Ostergren v. McDonnell

643 F. Supp. 2d 758 (2009)

Betty J. OSTERGREN, Plaintiff,
v.
Robert F. McDONNELL, in his official capacity as Attorney-General of Virginia, Defendant.

Civil Action No. 3:08cv362.

United States District Court, E.D. Virginia, Richmond Division.

June 2, 2009.

Rebecca Kim Glenberg, ACLU of Virginia, Richmond, VA, for Plaintiff.

James V. Ingold, Office of the Attorney General, Richmond, VA, for Defendant.

MEMORANDUM OPINION

ROBERT E. PAYNE, Senior District Judge.

This matter is before the Court on Plaintiff Betty J. Ostergren's BRIEF ON INJUNCTIVE RELIEF (Docket Number 26) filed pursuant to the Court's Order dated August 22, 2008, 2008 WL 3895593. Ostergren seeks to have the injunction previously entered by the Court, which enjoined enforcement of certain provisions of Virginia's Personal Information Privacy Act against her website as it then-existed, expanded to enjoin enforcement against her website at any time. The Defendant, Robert F. McDonnell, has filed a responsive BRIEF ON INJUNCTIVE RELIEF (Docket Number 27), which seeks to maintain the scope of the Court's remedial injunction. For the reasons set forth below, the Court's remedial injunction will be expanded to the extent, and for the reasons, set forth below.

I. BACKGROUND

For several years, clerks of court in Virginia, acting under authority conferred by Virginia's legislature, have made available on the Internet ("online") land records that are maintained in the office of the clerks of court in each city and county in Virginia. Of course, the clerks of court, by law, are required to maintain publicly available real (and some personal) property records in the courthouse and to have them available for public inspection. The land records contain many documents by which land is conveyed or encumbered, such as deeds, deeds of trust, divorce decrees, and documents which evidence the financing and ownership of land. Counsel for the Attorney General has advised, and Ostergren does not dispute, that the impetus for placing these land records online came principally from the real estate industry because to do so facilitated real estate transactions of all sorts. Years ago, Virginia's General Assembly blessed this process and authorized the clerks to charge fees for online access to public records. Va.Code. Ann. §§ 17.1-276, 279, 292.

For some time, dating back at least to the 1980's, some lawyers have included, for reasons not of record, Social Security numbers ("SSNs") in a significant number of documents tendered to the clerks of court for filing in the land records. (Hr'g Tr. at 69.) As the clerks of court began to make land records available online, they did nothing to redact from them the SSNs.

Until 2007, Virginia law did not require the clerks of court to redact SSNs from land records before making them available online. Even then, the redaction requirement was conditioned on the General Assembly making funding available to the various clerks for the redaction process. The General Assembly has not provided adequate funding to accomplish redaction for all jurisdictions.

Virginia law establishes a so-called "secure remote access" system which allows individuals, for a nominal fee, to obtain online access to the land records of a given locality. The term "secure remote access" system is something of a misnomer, because the system is not secure. Only the payment of a nominal registration fee stands between any person with an internet connection and access to the information contained on the system. (Stip. ¶ 6.) Ostergren paid the fee and secured the online land records that are posted on her website. (Id.)

Ostergren, who is a resident of Hanover County, Virginia, advocates for privacy rights in Virginia and nationwide. (Stip. ¶¶ 2, 3). Ostergren actively has opposed the posting of land records online without first redacting the SSNs. In fact, she has lobbied the General Assembly to stop that practice. As part of her advocacy work, Ostergren established the website www. TheVirginiaWatchdog.com in 2003. (Id. ¶ 5.) On this website, Ostergren has posted examples of public records that are available online and that contain SSNs. (Id.) The land records on the website, which contain the SSNs in question, appear along with written advocacy in support of Ostergren's views opposing the making of SSNs available online.

Ostergren's stated reason for doing so is to demonstrate graphically to members of the public that their own personal information may be available online. (Id. ¶ 5,) As "an object lesson" and for "shock value," Ostergren decided to post mainly the SSNs reflected in the land records of "legislators and clerks [of court] because, in her view, they are principally responsible for the online availability of millions of records containing SSNs." (Id. ¶ 12). Her website also includes public records obtained from government websites in other states and from sources other than Virginia's secure remote access system. (Id.; Hr'g Tr. at 22-28.) Ostergren has been successful in effecting change in record-keeping and SSN protection policies through her advocacy. (Hr'g Tr. at 73.)

At issue in this action is a provision of Virginia's Personal Information Privacy Act ("PIPA"), Va.Code. §§ 59.1-442-59.1-444. Section 59.1-443.2 provides, inter alia, that "a person shall not . . . [i]ntentionally communicate another individual's social security number to the general public." This provision took effect on July 1, 2008. Before then, the statute contained an exception for "records required by law to be open to the public." Va.Code. § 59.1-443.2(D) (2007). That exception was removed to create the current version of the statute, which Ostergren asserts to be unconstitutional as applied to her website.

Ostergren argues that her activities— posting copies of actual public records with SSNs clearly identified—fell within the scope of the old exception, but would now be subject to a range of civil sanctions, including fines, investigative demands, and injunctions. Va.Code Ann. § 59.1-201-59.1-206. Counsel for the Attorney-General agreed that, if Ostergren maintained her website with the posted records, she would be violating the law and be subject to those sanctions.

Ostergren represents that she obtained the unredacted public records that are posted on her website through Virginia's^[1] secure remote access system. (Decl. of Betty J. Ostergren ¶¶ 3, 11-14). She argues that the State, having made these documents available to the public on the Internet through its secure remote access system, cannot now prohibit her from posting those documents on her website in furtherance of her advocacy efforts.

On August 22, 2008, the Court held that Va.Code. § 59.1-443.2 was unconstitutional as applied to Ostergren's website as it existed as of the date of the filing of this action. (See Mem. Op. at 33.) The Court simultaneously ordered Ostergren to brief the issue of the appropriate scope of the permanent remedial injunction if she was of the view that an injunction of broader reach was appropriate. (Order issued August 22, 2008 (Docket Number 25).)

Thereafter, Ostergren filed a brief requesting that the permanent remedial injunction prohibit enforcement of Va.Code. § 59.1-443.2 against Ostergren's website for posting any public records, now or in the future. (PI. Br. at 1.) The Attorney General responded, arguing that, because of the basis for the Court's ruling, the appropriate scope of the injunction was limited to Ostergren's website as it existed when this action was filed (Def. Br. at 1.)

The parties also have filed a second stipulation of facts primarily relating to the progress made by the Virginia court clerks in redacting and removing SSNs from the records available through the secured remote access system. (Second Stip. at ¶¶ 1-5.) The second stipulation also indicates that many jurisdictions outside of Virginia continue to post available through records posted on public websites public records that contain SSNs. Additional evidence concerning Virginia's treatment of SSNs was adduced at the February 24, 2009 hearing on the issue of injunctive relief. That evidence, and its import, will be further discussed in connection with the legal issues to which it is relevant.

II. DISCUSSION

A. Appropriateness of a Permanent Injunction

1. General Principles

"The very essence of civil liberty certainly consists in the right of every individual to claim the protection of the laws, whenever he receives an injury." Marbury v. Madison, 1 Cranch 137, 163, 2 L. Ed. 60 (1803). It having been determined that a violation of the First Amendment exists, the issue now presented is the appropriate remedy for that violation. Ostergren asserts that the appropriate remedy is injunctive relief preventing the State from enforcing Va.Code. § 59.1-443.2 against her website. (Def. Br. at 1.)

Requests for injunctive relief in the context of Constitutional violations are generally subject to the same standards for equitable relief as non-Constitutional harms. See, e.g., Phelps-Roper v. Nixon 545 F.3d 685, 694 (8th Cir.2008); Aid for Women v. Foulston, 441 F.3d 1101, 1115 (10th Cir.2006); Ayres v. City of Chicago, 125 F.3d 1010, 1014-15 (7th Cir.1997); American Federation of Teachers—West Virginia, AFL-CIO v. Kanawha County Bd. of Educ, 592 F. Supp. 2d 883, 891-92 (S.D.W.Va.2009) (Goodwin, C.J.). The Supreme Court has recently described the burden on a plaintiff seeking a permanent injunction as follows:

a plaintiff seeking a permanent injunction must satisfy a four-factor test before a court may grant such relief. A plaintiff must demonstrate: (1) that it has suffered an irreparable injury; (2) that remedies available at law, such as monetary damages, are inadequate to compensate for that injury; (3) that, considering the balance of hardships between the plaintiff and defendant, a remedy in equity is warranted; and (4) that the public interest would not be disserved by a permanent injunction.

eBay Inc. v. MercExchange, L.L.C., 547 U.S. 388, 391, 126 S. Ct. 1837, 164 L. Ed. 2d 641 (2006); see also McManus v. District of Columbia, 530 F. Supp. 2d 46, 81 (D.D.C. 2007) (noting applicability of eBay standard to Constitutional claims). The applicable standard having been established, the Court will now turn to the analysis of Ostergren's claim under the eBay framework.

2. Irreparable Injury

The first factor that must be demonstrated by the Plaintiff to establish the propriety of a permanent injunction is the presence of irreparable injury. See eBay, 547 U.S. at 391, 126 S. Ct. 1837. The Supreme Court previously has held that the "loss of First Amendment freedoms, for even minimal periods of time, unquestionably constitutes irreparable injury." Elrod v. Burns, 427 U.S. 347, 373, 96 S. Ct. 2673, 49 L. Ed. 2d 547 (1976) (plurality). Indeed, in a somewhat similar case, the Fourth Circuit overturned a district court's denial of a preliminary injunction when the injury suffered by the plaintiff was the potential loss of a First Amendment right. Newsom ex rel. Newsom v. Albemarle County Sch. Bd., 354 F.3d 249, 261 (4th Cir.2003) (applying Elrod).

The application of this standard to Ostergren's case is clear. The Court already has held that Va.Code. § 59.1-443.2 infringes on Ostergren's First Amendment rights. (See Mem. Op. at 33.) Therefore, if at least some applications of the statute are not enjoined, Ostergren will suffer an irreparable injury. See Elrod, 427 U.S. at 373, 96 S. Ct. 2673. The precise applications of the statute that must be enjoined in order to preserve Ostergren's constitutional rights will be examined later. See Section II.B, infra.

3. Inadequacy of Remedies at Law

The inadequacy of monetary damages as compensation for Ostergren's loss of her First Amendment rights is similarly clear. Indeed, in cases where the damage is truly irreparable, monetary damages will seldom be an adequate remedy. See Safeway Inc. v. CESC Plaza Ltd. Partnership, 261 F. Supp. 2d 439, 469 (E.D.Va.2003) ("As a result, inadequacy of damages and irreparability of harm are often treated interchangeably in the permanent injunction analysis.") Furthermore, monetary damages are typically regarded as inadequate where the injury is continuous or repeated. See Teaching Co. Ltd. Partnership v. Unapix Entertainment, Inc., 87 F. Supp. 2d 567, 587 (E.D.Va. 2000); see also Disney Enterprises, Inc. v. Delane, 446 F. Supp. 2d 402, 408 (D.Md. 2006) (permanent injunction is appropriate when future violations are a "continuing threat"). Finally, damages are rendered inadequate as a remedy when actual damages would be difficult to ascertain. See Safeway, 261 F.Supp.2d at 469.

All of these factors weigh in favor of Ostergren. The threat to Ostergren's constitutional rights would be a continuing danger if the application of the statute against her website is not enjoined. See Section II.B.2, infra. Furthermore, the actual damages suffered by Ostergren would be essentially impossible to ascertain—Ostergren's website is a not-for-profit enterprise, and thus has no future earnings to lose, and the price tag on First Amendment rights is certainly difficult to establish. Finally, the harm suffered by Ostergren—the violation of her First Amendment rights—is essentially irreparable. Therefore, Ostergren's remedies are inadequate at law. See Safeway, 261 F.Supp.2d at 469.

4. Balance of Harms

The third factor to be considered in deciding on the propriety of a permanent injunction is whether "considering the balance of hardships between the plaintiff and defendant, a remedy in equity is warranted." See eBay, 547 U.S. at 391, 126 S. Ct. 1837. The Fourth Circuit has explained that a government "is in no way harmed" by the issuance of an injunction prohibiting it from enforcing an unconstitutional law. Newsom, 354 F.3d at 261. Indeed, if anything, in that circumstance the state's system would be improved by issuance of an injunction. See Giovani Carandola, Ltd. v. Bason, 303 F.3d 507, 520-21 (4th Cir. 2002). Therefore, any harm done to the State caused by enjoining unconstitutional applications of Va.Code. § 59.1-443.2 is minimal, at best.

Balanced against this minimal or nonexistent harm is the significant injury done to Ostergren by allowing enforcement of Va.Code. § 59.1-443.2 against her website. Much like the plaintiff in Carandola, Ostergren faces substantial fines and other stiff civil penalties if the statute were enforced against her. See 303 F.3d at 520; Va.Code Ann. § 59.1-201-59.1-206. In addition to these concrete sanctions, Ostergren will also suffer the serious harm of the deprivation of a Constitutional right. Therefore, the balance of harms weighs heavily in Ostergren's favor, supporting the issuance of a permanent injunction.

5. Public Interest

The final factor that must be considered in determining the propriety of a permanent injunction is whether such an injunction would be in the public interest. See eBay, 547 U.S. at 391, 126 S. Ct. 1837. The Fourth Circuit is unequivocal that "upholding constitutional rights serves the public interest." Newsom, 354 F.3d at 261; see also Carandola, 303 F.3d at 521 ("upholding constitutional rights surely serves the public interest."). It is true that the public certainly has an interest in being subject to the reduced likelihood of falling prey to the scourge of identity theft. However, "the public interest is better served by following binding Supreme Court precedent and protecting [] core First Amendment right[s]." Homans v. Albuquerque, 264 F.3d 1240, 1244 (10th Cir.2001). And, as discussed below, it is possible to frame an injunction that will accommodate both aspects of the public interest. Therefore, all four necessary factors weigh in favor of granting a permanent injunction that restrains the State from unconstitutional applications of Va. Code. § 59.1-443.2.

B. Scope of the Injunction

1. Standard of Review

Having determined that a permanent injunction is an appropriate remedy, it is necessary now to decide the appropriate scope of that injunction. As a general proposition, the scope of an injunction remedying a constitutional harm should be limited to "enjoin only the unconstitutional applications of a statute while leaving other applications in force." Ayotte v. Planned Parenthood of Northern New England, 546 U.S. 320, 329, 126 S. Ct. 961, 163 L. Ed. 2d 812 (2006) (citing United States v. Raines, 362 U.S. 17, 20-22, 80 S. Ct. 519, 4 L. Ed. 2d 524 (1960)). Accordingly, partial, not total, invalidation of a statute is the more usual scope of injunctive relief upon a finding of unconstitutionality. See id.

However, courts also must be careful not to intrude on the legislative domain by rewriting the statute. See id. Indeed, the goal should be to "devise a judicial remedy that does not entail quintessentially legislative work." Id. Finally, courts must attempt to craft the remedy so as not to defeat legislative intent, where that is possible. See id. To preserve legislative intent in the face of an unconstitutional statute or application thereof, courts "must next ask: Would the legislature have preferred what is left of its statute to no statute at all?" Id. These principles inform the resolution of the issue now presented for decision: the scope of the permanent remedial injunction.

2. Scope of the Right

The first step in determining the appropriate scope of the remedy in Ostergren's case is to determine the exact scope of the constitutional right placed at hazard by the statute. See id. at 329, 126 S. Ct. 961. Thus, for example, the Supreme Court has enjoined enforcement of a statute against picketers on public sidewalks in front of the Supreme Court, but not against those on Supreme Court property itself, because the violation of a constitutional right was occasioned only in the former situation. See id. at 329-330, 126 S. Ct. 961 (citing United States v. Grace, 461 U.S. 171, 180-83, 103 S. Ct. 1702, 75 L. Ed. 2d 736 (1983)). Similarly, in Ayotte, the Court enjoined enforcement of only those particular applications of the statute at issue that violated constitutional principles. See id. at 330, 126 S. Ct. 961 (enjoining application of statute requiring parental notification prior to a minor's obtaining an abortion only when the health of the minor was at risk).

Court's applying Ayotte have formulated similarly-limited remedies. For example, the Third Circuit, confronted with a Title VII employment discrimination claim against a religious institution, enjoined application of the discrimination provisions of Title VII against religious institutions only insofar as the complained-of employment decisions were "as to who will perform spiritual functions." Petruska v. Gannon University, 462 F.3d 294, 305 n. 8 (3d Cir.2006). Thus, the tailored remedy of the "ministerial exception" was sufficient to eliminate the First Amendment problems posed by application of Title VII in the context of those particular employment decisions. See id. Similarly, courts have used the rationale in Ayotte to strike the offending portions of a statute, while leaving others intact, and to issue declaratory judgments defining the exact scope of the class of individuals against whom a statute may not be enforced. See Jeffrey O. v. City of Boca Raton, 511 F. Supp. 2d 1339, 1359 (S.D.Fla.2007)(striking one section of a state ordinance that violated the Fair Housing Act, while leaving another section of the ordinance intact); Doe v. Prosecutor, Marion County, Ind., 566 F. Supp. 2d 862, 877 (S.D.Ind.2008) (issuing declaratory judgment based on Fourth Amendment violations caused by state statute).

The considerations concerning the scope of the remedy advanced in Ayotte have also been applied in the First Amendment context. See Maldonado v. Kempton, 422 F.Supp.2d 1169, 1177 (N.D.Cal.2006). In Maldonado, the district court permanently enjoined the enforcement of a state statute that prohibited non commercial billboards while permitting commercial advertising. See id. This was a clear violation of established First Amendment law, which requires that commercial and non-commercial speech be treated equally with respect to billboards. See id. Therefore, the appropriate remedy in that case was to "enjoin the State from enforcing [the statute] to prohibit non-commercial speech wherever the Act permits commercial speech." Id. at 1178.

The issue that now presents itself, therefore, is the scope of the First Amendment right at issue here. The previous decision issued in this case held that Va. Code. § 59.1-443.2 was unconstitutional as applied to the current version of Ostergren's website because the statute, as applied, violates her First Amendment right to report matters of public concern to the public. (See Mem. Op. at 24.) The scope of this right, and hence, the scope of the applicable remedy, was defined by a triptych of Supreme Court cases: Cox Broadcasting Corp. v. Cohn, 420 U.S. 469, 95 S. Ct. 1029, 43 L. Ed. 2d 328 (1975), Smith v. Daily Mail Pub. Co., 443 U.S. 97, 99 S. Ct. 2667, 61 L. Ed. 2d 399 (1979), and The Florida Star v. B.J.F., 491 U.S. 524, 109 S. Ct. 2603, 105 L. Ed. 2d 443 (1989). Most of the analysis contained in the original opinion need not be recapitulated here; the most concise and applicable statement of the scope of the right at issue was set forth in Florida Star:

If (1) a newspaper (2) lawfully obtains truthful information (3) about a matter of public significance then state officials may not constitutionally punish publication of the information, (4) absent a need to further a state interest of the highest order.

491 U.S. at 534, 109 S. Ct. 2603 (enumeration added). Even if a publication does not meet this test, the publication may only be punished if the punishment is narrowly tailored to serve the state interest. See id. at 541, 109 S. Ct. 2603; see also Bowley v. City of Uniontown Police Dept., 404 F.3d 783, 786-87 (3d Cir.2005). As discussed in the opinion on the merits, in order for this right to apply, all four of these elements must be present. (See Mem. Op. at 23-31.)

Therefore, in order to determine whether enforcement of Va.Code. § 59.1-443.2 against future publications of public records on Ostergren's website would violate her First Amendment rights, it is necessary to determine whether all four elements would be present at the time of those future postings. For the reasons discussed earlier, Ostergren's website will be regarded as the equivalent of "a newspaper" for purposes of the Florida Star analysis. (Mem. Op. at 23-24.) This status will not change with future postings of public records because Ostergren will still be "analytically indistinguishable from a newspaper" in that she will continue to provide information and opinion to the public about matters of public concern. (Id. at 23) (quoting Sheehan v. Gregoire, 272 F. Supp. 2d 1135, 1145 (W.D.Wash. 2003).)

Ostergren testified the SSNs which appear on her website are imbedded in the public records which she has obtained online. She intends to continue to publish records thusly obtained. (Hr'g Tr. at 24-33.) The parties have stipulated that, even after the redaction efforts have been completed, there will still be some publicly available documents on the secured access network and elsewhere with unredacted SSNs, because the redaction process has a one to five percent failure rate. (See Second Stip. at ¶¶ 4, 5., 6) It is, by definition, legal to obtain publicly available information. See Florida Star, 491 U.S. at 534, 109 S. Ct. 2603. Therefore, the second element of the Florida Star analysis will remain unchanged, as well, because Ostergren will still be publishing lawfully-obtained, truthful information. See id.

The resolution of the third element of the Florida Star test is similarly clear. See 491 U.S. at 534, 109 S. Ct. 2603. There is no indication that the need to prevent the release of SSNs to the public, and the related issue of the State's efforts achieve that goal, will cease to be a matter of public concern. (See Mem. Op. at 28.) Criminal activity, such as identity fraud, and information concerning that activity are archetypical matters of public concern. See Bowley, 404 F.3d at 787. Furthermore, the parties have agreed that identity theft, the criminal phenomenon that creates the necessity to prevent dissemination of SSNs, will continue to be a matter of public concern. (See PI. Br. at 3-4; Def. Br. at 4.) Virginia's publication of SSNs on what is a fundamentally unsecure network substantially increases the ability of individuals to commit the crime of identity fraud, and will continue to do so in the future, if the SSNs are not removed. Therefore, there is no cognizable difference between those records posted on Ostergren's website when this case was filed and the public records that would putatively be posted in the future.

The record indicates, and the parties tacitly agree, that the element of the most analytical moment is whether the State has indicated sufficiently that, going forward, it intends to treat the prevention of SSN dissemination as "a state interest of the highest order." (See Mem. Op. at 26, 31; PI Br. at 2-3; Def. Br. at 4.) The important issue for purposes of the crafting the scope of the permanent injunction, therefore, is to determine whether the State's recent efforts have been sufficient to indicate that the State now (i.e., after Ostergren's filing of this action) treats such information as a state interest of the highest order. See Florida Star, 491 U.S. at 534, 109 S. Ct. 2603.

Whether the State has an interest of the highest order is answered by examining objectively the means by which the State treats the information in question. See id. at 537, 109 S. Ct. 2603. The relevant case law is clear that, if the State wishes to claim that the confidentiality of a certain piece of information is a State interest of the highest order, then the State should not make that information publicly available. See id. at 534-5, 109 S. Ct. 2603. As the Supreme Court explained in Florida Star

Where information is entrusted to the government, a less drastic means than punishing truthful publication almost always exists for guarding against the dissemination of private facts . . . [W]here the government has made certain information publicly available, it is highly anomalous to sanction persons other than the source of its release.

Id. Subsequent cases comport with this assessment. See Buzayan v. City of Davis Police Dept., 2007 WL 1831139, *3-4 (E.D.Cal.2007) (no State interest of the highest order in confidentiality when information was disclosed to newspaper); Sheehan, 272 F.Supp.2d at 1145 ("when the government itself places information in the public domain, it must be presumed that the government concludes the public interest is thereby served").

The basic outline of the State's plan to maintain the confidentiality of SSNs is as follows: all clerks of court are required to have redacted the SSNs from their records by the end of 2010, if funding for the project is allocated by the General Assembly (Hr'g Tr. at 79); the redaction process used on both preexisting and newly-published records is being completed either by the clerks themselves or through contract work with outside companies (Second Stip. at ¶ 1); the redaction process has an average failure rate of one-to-five percent (Id. at ¶ 5); and, the General Assembly has appropriated approximately $7 million to fund the redaction, but this amount is insufficient to fully fund the project (Hr'g Tr. at 79).

The redaction process started in 2007 will not be complete for all jurisdictions until, optimistically, July, 2010. (See id. at ¶ 2.) Approximately 105 of 120 jurisdictions have completed the redaction process, but among the 15 jurisdictions that have not completed the process are some of the State's most populous areas. (Id. at ¶¶ 1-2.) The more-likely completion date, as identified at oral argument, is the end of 2010, and the redaction may not even be finished at that point because of funding problems. (Hr'g Tr. at 77.) The State has furnished no justification for why the land records of clerks that have not completed redaction have not simply been removed from the internet until the redaction is complete. The necessary inference drawn from the choices of the General Assembly in enacting the statutes that require clerks of court to make land records online, in providing limited funding for redaction of SSNs, and in failing to direct, even after this litigation, that the records be removed from the internet until redaction is complete, is that the State is of the view that having the documents available on the internet is of greater importance to the State than protecting confidentiality of the SSNs in those records.

Furthermore, the parties have stipulated that the redaction process will not be successful at removing all SSNs from the secured access network. (Second Stip. at ¶ 5.) Thus, the redaction process, even after completion, will leave over 60,000 SSNs available for public view on the network. (See Hr'g Tr. at 48-49.)

The State explains that, after the redaction process is complete, it will handle the one to five percent failure rate by removing SSNs from the network once the relevant clerk is alerted to their presence. (See Second Stip. at ¶ 5.) That approach does not obviate the fact that, even after the envisioned redaction process is completed, there will remain some 60,000 SSNs available on the Internet. The bell cannot be unrung: once the information has been released, it has been released, and it cannot be called back and retroactively made secret. See Florida Star, 491 U.S. at 534-35, 109 S. Ct. 2603.

A subsidiary issue that has not been discussed to this point is, even if a State interest of the highest order is assumed to exist, whether the statute codifying that interest has been narrowly tailored to further that interest. See Florida Star, 491 U.S. at 542, 109 S. Ct. 2603. The Third Circuit has held that, "when the government has stewardship over confidential information, not releasing the information to the media in the first place will more narrowly serve the interest of preserving confidentiality than will punishing the publication of the information once inappropriately released." Bowley v. City of Uniontown Police Dept., 404 F.3d 783, 788 (3d Cir.2005). This reasoning applies with equal force here: the most narrowly tailored solution to the problem of dissemination of SSNs over which the State has custody is not to release those SSNs into the public domain. Thus, as applied to Ostergren's website as it will exist in the future, Va.Code. § 59.1-443.2 is not narrowly tailored.^[2]

3. Legislative Function and Intent

The last two factors set forth by the Supreme Court in Ayotte, judicial restraint in rewriting statutes and preservation of legislative intent, are not particularly relevant to Ostergren's case. See 546 U.S. at 329-30, 126 S. Ct. 961. The scope of any injunction will reach only Ostergren and her website, and no violence has been done to the statutory language, save for the addition of implied terms limiting application of the statute only in constitutionally-acceptable circumstances. (See Mem. Op. at 33.) Therefore, this case presents no usurpation of the legislative function. See Ayotte, 546 U.S. at 329, 126 S. Ct. 961.

The primary consideration animating the third factor, "[w]ould the legislature have preferred what is left of its statute to no statute at all?" is likewise not a contested issue. See Ayotte, 546 U.S. at 330, 126 S. Ct. 961. This case seems quite similar to that in Petruska, in which the Third Circuit noted that "Congress would prefer a tailored exception to Title VII than a complete invalidation of the statute." 462 F.3d at 305 n. 8. Much like Petruska, it is reasonably and clearly inferable from the record that the Virginia legislature would prefer a restricted statute to none at all, because even a restricted statute (i.e., one that could not include news organizations republishing legally-obtained SSNs) would still be useful in combating identity theft. (See Mem. Op. at 25.)

4. Assessment of the Factors Governing the Scope of the Injunction

Without doubt, Va.Code § 59.1-443.2 violates Ostergren's rights under the First Amendment. The decisions of the Supreme Court making that clear, however, speak in broad terms, and, in each case, the Supreme Court has taken pains to confine its decisions to the facts presented by each particular case. See, e.g., Florida Star, 491 U.S. at 537-38, 541, 109 S. Ct. 2603. Furthermore, the Supreme Court has been clear that, fundamentally, the analysis of the First Amendment rights at issue requires striking the appropriate balance between the competing interests of the individual rights of the publisher and the protection of the citizens to whom the released information pertains. See id.; see also Daily Mail, 443 U.S. at 104-05, 99 S. Ct. 2667. In none of the decisions defining the contours of the First Amendment right at issue here did the Supreme Court confront a situation in which the published information, albeit obtained from publicly available sources, could result in the financial ruin of thousands of innocent members of the public.^[3]

Indeed, it is not overstating the matter to observe that the lives of victims of identity theft are severely altered for years after the theft occurs. See Chris Jay Hoofnagle, Identity Theft: Making the Known Unknowns Known, 21 HARV. J.L. & TECH. 97, 98-99 (2007). It is beyond question that access to a person's SSN provides an identity thief with the key element to effectuate particularly ruinous types of identity theft. See id. at 100-101. "An identity thief [armed with the victim's SSN] can empty bank accounts, obtain credit cards, secure loans, open lines of credit, connect telephone services, and enroll in government benefits in a victim's name." Danielle Keats Citron, Reservoirs of Danger: The Evolution of Public and Private Law at the Dawn of the Information Age, 80 S.CAL. L.REV. 241, 253 (2007). The average victim of identity theft suffers a loss of approximately $17,000, and will spend more than $1,000 and 600 hours of personal time dealing with the consequences of his victimization. See id. at 254. Identity thieves are only rarely caught and punished for their crimes. See Hoofnagle, supra, at 108 (identity thieves "have a one out of 700 chance of getting caught by federal authorities.").

Furthermore, identity theft is no longer an isolated problem: the loss caused by identity theft total over $50 billion per year; and, identity theft has been described as the fastest-growing crime in the United States. Jonathan J. Darrow & Stephen D. Lictenstein, "Do You Really Need My Social Security Number?" Data Collection Practices in the Digital Age, 10 N.C. J.L. & TECH. 1, 8-9 (2008). Thus, in concept, Va.Code § 59.1-443.2 furthers what ought to be, by any objective measure, a State interest of the highest order: protecting citizens from those consequences. Indeed, several states have taken legislative action to protect their citizens from identity theft. See Paul M. Schwartz, Preemption and Privacy, 118 Yale L.J. 902, 917 (2009).

When land records were first put online in Virginia, the prevalence of identity theft was not as great as it is now and its consequences were not as far reaching. However, the increased prevalence and the ruinous consequences of identity theft have been well publicized for several years and the actions of the General Assembly reveal that it is aware of the problem. In that time, however, the General Assembly has not prohibited the placement of SSNs into public records and has not adequately funded the redaction of SSNs from public records even while requiring that those records be placed online. Thus, the actions of the State have not been commensurate with what one would expect when addressing a State interest of the highest order.

The enactment of Va.Code § 59.1-443.2 certainly is a significant step toward demonstrating the order of the State's interest. However, the State ignored rather obvious alternative solutions (e.g., prohibiting inclusion of SSNs in documents to be filed in public records, requiring or funding complete redaction, and removing the records from interest access until redaction is complete) that are less drastic than punishing someone who republishes that which is in the public records; punishment that is in contravention of rather clear Supreme Court precedent. (See Op. at 768.)

To implement those alternatives by judicial order would constitute impermissible legislation by the judiciary. See Ayotte, 546 U.S. at 329, 126 S. Ct. 961 ("[M]indful that our constitutional mandate and institutional competence are limited, [Courts should] restrain [themselves] from rewriting state law to conform it to constitutional requirements even as we strive to salvage it.") (internal quotations omitted). Furthermore, given the text of the statute, a limiting construction of the statute itself does not present itself.

It is, however, conceptually possible to frame a remedial injunction that does not legislate, but that does accommodate the First Amendment rights of Ostergren and, at the same time, affords some protection to the innocent members of the public who have no control of the release of the public records containing their SSNs. Given the case-by-case approach to issues of this sort counseled by the Supreme Court in Cox, Daily Mail and Florida Star, that balance might be best effectuated by enjoining enforcement of the statute to allow Ostergren to use the SSN-containing public records of legislators, executives, and court clerks, which will allow her to pursue what she considers to be effective lobbying activity while minimizing the exposure of members of the public who have no way to prohibit the dissemination of the records containing their SSNs. Indeed, such an injunction largely only ratifies Ostergren's current course of conduct and, as she herself stated, would not have a seriously deleterious effect on her public advocacy. (Hr'g Tr. at 36-37.)

That course does afford less generous protection to Ostergren's rights under the First Amendment than was made available to a publishing entity under Cox, Daily Mail or Florida Star. However, as noted above, in none of those cases was the Supreme Court confronted with the particularly ruinous consequences that predictably ensue from the wholesale release of SSNs on Ostergren's website or on other sites that choose not to exercise the commendable restraint shown thus far by Ostergren. This application of the law adheres to the analytical method set forth in Cox, Daily Mail and Florida Star, despite the fact that it results in a remedy of slightly less expansive scope—a result clearly contemplated by the Supreme Court in those cases. See Florida Star, 491 U.S. at 537, 109 S. Ct. 2603 ("We accordingly do not rule out the possibility that, in a proper case, imposing civil sanctions for publication of [publicly released information] might be so overwhelmingly necessary to advance [the public's interest] as to satisfy the Daily Mail standard.").

Under all the circumstances, the public interests in free speech and public security are best balanced by entry of a narrowly tailored injunction that allows Ostergren to publish the SSN-containing records of State legislators, State Executive Officers and Clerks of Court, those who actually can act to correct the problem, but that forecloses wholesale publication of the SSN-containing records of innocent members of the public who did nothing to cause the problem and who can do nothing to change the law or appropriate or expend funds to address the problem.

III. CONCLUSION

For the foregoing reasons, a permanent injunction will be entered against enforcement of Va.Code. § 59.1-443.2 against any iteration of Ostergren's website, now or in the future, that simply republishes publicly obtainable documents containing unredacted SSNs of Virginia legislators, Virginia Executive Officers or Clerks of Court as part as an effort to reform Virginia law and practice respecting the publication of SSNs online.

It is so ORDERED.

NOTES

[1] Virginia is a Commonwealth but, because the relevant law is keyed to "state interests," the term State will be used hereafter when referring to the Commonwealth of Virginia.

[2] Ostergren has brought an as-applied challenge, so the Court explicitly does not decide whether Va.Code. § 59.1-443.2 is narrowly tailored to prevent the dissemination of SSNs acquired from non-state sources. It may be the case that penalizing publication of those SSNs is narrowly tailored to forward the State's interest of preventing identity theft. That issue is not before the Court at this time, so it need not be decided.

[3] This is not to say that the harms suffered by the victims in Florida Star or Daily Mail were quantitatively less severe than those suffered by the victim of identity theft. Instead, this statement only describes the evident qualitative differences between the two types of harms.