Header graphic for print
Privacy Compliance & Data Security Information on Data Breach Prevention and the Appropriate Response

Supreme Court Tells AT&T It Has No Right to Privacy

Posted in Right to Privacy

The Supreme Court of the United States has ruled in Federal Communications Commission, et al. v. AT&T Inc., et al. (slip opinion – PDF link) that business entities have no personal privacy rights under the Freedom of Information Act (FOIA) (PDF link).  The ruling was unanimous and arose from a Third Circuit decision.

There are several exemptions built into the FOIA, whereby federal agencies do not have to make certain information available when requested.  Exemption 7(C) pertains to law enforcement records that, if disclosed, “could reasonably be expected to constitute an unwarranted invasion of personal privacy.” 5 U. S. C. §552(b)(7)(C).  The issue addressed was whether corporations have “personal privacy” for purposes of exemption 7(C).

AT&T was investigated by the Federal Communications Commission in connection with AT&T’s participation in the FCC’s E-Rate (Education-Rate) program for schools and libraries.  As a result, AT&T disclosed to the FCC that it may have overcharged the Government for its services in connection with the E-Rate program.  During the resulting investigation, AT&T disclosed various information to the Government, including billing information, name and job descriptions of employees involved and AT&T’s conclusion regarding wrongdoing by its own employees.  The matter was resolved in December 2004 and AT&T paid $500,000 and instituted a plan to ensure the incorrect billing did not occur again.

CompTel, “a trade association representing some of AT&T’s competitors,” submitted a FOIA request in connection with the E-Rate program investigation.  The FCC’s Enforcement Bureau did withhold some competitive information, as well as names and other personal information related to AT&T’s employees.  However, the Enforcement Bureau did not apply exemption 7(C) to AT&T itself because “businesses do not possess ‘personal privacy’ interests as required by the exemption.”

AT&T took the position the root term “person” in the phrase “personal privacy” refers to “persons” as defined under the Administrative Procedures Act. The definition of “person” under the Administrative Procedures Act includes several types of business entities, specifically, corporations.  The FCC concluded that AT&T’s position that it is “a ‘private corporate citizen’ with personal privacy rights that should be protected from disclosure that would ‘embarrass’ it . . . within the meaning of Exemption 7(C) . . . at odds with established [FCC] and judicial precedent,” and concluded that “Exemption 7(C) has no applicability to corporations such as [AT&T].”

The Court of Appeals for the Third Circuit agreed with AT&T, and the FCC petitioned the United States Supreme Court for review, and the Third Circuit holding was overturned.

Chief Justice Roberts delivers a thoughtful analysis of why the terms “person” and “personal” should not be read to give business entities “personal privacy rights,” which you can read in detail in the opinion (PDF link).  In a final wink, nudge and affirmation of his reasoning, Chief Justice Roberts concludes the analysis by stating that “[w]e trust that AT&T will not take it personally.”