Data Access

CRE Analysis

16. Interface with State Privacy Laws

Comment by Missouri Department of Labor and Industrial Relations

CRE Response:

State privacy laws should not be superseded by the Shelby data access law. Where the state law grants privacy rights to individuals, those rights should be respected in by federal agencies. The FOIA protections against disclosure of personal data are quite broad, however, as are agency practices in stripping data that could be used to identify a person. While CRE has not undertaken a 50-state survey of state privacy laws, we believe that FOIA's privacy protections will cover most personal data protected under state law. Where unusual state provisions do arise, these should be both respected and publicized among federal agency FOIA offices.

With respect to the example given by the Missouri Department of Labor, that agency essentially answers its own question when it states, "The federal agency would then have to determine if the data is subject to an exemption to the FOIA law." The personnel data described (employee names forwarded to the federal government as part of a report analyzing Missouri's Unemployment Insurance program) fall squarely under FOIA exemption 6 and would be expunged by the federal agency responding to the FOIA request.