a complaint to the police from the management of a local restaurant about drunk and disorderly conduct at the establishment.
The Major concluded his report by noting that Hinderliter had previously received numerous commendations for his police enforcement and community work, that no prior complaints had been made against the officer, and that Hinderliter "is an aggressive police officer and a good one." The Major recommended, after studying the "entire matter at great length," that the "complaint be considered unfounded and not held against the records of the officers involved." Upon review of the report, Chief Owens agreed with the recommendation. He wrote Hinderliter that the complaint "will not be held against your record." Pursuant to department policy, the report of investigation was placed in Hinderliter's personnel file.
According to the evidence, the police officers' personnel files in Prince William County are maintained under the control and supervision of the Chief of Police. There are separate files on each officer, lodged in the Chief's office, arranged alphabetically by the individual's name. Included within each file is personal background information, promotion data, disciplinary information, fitness reports, commendations, and training records. Chief Owens' unwritten policy was that personal information contained in the personnel files was not available for release to the general public, although the individual officer could review the file at any time.
Subsequently, during the first part of March 1979, Humphries informally inquired of appellee Robert S. Noe, Jr., Prince William County Executive and a defendant below, about the investigation of the January incident. Although the discussion was not during a formal session of the Board, Humphries had made prior official complaints involving county police officers. Noe assumed Humphries in her official capacity wanted a copy of the report of investigation because there had been "some concern" by the Board about allegations against the county police "regarding excessive use of force." Noe then asked Owens for the report. Owens complied with the request because Noe was his "boss" and "he asked for it," although Owens had "no idea" why Noe wanted the report. Noe received the document, which was not in an envelope or other cover and was not marked "confidential" or "for official use only," and had copies made of it. Without reading the report, Noe transmitted a copy to Humphries.
Upon receipt of the report, Humphries assumed it was the response to her January demand for an investigation and a "report back." She did not realize that it was part of the police officer's personnel record or that it was not a public record. Actually, Humphries testified she considered the report public information because it was not marked "confidential" and stated that she had the right and obligation to disseminate the contents.
The report was kept on Humphries' desk at home in her living room. The daughter, who lived with her mother, removed the document and took it to the home of one of the other persons who had been arrested during the incident in question. The daughter then gave the report to her attorney. In July of 1979, apparently during the criminal trial of the charges against the daughter and another in the general district court, the attorney sought unsuccessfully to introduce the document into evidence.
Subsequently, Hinderliter filed in September of 1979 a bill of complaint against Humphries, the County, Noe and Owens *688 alleging violation of the Act. He sought to enjoin defendants "from disseminating, releasing, transferring, or otherwise communicating in any manner the information and contents" of the report of investigation. Following an ore tenus hearing, the chancellor ruled in favor of defendants, and denied the prayer of the bill in a February 1980 final decree, from which we awarded plaintiff this appeal.
Even though several issues are debated on appeal, the dispositive question is whether, under these facts, dissemination of the report of investigation violates the Act.
Asserting that many of the facts alleged in the report impute to Hinderliter violations of law and unfitness to perform the duties of a police officer, plaintiff focuses on specific sections of the Act which he claims were violated by one or more of the defendants. We will demonstrate that Humphries, who has not appeared on appeal, is the only defendant who violated the Act.
As we have already said, the stated purpose of the Act is to ensure safeguards for personal privacy as the result of record keeping in the public sector. This is to be accomplished by obedience to principles of fair information practice. Contrary to the conclusion that is implicit in plaintiff's argument, the Act does not render personal information confidential. Indeed, the Act does not generally prohibit the dissemination of information. Instead, the enactment requires certain procedural steps, noted supra, to be taken in the collection, maintenance, use, and dissemination of such data.
In order to understand the provisions of the Act, one must be attuned to the words of art employed. A "data subject" is an individual about whom "personal information" is indexed or may be located under his name or other identification in an "information system." § 2.1-379(3). "Personal information" is all data describing anything about an individual; it includes facts relating to education, ancestry, employment record, and personal characteristics. § 2.1-379(2). The term "information system" means the total components of a record-keeping process, whether automated or manual, containing personal information about a data subject. § 2.1-379(1).
Under the evidence in this case, Hinderliter was a "data subject." "Personal information" was included in the report in question because the contents bore on his employment record and personal traits. And the personnel records kept by the Chief of Police, of which the report became a part, qualified as an "information system" because it was a manual record-keeping process containing personal particulars on a data subject.
The term "agency" includes any "department" of any unit of county government. § 2.1-379(6). Thus the Prince William County Police Department is an "agency" as contemplated by the Act.
Against this setting, we examine the specific provisions of the Act that plaintiff claims defendants violated. The only remedy for violation of the Act is set forth in § 2.1-386; it provides for injunction or mandamus, including costs and attorney's fees, against any person or agency "which has engaged, is engaged, or is about to engage in any acts or practices" contrary to the Act.
Plaintiff attacks "dissemination" of the report, not collection or maintenance of the information. Specifically, he contends each defendant violated that portion of § 2.1-380 which requires an agency maintaining an information system that includes personal information to:
"1. Collect, maintain, use, and disseminate only that personal information permitted or required by law to be so collected, maintained, used, or disseminated, or necessary to accomplish a proper purpose of the agency; ..."
First, plaintiff argues there is no other law "which either permits or requires the Defendants to disseminate the personal information" contained in the challenged report. Second, he says "[t]he Chief of Police failed to establish that the dissemination of the `Internal Investigation' was necessary to accomplish *689 the purpose of the Police Department or the County Executive." We will assume and not decide plaintiff's first premise is correct. Nonetheless, as to all defendants except Humphries, we reject his second suggestion.
We will examine the burden of proof question and then consider whether dissemination was necessary to accomplish a proper purpose of the agency. The burden was not on the defendants; the burden was on the plaintiff to establish a lack of necessity or an improper purpose for the dissemination. There is a presumption that public officials will obey the law. WTAR Radio-TV v. Virginia Beach, 216 Va. 892, 895, 223 S.E.2d 895, 898 (1976). And there is nothing in the Privacy Protection Act that reverses such presumption or imposes the ultimate burden of proof on defendants sued under the Act. See Marsh v. Richmond Newspapers, Inc., 223 Va. 245, 257-58, 288 S.E.2d 415, 422 (1982). Consequently, the presumption stands until rebutted by contrary evidence.
The dissemination of the report must be viewed from the perspective of the "agency" charged with violation of the Act. Plaintiff implicitly argues that circulation of the document was among three independent "agencies": the Police Department, the County Executive, and the county. However, Owens, Noe, and the county argue there was no lateral, agency-to-agency dissemination but the circulation was vertical within the chain of what must be considered a single agency. It is unnecessary for us to decide that sub-issue; thus, we will agree with plaintiff and assume dissemination was from separate agencies: the Police Department to the County Executive, then from the County Executive to the County Board of Supervisors as a unit of government in the person of Humphries in her official capacity.
The evidence demonstrates that from the perspective of Owens and Noe, representing the "agencies" accused of improper distribution, they were responding to legitimate official requests. As to Noe, the demand of him was by a member of the Board of Supervisors, the policy-determining body of the County, Code § 15.1-590, in her official capacity upon the subject of law enforcement and police discipline. According to the evidence, there had been continuing concern by county officials about allegations of police brutality and misconduct. As to Owens, the request was from his "boss," the County Executive, who is vested with supervision and control over the police force. §§ 15.1-602 and -608.
Thus, plaintiff's evidence, measured against the presumption, fails to show that as the report moved from Owens to Noe and from Noe to the Board, personified by Humphries in her official capacity as Noe understood her inquiry, there was any violation of § 2.1-380(1); plaintiff did not establish a lack of necessity or an improper purpose for that segment of the dissemination.
In contrast, the evidence clearly shows that Humphries violated the foregoing section of the Act. Having received the report legitimately, she permitted the document to be taken by her daughter. The daughter circulated it to both an attorney (who exhibited it in open court) and at least one of her codefendants. To "disseminate" under the Act "means to release, transfer, or otherwise communicate information orally, in writing, or by electronic means." § 2.1-379(4). Manifestly, Humphries released private information about the plaintiff in writing. And there is the continuing threat that the information, still under her control, will be distributed further; Humphries maintains it is a public record and that she has an obligation to reveal its contents.
By her own admission, Humphries was acting in her personal capacity as a citizen and a mother. Yet as a public official she should have been circumspect in the handling of such a sensitive document and should have informed herself about any restrictions on its use; a mere inquiry to the County Attorney would have alerted her about the requirements of the Privacy Protection Act.
Thus, the dissemination by Humphries was unnecessary to accomplish any proper *690 purpose of the Board of Supervisors. Rather, the circulation was to serve the private interests of Humphries and her daughter, either to aid the defense of the criminal charge against the daughter, or perhaps to assist in the prosecution of a civil damage suit against the plaintiff as well as other officers involved in the arrests.
Consequently, the plaintiff is entitled to entry of a prohibitory injunction against Humphries only. The statute authorizing the injunctive remedy relieves plaintiff of the normal burden of proving that an adequate remedy at law does not exist and that irreparable injury will occur. WTAR Radio-TV v. Virginia Beach, 216 Va. at 894-95, 223 S.E.2d at 897-98.
Because of the view we take of the case, the evidentiary issue raised by plaintiff has become moot and we need not address plaintiff's contention that other sections of the Act also have been violated. We have carefully examined the argument and determined that either there have been no violations of the provisions relied on, or if there have been violations, the remedy should be by mandamus and not by injunction.
For these reasons, the judgment appealed from in favor of defendants Prince William County, Noe, and Owens will be affirmed. The judgment in favor of defendant Humphries will be reversed and the suit will be remanded for entry of appropriate injunctive relief against her under Code § 2.1-386.
Affirmed in part, reversed in part, and remanded.
NOTES
[*] For a discussion of the Act's federal counterpart, the Privacy Act of 1974, 5 U.S.C. § 552a (1977), see Note, The Privacy Act of 1974: An Overview, 1976 Duke L.J. 301.