Digital Media and Data Privacy Law Blog

I’m going to devote a few posts over the next several weeks to some intriguing cases from 2010 that you might have missed.

One such case is a fascinating decision from the Fourth Circuit, Ostergren v. Cuccinelli, 615 F.3d 263 (2010), in which the Court found a Virginia statute making it unlawful to intentionally publish a person’s social security number over the Internet violated the First Amendment. Judge Duncan’s thoughtful and thorough analysis offers insight into how the Supreme Court’s holdings in Cox Broadcasting v. Cohn, Smith v. Daily Mail Publishing, and The Florida Star v. B.J.F., all hallowed First Amendment decisions affirming the right to publish freely available public information, ought to be applied in a digital age fraught with the risk of identity theft and intrusions upon personal privacy.

The plaintiff in Ostergren is a privacy advocate. One way in which she has chosen to spread her message is by publishing on her web site public land records that reveal the social security numbers of various public officials. Virginia began placing its land records online in the 1990s. Initially, clerks of court did nothing to redact social security numbers from these records. Subsequently, the Virginia legislature required attorneys who filed instruments for recordation to ensure that social security numbers were removed before filing.

In 2007, the legislature addressed the redaction of records already available online (original land records maintained in hard copy form are not redacted). However, the record in the case demonstrated that there is an approximately 3% error rate in the redaction process, which means that even after the process is complete, over a million online records can be expected to contain unredacted social security numbers. By 2008, 105 of Virginia’s 120 counties had completed the redaction process; those that had not finished continued to make all records available online.

Ostergren began advocating for reform in 2003 when she created her web site, and two years later she began her practice of publishing unredacted documents on that site. The controversy sparked by her web site led to the amendment of Section 59.1-443.2, which prohibited the intentional communication of a person’s social security number, to remove the exception for “records required by law to be open to the public.” After the Virginia Attorney General announced his intention to prosecute Ostergren under the amended statute, Ostergren brought suit under Section 1983, seeking to have the law declared unconstitutional under the First Amendment as applied to her publication of copies of public records lawfully obtained from the government.

The district court ruled in Ostergren’s favor and entered an injunction. On appeal, the Fourth Circuit affirmed the district court’s core holding under the First Amendment, while modifying the scope of its injunction.

The Fourth Circuit began by rejecting the categorical approach advanced by Virginia that social security numbers are unprotected speech that may be prohibited entirely. The Court held that “[g]iven her criticism about how public records are managed, we cannot see how drawing attention to the problem by displaying those very documents could be considered unprotected speech. Indeed, the Supreme Court has deemed such speech particularly valuable within our society.”

The Fourth Circuit then considered what level of scrutiny to apply to the Virginia statute’s regulation of protected speech. After a lengthy discussion of Cox Broadcasting, Daily Mail Publishing, and The Florida Star, the Court concluded that those decisions

make clear that Ostergren’s constitutional challenge must be evaluated using the Daily Mail standard. Accordingly, Virginia may enforce section 59.1-443.2 against Ostergren for publishing lawfully obtained, truthful information about a matter of public significance ‘only when narrowly tailored to a state interest of the highest order.’

Thus, strict scrutiny applied.

The Court then discussed the state’s interest protecting the disclosure of social security numbers. After providing an extensive history of the development of social security numbers and the risk of their misuse, the Court concluded that “Virginia’s asserted interest in protecting individual privacy by limiting SSNs’ public disclosure may certainly constitute ‘a state interest of the highest order.’” However, the Court went on to hold that it need not decide the question because it concluded, in any event, that Virginia’s restriction at issue was not narrowly tailored to the asserted interest.

In examining the question of narrow tailoring, the Court noted that the case involved a different conception of privacy than that present in Cox Broadcasting and The Florida Star. Those cases proceeded from a notion of privacy premised on secrecy, namely shielding from public view the fact that one had been the victim of rape. In Ostergren, on the other hand, secrecy was not at issue in the sense that a person is not embarrassed or humiliated, nor is their reputation harmed, by the revelation of his social security number. Instead, the privacy concern rests on ensuring proper use of and control over sensitive information, that if one’s social security number is revealed, unscrupulous persons may use the number for identity theft, bank fraud, and so on.

The Court noted another difference from the Cox Broadcasting and The Florida Star cases in that in those cases the disclosure was unintentional and could easily have been prevented. In Ostergren, the Fourth Circuit noted that it is much more difficult to ensure that not one of the millions of land records placed online contain an unredacted social security number.

Based on this analysis, the Court concluded that Virginia’s prohibition was not narrowly tailored to its asserted interest. In particular, the Court found that while the First Amendment does not necessarily require that each and every original land record be redacted before Ostergren may be prohibited from publishing them online in unredacted form,

the First Amendment does not allow Virginia to punish Ostergren for posting its land records online without redacting SSNs when numerous clerks are doing precisely that. . . . Virginia could curtail SSNs’ public disclosure much more narrowly by directing clerks not to make land records available through secure remote access until after SSNs have been redacted.

The court noted further that when documents with social security numbers slipped through the redaction process unaltered, “we leave open whether under such circumstances the Due Process Clause would not preclude Virginia from enforcing section 59.1-443.2 without first giving Ostergren adequate notice that the error had been corrected.”

On the strength of this sound analysis, the Fourth Circuit affirmed the district court’s holding that enforcement of Section 59.1-443.2 against Ostergren for posting the Virginia land records on her website would violate the First Amendment.

However, the Court went on to vacate the injunction entered by the district court on the grounds that its scope was both too narrow and too broad in certain respects. First, the Court rejected Ostergren’s argument that the injunction should protect her publication of non-Virginia public records that she had posted on her web site. Second, the Court found the injunction was too narrow in that it applied only to Virginia land records of public officials and did not include those of private individuals. Third, the injunction failed to cover Virginia land records posted by Ostergren concerning non-Virginia public officials.

To my knowledge, this is the first case to examine this issue. Look for more disputes to arise under the Cox Broadcasting/Daily Mail Publishing/The Florida Star line of cases as concern over privacy continue to clash with the public interest, embodied in the First Amendment, to permit the publication of publicly available government records.