The Experton Group Blog: Metadata and the Law

The Arizona Supreme Court unanimously ruled that hidden data embedded in electronic public records must be disclosed. In a similar case last year a Washington state appellate court ruled that metadata in e-mail received by a city's deputy mayor was a public record.

Last month the Arizona Supreme Court, in a unanimous decision, overturned lower courts' rulings and is one of the first decisions by a state appellate court on whether a public records law applies to so-called "metadata" or data about data. Metadata can show how and when a document was created or revised and by whom. The information is not visible when a document is printed on paper nor does it appear on a screen in normal settings.

The Arizona ruling was part of a case involving a demoted Phoenix police officer's request for data embedded in notes written by a supervisor. The officer got a printed copy of the records but said he wanted the metadata to see whether the supervisor backdated the notes to a date prior to the officer's demotion. The Associated Press and other media organizations filed briefs asking the court to rule that the public records law applies to metadata.

In a similar ruling in Washington State, an appellate court ruled that metadata in e-mails was part of the public record. Unlike Arizona's public records law, the Washington law specifically states the data is subject to disclosure. The case is now pending before the Washington Supreme Court.

On the other hand, high-level leaks are driving efforts to strip hidden metadata from documents. For example, when the New England Journal of Medicine used a word-processing function to reveal that Merck & Co. had deleted study data about Vioxx and heart attacks, the pharmaceutical giant joined a long line of organizations bitten by information lurking in electronic files. It has happened to those in the White House, the Pentagon, the British prime minister's office and the United Nations. In each case, users made minor electronic adjustments to documents to air juicy details not meant for public disclosure – such as the true author of a file or sensitive data hacked from a final draft. These high-profile leaks are driving new efforts to keep metadata private.

The inclusion of metadata into the public record is not new and is reasonable. However, its implications are not understood today by most non-technical individuals, which can result in wasted attempts to doctor information.

Experton Group believes metadata should be included in the public record and business executives should view this inclusion as part of its data governance policy. By making it a corporate policy, knowledge of metadata capture and disclosure becomes a requirement for communications and education of employees on the topic. IT executives should work with corporate communications, human resources and legal staff to incorporate the policy into the company's ethics guidelines and develop an appropriate metadata communications plan.