If you work on U.S. privacy compliance, you've probably used the phrase "publicly available information" to exclude a data set from regulation. The exemption is real, but it's not uniform across states. Each state defines the term differently, and assuming it's a single national concept can lead to misclassification.
These myths persist because the term sounds intuitive, early state laws seemed similar, and many vendors simplify the differences. Let's debunk five common assumptions and explore practical alternatives.
Note: This post doesn't list each state's statutory text. Definitions vary and change, so always check the current definition in each state's statute.
Myth 1: "If it's publicly available, it's out of scope."
Reality: The exemption applies to specific categories of information, not just anything found online. State laws often tie the exemption to criteria like the source (e.g., government records) or how the information was made public. Just because data is accessible online doesn't mean it meets the statutory definition.
Finding data on the internet doesn't determine its legal status. It's crucial to verify whether the data falls within the relevant state's definition.
Myth 2: "Every state defines the term the same way."
Reality: This assumption can be costly. Definitions vary in who must have made the information public, what sources are lawful, and what businesses must believe about the information's status. A data element that qualifies in one state might not in another, making a single classification rule ineffective.
Privacy officers should maintain a state-by-state comparison of definitions, including statutory citations and verification dates. If your team can't specify which definition a decision relied on, you can't defend that decision later.
Myth 3: "A regulator will read the exemption as broadly as we do."
Reality: Privacy statute exemptions are usually read narrowly, and the burden of proof lies with the entity claiming the exemption. Regulators, including the Federal Trade Commission, focus on actual practices and whether a company's actions match its claims. Defending a privacy program requires a clear rationale, not just a conclusion.
Documenting why a data set was treated as publicly available, which definition was applied, and who approved it is crucial. A well-documented rationale is more valuable than an interpretation that can't be reconstructed.
Myth 4: "Public status is a property of the data, so we classify once."
Reality: Whether information qualifies can depend on changing factors, like whether access was restricted or if the data was combined with other information. Classifying once and never revisiting assumes a fixed legal status.
Data governance teams should include re-evaluation triggers in their workflows. These can include changes in source terms, new state laws, amended definitions, or new data uses. Classification should be a control with a review cycle, not a one-time label.
Myth 5: "Publicly available data carries no downstream obligations."
Reality: Even if the exemption applies, it doesn't eliminate other program obligations. Public data combined with non-public data may not qualify. Inferences, profiles, and identifiers can fall outside the exemption. When data flows through consent-driven activities, like Behavioural Advertising, the exemption for one input doesn't negate processing or disclosure obligations.
Misclassification is a compliance failure. If a data set is wrongly treated as exempt, you might process personal information without honoring rights like access, deletion, or opt-out.
What to Do Instead
Replace assumptions with a repeatable process:
- Build a definition matrix. Record each state's statutory definition, citation, and last review date. Assign an owner.
- Classify by element and by state. Test specific data elements against relevant definitions for the individuals concerned.
- Document the rationale. Record the data source, definition applied, reasoning, and approver. Ensure it's understandable to outsiders.
- Set re-evaluation triggers. Link reviews to new laws, amended definitions, source changes, and use changes.
- Test combined records separately. Assume aggregation and inference can take a record outside the exemption until verified.
- Default conservatively when uncertain. If you can't support the exemption, treat the data as in scope. Handling extra rights is cheaper than defending a wrong decision.
The term "publicly available information" will keep evolving as states amend their statutes. Teams that treat it as a documented, state-specific decision will adapt. Those using it as a shortcut will face challenges when definitions diverge.
