122nd Group, LLC v. Department of Consumer & Business Services

TOOKEY, J. Petitioner, 122nd Group, LLC (122nd), seeks judicial review of a final order of the Department of Consumer and Business Services (DCBS). In that order, DCBS held that 122nd had violated ORS 646A.620(l)(c)1 when it hired a cleaning company that threw out boxes containing its previous tenant’s customers’ Social Security numbers in its dumpster, and assessed a $5,000 civil penalty against 122nd. Because it is dispositive, we address only the first of 122nd’s three assignments of error. In that assignment, 122nd argues that DCBS’s and the administrative law judge’s (ALJ) interpretation of the phrase “otherwise make available to the public” in ORS 646A.620(l)(c) “greatly expands the breadth” of the statute. 122nd contends that the statutory prohibition on publicly posting or displaying Social Security numbers under ORS 646A.620(l)(c) does not extend to placing an evicted commercial tenant’s belongings in a private dumpster. We agree with 122nd and reverse. 122nd does not challenge the findings of historical fact made by the ALJ and adopted by DCBS. Jefferson County School Dist. No. 509-J v. FDAB, 311 Or 389, 393 n 7, 812 P2d 1384 (1991) (unchallenged findings of fact are the facts for purposes of judicial review of an administrative agency’s final order). Those findings include the following: “[122nd] is a commercial landlord, and David Mclnnis is the managing member of the LLC. “Agape Home Mortgage, Inc. (‘Agape’), formerly an Oregon licensed mortgage lender, was a tenant of [122nd] at 12143 NE Halsey Street in Portland. Bill Mclnerny was the president and owner of Agape, and George Elliott was the general manager. [122nd] was aware that Agape was a mortgage company. “Agape was having financial problems in the summer of 2011. As of August 2011, it had not paid its rent to [122nd] in several months. During that period of time, Mclnerny told Elliott to box up all of the mortgage records in the — 211 — office. Elliott removed the records from the filing cabinets and put them in boxes. He filled over 30 boxes with mortgage records and placed them in the room where Mclnerny had told him to put the records. “Late in the summer of 2011, [122nd] came into possession of the Agape mortgage records when [122nd] evicted Agape and locked out its employees. [122nd] would not allow Elliott to retrieve the boxed mortgage records or his own personal effects from the offices. “After locking Agape out, [122nd] hired a ‘cleaning company’ to clean out the property and did not give the ‘cleaning company’ any direction regarding disposal of the personal property in the office. No instructions were given to the ‘cleaning company’ other than to clean out the premises and to make it ready for the next renter. “[122nd’s] ‘cleaning company’ placed the 30 boxes of mortgage records into an unlocked ‘dumpster’ garbage receptacle on [122nd’s] premises. The dumpster was in a parking lot, close to the street and to a neighboring restaurant.” (Internal citations omitted.) Elliot retrieved six of the boxes from the dumpster and turned them over to an investigator for the Division of Finance and Corporate Securities (the enforcement division) of DCBS. After reviewing the files and determining that they contained unredacted Social Security numbers, the enforcement division cited 122nd with violating ORS 646A.620(l)(c). The enforcement division issued a proposed order concluding that 122nd had “violated ORS 646A.620(l)(c) by publicly posting, displaying or otherwise making available to the public the unredacted Social Security numbers of consumers when the Agape mortgage records were discarded” and assessing a $5,000 civil penalty. 122nd requested an administrative hearing to challenge the proposed order. Both parties moved for summary determination before the ALJ. The enforcement division argued that 122nd made the Social Security numbers available to the public and pointed to a dictionary definition of “available” as “that is accessible or may be obtained.” Webster’s Third New Int’l Dictionary 150 (unabridged ed 2002). The — 212 — enforcement division also submitted several exhibits to demonstrate that rummaging through other peoples garbage, i.e., dumpster diving, in Portland is a popular activity. Those exhibits included, among other things, instructions on how to properly dumpster dive and copies of several posts on the internet to local dumpster diving blogs. 122nd responded that it did not make the Social Security numbers available by placing them in its dumpster because, given the context of ORS 646A.620(l)(c), a more appropriate definition of “available” is “present or ready for use.” Merriam-Webster Dictionary, http://www.merriam-webster. com/dictionary/available. The ALJ agreed with the enforcement division’s interpretation of the phrase “otherwise make available” in ORS 646A.620(l)(c), granted the enforcement division’s motion for summary determination, and issued a proposed order concluding that 122nd had violated ORS 646A.620(l)(c) and proposing that 122nd be required to pay a $5,000 civil penalty. 122nd filed exceptions to the ALJ’s proposed order with DCBS. 122nd contended that the ALJ’s interpretation of “otherwise make available” expanded the breadth of the statute and, as a result, “[t]he proposed order should be amended to state that the placement of documents in the dumpster does not fall within the scope of ORS 646A.620 and that no violation of that statute occurred.” DCBS agreed with the ALJ’s interpretation of ORS 646A.620 and concluded that “placing the unredacted records in an unlocked dumpster constitutes making the records available to the public” because “[disposing of the records in such a manner resulted in the records being insecurely discarded, and * * * accessible to persons in the trash removal and disposal chain, as well as those who may engage in dumpster diving.” DCBS issued a final order concluding that 122nd had violated ORS 646A.620(l)(c) and assessing a $5,000 civil penalty for 122nd’s violation. On judicial review, 122nd argues that, by including the phrase “otherwise make available to the public” in ORS 646A.620(l)(c), the legislature did not intend to make a landlord liable for placing an evicted commercial tenant’s abandoned belongings in the landlord’s own dumpster. DCBS responds that its “interpretation of ORS 646A.620(l)(c) — 213 — is entirely consistent with the legislative intent underlying the Consumer Identity Theft Protection Act: to deter identity theft and protect consumers.” We review DCBS’s legal conclusions, including its interpretation of a statute, for legal error. Topaz v. Board of Examiners for Engineering, 255 Or App 138, 144, 297 P3d 498, rev den, 353 Or 714 (2013). When we interpret a statute, “[w]e ascertain the legislature’s intentions by examining the text of the statute in its context, along with any relevant legislative history, and, if necessary, canons of construction.” State v. Cloutier, 351 Or 68, 75, 261 P3d 1234 (2011). ORS 646A.620(l)(c) provides: “Except as otherwise specifically provided by law a person shall not: «‡⅜⅜⅜* “(c) Publicly post or publicly display a consumer’s Social Security number unless redacted. As used in this paragraph, ‘publicly post or publicly display’ means to communicate or otherwise make available to the public.” A “consumer” means an individual resident of Oregon. ORS 646A.602(2). The legislature included the phrase “otherwise make available to the public” in the definition of “publicly post or publicly display,” but did not specify what constitutes otherwise making a Social Security number available to the public. See State v. Couch, 341 Or 610, 617-19, 147 P3d 322 (2006) (when the legislature has expressly defined a term in a statute, we are “obliged to apply the legislature’s definition,” and we employ our standard methods of statutory interpretation to examine that definition). Thus, we will begin by determining the plain and ordinary meanings of “make” and “available.” See State v. Gaines, 346 Or 160, 175, 206 P3d 1042 (2009) (using dictionary definitions to discern the plain, natural, and ordinary meaning of terms). “Make” in this context means “to cause to be or become : put in a certain state or condition,” Webster’s at 1363, and “available” in this context means “that is accessible or may be obtained,” id. at 150. But the phrase “make available” — 214 — does not stand alone; it is immediately preceded by the word “otherwise,” and the phrase “otherwise make available” is a nonspecific phrase that follows the specific term “communicate.” Under these circumstances, it is appropriate for us to examine what it means to “communicate” to determine the meaning the legislature intended for the phrase “otherwise make available.” See State v. Snyder, 337 Or 410, 424, 97 P3d 1181 (2004) (“‘Otherwise’ is a comparative word; that is, to construe properly the meaning of the word that ‘otherwise’ is modifying, we must examine the concept or word to which that modified word is being compared.”); State v. James, 266 Or App 660, 668-70, 338 P3d 782 (2014) (using Snyder analysis to interpret the phrase “otherwise make available” as used in ORS 471.410(2), the statute prohibiting furnishing alcohol to minors, in light of the specific comparative terms to “sell” and to “give,” and noting that under the principle of ejusdem generis, we ordinarily assume that a nonspecific term in a series shares the same qualities as the terms that precede it). “Communicate” is defined, as relevant, as “to make known : inform a person of: convey the knowledge or information of[.]” Webster’s at 460. Because a feature of the specific term “communicate” is to make information known, that suggests that a person “otherwise make[s] available” a Social Security number when that person causes a Social Security number to be known or knowable as a result of its accessibility. Importantly, a person also needs to cause the Social Security numbers to be accessible to the “public.” See id. at 1836 (relevant dictionary definition of “public” when used as a noun is “the people as a whole : POPULACE, MASSES”). Thus, the inclusion of the word “public” shows that mere accessibility to a few is not enough to fall under the provisions of ORS 646A.620(l)(c). Cf. State v. Love, 271 Or App 545, 554-56, 351 P3d 780 (2015) (under disorderly conduct statute, ORS 166.025, defendant must consciously disregard an unjustifiable risk that his behavior would affect the public in general, not just specific individuals). Considering the terms “make,” “available,” and “public” in their immediate context, we conclude that to violate the provisions of ORS 646A.620(l)(c), a person must cause Social Security numbers to be accessible to the public at large. — 215 — Our interpretation is also compatible with the broader context of the identity theft protection statutes. DCBS concluded that “[disposing of the records in such a manner resulted in the records being insecurely discarded, and * * * accessible to persons in the trash removal and disposal chain, as well as those who may engage in dumpster diving.” ORS 646A.622 specifically addresses the safeguards that must be developed, implemented, and maintained “to protect the security, confidentiality and integrity” of a consumer’s Social Security number — including safeguards for the disposal of Social Security numbers. That statute applies to any person who “owns, maintains or otherwise possesses data that includes a consumer’s personal information,” including a Social Security number, ORS 646A.602(ll)(a)(A), “that is used in the course of the person’s business, vocation, occupation or volunteer activities.” ORS 646A.622(1). Subsection (2) of ORS 646A.622 specifies how a person may comply with subsection (1), including implementing physical safeguards to dispose of such personal information “by burning, pulverizing, shredding or modifying a physical record.” ORS 646A.622(2)(d)(C)(iv). That statute does not encompass a commercial landlord, like 122nd, who did not own, maintain, or otherwise possess the Social Security numbers for the landlord’s use in its own business, vocation, occupation, or volunteer activities. Essentially, DCBS’s interpretation of ORS 646A.620(l)(c) would require 122nd to meet the safeguarding and disposal standards for businesses that collect Social Security numbers for their own use under ORS 646A.622. In our view, the legislature did not intend ORS 646A.620(l)(c) to be construed in such a manner. See ORS 174.010 (when we construe statutes, we do not “insert what has been omitted,” or “omit what has been inserted”); Jordan v. SAIF, 343 Or 208, 218, 167 P3d 451 (2007) (where legislature includes particular procedures in one section of statute, but not another, court presumes that omission is purposeful). If the legislature had intended to incorporate safeguarding and disposal standards into ORS 646A.620, it could have done so as it did in the other section of the Oregon Consumer Identity Theft Protection Act, ORS 646A.622, but it did not. — 216 — In sum, we conclude, from the text and context of ORS 646A.620(l)(c), that a person “otherwise make[s] available” another person’s Social Security number to the public when the person causes the Social Security number to be accessible to the public at large, not just dumpster divers and persons in the trash disposal business. Here, the Social Security numbers were not made available in a way that caused them to be accessible to the public at large. Reversed. Footnotes [1] ORS 646A.620 (l)(c) provides, in part, that “a person shall not * * * [plublicly post or publicly display a consumer’s Social Security number unless redacted. As used in this paragraph, ‘publicly post or publicly display’ means to communicate or otherwise make available to the public.”