The Fourth Circuit has upheld in part and reversed in part a lower court ruling on a First Amendment challenge to Virginia’s Personal Information Privacy Act, which prohibits “[i]ntentionally communicat[ing] another individual’s social security number to the general public.” In Ostergren v. Cuccinelli, the Court considered Ms. Ostergren’s claim that the statute infringed her First Amendment right to publish Social Security numbers on her website, which she obtained legally from published Virginia land records, in an effort to demonstrate just how easy it is to publicize private information. The state alleged that her act was in violation of the statute.
Virginia’s decision to place land records online raised certain concerns about information privacy. For many decades, attorneys included SSNs on real estate documents submitted for recording. Initially assigned for the purpose of administering Social Security laws, nine-digit SSNs have become widely used for identification and account authentication by government agencies and private organizations because no two people have the same number. They are thus highly susceptible to misuse. An unscrupulous individual who knows another’s SSN could, for example, obtain fraudulent credit cards or order new checks on that person’s account.
When clerks of court began placing land records online, they did nothing to redact SSNs. At that time, Virginia law neither required such redaction nor prevented attorneys from submitting documents for recording that contained unredacted SSNs. In 2003 and 2004, however, the General Assembly provided that clerk[s] may refuse to accept any instrument submitted for recordation that includes a grantor’s, grantee’s or trustee’s social security number,” and clarified that “the attorney or party who prepares or submits the instrument has responsibility for ensuring that the social security number is removed from the instrument prior to the instrument being submitted for recordation.” … Virginia law also provides that clerks “shall be immune from suit arising from any acts or omissions relating to providing secure remote access to land records pursuant to this section unless the clerk was grossly negligent or engaged in willful misconduct.” …
The General Assembly finally addressed redaction in the 2007 legislation mandating that clerks provide secure remote access by July 1, 2008. …The General Assembly noted clerks’ authority to redact SSNs from digital land records available through secure remote access, authorized hiring private vendors to run redaction software, and authorized using Technology Trust Fund money for this purpose…. The legislation would have also required clerks to complete the redaction process by July 1, 2010, but this provision never went into effect because the General Assembly failed to appropriate the necessary funds. …These efforts focused solely on digital land records available online. Virginia does not redact SSNs from original land records maintained at local courthouses even though Virginia law requires that such records remain publicly accessible.
…
The controversy that spurred this case arose from Ostergren’s disclosure of others’ SSNs printed in Virginia land records that she posted online. …Section 59.1-443.2 of the Code of Virginia provides that “a person shall not . . . [i]ntentionally communicate another individual’s social security number to the general public.” …In Spring 2008, the General Assembly removed a statutory exception for “records required by law to be open to the public.” 2008 Va. Acts 837. The Attorney General of Virginia later indicated that, after this change took effect on July 1, 2008, Ostergren would be prosecuted under section 59.1-443.2 for publicly disseminating Virginia land records containing unredacted SSNs.
…
First we review the district court’s August 22, 2008, constitutional determination. “We review de novo a properly preserved constitutional claim.” … Virginia argues that SSNs are categorically unprotected speech that may be prohibited entirely. Alternatively, Virginia argues that the state interest in preserving citizens’ privacy by limiting SSNs’ public disclosure justifies barring Ostergren’s speech. In other words, Virginia maintains that the First Amendment does not apply here and that, even if it does, enforcing section 59.1-443.2 against Ostergren should survive First Amendment scrutiny. We address each argument in turn.
The Supreme Court has nevertheless identified certain categories of “unprotected” speech that may be circumscribed entirely. Fighting words, obscenity, incitement of illegal activity, and child pornography are examples.
…
Virginia argues that the unredacted SSNs on Ostergren’s website should not be protected under the First Amendment because they facilitate identity theft and are no essential part of any exposition of ideas. See Eugene Volokh, Crime-Facilitating Speech, 57 Stan. L. Rev. 1095, 1146-47 (2005) (arguing that SSNs and computer passwords are “categories of speech that are likely to have virtually no noncriminal uses” and that “[r]estricting the publication of full social security numbers or passwords . . . will not materially interfere with valuable speech”). Although these observations might be true under certain circumstances, we cannot agree with Virginia’s argument here. The unredacted SSNs on Virginia land records that Ostergren has posted online are integral to her message. Indeed, they are her message. Displaying them proves Virginia’s failure to safeguard private information and powerfully demonstrates why Virginia citizens should be concerned.
…
We next consider whether enforcing section 59.1-443.2 against Ostergren for posting online Virginia land records containing unredacted SSNs survives First Amendment scrutiny. Although Ostergren’s political speech criticizing Virginia “lies at the very center of the First Amendment,” Gentile, 501 U.S. at 1034, publishing SSNs online undermines individual privacy. Freedom of speech must therefore be weighed against the “right of privacy” which the Supreme Court has also recognized. See Cox Broad., 420 U.S. at 488 (recognizing “the so-called right of privacy”). The Court tried to strike that balance in Cox Broadcasting and subsequent cases involving restrictions on truthful publication of private information.
[The Court thens examines a number of cases, including Cox Broadcasting, Landmark and Smith, and concludes that the Daily Mail standard applies here].
…
Virginia concedes that Ostergren lawfully obtained and truthfully published the Virginia land records that she posted online. Moreover, this information plainly concerns “a matter of public significance,” Daily Mail, 443 U.S. at 103, because displaying the contents of public records and criticizing Virginia’s release of private information convey political messages that concern the public, see Cox Broad., 420 U.S. at 495 ….(Public records by their very nature are of interest to those concerned with the administration of government, and a public benefit is performed by the reporting of the true contents of the records by the media.”); Landmark Commc’ns, 435 U.S. at 839 (deeming the operation of government affairs “a matter of public interest”). Therefore, the only remaining issues are (1) whether Virginia has asserted a state interest of the highest order and (2) whether [**34] enforcing section 59.1-443.2 against Ostergren would be narrowly tailored to that interest. We address each in turn.
…In assessing Virginia’s asserted interest, the district court put to one side that interest’s actual importance and instead considered only whether Virginia itself considered the interest important–applying a subjective rather than objective standard. The court explained, “[I]t is not the perception of a federal court that defines a State interest of the highest order. Instead, it is the State’s view and its conduct that, under accepted First Amendment jurisprudence, must supply the basis for such a conclusion.” …
In reaching this conclusion, the district court may have limited its consideration unnecessarily. In deciding what constitutes a state interest of the highest order, courts cannot be bound by “the State’s view and its conduct.” … For example, although a state government might demonstrate a fervent, consistently applied policy of punishing people for not cleaning up after their dogs, we would not therefore be compelled to consider this a state interest of the highest order. Conversely, although a state government might practice racial discrimination for decades–and many have–we would not therefore be barred from considering racial equality a state interest of the highest order.
Furthermore, Supreme Court precedent applying the Daily Mail standard makes clear that objective criteria can be considered when deciding what constitutes a state interest of the highest order. In Butterworth v. Smith, 494 U.S. 624, 110 S. Ct. 1376, 108 L. Ed. 2d 572 (1990), Florida maintained that its interest in preserving grand jury secrecy justified preventing a reporter from publicizing his own grand jury testimony. Concluding that Florida’s asserted interest did not constitute a state interest of the highest order, the Court observed that the Federal Rules of Criminal Procedure contained no such requirement and that “only 14 States have joined Florida in imposing an obligation of secrecy on grand jury witnesses.” … The Court explained that, “[w]hile these practices are not conclusive [*278] as to the constitutionality of Florida’s rule, they are probative of the weight to be assigned Florida’s asserted interests and the extent to which the prohibition in question is necessary to further them.” Id. (emphasis added).
…
We find it helpful to place our inquiry in historical context by discussing the genesis of modern privacy concerns surrounding SSNs. The Social Security Administration created SSNs in 1936 merely to track individuals’ earnings and eligibility for Social Security benefits. They soon became used for other purposes, however, because SSNs provide unique permanent identification for almost every person. Indeed, the federal government was among the first to avail itself of their utility. In 1943, President Roosevelt ordered that any federal agency which “establish[es] a new system of permanent account numbers pertaining to individual persons” must “utilize exclusively the Social Security Act account numbers.” Exec. Order No. 9397, 8 Fed. Reg. 16,095 (Nov. 30, 1943). [**39] Countless state and federal agencies later adopted the SSN, particularly during the 1960s. For example, Congress authorized the Internal Revenue Service to begin using the SSN for taxpayer identification in 1961. See Act of Oct. 5, 1961, Pub. L. No. 87-397, 75 Stat. 828 (1961). Private organizations, especially financial institutions, also started using the SSN for account identification and other purposes. Indeed, the Bank Records and Foreign Transactions Act, Pub. L. No. 91-508, 84 Stat. 1114 (1970), required banks, savings and loan associations, credit unions, and securities brokers and dealers to collect customers’ SSNs. See, e.g., id. § 101 (requiring “the maintenance of appropriate types of records by insured banks of the United States where such records have a high degree of usefulness in criminal, tax, or regulatory investigations or proceedings”).
Public concern about information privacy, however, soon increased. In 1973, the Department of Health, Education, and Welfare published an influential report warning about “an increasing tendency for the Social Security number to be used as if it were an SUI [standard universal identifier].” U.S. Department of Health, Education, and [**40] Welfare, Report of the Secretary’s Advisory Committee on Automated Personal Data Systems: Records, Computers, and the Rights of Citizens xxxii (1973). Congress responded by enacting the Privacy Act of 1974, 5 U.S.C. § 552a, which prohibits government agencies from denying rights, privileges, or benefits because a person withholds his SSN. By enacting this statute, “Congress sought to curtail the expanding use of social security numbers by federal and local agencies and, by so doing, to eliminate the threat to individual privacy and confidentiality of information posed by common numerical identifiers.” Doyle v. Wilson, 529 F. Supp. 1343, 1348 (D. Del. 1982). The related Senate Report stated that widespread usage of SSNs was “one of the most serious manifestations [*279] of privacy concerns in the Nation.” S. Rep. No. 93-1183 (1974), as reprinted in 1974 U.S.C.C.A.N. 6916, 6943.
Since then, usage of SSNs by federal and local agencies, financial institutions, and other organizations has become nearly ubiquitous. Beyond simply matching records with accounts, these organizations also frequently use SSNs for account authentication. This means that the SSN provides a password that lets one modify [**41] account information. By consequence, the SSN has become a crucial piece of information allowing the creation or modification of myriad personal accounts. See U.S. Government Accountability Office, GAO No. 09-759T, Identity Theft: Governments Have Acted to Protect Personally Identifiable Information, but Vulnerabilities Remain 8 (calling the SSN “a vital piece of information needed to function in American society” and noting that “U.S. citizens generally need an SSN to pay taxes, obtain a driver’s license, or open a bank account, among other things”). Unfortunately, for that reason, SSNs can easily be used to commit identity theft–that is, tendering another’s identifying information to carry out financial fraud or other criminal activity. See Jonathan J. Darrow & Stephen D. Lichtenstein, “Do You Really Need My Social Security Number?” Data Collection Practices in the Digital Age, 10 N.C. J. L. & Tech. 1, 4-5 (2008) (“Reflecting the unfortunate reality that a single number can provide access to multiple accounts, commentators have lamented that the social security number has become a ‘skeleton key’ for identity theft criminals.”). One therefore has a considerable privacy interest in [**42] keeping his SSN confidential.
…
We next consider whether enforcing section 59.1-443.2 against Ostergren would be narrowly tailored to Virginia’s asserted interest in preserving individual privacy by protecting SSNs from public disclosure. Supreme Court precedent imposes a stringent standard regarding narrow-tailoring. Cox Broadcasting and its progeny indicate that HN14
punishing truthful publication of private information will almost never be narrowly tailored to safeguard privacy when the government itself [**45] released that information to the press. See Cox Broad., 420 U.S. at 496 (“Once true information is disclosed in public court documents open to public inspection, the press cannot be sanctioned for publishing it.”); Florida Star, 491 U.S. at 534 (“Where information is entrusted to the government, a less drastic means than punishing truthful publication almost always exists for guarding against the dissemination of private facts.”). Even where disclosure to the press was accidental, Florida Star indicates that the press cannot be prevented from publishing the private information. In that case, B.J.F.’s identity was disclosed to the press accidentally despite the police department’s policy against revealing rape victims’ names. The Supreme Court nonetheless concluded that “[w]here . . . the government has failed to police itself in disseminating information, it is clear under Cox Broadcasting, Oklahoma Publishing, and Landmark Communications that the imposition of damages against the press for its subsequent publication can hardly be said to be a narrowly tailored means of safeguarding anonymity.” Florida Star, 491 U.S. at 538.
In both Cox Broadcasting and Florida Star, the government [**46] disclosed private information to the press and thereafter sought to prevent media outlets from truthfully publishing that information. This case appears similar in that Virginia likewise disclosed public records containing private information to Ostergren and now seeks to prevent her from publishing them online. Because Virginia “failed to police itself in disseminating information,” Cox Broadcasting and Florida Star suggest that preventing Ostergren from publishing those records could almost never be narrowly tailored. Id. According to their stringent standard, Ostergren could never be prohibited from publicizing SSN-containing Virginia land records she already lawfully obtained (including those posted [*281] on her website), 13 and Virginia would need to redact all original land records available from courthouses (not merely digital copies available through secure remote access) before Ostergren could be prohibited from publishing SSN-containing Virginia land records she might later obtain. 14
