January 23, 2002



FROM: Robert J. Freeman, Executive Director

The staff of the Committee on Open Government is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the facts presented in your correspondence.

Dear Ms. Holstead:

As you are aware, I have received your letter in which you referred to a request for Town's bank statements. You indicated that you disclosed the statements following the deletion of the account number, and that the applicant for the statements asked that you specify the exception to rights of access that enabled the Town to withhold the account number. That person also questioned your ability "to withhold further requests until his previous ones are paid for."

In this regard, I offer the following comments.

First, as a general matter, the Freedom of Information Law is based upon a presumption of access. Stated differently, all records of an agency are available, except to the extent that records or portions thereof fall within one or more grounds for denial appearing in §87(2)(a) through (i) of the Law.

The pertinent exception with respect to bank account numbers in my view is §87(2)(i). For several years, that provision authorized an agency to withhold "computer access codes." Based on its legislative history, that provision was intended to permit agencies to withhold access codes which if disclosed would provide the recipient of a code with the ability to gain unauthorized access to information. Insofar as disclosure would enable a person with an access code to gain access to information without the authority to do so, or to shift, add, delete or alter information, i.e., to make electronic transfers, I believe that a bank account or ID number could justifiably have been withheld. Section 87(2)(i) was recently amended in recognition of the need to guarantee that government agencies have the ability to ensure the security of their information and information systems. That provision currently states that an agency may withhold records or portions of records which "if disclosed, would jeopardize an agency's capacity to guarantee the security of its information technology assets, such assets encompassing both electronic information systems and infrastructures." If disclosure of a bank account number could enable a person to gain access to or in any way alter or adversely affect an agency's electronic information or electronic information systems, I believe that it may justifiably be withheld.

With regard to the second issue, there is no judicial decision of which I am aware that is pertinent to the matter. However, when a request for copies of records is served upon an agency, both the agency and the applicant bear a responsibility. The agency is responsible for compliance with the Freedom of Information Law by retrieving the records sought and disclosing them to the extent required by law. The agency is also required to produce copies of records "[u]pon payment of, or offer to pay, the fee prescribed therefor" [see Freedom of Information Law, §89(3)]. Concurrently, if the applicant requests copies, I believe that he or she bears the responsibility of paying the appropriate fee.

If an agency has prepared copies of records in good faith and the applicant fails or refuses to pay the fee, I do not believe that the agency would be required to make available those copies that have been prepared. In my view, it follows that an agency should not be required to honor ensuing requests until the applicant has fulfilled his or her responsibility by tendering the fee for copies previously made.

I hope that I have been of assistance.