|
|
|
|
||
|
|
The Protection of Privacy in the Face of Governmental Transparency Rachel Hollrah 1. Introduction Granting citizens access to public government information is a truly telling mark of an open and democratic government. In pursuance of this candid relationship between the government and its people, both the United States and Mexico have enacted "freedom of information" statutes.1 These statutes are designed to enable citizens to peruse public government information so they may obtain data about their government´s actions. Accordingly, citizens act as a check on the state to prevent or reduce governmental corruption. While these governments desire transparency in their actions, they must also balance disclosure with the protection of their citizens´ confidential and personal information. Thus, a tension exists between the goal of making government information public and the need to safeguard individuals´ personal data.2 While granting citizens access to government information makes the government´s actions more transparent, it also puts individuals´ confidential data at a greater risk of exposure.3 As a result, privacy is threatened by the public´s interest in obtaining information.4 Both the United States and Mexico guarantee the right to privacy to their citizens. The right to privacy was first addressed by the US Supreme Court in Griswold v. Connecticut in which the Court stated that the Bill of Rights amendments, when taken together, create a fundamental right to privacy.5 The Court has protected and expanded this right to privacy and has held that it encompasses all intimate and personal choices that are central to personal dignity and autonomy.6 Similarly, the right to privacy is a fundamental right under Mexico´s Constitution. Article 16 is the principal basis for the right to privacy of information, and it states that the government may not disturb an individual in his person, family or home without a written mandate, or warrant, describing the legal cause for the search.7 Further, Article 16 also declares that private communications are inviolable and requires the government to sanction any act that attempts to violate the liberty or privacy of those communications.8 Accordingly, both countries regard privacy as a fundamental right. The difficulty arises when one attempts to draw the line between what is private information and what is public information.9 The Mexican Supreme Court10 stated in a jurisprudential thesis11 that "to determine what is private life one can turn to the method of exclusion and maintain that private life is that which does not constitute public life".12 However, this definition is vague and offers little guidance in distinguishing private from public. The US Supreme Court has generally interpreted privacy to include matters concerning one´s body,13 family14 and personal, intimate relationships.15 Correspondingly, Mexican courts traditionally interpret privacy as issues regarding personal matters, family and intimate relationships, and medical conditions.16 While the United States and Mexico have struggled with a definition of privacy, the principal purpose of privacy protection is to prevent the disclosure of personal information to the public in order to avoid embarrassing the individual.17 Both the United States and Mexico have extended this protection of privacy to the protection of personal data that the government possesses about individuals by exempting personal information from disclosure in their freedom of information statutes. While the US Freedom of Information Act (FOIA) and Mexico´s Ley Federal de Transparencia y Acceso a la Información Pública Gubernamental (LFTAIPG) (Federal Law on Transparency and Access to Public Government Information) both grant their citizens the expansive right to access public government information, they also create an exception to protect the personal data that the government possesses about its citizens. Although the statutory language of these exceptions is vague, US federal courts have expanded the protection through broad interpretation of the exemption. However, Mexican citizens´ personal information remains unprotected because the statute is not sufficiently specific in how it will protect the personal data that the government possesses about citizens, and the Mexican judiciary has not compensated for this inadequacy by expanding these protections, as was done in the United States. Accordingly, the Mexican Congress should amend LFTAIPG, enact new legislation to specify what personal data are protected and will not be released by the government, or the Supreme Court should prepare a jurisprudential thesis on the issue to expand the law´s protection of personal data. This article will demonstrate Mexico´s need to adequately protect personal data that is in danger of disclosure under the Federal Law on Transparency and Access to Public Government Information statute. It will explain this necessity by comparing the LFTAIPG´s protections of personal data to those of the US Freedom of Information Act. Part II will review the historical background of the LFTAIPG and FOIA and compare the texts of the statutes. Part III will explore how the statutes protect (or fail to protect) personal data from disclosure. Finally, Part IV will set forth solutions as to how Mexico may correct its lack of protection of personal data under LFTAIPG. 2. Background on the US and Mexican Freedom of Information Statutes
The Freedom of Information Act18 was passed into law in 1966. The central purpose of the FOIA was to subject governmental activities to public scrutiny by granting the public the right to access information from government agencies.19 As such, Congress sought to "pierce the veil of administrative secrecy and to open agency action to the light of public scrutiny".20 Further, an informed citizenry is vital to the functioning of a democratic society.21 The public acts as a check against governmental corruption by holding the "governors accountable to the governed".22 Under the statute, a person may request records from government agencies.23 Upon such request for records, the governmental agency must make the files promptly available.24 However, Congress acknowledged that public disclosure is not always in the public interest.25 As such, under the FOIA, the governmental agency may deny the petitioner´s request if it falls under one of the statute´s nine enumerated exemptions.26 These exemptions protect matters such as national security, trade secrets and personal information that the government possesses about its citizens.27 The governmental agency bears the burden of proving that the information sought falls within the exemption that it invokes.28 Because the primary objective of the FOIA is to encourage disclosure, not secrecy, the nine exemptions are exclusive and ought to be narrowly construed.29 Nevertheless, the Supreme Court qualified this by stating that the exemptions must have meaningful reach and application.30 An exemption does not necessarily exempt an entire document or file from disclosure to the public. If a governmental agency deems that only portions of the requested documents are covered by one of the nine exemptions, it must release the document redacted of offending information.31 However, the governmental agency still has the burden of proving that the eliminated portions were properly withheld.32 Because of its system of exemptions and burdens, the FOIA represents a balance between the public´s right to access government information and the government´s interest in protecting confidential data.33
In contrast to the US´ general goal of transparency, Mexico specifically seeks to correct its governmental corruption through its transparency legislation. Mexico´s long history of governmental corruption and repression has caused the Mexican people to distrust their government. Governmental corruption in Mexico began nearly 400 years ago while Mexico was a colony of Spain, as Spanish officials accepted mordidas (bribes) and sold political offices.34 After gaining independence from Spain, corruption continued to plague the Mexican government, especially under the Partido Revolucionario Institucional35 (Institutional Revolutionary Party).36 Technically, the PRI is a political party; however, it dominated Mexican politics through its one-party political system for most of the twentieth century.37 It has been said that "the party is the government and the government is the party".38 The PRI was officially founded in 1946, although its political dominance began in 1929.39 In fact, the PRI´s hand-picked presidential candidate has won every presidential election since 1946, apart from the 2000 election.40 Beginning in the 1940s, the PRI sanctioned and encouraged dummy candidates from minority parties to run in elections in order to provide outward legitimacy for the PRI´s rigidly controlled political system.41 As such, corruption abounded under the PRI´s tight regime, and the PRI has actively repressed those who challenge its authority. Numerous presidents have utilized corruption to wield power and accrue personal financial gain. Initially, President Francisco Madero, elected in 1911, was hailed a hero for rescuing Mexico from the 35-year dictatorship of Porfirio Díaz.42 While Madero began his presidency by preaching freedom of speech and press, his brother exercised actual control by forming a brutal secret police force.43 Beneath the surface of Madero´s ideological declarations, governmental nepotism and corruption flourished.44 Miguel Alemán, the first official PRI presidential candidate, was elected in 1946. Under Alemán, the mordidas within the government rose to stunning new proportions.45 By the end of Alemán´s presidency, corruption was considered the "national ill" that plagued Mexico.46 Governmental corruption steadily rose to epic proportions under the Mexican presidents of the latter half of the twentieth century. President Luis Echeverría, elected in 1970, employed archaic governmental accounting methods that grossly failed to monitor state spending.47 Echeverría used this ineffectual accounting system to his advantage to amass his own personal wealth.48 José López Portillo, Echeverría´s hand-picked successor, followed the latter´s iniquitous example by sending millions of dollars of embezzled funds to California to invest in real estate.49 While the Mexican public reacted with indignation to the outrageous amount of corruption under the López Portillo administration,50 the numerous attempts to bring criminal action against the former president failed.51 Finally, Mexican governmental corruption and avarice reached a heightened level under Carlos Salinas de Gortari, who was elected president in 1988. Salinas´ brother, Raul, was accused by the Swiss government of laundering over US$100 million, which was allegedly acquired through drug trafficking.52 As this brief reprisal of the country´s history demonstrates, corruption has plagued numerous Mexican presidencies, leaving Mexicans with an acute distrust of the government. While corruption has caused Mexicans to distrust their government, active repression has caused some to fear it. Repression by the PRI-dominated government sought to eradicate challenges to its power by repressing and eliminating opponents in elections, violently quashing civic protests and even weeding out dissenters within the PRI.53 While the oppression of adversaries has a considerable history in Mexico, it greatly increased in the later decades of the twentieth century.54 For example, a new political party, the Partido de la Revolución Democratica (Party of the Democratic Revolution)55 emerged following the 1988 elections.56 The PRD was an organizational catalyst for the leftist parties that felt that the PRI was too slow in implementing policy changes.57 While the PRD has provided the PRI with serious competitors in state and local elections, PRD activists have suffered physical abuse and violence at the hands of the PRI-controlled police and government officials.58 The PRI has gone so far as to eliminate those who challenge the party´s domination, even when those perceived challengers have been members of its own ranks. The assassinations of two PRI leaders in 1994 reveal the violent internal struggle over social reforms that racked the party from within. The PRI nominated Luis Donaldo Colosio as its candidate for the 1994 presidential elections.59 Colosio was a populist leader who championed social reform for the poor and indigenous sectors of the population.60 Tragically, Colosio was assassinated on March 23, 1994, while campaigning in Tijuana.61 While Colosio´s murder remains unsolved,62 many suspect that drug traffickers and old-guard conservative PRI henchman conspired to assassinate him, fearing the extensive social reforms he proposed.63 Further, José Francisco Ruiz Massieu, the PRI general secretary, was killed on September 28, 1994, only six months after the Colosio assassination.64 Raul Salinas de Gortari, the brother of former president Carlos Salinas de Gortari, was convicted for ordering the latter assassination.65 These assassinations were perceived to be warnings against rapid social reforms or challenges to the drug trade in Mexico.66 The PRI government has also sought to suppress challenges to its power from the citizenry. The most egregious repression occurred in 1968, when the government utilized military power to quell a protest in Mexico City by opening fire on the civilian demonstrators.67 The protests in Mexico City began on July 22, 1968 as a response to a series of repressive actions committed by the government.68 By August 13 100,000 citizens had gathered in the Zócalo (the main plaza in Mexico City) to protest the administration´s violations of liberties; the government responded by stationing military tanks in the city streets.69 Tensions mounted until October 2 of that same year, when military troops and police opened fire on protestors who had gathered in the Plaza de las Tres Culturas.70 Numerous protestors were arrested or simply "disappeared", and the final number of demonstrators killed is still disputed.71 The government has consistently refused to release any information regarding the incident.72 Moreover, no government official was held politically accountable for the massacre.73 The 1968 massacre is the dividing line in modern Mexican politics.74 While the massacre ended the protest movement, it spurred opposition that eroded the PRI´s support.75 Up until that point, the PRI had enjoyed considerable support from many groups, including the middle classes.76 However, the mass executions spurred a lengthy crisis as Mexicans, including the urban and well-educated, began to challenge the efficacy of a government that practiced brutal violence against college students to maintain its position of authority.77 As a result of the PRI´s domination of the corrupt Mexican political system and violent tactics against civilian opponents, Mexicans grew to greatly distrust the government.78 Consequently, reform in the form of the Federal Law on Transparency and Access to Public Government Information was necessary to augment Mexicans´ trust and confidence in their government.
The Mexican government sought to break with its corrupt past by passing legislation that would grant its citizens access to public government information.79 Although technically a democracy, Mexico has had a more authoritarian than democratic government under the PRI´s regime, since the will of the PRI has dominated politics regardless of the public´s will.80 Furthermore, Mexico has lacked a free, competitive process due to the PRI´s exclusion of other political groups from the political process.81 Most importantly, Mexicans had no access to public information during the 19292000 reign of the PRI.82 Nonetheless, the Mexican government now seeks break with its sordid past and alter its relationship with the Mexican people by moving toward a more democratic government that is accountable to its citizens.83 Moreover, the government aims to decrease official corruption, especially since the Mexican Association of Consumer Defense Studies estimates that corruption costs Mexican consumers the equivalent of 20 per cent of the country´s gross domestic product (GDP).84 Accordingly, Mexican authorities believed it was necessary to draft legislation that would lessen official corruption by making the government accountable to citizens by granting citizens access to government information.
The Mexican Congress attempted to fulfill this objective by passing the Ley Federal de Tranparencia y Acceso a la Información Pública Gubernamental (Federal Law on Transparency and Access to Public Government Information)85 into law on June 12, 2002.86 Under the LFTAIPG, Mexicans can request information from the executive, legislative or judicial branches of the federal government,87 as well as from federal administrative courts and autonomous constitutional agencies.88 The objectives of the act include making the public administration transparent, fostering accountability to citizens and contributing to the democratization of Mexican society and the full application of the rule of law.89 Further, the LFTAIPG requires that governmental bodies must publish, among other items, all relevant information related to the day-to-day functions, budget, operations, personnel, directory, wages, internal reports and the signing of contracts and concessions.90 In addition, the Act grants citizens the right to solicit government information that is not already public through a direct request process.91 Finally, the Act instructs governmental offices and agencies to place a priority on disclosure over secrecy.92
The Act also provided for the creation of the Instituto Federal de Acceso a la Información (Federal Institute for Access to Public Information),93 which is a decentralized agency of the Public Federal Administration that began operating in June 2003.94 The general objectives of the IFAI are to guarantee citizens the right to access public government information, resolve denials of access to information issued by a governmental division and protect personal data held by the government.95 The IFAI is responsible for advancing the right to access information and enforcing and ensuring the application of the law in the Federal Executive Branch.96 The IFAI has the power to enforce compliance because the Act empowers the Institute to carry out functions regarding "settlement and regulation, monitoring and coordination, and the operation and management of promotion and dissemination of activities".97 While the IFAI possesses the authority to ensure that governmental entities comply with requests for information, it also is charged with the duty of safeguarding the confidentiality of personal information that government possesses with regard to its citizens.98 The IFAI provides Mexican citizens with numerous methods through which they may request information from a governmental entity. They can visit an IFAI Service Center, where Institute personnel will assist them in their request.99 Alternatively, they can go to the general office of the government division from which they wish to petition information.100 Finally, they can fill out a request form on the Internet.101 The IFAI also makes a significant contribution to the effectiveness of the LFTAIPG because it may revoke, modify or confirm the decision of a governmental entity regarding a citizen´s petition for access to the information that it holds.102 A petitioner may appeal to the IFAI under the following circumstances: when the entity denies the petitioner´s request for information or informs him or her that such data do not exist; when the petitioner is dissatisfied with the terms or shipping costs; or when the petitioner believes that the information provided by the governmental entity is incomplete or fails to correspond to the data requested.103 The appeal goes before the full committee of the IFAI, which is comprised of five commissioners who have operational, budgetary and decision-making autonomy so they will not be unduly influenced in their decisions by other governmental branches or offices.104 If a petitioner wishes to appeal an IFAI decision, he or she may appeal to the federal courts representing him or herself, through an attorney or through the public defender´s office.105
While the LFTAIPG seeks to encourage the type of government where citizens have free access to information, limits exist as to the scope of the data that can be accessed regarding individuals´ or the government´s confidential information. The LFTAIPG protects personal information that the government has about its citizens by stating that only the individual or his or her representative may request that person´s data.106 Under the LFTAIPG, personal information is defined as all information about the individual, including race, personal or family life, telephone number, health status, religion and sexual preference.107 An individual´s personal information will only be publicly available if he or she consents.108 The LFTAIPG also protects government information that is classified as privileged and confidential. Information is privileged if it could endanger national security; undermine international relations; damage the country´s economic stability; risk the life, health or safety of any person; or seriously harm law enforcement efforts.109 In addition, the LFTAIPG defines the following as privileged information: commercial or fiscal secrets protected by legal provisions, judicial files of a trial that has not concluded, and legal proceedings that are still in progress.110 While the LFTAIPG protects these categories of information from public disclosure, that protection is limited. The Act declares that these types of privileged information may only remain protected for a maximum of 12 years.111 After that deadline has expired, or when the causes for the classification of privilege are not longer valid, the information will be declassified and become available to the public.112 Government agencies may request an extension of the privilege period beyond 12 years if they can provide evidence that the causes for maintaining the classification still exist.113 Nonetheless, the IFAI acts as a check on the protection of privileged information. If a governmental entity denies a petitioner´s request for information on the grounds that such data is privileged, the petitioner may appeal to the IFAI for review of the decision.114 The IFAI must determine whether the denial of access to the information is properly grounded and motivated.115 Finally, no governmental entity may classify any information regarding grave human rights violations and crimes against humanity, such as torture or forced disappearance, as privileged and confidential.116 3. Analysis of the Freedom of Information Statutes
Exemption 6, one of the nine exemptions by which a governmental agency may deny a petitioner´s request for information, protects medical, personnel and similar files, whose disclosure would result in a clearly unwarranted invasion of personal privacy.117 Accordingly, Exemption 6 is intended to protect "individuals from the injury and embarrassment that could result from the unnecessary disclosure of personal information".118 This is an especially important exemption because it protects individuals´ personal data that the government possesses. Federal courts have interpreted this statute broadly to protect numerous individual rights. In fact, the Supreme Court stated that Exemption 6 applies expansively to detailed government records about an individual which can be identified as applicable to that person.119 Furthermore, the Supreme Court has consistently acknowledged that the government must vigilantly protect the disclosure of personal information that it possesses about private citizens.120 Congressional legislative history supports the Supreme Court´s interpretation. Both the Senate and House Reports state an intent that the FOIA provide general exemptions, which were found to be more practical than drafting individual statutes.121 Therefore, Exemption 6 is limited in scope only by the requirement that disclosure must constitute an unwarranted invasion of personal privacy. Federal courts have struggled to define what constitutes a "clearly unwarranted invasion of personal privacy". The Supreme Court defined "privacy" as encompassing "the individual´s control of information concerning his or her person".122 This includes the prosaic, such as place of birth and date of marriage, as well as the intimate and potentially embarrassing.123 Furthermore, the Circuit Court of Appeals for the District of Columbia interpreted the word "clearly´ as a purposeful addition on the part of Congress to instruct courts to tilt the balance in favor of disclosure rather than privacy.124 Accordingly, federal courts utilize these guideline definitions when interpreting the statute. A court must proceed through specific steps in analyzing a governmental agency´s claim that Exemption 6 precludes it from disclosing information. The threshold inquiry is whether the requested information includes medical, personnel or similar files, which the Supreme Court has broadly interpreted to include any data that apply to a particular individual.125 Second, the Court balances the private individual´s interest in protecting the data against the public´s interest in discovering the information.126 The Court must therefore weigh whether the public interest served by disclosure outweighs the invasion of privacy.127 While the privacy interest protected by Exemption 6 includes an individual´s interest in avoiding disclosure of personal matters,128 the public has an interest in understanding governmental activities and operations.129 The privacy interest must constitute a clearly unwarranted invasion of personal privacy in order to outweigh the public´s interest in disclosure.130 Finally, many courts examine whether an alternative means exists by which the petitioner may access the information.131 If such a means exists, the court typically encourages the petitioner to seek the information in that manner so as to protect the individual´s privacy interest.132 Accordingly, the Court must consider these factors in order to determine if the private individual´s interest outweighed the public interest and if the governmental agency properly withheld data under Exemption 6.
While Congress and the Supreme Court have generally defined the parameters of Exemption 6, much of the interpretation of the statute has been left to the federal courts. Although the courts have utilized a straightforward approach in interpreting what constitutes a medical or personnel file, they have broadly interpreted what constitutes a similar file in order to extend protection to a wide range of personal information.
While the statute contains no definition of a "medical file", the courts interpret this term to mean files relating to an individual´s medical history or current state of health.133 For example, in Marzen v. Department of Health and Human Services, 134 the Seventh Circuit ruled that a Down´s syndrome baby´s medical file was protected from disclosure under Exemption 6.135 A public interest group136 sought documents regarding a hospital´s decision to honor the parents´ request to refuse treatment to their baby who suffered from Down´s syndrome and subsequently died.137 However, the court held that the deceased child´s medical records, as well as the conversations between the child´s doctor and parents, were protected from disclosure under Exemption 6.138 The court further stated that petitioner DHHS had failed to establish a nexus between the release of the medical records and the public interest in revealing the hospital and State´s failures to intervene in the parents´ medical treatment decisions regarding their child.139 Since the public interest in disclosure failed to outweigh the deceased baby´s privacy interest, the court held that the information was protected by Exemption 6.140 Similarly, the Ninth Circuit ruled that medical files were protected under Exemption 6 in the case of Bowen v. US Food and Drug Administration. 141 In that case, the petitioner sought governmental documents and records involving cyanide and other poison contaminations of consumer products.142 The court held that the FDA had properly withheld medical records and autopsy reports concerning individuals injured or killed by cyanide-contaminated products because these documents were protected from disclosure by Exemption 6.143 Accordingly, courts typically hold that the individual´s privacy interest with regard to medical files outweighs the public´s interest in disclosure.
Federal courts consistently protect information in governmental personnel files from disclosure through Exemption 6. The Supreme Court declared that personnel files typically contain information such as the birthplace of an individual, his or her parents´ names, school records, where he or she has resided, results of examinations and work performance evaluations.144 For instance, in Office of the Capital Collateral Counsel v. Dep´t of Justice, the Eleventh Circuit protected employee disciplinary proceedings from disclosure and held that documents containing the names of third parties and the personal thoughts and feelings of the assistant US attorney accused of professional misconduct were protected under Exemption 6.145 The Office of Capital Collateral Counsel had requested all records concerning Assistant US Attorney Cox´s disciplinary proceedings and, in response, the Department of Justice (DOJ)146 released the full text of over 1,000 pages and redacted versions of 41 pages.147 The DOJ only withheld five documents, citing Exemption 6.148 The Eleventh Circuit held that the DOJ correctly withheld the documents because Cox´s privacy interest in protecting candid disclosure of her personal thoughts regarding the effect of her misconduct outweighed the public´s interest in disclosure, since Cox´s personal reflections were not relevant to informing the public about the government´s actions, and the DOJ had already released copious amounts of information on the proceedings.149 Further, the Court noted that the privacy interests of the third parties identified in the documents must also be protected.150 Consequently, the employee disciplinary proceedings were protected under Exemption 6. While courts protect many components of the personnel file,151 they nevertheless allow disclosure if they determine that the public interest outweighs the governmental employee´s privacy interest. In Dobronski v. F.C.C., the Ninth Circuit held that personnel records of sick leave taken by agency officials are not protected under Exemption 6 because the public has a right to investigate governmental corruption.152 Here, the petitioner153 received a tip that the assistant bureau chief of the Federal Communications Commission (FCC) Private Radio Bureau had used sick leave for unauthorized paid vacations.154 The court held that the petitioner had a right to the information, as the public interest in uncovering corruption in a governmental agency in the form of abuse of sick leave outweighs the nominal privacy interest that governmental employees have in the dates and times when they take their sick leave.155 As a result, those personnel records were not protected under Exemption 6.
The similar files protection is by far the vaguest portion of Exemption 6, and courts have broadly interpreted this phrase. In searching for a definition of "similar files", the Fourth Circuit stated that "similar files, in order to qualify under the exemption, must fit the additional qualifications set forth in the exemption, i.e., they must contain information the disclosure of which would constitute a clearly unwarranted invasion of personal privacy".156 Alternatively, the Seventh Circuit stated that when a file is neither a medical nor personnel file, then the threshold test to determine if Exemption 6 applies is whether the records at issue are similar files.157 Accordingly, it is only then that the court must examine whether disclosure would cause a "clearly unwarranted invasion of privacy".158 Finally, the Third Circuit declared that the common denominator in medical, personnel and similar files is the "personal quality of the information in the file, the disclosure of which may constitute a clearly unwarranted invasion of personal privacy".159 While these clarifications are helpful, neither the Supreme Court nor Congress has established a clear-cut definition for what constitutes a similar file. As such, the interpretation of this nebulous term has fallen to the federal courts that, in turn, interpret the term on a case-by-case basis. While similar files constitute a broad category, the most important protection under similar files is the prevention of release of information to parties with commercial interests. The courts have been especially protective of individuals´ personal information when the petitioner seeks the information for commercial purposes. For example, in Multnomah County v. Scott, petitioner Health Care Financing Administration sought the names and addresses of Medicare beneficiaries in the Portland area.160 The court used the Minnis v. Dep´t of Agriculture four-prong balancing test, which requires the court to balance the following factors: (1) the plaintiff´s interest in disclosure, (2) the public interest in disclosure, (3) the degree of invasion of personal privacy and (4) the availability of alternative means of obtaining the request information.161 The court concluded that the individuals had a privacy interest in their age and disability status.162 As such, the disclosure of individuals´ names and addresses constituted more than a minimal privacy interest.163 Furthermore, the court held that a commercial interest fails to warrant disclosure of otherwise private information under the FOIA, since it fails to promote the public interest of disclosure of information about governmental agencies as enumerated by Congress.164 While the petitioner claimed that it merely sought the information to educate Medicare beneficiaries on recent legislation changes, the court concluded that its interest was primarily commercial.165 The court therefore held that the information was protected as a similar file under Exemption 6. Similarly, in Painting Industry of Hawaii Market Recovery Fund v. United States Department of Air Force the court protected individuals´ privacy interests through redaction because the petitioner labor union sought the information to use it for commercial purposes. The petitioner sought payroll information provided to the Air Force by a private contractor working on a federally funded construction project.166 The court allowed the release of the payroll records, provided that the names, addresses and social security numbers were redacted.167 The court held that the workers had a substantial privacy interest in the information that connected their names and addresses to payroll figures, especially since a substantial probability existed that disclosure of the list would lead to its use by marketers who would invade the workers´ right to be free from solicitation.168 Further, the court chided the petitioner by stating that the FOIA only recognizes the public´s interest in acquiring knowledge regarding the actions of its government; it is not a method to obtain information regarding private individuals that the government possesses.169 In addition, the court stated that the petitioner had alternative means of obtaining the desired information by personally interviewing the workers.170 Accordingly, the court denied the petitioner´s request since it suspected that the petitioner would utilize it for commercial purposes.
While Congress was overly vague in composing the statutory language "medical, personnel, or other similar files", the Supreme Court and other federal courts have correctly and meticulously filled in the gaps in the legislation by interpreting those definitions broadly to amply protect the personal data that the government possesses. Without the courts´ consistently expansive interpretation of Exemption 6 protection, Congress would have wrongly exposed individuals´ information to disclosure, since the statute by and large fails to adequately protect such data. However, the courts have scrupulously limited the government to prevent it from releasing an extensive range of information that it possesses. As the courts acknowledge, the FOIA should not be used as a method to acquire personal, private information about individuals. Rather, the government should protect the intimate details of individuals´ lives from disclosure. This protection is especially vital, as personal information, such as names, telephone numbers and addresses, has become a valuable commodity that many are willing to purchase. Consequently, the US federal government sufficiently protects individuals´ personal information that the government possesses through Exemption 6.
LFTAIPG is in its infancy as compared to the FOIA, since the Mexican Congress only passed the LFTAIPG into law on June 11, 2002, and it entered into effect on June 12, 2003.171 As a result, the Mexican government is still perfecting the law. To date, the Supreme Court has not issued any opinions or jurisprudential theses on the interpretation of the personal data exception from the right to access information.172 Absent judicial interpretation, one must first examine the statutory language and secondly scrutinize other legal sources, such as the Constitution, treaties and legal scholars´ hypotheses, that may shed light on how courts and the IFAI will interpret this exception.
One of the objectives enumerated in the LFTAIPG is to "guarantee the protection of personal data in the custody of government bodies subject to the law".173 The LFTAIPG seeks to fulfill this objective by including personal data as one of the exemptions to government information that citizens may request from the government, because personal data is confidential.174 The statute defines personal data as: The information concerning an individual, identified or identifiable, including that concerning his or her ethnic or racial origin, or referring to his or her physical, moral or emotional characteristics, his or her sentimental and family life, domicile, telephone number, patrimony, ideology and political opinions, religious or philosophical beliefs or convictions, his or her physical or mental state of health, his or her sexual preferences, or any similar information that might affect his or her privacy.175 Under the statute, personal data is confidential, and the "owner" or "holder" of the personal data (the person who the data concern) must consent before the government may disclose, distribute, or commercialize the information.176 Further, confidential information, such as personal data, remains confidential indefinitely, unless the holder of such information expressly writes to consent to its release.177 The governmental agencies must train their personnel regarding when it is appropriate to use or release personal data.178 Further, the agencies must develop and adopt policies to guarantee the security of personal data in order to avoid their unauthorized conveyance or access.179 Nonetheless, governmental agencies have a free rein to release personal data without the permission of the owner of the personal information under certain circumstances. Personal information in public registries or sources that are publicly available is not confidential and thus may be disclosed.180 In addition, information needed for statistical or scientific purposes, information transferred between governmental agencies or information issued upon a court order may be released by the government without the individual´s permission.181 Finally, the government may release personal data to third parties when it hires such third parties and they need the personal data to perform their duties.182
The LFTAIPG critically fails to protect individuals´ personal data from wrongful governmental disclosure. While the law states that it guarantees the protection of individuals´ rights regarding privacy, intimacy and access to their personal information,183 the law´s exceptions to personal data protections leave the data dangerously vulnerable to easy disclosure, which would in turn violate individuals´ rights to privacy. First, the law deems that information in public registries is not confidential. However, the law fails to define what constitutes a "public registry". While the legislation vows to protect individuals´ personal data, which the law defines to include one´s name, address and telephone number, these exact pieces of information are typically included in a public registry. Although some public information regarding individuals actually should be considered public information, the Mexican Congress should amend the LFTAIPG to add a definition of what constitutes a public registry, so that this term may be narrowly interpreted to protect individuals´ privacy of personal data. This is an especially vital issue in Mexico due to its recent history. Prior to the enactment of the LFTAIPG, the Mexican government sold millions of individuals´ confidential information from the federal voter registration list, the National Motor Vehicle Registry and the list of drivers´ licenses to US companies such as Choicepoint.184 Choicepoint is an entity that serves as an online market to sell individual´s personal information185 to other companies and to other governmental agencies, such as the US Immigration and Naturalization Service.186 Public outrage erupted when the Reforma, one of the major newspapers in Mexico City, published a front-page exposé detailing the Mexican government´s actions.187 While no citizens have initiated lawsuits against the government, many Mexicans believe that the government ought to be held responsible for this institutional negligence and pay financial indemnities to the individuals whose confidential information was sold.188 Moreover, numerous citizens posit that the National Human Rights Commission ought to investigate the incident in order to signal to the federal executive branch of government that the culpable agencies and parties ought to be brought to justice.189 This is especially vital in order to validate the LFTAIPG and to demonstrate that the government will not tolerate or sanction agencies´ release of individuals´ confidential, personal information. The law also makes vulnerable personal information by permitting the release of personal data for statistical or scientific purposes or to third parties hired by the government who need the information to perform the services for which they were contracted.190 While these provisions may sound logical, they put personal data at risk. The LFTAIPG leaves these exceptions to personal data protection completely unregulated and does not impose any sanctions or negative consequences should one of these groups wrongfully release individuals´ personal data that have been entrusted to them. Accordingly, Mexican Congress should amend the LFTAIPG to limit these exceptions to personal data protection and also should impose criminal penalties against anyone who wrongfully releases these data. The statutory language of the LFTAIPG defines personal data and guarantees governmental protection. However, the exceptions to these protections are overly vague and allow for gaps that could easily permit the wrongful release of personal data. Moreover, the LFTAIPG fails to impose criminal penalties against persons who wrongfully release such data. As a result, the law fails to adequately protect personal data and Congress must amend the law to limit the exceptions and to criminalize a wrongful release of information to deter such occurrences. Protection of Personal Data under the Mexican Constitution While the LFTAIPG does not sufficiently guard against the release of personal data held by the government, it could be argued that this protection is provided through the Mexican Constitution. The Mexican Constitution protects the right to privacy. Specifically, Article 7 protects the individual´s right to privacy.191 In addition, Article 16 is the fundamental basis for the right to privacy of information in Mexico. It states that the government may not disturb an individual in his person, family or home without a written mandate, or warrant, describing the legal cause for the search.192 Further, Article 16 also declares that private communications are inviolable and requires that the government sanction any act that attempts to violate the liberty or privacy of these communications.193 While an exemption exists to this right, since a federal judicial authority may authorize the intervention of a private communication, the government´s intervention is limited since it must enumerate the legal causes for the request, the type of intrusion, the subject of the information and the duration of the intrusion.194 Moreover, the federal judicial authority may not grant a request to intercept a private communication if it concerns electoral, fiscal, business, civil, labor or administrative information, or attorney-client communications.195 Although the Constitution protects citizens´ rights to privacy of the home and secrecy of information and communications, it does not adequately fill in the gaps in protection that the LFTAIPG leaves with regard to personal data. While Article 16 generally protects the privacy of communications, it fails to explicitly extend this protection to the modern notion of personal data.196 Accordingly, the Constitution would have to be amended to stipulate the protection of personal data since it would be a stretch in interpretation if the courts were to grant this protection under Articles 7 or 16.197 Consequently, the Constitution fails to protect individual´s personal data from disclosure by the government.
The United States´ and Mexico´s freedom of information laws are similar in that they seek to open up their governments to public scrutiny while protecting the personal data that they possess about their citizens. While both statutes´ protections of personal data are vague and incomplete, the United States has compensated for its lack of protection through the federal courts. The courts have expansively interpreted the minimal FOIA language that bans the release of "medical, personnel or similar files" in order to protect a wide range of information that the US government possesses regarding its citizens. Federal courts have been especially meticulous in their protection of personal information when they believe that the petitioner seeks such information for commercial purposes.198 In this age of information technology, personal data is a commodity, which puts it at a greater risk of disclosure, since many companies have a financial interest in it. However, while it is legal for such companies to acquire this information, the government should not be allowed to be their source. Mexico´s LFTAIPG better defines what constitutes personal data,199 but it provides so many exceptions to the protection that it leaves almost all personal data that it is supposed to protect vulnerable to disclosure. The exceptions for information in public registries, a term undefined and unlimited by the statute, and the concession of releasing personal data for statistical or scientific purposes or to third parties leave the door wide open for governmental agencies to negligently or intentionally release confidential information. Since the law has only been in effect for a year, the Supreme Court and the federal courts have not ruled on any personal data cases, nor have they issued any jurisprudential theses that further interpret the law.200 Consequently, the US government adequately protects personal data that the government possesses through a joint effort of Congress´ enactment of the FOIA and the federal courts´ broad interpretation of the statute´s protections of personal information. However, the Mexican government does not sufficiently protect individuals´ personal data because the law provides extensive exceptions to the protections, and the federal courts have not yet stepped in to protect the right through judicial interpretation. 4. How the LFTAIPG Can be Improved to Protect Personal Data The Mexican government has several options on how to amend the gap in protections of personal data in the LFTAIPG. These options include: the Supreme Court issuing a jurisprudential thesis, allowing individuals to sue the government for the wrongful release of their personal data, amending the LFTAIPG or enacting new legislation.
The Supreme Court could issue a jurisprudential thesis interpreting the LFTAIPG and greatly limiting the exceptions that the law provides to personal data protection. A jurisprudential thesis (tesis jurisprudencial) by the Supreme Court is binding on itself and all lower courts and occurs after five interrupted and consecutive decisions that sustain the same legal opinion.201 Accordingly, after the Supreme Court ruled consistently in five cases to limit the exceptions to personal data protection, the high court would issue a jurisprudential thesis that would be binding on all courts and would universally protect this right. While the Mexican legal system typically does not allow judicial legislation,202 the jurisprudential thesis is the exception to this rule. Thus, the Supreme Court could narrowly interpret the exception to extend protection of personal data.
The Mexican Congress could create a cause of action so that an individual may sue the government if it wrongly releases his or her confidential information. This would provide a check on the governmental agencies so that they will endure consequences if they wrongly release confidential information, as in the CheckPoint debacle. Moreover, given Mexico´s history of governmental corruption, an additional check on the authorities would empower citizens to have more influence over their government. Congress could utilize the IFAI to handle these claims, and, as in cases of requests for information, the petitioner would be able to appeal the IFAI´s decision in court. However, granting this cause of action could also lead to endless litigation and a heavy strain on judicial resources. It may not be necessary for Congress to create a cause of action because individuals could file suit against the government for Juicio de Amparo (federal suit for constitutional relief).203 The Juicio de Amparo is a federal suit filed by an individual against the government for a violation of the person´s constitutional rights.204 Article 103 of the Constitution states that the objective of the Juicio de Amparo is to resolve any controversy that arises: I. From laws or acts of an authority that violate individual guarantees; II. From laws or courts of a federal authority that infringe or restrict the sovereignty of the states; and, III. From laws or acts of the state authorities that invade the sphere of federal authority.205 However, the legal effects of the court´s ruling in a Juicio de Amparo only apply to the plaintiff in the suit and to no one else.206 As a result, a court´s declaration that a law is unconstitutional only affects the injured individual; it is not a general declaration that applies universally.207 With regard to the LFTAIPG, individuals could file a Juicio de Amparo by claiming that their Article 16208 right to privacy of information was violated by the wrongful release of personal data by the government. Nonetheless, even if the court ruled that the individual´s constitutional right had been violated by the release of the personal data, this decision would not affect the LFTAIPG´s current stance on the exceptions to personal data protection.
The Mexican Congress could amend the LFTAIPG or enact new legislation to protect personal data. If Congress amended the LFTAIPG, it would need to greatly limit the loopholes in protection caused by the exceptions in order to guard the personal data held by the government. It would need to define the term "public registry" to resolve the ambiguity of the term and to prevent the wrongful release of confidential information. This would prevent the occurrence of another development such as the ChoicePoint incident. In addition, while it may be acceptable for the LFTAIPG to allow for the release of confidential information for statistical or scientific purposes or to third parties contracted by the government, Congress must greatly limit those agencies´ abilities to use that information and provide for criminal actions against any member of such agencies who wrongfully discloses personal data. While amending the statute only a year after its enactment could diminish its credibility, these necessary changes would significantly alleviate the potential problems in the legislation.
Alternatively, Congress could enact new legislation in order to protect personal data. In fact, a bill entitled Iniciativa de Ley de Protección de Datos Personales (Personal Data Protection Bill) has been proposed in Congress.209 The purpose of the bill is to protect the honor and privacy of personal data.210 This bill would criminalize the collection and creation of databases of individuals´ personal information, where the individuals have not consented to the release of such data.211 It would impose strict penalties on those who violate the law, including suspension of operations, fines and/or cancellation of the database.212 In addition, this bill would create the Instituto Federal de Protección de Datos Personales (Federal Institute for Personal Data Protection), which would be a federal administrative agency.213 Individuals would be able to obtain information from the Institute regarding which archives, registries or personal databases contained the individual´s personal data.214 Also, the Institute would dictate protection and security standards for protecting personal data contained in databases, impose administrative sanctions for violators of the law and present lawsuits for violations of the law.215 This bill is the best solution to the problems presented in the LFTAIPG because it would fill in the gaps in the legislation´s personal data protections. Further, the bill would limit the LFTAIPG´s exceptions, since it criminalizes the wrongful release of personal data from databases and imposes severe penalties. The only issue with the bill is that it seems exclusively to apply to private businesses that possess databases of individuals´ personal information; it is unclear whether this would also be enforceable against government agencies. If it does not apply to government agencies, the bill should be amended to include criminal sanctions against governmental employees who wrongfully release individuals´ personal data. 5. Conclusion Mexico has attempted to break with its government´s corrupt past by enacting the Federal Law on Transparency and Access to Public Government information. This legislation grants citizens the right to access public government information in order to promote an open relationship between the government and its people. However, while governmental transparency is a noble pursuit, authorities must also protect individuals´ personal information that are in their possession. While the US federal courts have filled in the gaps in protection of personal data under the FOIA, Mexicans´ personal information under the LFTAIPG remains vulnerable to wrongful disclosure because the exceptions to personal data protection are too broad under the statute. As a result, the Mexican government must take one of the following steps to redress this lack of protection: the Supreme Court must issue a jurisprudential thesis narrowly interpreting the exceptions under the LFTAIPG; Congress must create a cause of action or allow citizens to sue the government under the Juicio de Amparo; Congress must amend the LFTAIPG to narrow the exceptions; or Congress must pass new legislation, such as the Ley de Protección de Datos Personales that protects personal data from disclosure. The Ley de Protección de Datos Personales is the best solution, provided that it is also enforceable against governmental employees, because it would afford the most protection of individuals´ personal data. It is commendable that Mexico seeks to foster governmental transparency; however, it must balance that objective by adequately protecting individuals´ personal information. Notes:
|
|
Derechos Reservados, (C)2011 IIJ-UNAM |
|
