Ostergren v. Cuccinelli

• Citation: 615 F.3d 263
• Decision Date: 26 July 2010
• Docket Number: Nos. 09-1723, 09-1796.,s. 09-1723, 09-1796.
• Parties: Betty J. OSTERGREN, Plaintiff-Appellee, v. Kenneth T. CUCCINELLI, II, in his official capacity as Attorney General of Virginia, Defendant-Appellant. Electronic Privacy Information Center, Amicus Supporting Appellee. Betty J. Ostergren, Plaintiff-Appellant, v. Kenneth T. Cuccinelli, II, in his official capacity as Attorney General of Virginia, Defendant-Appellee. Electronic Privacy Information Center, Amicus Supporting Appellant.
• Court: United States Courts of Appeals. United States Court of Appeals (4th Circuit)

615 F.3d 263

Betty J. OSTERGREN, Plaintiff-Appellee,

v.Kenneth T. CUCCINELLI, II, in his official capacity as Attorney General of Virginia, Defendant-Appellant.

Electronic Privacy Information Center, Amicus Supporting Appellee.

Betty J. Ostergren, Plaintiff-Appellant,

v.Kenneth T. Cuccinelli, II, in his official capacity as Attorney General of Virginia, Defendant-Appellee.

Electronic Privacy Information Center, Amicus Supporting Appellant.

Nos. 09-1723, 09-1796.

United States Court of Appeals,Fourth Circuit.

Argued: March 23, 2010.

Decided: July 26, 2010.

COPYRIGHT MATERIAL OMITTED.

ARGUED: Earle Duncan Getchell, Jr., Office of the Attorney General of Virginia, Richmond, Virginia, for Appellant/Cross-Appellee. Rebecca Kim Glenberg, American Civil Liberties Union Foundation of Virginia, Richmond, Virginia, for Appellee/Cross-Appellant. ON BRIEF: William C. Mims, Attorney General of Virginia, Stephen R. McCullough, State Solicitor General, William E. Thro, Special Counsel, Martin L. Kent, Chief Deputy Attorney General, Stephen M. Hall, Assistant Attorney General, Office of the Attorney General of Virginia, Richmond, Virginia, for Appellant/Cross-Appellee. Frank M. Feibelman, Cooperating Attorney, ACLU of Virginia, Richmond, Virginia, for Appellee/Cross-Appellant. Marc Rotenberg, John Verdi, Jared Kaprove, Matthew Phillips, Electronic Privacy Information Center, Washington, D.C., for Amicus Supporting Appellee/Cross-Appellant.

Before DUNCAN and DAVIS, Circuit Judges, and Joseph R. GOODWIN, Chief United States District Judge for the Southern District of West Virginia, sitting by designation.

Affirmed in part, reversed in part, and remanded by published opinion. Judge DUNCAN wrote the opinion, in which Judge DAVIS and Judge GOODWIN concurred. Judge DAVIS wrote a separate concurring opinion.

OPINION

DUNCAN, Circuit Judge:

This appeal arises from a First Amendment challenge to Virginia's Personal Information Privacy Act, Va.Code §§ 59.1-442 to -444. Section 59.1-443.2 prohibits “[i]ntentionally communicat[ing] another individual's social security number to the general public.” The district court found this section unconstitutional as applied to an advocacy website that criticized Virginia's release of private information and showed publicly available Virginia land records containing unredacted Social Security numbers (“SSNs”). Ostergren v. McDonnell, No. 08-362, 2008 WL 3895593, at *14 (E.D.Va. Aug. 22, 2008). Later, the court entered a permanent injunction barring Virginia from punishing the republication of “publicly obtainable documents containing unredacted SSNs of Virginia legislators, Virginia Executive Officers or Clerks of Court as part as [sic] an effort to reform Virginia law and practice respecting the publication of SSNs online.” Ostergren v. McDonnell, 643 F.Supp.2d 758, 770 (E.D.Va.2009). Both decisions are challenged on appeal. For the reasons that follow, we affirm in part and reverse in part.

I.

Betty Ostergren resides in Hanover County, Virginia, and advocates for information privacy across the country. Calling attention to Virginia's practice of placing land records on the Internet without first redacting SSNs, she displayed copies of Virginia land records containing unredacted SSNs on her website. After section 59.1-443.2 was amended to prohibit this practice, but before the amendment took effect in July 2008, Ostergren brought this constitutional challenge. ¹

A.

The clerk of court for each county in Virginia maintains documents affecting real property within the county. These “land records” reflect the ownership, conveyance, encumbrance, or financing of real property. ² They include deeds, contracts, liens, divorce decrees, and various other documents. See Va.Code § 17.1-227. Virginia law requires that clerks make land records available for public inspection. See Va.Code § 17.1-208. Any person can review and copy land records by visiting the courthouse and requesting them.

During the 1990s, many clerks of court began placing land records on the Internet. According to counsel for the Attorney General, the impetus came mainly from the real estate industry because online access to land records facilitated numerous real estate transactions. The Virginia General Assembly encouraged this practice by allowing clerks to charge a fee for online access. See Va.Code § 17.1-276. The General Assembly later established a “Technology Trust Fund Fee” assessed for every document recorded, and set aside the revenue for improving access to public records through information technology. See Va.Code § 17.1-279. The General Assembly also declared “the intent ... that all circuit court clerks provide secure remote access to land records on or before July 1, 2006.” 2004 Va. Acts 980. Finally, in 2007, the General Assembly imposed guidelines for posting land records online, see Va.Code § 17.1-294, and required that “[e]very circuit court clerk shall provide secure remote access to land records ... on or before July 1, 2008,” Va.Code § 17.1-279(D)(3).

The parties stipulated that “[u]nder Virginia's ‘secure remote access' system, any person may, for a nominal fee, obtain online access to all of the land records for a given locality.” J.A. 86. Guidelines require that an individual must register and obtain a username and password before using the system. See Information Technology Resource Management Standard, SEC503-02 §§ 1.4(3), 2.1 (Va. Info. Techs. Agency Mar. 28, 2005). This involves signing an agreement, paying a fee (possibly several hundred dollars per year), and providing certain personal information (first and last names, business name, mailing address, telephone number, email address, and citizenship status). Id. § 2.1.1. “Registration must be in person or by means of a notarized or otherwise sworn application that establishes the prospective Subscriber's identity, business or residence address, and citizenship status.” Id. § 2.1.2.

By July 2008, every county in Virginia had made its land records available on the Internet through secure remote access. This included over 200 million Virginia land records.

B.

Virginia's decision to place land records online raised certain concerns about information privacy. For many decades, attorneys included SSNs on real estate documents submitted for recording. Initially assigned for the purpose of administering Social Security laws, nine-digit SSNs have become widely used for identification and account authentication by government agencies and private organizations because no two people have the same number. They are thus highly susceptible to misuse. An unscrupulous individual who knows another's SSN could, for example, obtain fraudulent credit cards or order new checks on that person's account.

When clerks of court began placing land records online, they did nothing to redact SSNs. At that time, Virginia law neither required such redaction nor prevented attorneys from submitting documents for recording that contained unredacted SSNs. In 2003 and 2004, however, the General Assembly provided that “clerk[s] may refuse to accept any instrument submitted for recordation that includes a grantor's, grantee's or trustee's social security number,” and clarified that “the attorney or party who prepares or submits the instrument has responsibility for ensuring that the social security number is removed from the instrument prior to the instrument being submitted for recordation.” Va.Code § 17.1-227. Virginia law also provides that clerks “shall be immune from suit arising from any acts or omissions relating to providing secure remote access to land records pursuant to this section unless the clerk was grossly negligent or engaged in willful misconduct.” Va.Code § 17.1-294(D).

The General Assembly finally addressed redaction in the 2007 legislation mandating that clerks provide secure remote access by July 1, 2008. See Va.Code § 17.1-279(D)(3). The General Assembly noted clerks' authority to redact SSNs from digital land records available through secure remote access, authorized hiring private vendors to run redaction software, and authorized using Technology Trust Fund money for this purpose. See Va.Code § 17.1-279. The legislation would have also required clerks to complete the redaction process by July 1, 2010, but this provision never went into effect because the General Assembly failed to appropriate the necessary funds. See 2007 Va. Acts 872; 2007 Va. Acts 748. These efforts focused solely on digital land records available online. Virginia does not redact SSNs from original land records maintained at local courthouses even though Virginia law requires that such records remain publicly accessible.

The redaction process involves two steps-one electronic, the other manual. First, computer software checks digital land records and, in essence, labels each document “SSN found,” “SSN probably found,” “SSN possibly found,” and “SSN not found.” Individuals then manually review all but the last category, which they randomly sample. According to stipulation,

The accuracy of the redaction methods used by the circuit court clerks with regard to images that actually have social security numbers is between 95% and 99%. After redaction, a social security number that remains un-redacted in the online land records will be redacted if the Clerk is informed of the inaccuracy. If not brought to the Clerk's attention, it will remain accessible in the online land records.

J.A. 230. One company, Computing System Innovations (“CSI”), handled redaction for 67 counties. In processing about 50 million images, CSI manually reviewed about 5 million and discovered that 1,575,422 (about 3.21%) contained SSNs. ³

By July 2008, 105 of Virginia's 120 counties reported that they had completed the redaction process. Among the 15 that remained, two planned to finish by July 2010 and the rest planned to finish by December 2009. Despite the incomplete redaction, these 15 counties nonetheless continued to...