Ostergren v. McDonnell
Concerning the Publication of Social Security Numbers
Latest News
- EPIC Urges Court to Protect Speech of Privacy Advocate: Today, EPIC filed a "friend of the court" brief with the Fourth Circuit Court of Appeals, urging the court to hold that the First Amendment protects the speech of Betty Ostergren, a privacy advocate. Ostergren runs a Website that republishes Social Security Numbers, collected from public records, to persuade Virginia lawmakers to stop releasing documents that reveal Social Security Numbers. Under Virginia law, Ostergren could be prosecuted for publishing SSNs, even though Virginia makes the numbers widely available. A lower court held that the law violated Ostergren's First Amendment rights. Virginia appealed. EPIC's brief urges the appeals court to uphold the lower court's ruling. For more information, see EPIC Ostergren v. McDonnell, EPIC Social Security Numbers, and EPIC Identity Theft. (Oct. 19, 2009)
Background
Virginia provides "secure remote access" to certain public records, including court records that contain "several hundred million documents with SSNs." Any person who provides basic registration information, signs an agreement, and pays a fee may use the service and gain remote access to the records. By statute, court clerks are required to redact SSNs from records before making them available for secure remote access; however, that provision did not go into effect because the redaction process was unfunded. Going forward, the Virginia legislature has dedicated approximately $7 million towards the redaction of SSNs from secure remote access records, with a goal of complete redaction by the end of 2010.
The plaintiff in this case, Betty Ostergren, is a privacy advocate who maintains a website calling for improved privacy rights and the removal of private information from public records. Ostergren obtained unredacted public documents through Virginia's secure remote access system and posted the documents on her website. Ostergren argued that posting the records informs the public about the online availability of personal information, and increases transparency and oversight.
The publication of the SSNs exposed Ostergren to liability under a revised provision of Virginia’s Personal Information Privacy Act (PIPA) that states that “a person shall not . . . [i]ntentionally communicate another individual’s social security number to the general public.” The previous version of the statute provided an exception for "records required by law to be open to the public." Before the revised provision went into effect, Ostergren filed a complaint in the United States District Court for the Eastern District of Virginia, alleging that the revised provision was unconstitutional under the First Amendment and applicable Supreme Court precedent.
The court agreed that the provision was unconstitutional as applied to her website. The court found that Ostergren's website addressed a matter of public concern, and that Virginia did not appear to regard the protection of SSNs as an "interest of the highest order" because it made some records available online and did not fund the redaction of the records. The court found that it was not an interest of the highest order even though the SSNs on Ostergren's website have been used at least twice for criminal activity. One individual has admitted to using the SSNs to fraudulently obtain credit cards, and another confessed to using the SSNs to attempt to blackmail people.
The court entered a permanent injunction against enforcement of the provision against “any iteration of [plaintiff]’s website … that simply republished publicly obtainable documents containing unredacted SSNs of Virginia [state officials].” The Virginia Attorney General filed a notice of appeal on June 30, 2008, and filed its Opening Brief before the Fourth Circuit on September 8, 2009.
EPIC's Interest
EPIC has also routinely urged lawmakers, regulators, and courts to take meaningful steps to curb identity theft. Specifically, EPIC has advocated for increased privacy of SSNs and has argued repeatedly that the unwarranted disclosure of SSNs, even if truncated, can lead to identity theft. However, privacy and transparency are not a zero sum game. In this case, EPIC believes that the transparency and oversight interests advanced by Ostergren's disclosures will lead to greater protection of privacy, even if she discloses SSNs in order to do so.
Legal Documents
- EPIC's Amicus Brief, EPIC, October 19, 2009
- Appellee's Brief by the ACLU of Virginia, 4th Circuit, October 13, 2009
- Appellant's Brief by the Virginia Attorney General, 4th Circuit, September 8, 2009
- Memorandum Opinion Granting Permanent Injunction, U.S. District Court, June 2, 2009
- Permanent Injunction Order, U.S. District Court, June 2, 2009
- Memorandum Opinion, U.S. District Court, August 22, 2008
- Complaint, U.S. District Court, June 11, 2008
News Reports
- Judge Lets Privacy Advocate Keep Social Security Numbers on Web Site, ComputerWorld (August 27, 2008)
- Collect Them All: Politicians' Social Security Numbers, Washington Post, Opinion (August 25, 2008)
- Judge Supports Right to Post Social Security Numbers on Web Site, Richmond Times-Dispatch (June 2, 2008)
- Online Records May Aid ID Theft, Washington Post (January 2, 2008)
- A Matter of Public Record, Washington Post (May 25, 2005)
