CA DOJ Willful Disclosure Of Firearm Safety Instructor Private Information

As we previously reported, the California Department of Justice began mailing letters like this one to Certified California Firearm Safety Instructors in late December. Those letters ominously warned that that DOJ had “inadvertently” released vital private information of instructors, including instructors’ names, dates of birth, driver’s license numbers, and other information that could be used by identity thieves.  DOJ’s letter simply states that the information was released to an unknown “requestor” pursuant to a Public Records Act request. We now have more information on how many people are affected by the privacy breach and to whom the information was provided.

We can now tell you that DOJ claims 3,424 Firearm Safety Instructors had their information illegally disclosed. More surprisingly, the recipient of the unlawfully-released information was Aaron Mendelson, a reporter for Southern California Public Radio (KPCC). Mendelson obtained instructors’ private information by submitting a Public Records Act request to DOJ on August 24, 2016. He asked DOJ to provide “[a]ll data on Firearm Safety Certifications kept by the California Department of Justice,” including the “name, date, location, instructor and so on.” Mendelson also sought “any training materials instructors receive informing them how to submit Firearm Safety Certifications.” Notably, Mendelson himself understood and acknowledged that due to the breadth of information he was requesting about instructors, some of the information may be protected by privacy laws and therefore require redaction. In fact, he indicated that he fully expected the information provided to him by DOJ to include redacted material, and requested that he merely be notified of the legal justification for the expected redactions DOJ would make.

But as many have now been notified, DOJ failed to recognize what both the law and Mendelson understood: that instructors’ vital private information should not be disclosed in response to a PRA request. Thus, in responding to Mendelson’s request on October 14, DOJ failed to properly redact the private information of every single Firearm Safety Instructor about whom it produced records. DOJ discovered their costly mistake three days later. Thus, DOJ is attempting to rectify the situation by claiming it has asked Mendelson to destroy the information and to not disseminate it any further. But DOJ has not clarified if Mendelson has done so, or if he has already published any of the information he received. A cursory search of Mendelson’s publications through Southern California Public Radio does not yet include any information on Firearm Safety Instructors that would have been culled from the disclosures made to him by DOJ.

Perhaps most disturbing of all is the timing of DOJ’s notice. DOJ was clearly aware of the breach in October but failed to notify the more than 3,000 affected individuals for over two months. It is also not entirely clear when exactly DOJ notified Mendelson, or what additional communications it may have had with him and his station.