THE FOIL REQUEST FOR THE NAMES AND EMAIL ADDRESSES OF THE SUBSCRIBERS TO A TOWN’S ONLINE ALERT SYSTEM SHOULD HAVE BEEN DENIED AS AN UNWARRANTED INVASION OF PRIVACY (CT APP).

The Court of Appeals, reversing the Appellate Division, in a full-fledged opinion by Judge Rivera, determined the disclosure of the names and email addresses of subscribers to the Town’s online news alert system would constitute an unwarranted invasion of privacy:

The Town uses a notification system called “E-news” to send subscribers email alerts regarding news, updates, or announcements relating to the Town. Petitioner James Russell submitted a FOIL request to the Town seeking disclosure of the names and email addresses of all residents of the Town who subscribe to E-news. Petitioner’s FOIL request relied on the Appellate Division’s decision in Matter of Livson v Town of Greenburgh, which held that a neighboring town was required under FOIL to disclose a similar email subscriber list for its electronic news service because the town had failed to “articulate any privacy interest that would be at stake” (see 141 AD3d 658, 661 [2d Dept 2016]). Petitioner’s request also stated that he would not reproduce, redistribute, or circulate the names or email addresses or use the information contained therein for solicitation, fundraising, or any commercial purpose—the same conditions that the court imposed in Livson … .  * * *

On one side of the scales, the subscribers have a strong privacy interest in keeping their names and email addresses confidential to avoid unwanted and unwelcome communications, and to minimize the risk of cybersecurity threats resulting from disclosure of such information. An email address, and the corresponding holder’s name, are commonly treated as personally identifying information (PII). For example, New York’s Stop Hacks and Improve Electronic Data Security Act includes email addresses, in combination with a password or security question and answer that would permit access to an online account, as an example of protected information which—if accessed or acquired without valid authorization—triggers notification to the affected persons … . …

Generally, individuals share their email address with people they know, or in exchange for a particular benefit or information that they consent to receive. They assume and rely on a common understanding that those with whom they share their email address will maintain that information private from third parties and the public at large, unless otherwise agreed or implied. * * *

The subscribers’ privacy concerns also reflect the ubiquitous use of email as a means of communicating highly sensitive private information. One’s email account generally contains a large amount of personal data. For example, medical records, job applications, consumer purchase histories, tax returns, and credit card, bank account, and social security numbers are often embedded in emails, or in documents attached to emails. In addition, people often use their email addresses as a username or user ID to log in to many different websites or access online services … . * * *

On the other side of the scales, there is no public interest served by disclosure here. Petitioner argues only that disclosure will increase public engagement on issues of community concern. Matter of Russell v Town of Mount Pleasant, N.Y., 2026 NY Slip Op 00966, CtApp 2-19-26

Practice Point: Consult this opinion for a discussion of the privacy concerns raised by the publication of one’s name and email address.