By Jeffrey A. Roberts
CFOIC Executive Director
An 18-month push to update Colorado’s open-records law for the digital age culminated Wednesday in the final passage of a bill that clarifies the public’s right to copies of electronic government records in useful file formats that permit analysis of information in those records.
Senate Bill 17-040 heads to Gov. John Hickenlooper’s desk after passing the House on a 39-26 vote and then repassing the Senate unanimously, all on the last day of the 2017 legislative session.
The measure is intended to bar government entities from providing printouts of databases and spreadsheets when people ask for public records kept in databases and spreadsheets. No longer will governments be permitted to provide searchable records in non-searchable formats such as image-only PDFs.
The bill, which was completely rewritten in the last couple of days, states that requesters are entitled under the Colorado Open Records Act (CORA) to copies of “sortable” digital records in sortable formats. If a public record is “searchable” but not sortable, a government entity must provide a copy in a searchable format.
“I think it’s a good modernization, a step forward,” said Peg Perl, senior counsel for Colorado Ethics Watch. “It’s not as big a step as the original bill would have been, but it’s a recognition that two to three decades have passed since CORA was updated” to address electronic records.
Helping final passage in the House was a last-minute amendment, requested by the Colorado Water Congress, to provide additional protections for infrastructure security data. Although Rep. Joe Salazar, D-Thornton, called the provision “redundant” because CORA already allows records custodians to withhold “specialized details of security arrangements,” it was clear that many lawmakers were convinced the language was necessary to protect water systems, electricity grids and other “critical infrastructure.”
The final bill also adds “electronic health records” to a current CORA exemption that prohibits the disclosure of an individual’s medical information.
Under SB 17-040, records custodians may withhold searchable or sortable copies of records if they determine it is not “technologically or practically feasible” to provide them. They must instead produce the records in an alternate format and explain in writing why they can’t provide the records in the requested format.
The bill also states that the removal of any information not disclosable under CORA will not constitute the creation of a new record. This provision is designed to ensure that entire datasets are not withheld because they contain some confidential fields that must be deleted.
Records requesters in Colorado have been frustrated for years by outdated language in CORA that only vaguely implies that the public is entitled to copies of digitized records in useful formats such as comma-separated-value (CSV) files that can easily be imported into a spreadsheet or a database manager.
The latest effort to modernize CORA began in November 2015, when a column in the Fort Collins Coloradoan caught the eye of state Sen. John Kefalas, D-Fort Collins. Written by Steve Zansberg, president of the Colorado Freedom of Information Coalition, it criticized Colorado State University for providing a Coloradoan reporter with 145 printed pages from a faculty salary database rather than a digitized copy of the database that could be analyzed.
Kefalas introduced a 2016 CORA update bill that didn’t survive its initial committee hearing. Afterward, the Colorado Secretary of State’s office convened a CORA Working Group that met for several months to work on a new version of the bill. The stakeholders’ committee included journalists, lawmakers, citizen watchdogs and representatives of government entities.
Perl represented requesters on the task force along with people from the CFOIC, Colorado Press Association, Colorado Broadcasters Association, Colorado Common Cause and the Independence Institute.
SB 17-040, introduced by Kefalas and Rep. Dan Pabon, D-Denver, came out of the CORA Working Group, although some governments did not support the legislation as introduced. Some, including various state agencies and the University of Colorado, made their opposition known in recent stakeholder meetings and sent lobbyists and lawyers to testify against the measure when it came up in a House committee last month.
Jeremy Hueth, CU’s managing legal counsel, complained that the bill would put the university’s databases “at risk.” He called the legislation a “paradigm shift” that would make CORA an open-data law rather than an open-records law.
But state agencies and other governments dropped their opposition in the last few days after SB 17-040 was completely rewritten. Assisting Pabon in finding a compromise were Democratic Reps. Chris Kennedy of Lakewood and Mike Weissman of Aurora.
Key to the “heavily negotiated” compromise, as Kefalas called it, was the removal of defined terms such as “structured data.” Various exemptions added in the Senate also fell away, and the bill became much shorter.
“I think we’ve come up with a really helpful framework that will be very clear for both requesters and records custodians,” Kennedy said during floor debate Wednesday.
Rep. Terri Carver, R-Colorado Springs, urged the defeat of SB 17-040.
“There is not adequate protection of personal information,” she said. “It is still open to data mining. We need to vote this bill down and start again.”
Calling the final bill “a modest approach,” Pabon said further efforts to update CORA are likely in future legislative sessions.
Perl noted that, unlike the introduced bill, the final version of SB 17-040 doesn’t address fee issues, leaving CORA’s current fee structure in place.
“There are still some open questions,” she said, “involving the interplay between different types of formats that records may be produced in and the different types of fees that may be charged … We’re going to have to see how it plays out.”
Less noticed in the bill is the deletion of a long-standing misdemeanor (with a penalty of up to 90 days in jail and a $100 fine) for anyone who “willfully and knowingly” violates CORA. Lawyers who have worked on open-records cases for many years can’t recall anyone ever being prosecuted for a CORA violation.
Follow the Colorado Freedom of Information Coalition on Twitter @CoFOIC. Like CFOIC’s Facebook page. Visit CFOIC’s legislature page to track bills in the General Assembly that could affect the flow or availability of information in Colorado.