Data as Records: PRA Disclosure of Database Information

One of the more seemingly complex public records request types are those that seek information held within a database. There are several questions we are often asked, and I hope my answers below will assist in unraveling this digital conundrum.

Treating Data As a Public Record

Are databases even public records at all?

First, let us agree on a few terms. A database is an organized collection of data stored and accessed electronically. In turn, data or datum, are the individual pieces of information stored within the database.

A database management system (DMS) is the visual interface that organizes the data, translates the data from zeros and ones, and allows users to access and view the data in a manner they can understand. A DMS can be incredibly sophisticated, with multiple databases of information and the ability to link, manipulate, and analyze data, or it can be a simple Excel spreadsheet. Both are database management systems.

What would be the analog version? For those of a certain age, a database management system is roughly the same as a library card catalog. Each card is a piece of data, all the cards together are the database, and the cabinet that keeps everything organized, cross-referenced, and accessible to library patrons is the DMS. Without the cabinet, you’d be faced with a pile of cards and no way to find what you are looking for.

Let us apply this analogy now to the Public Records Act, Chapter 42.56 RCW (PRA). The PRA defines a “public record” as:

any writing containing information relating to the conduct of government or the performance of any governmental or proprietary function prepared, owned, used, or retained by any state or local agency regardless of physical form or characteristics. 

Each of those cards in the card catalogue is a writing that contains information, and it happens to be in paper form. For databases, each piece of data in the DMS is a writing that contains information, and it happens to be in digital form.

So, if that piece of data in the database pertains to the conduct of government and it was prepared, owned, used, or retained by the local agency, then, yes, it is a public record. But it is the data itself, and not the database management system, that is the public record.

How do you disclose data in a database?

Under the PRA, we are obligated to disclose the data in the database but not necessarily to provide unfettered access to that data. At the same time, we cannot somehow turn over a bunch of zeros and ones and think that we have met our obligations under the PRA — we must provide the data in a form that the requestor can actually read.

There are several ways to do this. Some jurisdictions simply provide public access to the relevant DMS, although access is limited to view only. Examples of this include a county assessor’s property tax database, a city’s planning and development permit records online portal, or a clerk’s website that posts all the council’s agendas and meeting minutes.

However, in many situations, the DMS is a part of a public employee’s daily workflow, one which is constantly being updated with new activities and may contain information that is subject to an exemption or prohibition against disclosure such that is inappropriate to provide the public with unfettered access.

If you are lucky, your DMS allows you to run reports that extract the responsive data and present it in a form that you are then able to provide to the requestor. Alternatively, you have to consider providing customized access to the database that will limit the requestor’s access to only the data they are entitled to.

Creating or Running Reports to Disclose Data

Isn’t running a report creating a new record?

We do consider the results of extracting data from a database into a new spreadsheet or word document to be the creation of a new record that is itself fully subject to the PRA. But sometimes, especially when it comes to databases which you often cannot provide unrestricted public access to, that approach makes the most practical sense.

Creation of a new record is not addressed in the Public Records Act, but there is case law that states agencies are not under an obligation to create records for a requestor. See Citizens For Fair Share v. State Dep't of Corrections, 117 Wn. App. 411, 435, 72 P.3d 206, 219 (2003) ("the law does not require creation of nonexistent records in response to a public records disclosure request”).

The Attorney General PRA Model Rule (WAC 44-14-04003(6)) states that an agency has discretion whether to create a public record:

. . . The decision to create a new record is left to the discretion of the agency. With respect to databases, for example, there is not always a simple dichotomy between producing an existing record and creating a new record. In addition, an agency may decide to provide a customized service and if so, assess a customized service charge for the actual costs of staff technology expertise needed to prepare data compilations, or when such customized access services are not used by the agency for other business purposes. RCW 42.56.120.

If the agency is considering creating a new record instead of disclosing the underlying records, or creating new records from a database, it should obtain the consent of the requestor to ensure that the requestor is not actually seeking the underlying records, and describe any customized service charges that may apply.

According to RCW 42.56.100, your agency must provide the “fullest assistance” to inquirers requesting public records, but this does not mean your agency must create a new record upon request. That being said, if your database is itself a compilation of independent records, such as scanned and uploaded records, I would consider the downloading of a previously scanned record akin to making a copy and not generating a new record.

What if our DMS is not set up to allow for the extraction of data, such as to run reports?

You may need to get creative. One brute force method is to take screenshots of the DMS displaying the requested information, although this would not work if the requestor is seeking the data in its native format, nor would it work for a visually impaired requestor. Your other option is to consider providing customized access.

What is customized access, and can we charge for that?

In addition to the regular copying charges that an agency can impose under RCW 42.56.120, paragraph (3) allows an agency to include a “customized service charge.”

A customized service charge may only be imposed if the agency estimates that the request would require the use of information technology expertise to prepare data compilations, or provide customized electronic access services when such compilations and customized access services are not used by the agency for other agency purposes.

Examples may include working with your software developer or IT staff to run a new, customized report that extracts data from the database, developing a new user interface that has restricted functionality, or purchasing a new user software license to allow the requestor direct access.

Other Ways Data is Disclosed

What if we don’t control the database or database management system?

A record is a public record if it is “prepared, owned, used, OR retained” by the public agency, so even if the agency no longer has control of the record — i.e., did not “retain” the record — if the agency created the record or used the record in the course of public business, it is a public record subject to disclosure.

I am aware of several situations where local agencies access and/or upload information to databases controlled by other private or public entities. Regardless of where that data now lives, local agencies are obligated to make it available to the public upon request. It is not enough to simply direct requestors to the third party.

Any agency that uses third-party databases should review the contract or terms of service for those databases to ensure that the agency has a process for requesting copies of records contained in the database from the vendor.

We received a PRA request for a record that is already available on a publicly accessible database online. Can we simply direct the requestor to search on the public website?

No. While many agencies make records available online in the hope that members of the public will be able to self-serve and access the records they seek without submitting a records request, once an individual does submit a request, all of an agency’s obligations under the PRA come into effect.

In describing the specific methods by which an agency can respond to a public records request, RCW 42.56.520(1)(b) authorizes the agency to provide “an internet address and link on the agency’s website to the specific records requested.” (Emphasis added). Providing a link to a database that requires the requestor perform the search themselves does not satisfy this obligation. Of course, an agency can inform the requestor that, in the future, they can search the public database themselves and avoid any delay in receiving a response.

Wow, it can get pretty complicated. What if we need more guidance?

You are not alone! MRSC has lots of information available on our Public Records Act topic pages. If your question is not addressed there or you wish to contact one of our consultants directly, eligible government agencies can Ask MRSC.