Southern Illinoisan v. Department of Public Health

JUSTICE WELCH delivered the opinion of the court: The defendants, the Illinois Department of Public Health and Dr. John Lumpkin, in his capacity as Director of Public Health, appeal two orders of the circuit court of Jackson County. The first order directed the defendants to release certain Illinois Cancer Registry (Registry) information to the plaintiff, the Southern Illinoisan, a daily newspaper that is based in Carbondale, Illinois, and is a division of Lee Enterprises, Inc. The second order awarded attorney fees to the plaintiff. For the reasons that follow, we affirm the first order of the circuit court and reverse the second order of the circuit court. This is the second time this court has been asked to rule in this case. The factual background, procedural history, and policy considerations implicated in this case are detailed in our first ruling, Southern Illinoisan v. Department of Public Health, 319 Ill. App. 3d 979 (2001). We refer interested readers to that opinion, and for purposes of judicial economy we confine our discussion in this disposition to the issues presently before us. We note, however, that in our first ruling we held that for purposes of determining whether Registry data should be released in response to a request under the Freedom of Information Act (5 ILCS 140/1 et seq. (West 1998)), the phrase in the Illinois Health and Hazardous Substances Registry Act (410 ILCS 525/4(d) (West 1998)) that prohibits the public inspection or dissemination of any group of facts that tends to lead to the identity of any person whose condition or treatment information is submitted to the Registry means “any group of facts that reasonably would tend to lead to the identity of specific persons.” (Emphasis in original.) Southern Illinoisan, 319 Ill. App. 3d at 987. Upon the remand from our disposition in the above-quoted opinion, the circuit court, per our instructions, held proceedings on June 6, 2002, to determine if the data sought by the plaintiff in this case would reasonably tend to lead to the identity of any person whose condition or treatment information had been submitted to the Registry. Two witnesses testified on behalf of the defendants during the proceedings. The first witness, Jan Snodgrass, manages the Registry for the defendants. Her testimony consisted mainly of background information on the structure, purpose, and functioning of the Registry. The second witness, Dr. Latanya Sweeney, was qualified by the circuit court as an expert witness on the subject of data anonymity. Dr. Sweeney is an accomplished academic who holds a doctorate degree in computer science from the Massachusetts Institute of Technology (MIT) and is, among other things, the director of the Laboratory for International Data Privacy at Carnegie Mellon University in Pittsburgh. She testified that, using the data the plaintiff seeks in this case, she was able to supply a single correct name for 18 of the 20 sets of data the defendants gave her to analyze and that she was able to suggest two alternative names, one of which was correct, for each of the remaining two sets of data. Dr. Sweeney’s testimony on the exact methodology she used to make these identifications was sealed by the circuit court, and although we have examined the sealed testimony thoroughly for purposes of rendering our opinion, we decline to publicly disclose the details of that methodology. On June 7, 2002, the circuit court issued its order directing the defendants to release to the plaintiff the Registry data requested by the plaintiff. In its order, the court concluded that the data did not reasonably tend to lead to the identity of specific persons, relying in part on its finding that the knowledge acquired by Dr. Sweeney during her education and in her professional career provided her with a unique, although not exclusive, foundation upon which she drew in conducting her data analysis. The court posited that it was not reasonable to believe that someone with less knowledge, education, and experience in this area would be as successful as Dr. Sweeney in using the information provided to arrive at the same results Dr. Sweeney reached. Accordingly, the court concluded that the information requested by the plaintiff does not lead to the identification of individuals. In its second order in this case, issued November 26, 2002, the circuit court directed the defendants to pay the attorney fees of the plaintiff. The defendants now appeal from these two orders. As a preliminary matter, we note that regarding the first order issued by the circuit court, the parties disagree on the standard of review to be employed by this court in reviewing that order. The defendants urge us to employ a de novo standard of review, because, according to the defendants, in reaching its decision the circuit court applied an erroneous interpretation of law. The plaintiff, on the other hand, urges us to review the circuit court’s order under the manifest-weight-of-the-evidence standard, because, according to the plaintiff, the matter presents a question of fact. We decline to wade into this question at this time, because we find that even under the less deferential of the two standards, the de novo standard urged by the defendants, we still affirm the order of the circuit court. As noted above, the circuit court based its first order, directing the defendants to release to the plaintiff the Registry data requested by the plaintiff, at least in part on its finding that the knowledge acquired by Dr. Sweeney during her education and in her professional career provided her with a unique, although not exclusive, foundation upon which she drew in conducting her data analysis. On appeal, the defendants take issue with this finding, contending that it is evident from Dr. Sweeney’s own testimony “that one does not need to be a professor from MIT” to discover the identity of the Registry members from the data the plaintiff has requested in this case. We do not agree with this analysis of Dr. Sweeney’s testimony, nor do we agree with the conclusion the defendants draw from it. Although it is true, as the defendants contend, that Dr. Sweeney testified that she did her work on a simple laptop computer using standard, readily available software, we do not believe that it was Dr. Sweeney’s equipment alone or her equipment in conjunction with a passing knowledge of computing that made it possible for her to identify the subjects in question. Rather, it was, as the circuit court noted, her knowledge, education, and experience that allowed her to make the identifications. Dr. Sweeney testified that she used a six-step method to identify the subjects in question. Without divulging information under seal, we note that this six-step method required knowledge that statistical information of the kind she sought existed, skill in the gathering of that information, the integration and manipulation of the information from multiple sources so that a coherent picture of the relevance of each piece of information could be formed, the analysis of the information to determine its significance to the process of identification, and the solution of the sometimes complex problems that developed during the gathering, integration and manipulation, and analysis stages. The defendants’ assertions to the contrary notwithstanding, the identification process was not a simple task that almost anyone with a computer could accomplish. The process required not only the knowledge that relevant statistical data existed and the knowledge of where to look for that data but also the knowledge, education, experience, and skill to know what to do with that data once it was located — to put it all together so that it made sense. For example, Dr. Sweeney testified that at one stage in her process she examined six cases to determine what each case had in common with the others. Initially, she settled on one factor, but when she sought medical records on the basis of that factor, she got a huge number of records back and recognized that the factor in question was far too broad to help her. That Dr. Sweeney recognized that she had made a mistake, what the mistake was, and how to correct the mistake is indicative of her level of sophistication in this field of study. We find it difficult to believe that an individual with less knowledge, education, and experience than Dr. Sweeney has would have been able to navigate the six-step process as adeptly as she did. Clearly, Dr. Sweeney’s methodology required knowledge and analytical skills beyond that of the average person. The circuit court even engaged Dr. Sweeney in an extended discussion of her methodology. The trial judge stated, “I want to go through the project with you step by step as if I was a computer literate person attempting to recreate what you did.” Significantly, although Dr. Sweeney’s responses to this line of questioning by the court indicate in great detail how she knew what to do, her responses lack concreteness and specificity regarding the extent to which others would be able to do the same. Nor did the defendants present any other evidence on this point. Accordingly, we conclude that although Dr. Sweeney’s testimony provides a detailed analysis of how she was able to identify the subjects, it in no scientific way quantifies the knowledge base and analytical skills necessary for others to replicate her achievements, nor does it in any way guide this court to a reasoned appreciation of the threat that might exist from the release of this information to this plaintiff or, for that matter, to the public in general. In other words, while the evidence presented by the defendants demonstrates that one expert in data anonymity was able to identify the subjects in question from the data requested by the plaintiff, following her own six-step process and drawing upon her years of education, knowledge, and experience to analyze the data to the extent necessary to identify the subjects in question, that evidence does not concretely and conclusively demonstrate that a threat exists that other individuals, even those with skills approaching those of Dr. Sweeney, likewise would be able to identify the subjects or what the magnitude of such a threat would be, if it existed. Are there two people in the entire State of Illinois who could replicate Dr. Sweeney’s results with the same limited data or are there two thousand? Are there zero or are there a million? These questions are significant because without some sense of the magnitude of the alleged threat of which the defendants complain, it is very difficult for this court to determine whether the data in question reasonably tends to lead to the identity of specific persons. As we noted in our previous opinion in this case, the reasonableness requirement is necessary because in this age of ubiquitous information, “any fact, no matter how unrelated to identity, can tend to lead to identity.” Southern Illinoisan, 319 Ill. App. 3d at 987. But the fact that one expert in data anonymity can manipulate data to determine identity does not necessarily mean, without more, that a threat exists that other individuals will be able to do so as well, nor does it in any way define the magnitude of such a threat or whether that threat, if it in fact even exists, renders the release of the data an act that reasonably tends to lead to the identity of specific persons. To find otherwise would undermine the reasonableness requirement and would effectively remove it from our analysis, leading to a situation where if it could be shown that one expert could identify individuals from information released, then the release of that information would automatically be deemed to reasonably tend to lead to the identity of specific persons. Had the defendants, with the many and varied resources available to a state agency, wished to present specific evidence on the extent to which other individuals possess the unique knowledge, experience, and analytical skills necessary to replicate Dr. Sweeney’s work, they were free to do so. Had they chosen to bring in other witnesses who also had been able to identify the subjects from the data in question, they were free to do that as well. Had they done one or both of these things, this court would be in a better position to evaluate the threat of which the defendants complain. However, the defendants did not do so, and they now must stand by the evidence they actually presented, not by alarmist conjecture about the resounding policy implications of that somewhat limited evidence. We conclude, as did the circuit court, that the defendants have failed to demonstrate that the release of the Registry data requested by the plaintiff reasonably tends to lead to the identity of the specific persons described in that data. Accordingly, we affirm the June 7, 2002, order of the circuit court. The defendants also appeal the November 26, 2002, order of the circuit court directing the defendants to pay the attorney fees of the plaintiff. In its order, the circuit court stated that it was appropriate for the defendants to pay the attorney fees of the plaintiff pursuant to section ll(i) of the Freedom of Information Act (Act) (5 ILCS 140/ll(i) (West 2002)) because this issue had been ruled upon at least once already by an Illinois court and because the circuit court believed that the defendants in this case were being obstreperous by standing on their legal theory. Although the circuit court did not explicitly so find, presumably the court believed that the above-cited reasons for awarding fees demonstrated that the defendants had no reasonable basis in law for withholding the requested information, one of the requirements to award fees under the Act (5 ILCS 140/11(i) (West 2002)). However, in our earlier ruling in this case, we noted that up until that point in the case, we were aware of no conduct on the part of the defendants that would indicate “inexcusable noncompliance,” and we reversed the circuit court’s earlier order that the defendants pay the plaintiffs attorney fees. Southern Illinoisan, 319 Ill. App. 3d at 988. The record discloses no subsequent actions on the part of the defendants that could be deemed noncompliant. There is nothing in the record to indicate that the defendants attempted to use stall tactics or other inappropriate means to prolong this litigation. To the contrary, the defendants did exactly what our earlier opinion required of them: they put on their evidence and made the best case that they believed they could make. That they were ultimately unsuccessful does not mean that they had no reasonable basis in law for withholding the requested information. Although we disagree with their position, as discussed above, we do not believe it is so far-fetched that it could be considered to be without a reasonable basis. For the foregoing reasons, the June 7, 2002, order of the circuit court of Jackson County is affirmed, and the November 26, 2002, order is reversed. Affirmed in part and reversed in part. HOPKINS and MAAG, JJ, concur.