## Facts

- The New York State Department of Environmental Conservation (DEC) regulates recreational hunting and issues deer management permits (DMPs).
- DEC implemented a centralized computerized licensing database (DECALS) that included DMP-related data and extensive personal identifiers from license applications.
- Jacqueline Goyer, acting as a citizen taxpayer and as part of her Assembly employment duties, submitted a FOIL request seeking the DMP application computer file in electronic form, including file layout, code definitions, and total record count.
- DEC denied the request, asserting FOIL’s personal privacy exemption and citing security risks, including potential targeting of firearm owners and identity theft.
- DEC affirmed the denial on administrative appeal.
- Goyer commenced a CPLR article 78 proceeding to compel disclosure and sought costs and attorney’s fees.

## Issues

1. Whether DEC properly denied the FOIL request for DMP-related electronic records based on the personal privacy exemption and asserted security risks.
2. Whether FOIL required DEC to disclose non-exempt portions of the requested records through redaction rather than withholding the records categorically.
3. Whether DEC was required to provide the records in electronic form, including layout and coding information, where the data were maintained electronically and production was reasonably available.

## Decision

- The court granted the petition in substantial part.
- DECALS information constituted “records” subject to FOIL, including computerized data.
- DEC failed to justify a blanket denial under FOIL’s privacy exemption and security concerns.
- DEC was directed to produce the requested DMP-related data in electronic form, with redaction of personal identifiers and sensitive fields to address privacy and security risks.
- The court rejected the position that disclosure would require impermissible creation of a new record where DEC could extract or copy existing electronic data with appropriate deletions.

## Legal Principles

- FOIL is construed in favor of disclosure, and exemptions are narrowly interpreted; the agency bears the burden of justifying nondisclosure.
- Computerized information maintained by an agency is a FOIL “record,” and inclusion within a larger mixed-purpose database does not remove it from FOIL’s coverage.
- Where a record contains both exempt and non-exempt information, FOIL requires disclosure of the non-exempt portions with deletion of identifying or otherwise exempt details when feasible.
- Privacy and safety risks tied to specific identifying elements support targeted redactions, not categorical withholding of all related information.
- When records are maintained electronically, FOIL generally requires production in the medium maintained or another reasonably available electronic format if it can be done without undue burden or creation of wholly new substantive content.

## Conclusion

The court held that DEC could not categorically withhold DMP-related licensing data under FOIL based on privacy and security concerns and instead had to disclose the requested information in electronic form while redacting sensitive personal identifiers to prevent unwarranted invasions of privacy and related risks.


Matter of Goyer v. N.Y. State Dep’t of Env’t Conservation, 12 Misc. 3d 261, 813 N.Y.S.2d 628 (Sup. Ct. Albany Cnty. 2005)