Privacy & Cybersecurity Law Report – From the Courts

A number of courts recently have considered issues relating to individuals’ privacy, the First Amendment, and the public’s right to know. Here, Jay D. Kenigsberg reviews and examines several notable decisions involving these subjects.

Montana Supreme Court Reverses Order to Release College Student’s Educational Records

The Supreme Court of Montana[1] has reversed a trial court’s decision ordering the state’s education commissioner to release the educational records of a student at the University of Montana, concluding that the student’s right to privacy in those records “clearly” exceeded the merits of their public disclosure.

The Case

In January 2014, Jon Krakauer, a writer who chronicled instances of alleged sexual misconduct on or near the University of Montana campus, submitted a request to Clayton Christian, Montana’s commissioner of higher education, for the release of the educational records relating to a person referred to in the court’s decision as John Doe.

The commissioner refused to release the records, asserting that state and federal law prevented him from doing so.

Krakauer then filed a lawsuit asserting that the commissioner had wrongly denied him access to Doe’s records, citing the right to know under the Montana constitution.

The trial court granted summary judgment to Krakauer and ordered the commissioner to release Doe’s educational records.

The commissioner appealed and the Supreme Court of Montana[2] reversed and remanded the case to the trial court to conduct an in-camera review of Doe’s records with the following instructions:

• Determine whether there was an adverse final ruling against Doe during his student disciplinary proceedings that would have allowed for the release of certain, limited information as an exception to the general prohibition against the release of educational records under the Family Educational Rights and Privacy Act of 1974, as amended (“FERPA”);[3]
• Factor the enhanced privacy interests of students into the analysis of whether the Montana constitution[4] permitted disclosing Doe’s educational records; and
• Determine whether the potential for redacting Doe’s personally identifying information affected the privacy analysis and the ultimate determination about what records, if any, could be released.

The trial court subsequently ordered the commissioner to release Doe’s records, and the dispute again reached the Montana Supreme Court.

The Montana Supreme Court’s Decision

The court reversed the trial court’s order to the commissioner to disclose Doe’s educational records.

In its decision, the court explained that it has recognized “a constitutional presumption that all documents of every kind in the hands of public officials are amenable to inspection.”[5] The court added, however, that the right to know was not “absolute” and that it could be overcome “when the demands of individual privacy clearly exceed the merits of public disclosure.”

The court then observed that the Montana constitution provided for an individual’s right to privacy,[6] but that the right to privacy also was not absolute and could be infringed upon with the showing of a compelling state interest.

The court added that when these “competing constitutional rights” conflicted, it had to determine whether an individual privacy interest existed and, if so, it then had to “balance the competing constitutional interests in the context of the facts of each case” to determine whether the demands of individual privacy “clearly” exceeded the merits of public disclosure. 

According to the court, the right to know “may outweigh the right of individual privacy, depending on the facts.”

The court then found that Doe had an actual expectation of privacy in his educational records and that he did not have notice of possible public disclosure of those records. Among other things, the court noted that Montana law permitted the public release of educational records only through a student’s written permission or through a court subpoena[7] and that FERPA limited the non-consensual public release of educational records to a few exceptions.[8] Moreover, the court continued, the University of Montana student conduct code also guaranteed all students a right to confidentiality with respect to disciplinary proceedings.

Next, the court ruled that Doe’s expectation of privacy in his educational records was reasonable. It found that even as a “high-profile student-athlete who enjoyed a position of prominence and popularity” and who received “valuable consideration for his skills in the form of an athletic scholarship,” Doe was not a public official but a student who was “entitled to an enhanced privacy interest in his educational records.”

The court then decided that the public’s Article II, Section 9, right to know the information contained in Doe’s records was “weighty”; that the records were documents “in the hands of public officials” and, accordingly, there existed a constitutional presumption that the records were amenable to public inspection; and that there was a “strong public interest” in knowing how universities addressed allegations of sexual assault.

Finally, the court also determined that Doe’s Article II, Section 10, right of privacy in his records also was “weighty.” It then concluded, after reviewing Doe’s educational records, that Doe’s demand for individual privacy in them “clearly” exceeded the merits of their public disclosure.

Court Rejects Privacy Claim Over Public Posting of Administrative Decision

The U.S. District Court for the Southern District of New York has dismissed a lawsuit alleging that an administrative decision that was posted on the internet violated the privacy rights of the individual involved in the dispute.[9]

The Case

Zinoviy Levitant’s lawsuit asserted a claim for violation of his right to privacy against the New York City Office of Administrative Trials and Hearings (“OATH”), Administrative Law Judge Tynia Richards (“ALJ Richards”), and Chief Administrative Law Judge Roberto Velez (“Chief ALJ Velez”). The lawsuit also asserted a claim for municipal liability against the city and OATH. In particular, Levitant alleged a violation of his due process rights pursuant to the Fourteenth Amendment, brought through an action under 42 U.S.C. § 1983.

Levitant’s lawsuit arose out of an OATH disciplinary proceeding brought by his former employer, the New York City Human Resources Administration (“HRA”), which resulted in the termination of his employment.

ALJ Richards conducted the OATH hearing, concluded that Levitant had committed at least 15 acts of misconduct, and recommended that Levitant be terminated from HRA.

ALJ Richards’ OATH decision, which discussed Levitant’s workers’ compensation claims and related medical examinations, was “publicly issued” and accessible to the public on OATH’s website.

Levitant alleged that the defendants violated his constitutional due process right to privacy by disclosing, and by continuing to disclose, the OATH decision and failing to seal the underlying administrative record and transcript, which contained information about his health, work record, and workers’ compensation claim. He sought damages of $5,000,000 against OATH, ALJ Richards, and Chief ALJ Velez, and additional damages of $5,000,000 against the city and OATH.

The defendants moved to dismiss.

The Court’s Decision

The court decided that Levitant’s action should be dismissed.

In its decision, the court explained that Levitant alleged a violation of his right to privacy by public disclosure of his medical and workers’ compensation information in the OATH decision and the underlying administrative record.

In the court’s view, these allegations did not sustain Levitant’s assertion of a constitutional claim, whether asserted against the individual defendants or as a claim against the municipal defendants pursuant to Monell v. Department of Social Services.[10]

The court was not persuaded by Levitant’s argument that the defendants’ public disclosure of his medical conditions and records violated his constitutional right to privacy, finding that he failed to plead “any serious or stigmatizing medical condition that was sufficient to implicate a constitutional violation.”

The court observed that, in the U.S. Court of Appeals for the Second Circuit, the right to privacy with respect to one’s medical records was “something less than a fundamental right.”[11] Rather, the court continued, it was a “qualified or conditional right” that existed only when the individual’s interest in maintaining that confidentiality was “not outweighed by the government’s interest in having or using the information.”[12]

Moreover, the court said, courts have extended the right of privacy to only a “very limited set of medical conditions, such as one’s HIV status, transsexualism, psychiatric health, substance-abuse history, and details of a sexual assault.” Beyond these circumstances, it noted, “courts have declined to recognize a constitutional right of privacy.”[13]

Accordingly, the court concluded that the medical information allegedly disclosed through the OATH decision did not include reference to any of the conditions for which a constitutional right to privacy attached.

The court reached the same result with respect to Levitant’s assertion that his privacy rights were violated because the public knows that he filed a claim for workers’ compensation. Levitant argued that that could “lead to retaliatory consequences, or a have a chilling effect on future employment” and that the reference to his fitness for duty “may lead to the stigmatizing conclusion that because he did not return to work[] when told to do so, he could be characterized as a malingerer[.]”

The court declared that these findings did “not implicate any privacy right sufficient to invoke the protection of the Constitution’s Due Process Clause.” It found no authority for the proposition that release of information about workers’ compensation status and claims might implicate a constitutional right to privacy.

The court also rejected Levitant’s contention that his privacy claim could be based on the New York law that governs confidentiality of workers’ compensation records.[14] According to the court, even assuming that the defendants had violated that state law, a violation of state law was not cognizable under Section 1983.

In summary, the court ruled that Levitant failed to assert any constitutionally cognizable privacy interest in the information disclosed by the OATH decision or made available in the public record, and it concluded that his claims against OATH, ALJ Richards, and Chief ALJ Velez should be dismissed.

The court also decided that Levitant’s damages claims against the city and OATH based on the theory of municipal liability also failed to state an actionable claim.

Under Monell, the court explained, local governing bodies can be held liable under Section 1983 where the action alleged to be unconstitutional implemented or executed “a policy statement, ordinance, regulation, or decision officially adopted and promulgated by that body’s officers.” The court noted, however, that liability under Monell was not available where the plaintiff had not suffered a deprivation of a constitutional right.

Because Levitant failed to state a constitutional injury to his right to privacy, the court concluded, his Monell claim against the city and OATH had to be dismissed.

Second Circuit Explains Standard for Sealing Court Documents

The U.S. Court of Appeals for the Second Circuit has issued a decision explaining when documents filed in court may be sealed, and when they must be open to the public.[15]

The Case

On June 30, 2008, financier Jeffrey Epstein pleaded guilty to Florida state charges of soliciting, and procuring a person under the age of 18 for, prostitution. The charges stemmed from sexual activity with privately hired “masseuses,” some of whom were under 18, Florida’s age of consent. Pursuant to an agreement with state and federal prosecutors, Epstein pleaded to the state charges. He received limited jail time, registered as a sex offender, and agreed to pay compensation to his victims. In return, prosecutors declined to bring federal charges.

Shortly after Epstein entered his plea, two of his victims, proceeding as “Jane Doe 1” and “Jane Doe 2,” filed suit against the government in the U.S. District Court for the Southern District of Florida under the federal Crime Victims’ Rights Act (“CVRA”). The victims sought to nullify the plea agreement, alleging that the government failed to fulfill its legal obligations to inform and consult with them in the process leading up to Epstein’s plea deal. (On February 21, 2019, the district court ruled that federal prosecutors had violated the CVRA by failing to adequately notify the two victims-plaintiffs of the plea deal.)[16]

On December 30, 2014, two additional unnamed victims – one of whom subsequently self-identified as Virginia Giuffre – petitioned to join in the CVRA case. These petitioners included in their filings not only descriptions of sexual abuse by Epstein but also new allegations of sexual abuse by several other prominent individuals, “including numerous prominent American politicians, powerful business executives, foreign presidents, a well-known Prime Minister, and other world leaders,” as well as Alan M. Dershowitz (a long-time member of the Harvard Law School faculty who had worked on Epstein’s legal defense) and Ghislaine Maxwell.

Dershowitz moved to intervene, seeking to “strike the outrageous and impertinent allegations made against him and to request a show cause order to the attorneys that have made them.”[17] Exercising its authority to “strike from a pleading an insufficient defense or any redundant, immaterial, impertinent, or scandalous matter . . . on its own,”[18] the district court sua sponte struck all allegations against additional parties from the pleadings, including those against Dershowitz, and therefore denied Dershowitz’s motion as moot.

The stricken allegations, however, found their way into the press and several media outlets published articles repeating Giuffre’s accusations. In response to the allegations, Maxwell’s publicist issued a press statement declaring that Giuffre’s allegations against Maxwell were untrue and that her “claims are obvious lies.”

Thereafter, Giuffre sued Maxwell in the U.S. District Court for the Southern District of New York. Giuffre alleged that Maxwell had defamed her through this and other public statements.

The district court entered a sealing order that effectively ceded control of the sealing process to the parties themselves. The sealing order disposed of the requirement that the parties file individual letter briefs to request sealing and prospectively granted all of the parties’ future sealing requests. In total, 167 documents – nearly one-fifth of the docket – were filed under seal.

On May 24, 2017, Maxwell and Giuffre executed a settlement agreement, and the case was closed the next day.

Over the course of the litigation or soon after it settled, three outside parties attempted to unseal some or all of the sealed material:

• Dershowitz moved to intervene, seeking to unseal three documents that, he argued, demonstrated that Giuffre had invented the accusations against him;
• Michael Cernovich, an independent blogger and self-described “popular political journalist,” moved to intervene, seeking to unseal the summary judgment record, and Dershowitz joined his motion; and
• The Miami Herald Company and reporter Julie Brown (together, the “Herald”) moved to intervene and unseal the entire docket.

The district court granted each of these motions to intervene, but denied the related requests to unseal. Dershowitz, Cernovich, and the Herald appealed to the Second Circuit.

The Second Circuit’s Decision

The Second Circuit reversed.

In its decision, the court explained that there were two categories of sealed material at issue: (1) the summary judgment record, including the parties’ summary judgment briefs, their statements of undisputed facts, and incorporated exhibits; and (2) court filings made in the course of the discovery process and with respect to motions in limine. The Second Circuit decided that the law required the unsealing of the summary judgment materials and individualized review of the remaining sealed materials.

With respect to the first category of materials, the court said that it was “well-settled” that documents submitted to a court for its consideration in a summary judgment motion were judicial documents to which a “strong presumption” of access attached, under both the common law and the First Amendment.”[19] In light of this strong First Amendment presumption, the court said, sealing of the documents could be justified “only with specific, on-the-record findings” that sealing was necessary to preserve higher values and only if the sealing order was “narrowly tailored to achieve that aim.”

Applying this standard, the Second Circuit found that the district court erred in failing to give proper weight to the presumption of access that attached to documents filed in connection with summary judgment motions. It added that the district court also failed to review the documents individually and produce “specific, on-the-record findings” that sealing was “necessary to preserve higher values.” Instead, the circuit court found, the district court made “generalized statements about the record as a whole,” which was error.

The Second Circuit then ruled, after reviewing the summary judgment materials itself, that there was “no countervailing privacy interest sufficient to justify their continued sealing.” It ordered that they be unsealed (with minimal redactions to protect personally identifying information such as personal phone numbers, contact lists, birth dates, and Social Security numbers and to remove the names of alleged minor victims of sexual abuse).

With respect to the remaining sealed materials, the circuit court explained that they included filings related to, among other things, motions to compel testimony, to quash trial subpoenas, and to exclude certain deposition testimony. According to the Second Circuit, all of these motions, at least on their face, called on the district court to exercise its Article III powers and were subject to “at least some presumption of public access.”

The Second Circuit added that although a district court’s authority to oversee discovery and control the evidence introduced at trial constituted an exercise of judicial power, this authority was “ancillary to the court’s core role in adjudicating a case.” Therefore, it said, the presumption of public access in filings submitted in connection with discovery disputes or motions in limine generally was “somewhat lower than the presumption applied to material introduced at trial, or in connection with dispositive motions such as motions for dismissal or summary judgment.” Thus, it stated, although a district court still had to articulate specific and substantial reasons for sealing such material, the reasons usually need not be as compelling as those required to seal summary judgment filings.

Applying that standard, the Second Circuit decided that the “precise basis” for the district court’s decision to deny the motion to unseal these remaining materials was “unclear.” The circuit court said that the district court had to determine if the documents were relevant to the performance of the judicial function. The circuit court added that to the extent that the district court held that privacy interests outweighed the presumption of public access in each of the thousands of pages at issue, that decision, which appeared to have been made “without particularized review,” amounted to an abuse of discretion.

The circuit court concluded by directing the district court to conduct an individualized review of the sealed materials and to unseal all documents for which “the presumption of public access” outweighed any countervailing privacy interests.

In summary, the Second Circuit held that:

• Materials submitted in connection with a motion for summary judgment were subject to a strong presumption of public access; and
• Materials submitted in connection with, and relevant to, discovery motions, motions in limine, and other non-dispositive motions were subject to a lesser, but still substantial, presumption of public access.

[1] Krakauer v. State, No. DA 18-0374 (Mont. July 3, 2019), rehearing denied (Aug. 7, 2019).

[2] Krakauer v. State, 381 P.3d 524 (Mont. 2016).

[3] Family Educational Rights and Privacy Act of 1974, as amended, 20 U.S.C. § 1232g.

[4] Article II, Section 9, of the Montana constitution provides: “No person shall be deprived of the right to examine documents . . . of all public bodies or agencies of state government and its subdivisions, except in cases in which the demand of individual privacy clearly exceeds the merits of public disclosure.”

[5] Great Falls Tribune v. Mont. PSC, 82 P.3d 876 (Mont. 2003) (citation and emphasis omitted).

[6] Article II, Section 10, of the Montana constitution provides: “The right of individual privacy is essential to the well-being of a free society and shall not be infringed without the showing of a compelling state interest.”

[7] See, Montana Code Section 20-25-515.

[8] See, e.g., 20 U.S.C. § 1232g(b)(6)(B) (institution may disclose limited information about the final results of a disciplinary proceeding against a student who is an alleged perpetrator of a crime of violence or a nonforcible sex offense, “if the institution determines as a result of that disciplinary proceeding that the student committed a violation of the institution’s rules or policies with respect to such crime or offense.”).

[9] Levitant v. City of New York, No. 18-cv-7292 (LAK)(RWL) (S.D.N.Y. July 30, 2019).

[10] Monell v. Department of Social Services, 436 U.S. 658 (1978).

[11] Powell v. Schriver, 175 F.3d 107, 112 n. 2 (2d Cir. 1999).

[12] Doe v. Marsh, 918 F. Supp. 580, 585 (N.D.N.Y. 1996), affirmed, 105 F.3d 106 (2d Cir. 1997).

[13] See, e.g., Watson v. Wright, No. 9:08-CV-62, 2010 U.S. Dist. LEXIS 586 (N.D.N.Y. Jan. 5, 2010) (finding no constitutional right to privacy in a Hepatitis C condition); Rush v. Artuz, No. 00 Civ. 3436, 2004 U.S. Dist. LEXIS 15333 (S.D.N.Y. Aug. 6, 2004) (finding no constitutional right to privacy in one’s wrist injury and stomach problems); Makas v. Miraglia, No. 05 Civ. 7180, 2007 U.S. Dist. LEXIS 15628, (S.D.N.Y. March 5, 2007) (finding no constitutional right to privacy in a patient’s cholesterol or thyroid level), vacated in part on other grounds, 300 F. App’x 9 (2d Cir. 2008).

[14] N.Y. Workers’ Comp. Law § 110-a.

[15] Brown v. Maxwell, 929 F.3d 41 (2d Cir. 2019).

[16] See Doe 1 v. United States, 359 F. Supp. 3d 1201 (S.D. Fla. 2019).

[17] Internal quotation marks and brackets omitted.

[18] Fed. R. Civ. P. 12(f).

[19] See, e.g., Lugosch v. Pyramid Co. of Onondaga, 435 F.3d 110 (2d Cir. 2006).