Todd v. Hause, Director of Legal and Regulatory Compliance for the Colorado Department of Public Health and Environment

Opinion by JUDGE BERGER 1 1 Plaintiff, Vincent C. Todd, appeals the district court's grant of summary judgment in favor of defendant, the Colorado Department of Public Health and Environment (Department), and denial of Todd's Colorado Open Records Act (CORA) request for access to certain information in records maintained by the Department regarding breath *708 aleohol level testing by Colorado law enforced ment agencies. 1 1 2 We affirm the Judgment in all respects except as to the portion of the court's order denying Todd: access to information. about persons who took the breath tests, As to that portion of the court's order, we-reverse and remand for further proceedings. I,. Relevant Fects and Procedural Background T3 According to his complaint, Todd is a "consulting paralegal to Colorado attorneys" who "devotes a significant amount of his professional time to assisting criminal defense attorneys in DUI and DUID defense...." Todd made several mutton CORA requests to the Department for all data gathered from the Intoxilyzer 9000, the | device Colorado law enforcement agencies use to test the breath alcohol level of suspected intoxicated drivers. 4 The Department maintains the centralized database server for in-field Intoxilyzer 9000 instruments. The database links with Intoxilyzer 9000s to retrieve and transfer instrument data, to perform instrument updates, and for remote control of the instruments. The database links with the in-field Intoxilyzer 9000s through software developed by CMI, Inc., called Computerized Online Breath Archive (COBRA) software, In response to Todd's request, the Department asserted that the COBRA software is pro-prictary and that, under its license agreement with CMI, it was prohibited from copying or transferring the COBRA software. T5 While the Department acknowledged that the information contained in the database is not protected under the HMcensing agreement, it claimed that the COBRA database file contains proprietary programming belonging to CMI that cannot be separated from the Intoxilyzer 9000 data while in the native Structured Query Language (SQL) file format. Thus, according to the Department, providing the data to Todd in SQL format would necessarily disclose CMI's proprietary software, which in turn would violate the licensing agreement entered into by the Department-with CML.. ~ 16 The Department offered to convert the data to Comma-Separated Values (esy) file format, a different file format than SQL and, after redacting all confidential or personally identifying data fields, to provide the data to Todd. ' 17 Todd refused this offer and filed a complaint in district court alleging that, under CORA, the Department was required to disclose the data in SQL format and that certain redactions claimed by the Department were not authorized by the statute. Todd has never explained why the data in .csv file format is materially different than the data in SQL file format. 18 Both par-mes filed motlons for summary judgment In its summary judgment motion, the Department asserted that, under CORA's trade secret exception, section' 24-72-204(8)(a)(IV), C.R.S. 2014, the data in SQL format was not subject to' disclosure. 'The Department further asserted that it had the right to redact any personally identifying information of both the persons who performed the tests and the persons who took 'them. As to the former, the Department contended that disclosure of such identifying information could compromise the security of the state DUI enforcement system. As to the latter, the Department asserted that persons who were required to take the breath tests had privacy rights in the information. 1 9 In support of these assertions, the Department submitted the affidavits of CMI's corporate counsel and two Department employees who provided computer-related support for the Department's breath «aleohol testing program. *709 [ 10 Todd submitted only his own affidavit in opposition to the Department's motion for summary judgment and in support of his own motion. ~ [11 The district court granted the Department's motion and denied Todd's. II. The Court Correctly Denied Todd's Request for the Data in SQL Format A. Summary Judgment Standard 12 Summary judgment is appropriate if the pleadings, affidavits, depositions, or admissions show that there 'is no disputed issue of material fact and that the moving party is entitled to judgment as a matter of law. McDaniels v. Laub, 186 P.3d 86, 87 (Colo. App. 2008) (citing C.R.C.P. 56(c)). The party requesting summary judgment has the initial burden to demonstrate the absence of evidence in the record that supports the fion-moving party's case. Civil Serv. Comm'n v. Pinder, 812 P.2d 645, 649 (Colo. 1991). €13 Onee this initial burden is met, the burden shifts to the nonmoving party to show that a disputed issue of material fact exists. Id. In makmg this showing, the party opposing summary judgment cannot rest on the mere allegations of the pleadings, but must demonstrate by specific facts admissible under the rules of evidence that a controversy exists. USA Leasing, Inc., L.L.C. v. Montelongo, 25 P.3d 1277, 1278 (Colo. App. 2001). " 14 When the nonmoving party presents no aff1dav1ts or other counterevidence to con-tradiet the moving party’s initial showing, a court must conclude that no genuine issue of material fact exxsts. Pinder, 812 P.2d at 649. T 15 We review a grant of summary judgment de novo. Arnold v. Anton Co-op. Ass'n, 298 P.3d 99, 105 (Colo. App. 2011). B., Trade Secret Exception. ~ 116 Todd first contends that the Department did not meet its initial burden to show that there was no disputed issue of material fact whether the data in SQL format was protected from disclosure under CORA's trade secret exception. We reject this argument, T17 Under CORA's trade secrets exception, a custodian of public records may deny the right of inspection if the records are "trade secrets, privileged information, [or] confidential commercial ... data." § 24-72-204(8)(a)(IV). 118 Through the affidavits submitted in support of its summary judgment motion, the Department asserted that its software licensing agreement with CMI restricts it from copying or transferring the COBRA software. The Department claimed that the In-toxilyzer 9000 test data in SQL format could not be separated from the. COBRA software: CMI's corporate counsel stated in his affidavit that sharing the data in SQL format is the same as sharing the COBRA software itself. He asserted that therefore anyone receiving the data in SQL format would nee-essarily obtain CMI's COBRA software, which would violate the licensing agreement. (19 Todd argues that the statements in the affidavits regarding the proprietary nature of the COBRA software are incompetent under C.R.C.P. 56(e) because they purportedly express legal opinions, not facts. Like the district court we reject that argument. _ 120 C.R.C.P. 56(e) requires affidavits to (1) be made on personal knowledge; (2) set forth facts, which would be admissible under the rules of evidence; and (3) demonstrate that the affiant is competent to testify to the matters stated therein. 121 The Department's affidavits contain information from persons who have personal knowledge of the nature of the database. Moreover, based 'on the information contained in the affidavits, the affiants are' competent to testify about such matters, The affidavits address the proprietary nature of the COBRA software and do not contiin opinions as to the law or ultimate issues in the case. 2 *710 T22 We also reject Todd's argument that the determination of whether the data may be withheld under the trade secrets exception must be made based only on the four corners of the software licensing agreement. T 23 Todd's argument is fundamentally inconsistent with Colorado's statutory recognition of trade secrets in the Colorado Uniform Trade Secrets Act, sections 7-74-101 to -110, C.R.S, 2014. No contractual agreement is necessary to create or protect a trade secret. Provided the requirements of the Uniform Trade Secrets Act are met, a trade secret is subject to protection under Colorado law. Todd cites no authority to the contrary and we are aware of none that would support the proposition that a court may look only to a contract to determine whether information is within CORA's trade secret exception. 124 Accordingly, the Department met its initial summary judgment burden, and the burden then shifted to Todd to establish a disputed issue of material fact whether supplying the data in SQL format would violate the licensing agreement and disclose trade secrets owned by CML Todd's only counterevidence was his conclu-sory statement that the SQL file format (the ~ general programming language itself) is not proprietary. That statement, however, does not create a disputed issue of material fact because the Department never asserted that the SQL file format itself was proprietary. Instead, the Department claimed that providing the data in SQL file format entailed disclosing proprietary information." 25 Todd did not, by admissible evidence, contradict any of the factual statements in the Department's affidavits, Accordingly, the district court correctly determined that the Department was entitled to summary judgment and could withhold the data in SQL file format. See Pinder, 812 P.2d at 649. C. Personal Information of Intoxilyzer 9000 Operators ~- 126 Todd next contends that the district court erred in permitting the Department to redact certain personal information of the operators of the Intoxilyzer 9000. We reject this argument, [ 27 The Department asserts that two statutory exceptions to CORA disclosure support the district court's order permitting the re-dactions. 128 The first statutory exception is the "substantial injury exception." That exception provides that "lilf, in the opinion of | the official custodian of any public record, disclosure of the ... record would do substantial injury to the public interest ... the official custodian may apply to the dlstnct court . for an order permitting him or her to restriét such disclosure,..." § 24-72-204(6)(a). The custodian has the burden to prove that disclosure of the information would substantially injure the public interest. Id (29 The second exception is the "personnel files" exception contained in section 24-72-204(8)(a)(II). Under that exception, a custodian must deny inspection of "personnel files," which include "home addresses, telephone numbers, financial information, and other information maintained because of the employer-employee relationship." § 24-72-C.R.8. 2014. 180 The Department presented admissible evidence that disclosure of the operator identification, login information, and personal identification numbers (PINs) could under-miné the breath alcohol testing program by potentially giving & third party unauthorized access to the Intoxilyzer 9000 instruments. The Department and the State of Colorado have substantial legitimate interests in preventing such a breach of security of the DUI enforcement system,. The district court thus correctly determined that release .of this information would do substantial injury to the public interest. 3 *711 31 Therefore, the Department met its summary judgment burden with respect to the redaction of the operators' personal information. Todd did not present any evidence that created a disputed issue of material fact and thus the court correctly granted summary judgment to the Department on this issue. {32 Because the substantial injury exception supported the Department's refusal to disclose the personal information of the In-toxilyzer operators, we need not address the personnel files exeeption to CORA. D. Personal Information of Individuals Who Took Intoxilyzer 9000 Breath Tests $83 The Department contends that the district court correctly held that disclosure of information about the persons who took the breath tests (Todd requested their date of birth, the case number, and the date and time of offense) would do serious injury to the public interest and was thus exempt from CORA disclosure. We disagree. 134 CORA contains a broad legislative declaration that all public records are open for public inspection unless CORA itself or other specific law exempts the records from disclosure. Denver Publ'g Co. v. Dreyfus, 184 Colo. 288, 292, 520 P.2d 104, 106 (1974); Freedom Newspapers, Inc. v. Tollefson, 961 P2d 1150, 1158-54 (Colo. App. 1998); Denver Post Corp. v. Univ. of Colo., 739 P.2d 874, 877 (Colo. App. 1987). - 185 CORA contains no express exception for disclosure of information which would violate an individual's privacy rights. But Colorado courts have construed section 24-72-204(6)(a)-the substantial injury to the public interest exception-to include, under appropriate cireumstances, protection of information collected by the government, the disclosure of which would violate an individual's right to privacy. Freedom Newspapers, 961 P.2d at 1156; Denver Post, 739 P.2d at 878-79. 136 Neither the Department nor the district court identified the source or extent of any right of privacy that might protect the information . at issue. Instead, the court based its judgment solely on application of the summary judgment burden-shifting paradigm. The Department submitted affidavits stating that the database information of individuals who take a breath test includes their name, gender, date of birth, driver's license number, and address; the affidavits did not address whether any individual had a privacy right in the information. The Department stated in its summary judgment motion and briefs that test takers "have a legitimate expectation that their personal identifying information ... will not be disclosed to anyone other than law enforcement" officials and that "public disclosure ... could subject the individuals to a range of substantial injuries-from embarrassment to physical and/or financial harm." 137 Because Todd did not dispute these conclusory statements in his counteraf-fidavit, the court concluded that Todd failed to establish a disputed issue of material fact relating to that purported expectation of nondisclosure. It thus ruled that summary judgment in favor of the Department was appropriate. However, as noted above, the Department's affidavits did not assert that the test takers had a privacy right in the information. Nor were the Department's conclu-sory allegations in its pleadings sufficient to establish the factual basis for such a right, See USA Leasing, 25 P.3d at 1278. A court considering whether personal information is protected from disclosure must "ensure that documents as to which ... protection is claimed actually do in fact implicate [the individual's right of privacy]." Denver Post, 739 P.2d at 878. We therefore disagree that the Department met its burden to establish that there was no genuine issue of material fact that the test takers possessed a legitimate expectation that their personal information would not be disclosed. 138 And even if the Department's affidavits had asserted, without contradiction by *712 Todd, that the test takers had privacy interests in the information, the inquiry would not end. - While the summary judgment burden-shifting paradigm is applicable to questions of fact, it is not dispositive of legal issues relevant to the grant or denial of summary judgment. A party is entitled to summary judgment only if there are no disputed issues of material fact and the moving party is entitled to judgment as a matter of law. McDaniels, 186 P.3d at 87. A conclusory statement by a summary judgment movant on an issue of law, coupled with the opposing party's failure to dispute that statement of law in its counteraffidavits, is insufficient, by itself, to justify summary judgment. Vermont Teddy Bear Co. v. 1-800 Beargram Co., 373 F.3d 241, 244 (2d Cir. 2004); Instead, before granting summary judgment when there are no disputed issues of material fact, the court must determine whether the moving party is entitled to judgment as a matter of law. 4 Id.; see also Blocker Exploration Co. v. Frontier Exploration, Inc., 740 P.2d 983, 988-89 (Colo. 1987) (applying this principle). 189 In certain cireumstances, the constitutional right of privacy prevents the government from disclosing personal information. Nixon v. Adm'r of Gen'l Servs., 433 U.S. 425, 97 S.Ct. 2777, 53 L.Ed.2d 867 (1977), Whether CORA requires disclosure of personal information collected by the government depends on whether disclosure would do substantial injury to the public interest by invading the constitutional right to privacy of the individuals involved. Freedom Newspapers, 961 P.2d at 1156; Denver Post, 739 P.2d at 878. To make that determination, Colorado courts apply the three-factor test set forth in Denver Post, 739 P.2d at 879. Freedom Newspapers, 961 P.2d at 1156; see also Denver Policemen's Protective Ass'n v. Lichtenstein, 660 F.2d 432, 435 (10th Cir, 1981). 140 Denver Post prescribes consideration of the following three factors: (1) whether the individual has a legitimate expectation of nondisclosure; (2) whether dis-clogure nonetheless is required to serve a compelling public interest; and (3) if so, how disclosure may occur in the least intrusive manner with respect to the individual's privacy right, Denver Post, 739 P.2d at 878-79. Accordingly, although there are predicate factual issues involved in determining whether a right to privacy protects the disclosure of particular information collected by the government, the ultimate determination of whether that information is protected from disclosure is a question of law. See Nilson v. Layton City, 45 F.3d 369, 371 (10th Cir. 1995). 41 Although the district court cited Denver Post in its summary judgment order, because it viewed the lack of a disputed issue of material fact under the summary judgment burden-shifting paradigm as determinative, it did not apply Denver Post's three-factor test or make findings or conclusions with respect to those factors. Thus, even had the Department's affidavits established, without contradiction by Todd, that the test takers had a privacy right in the information collected, the court erred in granting summary judgment in favor of the Department without first concluding that it was entitled to judgment as a matter of law under the Denver Post test. T42 Accordingly, we reverse that part of the summary judgment order allowing redaction of the test takers' personal information and remand for further proceedings. 5 If the same issue arises on remand, the district *713 court must evaluate the Department's claim that disclosure of the test takers' information would do serious injury to the public interest under Denver Post's three-part test. 148 Regarding the first factor of the test, "[e}xpectations of privacy are legitimate if the information which the state possesses is highly personal or intimate." Layton City, 45 F.3d at 372; Mangels v. Pena, 789 F.2d 836, 839 (10th Cir, 1986). For example, in Freedom Newspapers, this court held that public employees' pension rights were not "so intimate, personal, or sensitive that disclosure of such information would be offensive and objectionable to a reasonable person." Freedom Newspopers, 961 P.2d at 1156. $44 Likewise, an individual cannot have a legitimate expectation of nondisclosure if the information is readily available to the public Layton City, 45 F.3d at 872. Accordingly, an individual does not have a legitimate expectation of nondisclosure in government arrest 'records, see Paul v. Davis, 424 U.S. 698, 713, 96 S.Ct. 1155, 47 L.Ed.2d 405 (1976), most judicial proceedings, see Cox Broad. Corp. v. Cohn, 420 U.S. 469, 492, 95 S.Ct. 1029, 43 L.Ed.2d 328 (1975), and information contained in police reports, see Layton City, 45 F.3d at 372; Scheetz v. Morning Call, Inc., 946 F.2d 202, 207 (8d Cir. 1991). Nor does an individual have a legitimate expectation of nondisclosure of information concerning unlawful activity. Mangels, 789 F.2d at 839. 145 Also, for the test takers to have a legitimate expectation of nondisclosure under the first factor of the test, the disclosure of the information sought by Todd must actually permit Todd or anyone else to determine the identity of the test takers. 6 " 46 Other considerations under this factor include whether the privacy rights, if any, of persons who took the test and had a breath alcohol level below the lawful levels for drivers are materially different from the rights, if any, of persons who took the test and had a breath aleohol level that exceeded those levels. See McTimmonds v. Alcohol & Drug Testing Servs. LLC, Civ. No. 2:14-2124, 2014 WL 6835636, at *2-*3 (E.D.Cal. Dec. 3, 2014) ("Plaintiff has made no attempt to identify a privacy interest in his positive breathalyzer results such that they would constitute 'private facts." "). 147 If no legitimate expectation of nondisclosure exists, the inquiry ends, and disclosure of the requested information is required under CORA. If, however, the test takers have a legitimate expectation of nondisclosure, factors two and three of the Denver Post test must be addressed. 148 Regarding the second factor, Todd has not identified any compelling public interest that would require disclosure even if the test takers have a legitimate expectation of nondisclosure, and we note that the existing record is sparse regarding any such compelling public interest in the disclosure of the information that Todd seeks. But at least in the first instance, that is for the district court to decide. . «[ 49 If the court determines that disclogure would serve a compelling public interest, the ordered disclosure must be tailored under the third factor of the Denver Post test to minimize the intrusion of any right to privacy the test takers - may have in the information. © III. Conclusion - T50 The judgment 'is affirmed in all respects except as to the redaction of the test takers' date of birth, case number; and date and time of offense, As to those redactions, the . judgment .is reversed and, the case is remanded for further proceedings, JUDGE TAUBMAN and J UDGE HAWTHORNE concur. __/ Footnotes [1] Todd hamed two employees of the Department as defendants who are also appellees: Ann Hause, Director of Legal and Regulatory Compliance, and Jeffrey A. Groff, Program Manager for the Evidential Breath Alcohol Testing Program. The Department denied that those individuals were custodians of the records within the meaning of CORA, and because of its disposition of:the case, the district court never resolved that issue. Nor do we. Our disposition requires the court to determine whether the Department must disclose certain records. The presence or absence of the individual defendants is immaterial to this determination. Under these circumstances, we do not further refer to the individual appellees. [2] Even if the affidavits did contain opinions regarding the ultimate issues in the case, they would not be objectionable on that basis. "Testimony in the form of an opinion or inference otherwise admissible is not objectionable be *710 cause it embraces an ultimate issue to be decided by the trier of fact." CRE 704. [3] Todd also argues that the substantial injury exception only requires the redaction of the operators' information that could potentially give a third party access to the Intoxflyzer 9000s. He thus contends the operators' other personal information was improperly redacted. We reject this argument because the Department met its *711 summary judgment burden that disclosure of the personal information at issue could give unauthorized persons access to the Intoxilyzer database. Todd failed to meet his burden to demonstrate that there remained disputed issues of material fact on this question: [4] Whether, identifying information of Intoxilyzer operators is subject to CORA disclosure, the issue addressed above, is an entirely different question from the one addressed here. The Department established in its summary . judgment affidavits the factual proposition that the security of the Intoxilyzer system would be compromised by the disclosure of that information. That factual showing sufficiently established that, without regard to the privacy rights of any individuals, substantial injury to the public interest would result if disclosure were permitted, The summary judgment burden then shifted to Todd on this factual issue to establish a disputed issue of material fact. Because Todd failed to do so, the court correctly granted summary judgment to the Department. [5] This disposition does not necessarily require the district court to hold a trial, The court, in its discretion, may entertain another summary judgment motion from either party addressing the same issue. [6] We cannot tell from the record whether the "case number" associated with a particular In-toxilyzer test is the case number for that particular test or the case number of a related criminal or civil case. If the latter, publicly available statewide databases would easily permit identification of the person who took the test. See, eg., ' LexisNexis Colorado Courts Record Search, hitp://permg.cc/RAP3-E3PC, But if the former, it is unclear how the case number would permit identification of the test taker