Private Rights in Public Data?

Episode transcript:

Note: This transcript is generated from a recorded conversation and may contain errors or omissions. It has been edited for clarity but may not fully capture the original intent or context. For accurate interpretation, please refer to the original audio. 

JOHN QUINN: This is John Quinn and this is Law, disrupted, and today we’re gonna be speaking with two of my partners, Shon Morgan and Jack Baumann, who are in our Los Angeles office, and we’re gonna be talking about public information and the circumstances under which people who aggregate information that is public, who create databases, publish materials that they’ve pulled together off the internet and elsewhere in public information or research they’ve done in public sources and created some type of directory or library.

To what extent does that effort yield something that is protectable, that they can assert a property right to that you know, people can’t just use, and mine or copy, because it’s public information and we’ll, we’re going to go there, these issues arise in various contexts and we’ll begin by talking about a number of class actions that our firm has been involved in for companies like Ancestry.com, academia, ZoomInfo, and the like, where you have information.

So much information, of course, is available on the internet, histories, addresses, telephone numbers, job descriptions, genealogical information, information about your ancestors, and the like. There’s companies that put a lot of money into developing these databases, resources, based on public information. And the question that’s arising in the courts and scores of cases, class action cases, individual cases, and the like, is to what extent can the companies who compile the public information, have a protectable interest in that. And Jack, I know that you’ve been working a lot in these cases, can you kind of tee off the discussion here and tell us about what the issues are and what kinds of cases that you’ve been involved in?

JACK BAUMANN: Sure. So there’s probably two different ways to think about the attacks that are coming in these lawsuits. So one category, and I can talk about a case that we litigated recently is, people who use public records requests to come after information that while it was originally public and it’s derived from public records, has been organized and called in a way that is usable and required a lot of resources to get to that point where it’s organized so that people can use it.

So that’s sort of the first category. The second is the people whose information is in those public records, and there have been many different types of actions that have been filed by those folks saying, I have a protectable interest in my personal information that appears in these records, and that’s come in the form of various types of claims that we can talk about.

But those are sort of analytically the two different types of challenges that we’ve been seeing.

JOHN QUINN: Begin by starting with the first one, the circumstances under which a company, an enterprise that has put together a compilation of information based on public resources, under what circumstances they can actually claim a protectable interest in that.

JACK BAUMANN: So we can take a recent case as an example, and our client in that case is Ancestry.com, which is a genealogy database. People can use it to track their family histories, to build out family trees. You can find old immigration records, you can find old marriage records, and it allows you to sort of put together what your family history looks like or you know what?

JOHN QUINN: I’ll derive from public information.

JACK BAUMANN: Exactly. So what Ancestry does in many instances is it partners with government archives, and the government archives usually store these records in paper format or microfiche. So they’re there, they’re accessible to the public, but people would have to go to those archives and look at the records on site or, you know, make their own copies.

Ancestry often partners with these government archives and says, we, Ancestry, will make a big investment in digitizing these records. So take for example, our case for Ancestry in Pennsylvania. They went to the Pennsylvania Historical Museum Commission, PHMC, and they offered to digitize a bunch of Pennsylvania public records.

And what Ancestry did was invest millions of dollars in not only creating digital copies of these records, but also creating in indexes, which allow those records to be sort of usable and searchable and organized. And metadata, which sort of does the same. And in our case, there’s a plaintiff named Alec Ferretti, who is on the board of an organization called Reclaim the Records.

And what they do is utilize states’ you know, right to know laws, so access to public records.

JOHN QUINN: Laws like FOIA, the state equivalent of Freedom of Information Act requests.

JACK BAUMANN: Exactly, and their goal is to sort of build out a website that hosts this type of public record information for free. Now, the problem with how Ferretti went about it is, all of those Pennsylvania records that I just described are accessible to anyone. And you know, he could have gone and digitized and indexed and created this metadata for the records.

But instead what he did was put in a public record request to get the work product that Ancestry had created. So the digital records that Ancestry had created, the metadata that Ancestry had created, the indexes.

JOHN QUINN: So when Ancestry does its work, there’s a public body or institution that has a copy of all that.

JACK BAUMANN: Exactly. So, and that can always be accessed regardless what ends up on Ancestry site. So, you know, Ferretti could have gone to the Pennsylvania archives and made his own photocopy, created his own index, but that’s not what he did. He tried to sort of piggyback off of the investment that Ancestry had already made in creating these digital records and searchable indexes and….

JOHN QUINN: He asked for a copy of the Ancestry.com, created database from a public source.

JACK BAUMANN: Exactly. And he made that request in the lower tribunal, the office of Open Records agreed and said the Pennsylvania archive had to turn over to his organization what Ancestry had created.

JOHN QUINN: So basically they have Ancestry.com’s work product, and instead of going to Ancestry.com, he just went to the public authorities and said, gimme a copy of Ancestry.com’s work product.

JACK BAUMANN: Exactly, so the digitized images, the indexes, et cetera, and tried to get those from the Pennsylvania archive. So that issue went up on appeal.

JOHN QUINN: And was Ancestry.com the plaintiff in this, that tried to stop him from doing this? Or how does that play out in the litigation?

JACK BAUMANN: So, interestingly, the plaintiff was Alec Ferretti, and he was trying to enforce this public records request. The defendant was the PHMC, the Pennsylvania Historical Museum Commission. Ancestry initially wasn’t even involved in the case and eventually had to intervene because this was Ancestry’s material that this plaintiff was seeking from the Pennsylvania archive.

JOHN QUINN: So the Pennsylvania authorities were prepared to turn over Ancestry.com’s work?

JACK BAUMANN: Well, they were resisting it in the lawsuit, but obviously Ancestry had a meaningful invested interest in what was happening there.

JOHN QUINN: Okay. But the public authorities were sympathetic in, into Ancestry’s view were protective of Ancestry’s work product.

JACK BAUMANN: Correct. Yeah. So we were aligned with the Pennsylvania archive in this case, and adverse to Alec Ferretti, who’s the sort of open records activist.

JOHN QUINN: So at what point does, did Ancestry intervene?

JACK BAUMANN: Ancestry intervened before the Office of Open Records, which was the sort of lower tribunal that was making the initial decision as to whether this public records request would be enforced.

JOHN QUINN: That some type of administrative body rather than a court.

JACK BAUMANN: Correct.

JOHN QUINN: Okay, so what happened there?

JACK BAUMANN: So the Office of Open Records agreed with Alec Ferretti and said that by digitizing and indexing these records, Ancestry had essentially performed as an arm of the government, and performed a governmental function in, you know, preservation of these historical records and based on that argument, found that the records were accessible publicly under the right to no law in Pennsylvania.

JOHN QUINN: So they’re prepared to turn it over to him.

JACK BAUMANN: Correct. Yes. So then, obviously there was a, we took an appeal from that decision by the Office of Open Records and it went before an en banc court in Pennsylvania.

JOHN QUINN: That’s an appellate court?

JACK BAUMANN: It’s sort of a funny structure, but it’s a Commonwealth Court of Pennsylvania sitting in an appellate capacity to oversee the decisions of the tribunal, which would be the Office of Open Records.

JOHN QUINN: Okay. That’s a Pennsylvania thing. A Pennsylvania specific thing. Tribunal.

JACK BAUMANN: I also had not previously encountered that setup.

JOHN QUINN: All right, so what happened at that quasi appellate level?

JACK BAUMANN: So at the quasi appellate level, you know, our argument was essentially what Ancestry created is something entirely different than what is the underlying records. Those underlying records are always available. They’re still available through the Pennsylvania archive. What Ancestry had done is invest its own resources to make something new and different, which is this digitized, indexed, and searchable version of these records, and in so doing, it wasn’t acting as, you know, in a government capacity.

The government’s capacity is preservation of these original records. It was done doing something new and the court ultimately agreed with us and recognized that there is a difference between the underlying public records which anybody can access, and creating something new through investment that provides a different type of utility to those same records.

JOHN QUINN: Look this was, is that the end of the case now? Or where does it stand?

JACK BAUMANN: They could conceivably petition the Pennsylvania Supreme Court. But you know, that’s discretionary as to whether that case would be taken up. So it, it may be the end of the line, it may not, but that remains to be seen.

JOHN QUINN: I mean, this must come up in a lot of different contexts where you have companies or people who put an investment and time and money into assembling databases from public information. This can’t be an issue, a first impression, I wouldn’t think. Or is it?

JACK BAUMANN: For the, from the perspective of the challenge that I was just talking about, I’ve not seen that issue come up before. That seems to be distinctly a, you know, an issue of first impression. The cases that we had to rely on there involved, you know, governments outsourcing, running stadium and things like that, and trying to determine whether that makes them an arm of the government and performing a governmental function when it came to, you know, digitizing and helping to organize public records.

I don’t think that that’s come up before.

JOHN QUINN: I mean, that’s surprising to me because there’s all kinds of public information available that different companies, enterprises aggregate, whether it’s real estate records, records about jobs and people’s history, you know, all different kinds of data about people in businesses. It’s publicly available, but it’s not really, practically useful because until somebody aggregates it.

JACK BAUMANN: That’s right. And you know, the challenge, you know, this was at least to my knowledge, an issue of first impression from the perspective of somebody coming in and trying to get access to that information because it was originally the underlying records were public. What we have seen are challenges from the other side of it.

And those have been, you know, sort of long pursued by the individuals whose information is reflected in those public records. And that’s really where most of the challenges that we’ve seen have come from.

JOHN QUINN: Okay, so in info, there are people, I guess, who challenge this saying, look, you put my personal information in this database and you know, whether it’s my address or my phone number. Look, I have my cell phone number on my webpage, and my business card.

So that’s, but that’s, in a sense you could say I’ve made my cell phone number public information, but I can imagine some people objecting if you create and make publicly available, you know, an aggregation of people’s cell phone numbers, public information and addresses that some people might object to your doing that, even though in some sense it’s been put out there.

So that’s, you’ve seen some of those cases as well.

JACK BAUMANN: Yes, many. And, Shon probably would, can touch on a few.

JOHN QUINN: Tell us about that, Shon. What kinds of cases are you seeing from the other end – people, consumers, members of the public, challenging the inclusion of their information in these databases?

SHON MORGAN: Yeah, there have actually been dozens of these class actions over the last five or six years, and one category is what you mentioned, John, is that there are a number of companies such as ZoomInfo or Spokeo or Whitepages.com and people connect who, sort of mine information off the internet and other public sources of the kind that you were talking about; phone numbers, job titles, business contact information, and they sort of repackage this and put it behind paywalls in various forms.

And look, this is, serves a very useful function for the consumers of such information because it’s one thing to go to Google or other search engines and, and just, you know, put in a person’s name or, if you’re searching for someone to fill a particular role in your company, you’ll get a set of search results, but they’re not going to be as useful and as targeted as what these companies do, which is really curate this information for specific needs.

So, you know, if you are the head of a law firm and you’re looking for a new head of AI infrastructure, you’re gonna get a different result if you just Google people who do that job versus going to somebody like ZoomInfo, who can really target, you know, who has expertise in this field, in your area, geographically, their years of experience, you know, you’ll get a tremendous amount of valuable data from these sources.

But as you said, the people who are, you know, essentially the constituents who make up these databases are now suing via plaintiff’s lawyers in class actions alleging that the constituents of this data are the real value drivers here. Yes, you put this together but, you know, their argument would be that this is only valuable because it is a collection of lots of individuals data. And those individuals should have a right to control that. And, you know, there’s some instinctual, you know, attraction to that view.

People don’t want their identities misused. They don’t want false endorsements.

JOHN QUINN: I can see, I mean, this has privacy implications. I can see people saying, for example, yeah, okay, I may have put my cell phone number on my business card, I may have put it on my webpage, but I didn’t do that with a view to somebody else profiting from it. There’s a difference between my making that public in a sense, and somebody else taking that and making a buck off my personal information.

SHON MORGAN: And you’re hitting on exactly the tension. So you’ve got on the one hand information that somebody has already made public was voluntarily shared, and in most cases doesn’t have any individually marketable value. There’s nobody, there’s no broker out there for this information where you can go sell it yourself.

But the objection is, as you just stated, that another company is clearly, you know, making money off the use of this and, you know, the claim is that there’s something, you know, must be wrong. That, and then the, the wrong with that. And the hook is trying to find, you know, a legal doctrine that fits that because, you know, there aren’t clear laws that deal with that.

And so historically what they are trying to fit this into is a right of publicity claim.

JOHN QUINN: That’s obviously a preacher of state law and I know in some states, California for one, I think had the first such law, you know, there we’re talking about statutory claims at this point.

SHON MORGAN: There are statutory claims. Most states, in fact, don’t have statutory right of publicity claims. Some have common law ones. As you mentioned, California was the first and it grew up around the entertainment industry, and so you had celebrities who had, you know, valuable rights in their persona, you know, Humphrey Bogart was a recognizable character and people could try to use his persona to, you know, market their car wash or their, you know, dry cleaner.

JOHN QUINN: For commercial use.

SHON MORGAN: Right? And so that was the intent originally of these laws. They weren’t typically by their face limited to celebrities, even though that was the core intent because the legislatures wanted to leave open the possibility that somebody who was a non celebrity could still have a marketable value in their persona.

But because of the breadth of those laws, the plaintiff’s lawyers have been able to essentially get past the pleading stage on many of these cases, saying that, you know, even though there isn’t an identifiable market for, you know, John Smith from Albuquerque’s name or phone number, clearly these companies are finding a way to monetize it and they’re sort of looking backwards from what the company has done with that information to say, well, there must be value there, and I, as the person who, you know, owns that name, should have a property interest in it.

Now, the law is interesting because the law on these cases says you can’t look at the defendant’s profits from this or their ability to market it.

You have to show on the front end that the plaintiff has a valuable interest in this name itself.

JOHN QUINN: Well, for your average John Smith, that’s gonna be hard to do, I would think.

SHON MORGAN: But courts are letting this past the pleading stage. And you know, as with all class actions, if you get past the pleading stage, there’s tremendous pressure on the companies because all of these statutes come with statutory damages provision. So there’s a standing issue about whether they can show that they were actually harmed.

But if they can show that they can obtain statutory damages per use of, you know, often up to like $5,000. And so for a company like Ancestry who’s got tens, hundreds of millions of these records, it’s, you know, enterprise threatening liability. And, you know, the plaintiffs are, once they get through the pleading stage, they’re in the game.

They get discovery on this.

JOHN QUINN: Presumably in the case of Ancestry.com, most of the people whose names are in the records are not living, and they’re not be in a position to make a claim. It’s only the current generation.

SHON MORGAN: Correct. But they’re still, you’re talking about tens or hundreds of millions of folks at issue. And so the numbers are staggering,

JOHN QUINN: You know what, this reminds me of the data breach class actions we’re seeing, you know, when data breaches were first a thing, you remember the hacking into, Sony studios, when they were making that movie about the leader of North Korea and the North Koreans were not amused by the movie, and they dispatched hackers and, and hacked into Sony’s records published all kinds of emails and information class actions were filed, but that was very early on.

That was probably a decade ago and those cases settled for bupkis, basically because I don’t think there was a plaintiff’s bar that had yet figured out how to monetize that. But we now have a very sophisticated plaintiff’s bar in the data breach class actions world, where they have whole theories about damages from like, you know, my data, it’s, you know, data is the new oil data is valuable.

My information may be only worth $3, but data’s valuable. You were, you held my data, you know, you had duties to me to protect it, like medical monitoring. Now for the rest of my life, I’m gonna have to be checking and monitoring to see if anybody uses my credit card. They have these various theories about attaching damage figures to these breaches and, and publishing their information.

And, you know, the individual numbers may be very, very small, but if you’re talking about 50 million people, it adds up.

SHON MORGAN: Yeah, and it’s, you draw a good analog. I mean, one of the, the fault lines in the data breach cases, that surprisingly still after all these years, hasn’t really been definitively resolved is to establish standing, do you have to show that you know, your data was actually used, or it’s just the mere threat that it was breached and might be misused sufficient for standing?

And the analog in these cases is when a company puts your information into a database. Nobody’s accessed it, right? It takes a user to go out and say, well, I wanna know about John Quinn and see his yearbook photo from 1976. It’s just sitting in a database. And so that’s been a question in these cases, are complainants established standing if they can’t show that their information has ever been accessed?

JOHN QUINN: Yeah, so I guess under Spokeo, if I recall, you don’t have standing unless you actually have some harm. I mean, that’s a first question before you even get to damages. But as you say, if they can get past the pleading stage, then there’s a significant exposure potentially for the defendant in these class actions.

SHON MORGAN: And like in Spokeo and the data breach cases, what a lot of the plaintiffs here have tried to claim as emotional distress harm, psychic harm from the mere fact that their information is out there and might be misused, some courts have given credence to that at the pleading stage. Some haven’t.

JOHN QUINN: So some of these cases are getting past the pleading stage. Ha ha. Is there any emerging law from this or are these cases still too early to see what direction the courts are gonna go?

SHON MORGAN: Not in a systematic way for business to make really informed decisions. We’ve won, I think we’ve won the only case at the pleading stage in one of these cases. We’ve won some cases at summary judgment, on the argument I was just talking about that the name plaintiff could not show that their data had actually ever been accessed.

And so it’s actually, you know, somewhat difficult for the plaintiff’s lawyers to find a name plaintiff who can show that their information has been accessed and used, you know, of the tens of millions of people whose records are out there only a small portion get accessed and so it’s not as easy as you might think for them to find a name plaintiff who can concretely say my information has been been used.

So some cases have been shut down on those grounds, but in terms of business guidance and how a company can ensure that it’s structured this in a, you know, enforceable non liability inducing way – no, I think the lines are still very much unclear and, you know, some of the companies have tried to use sort of opt-out procedures to say, if you object to this, then we’ll remove your information from the database.

But of course, the plaintiff’s lawyers are saying, you know, most people don’t even know my information is in the database. You know, that’s not an effective way to protect rights. So, you know, that’s an unresolved issue as well.

JOHN QUINN: So what I’m hearing is, on the one hand, if you’re an aggregator, someone who builds one of these databases based on public information, you may well have a protected property interest in that but you may be facing claims from people whose information is in that database saying, wait a second, you know, your property interest, you’re a commercial profit making enterprise, and my information may be publicly available, but I never agreed that you could go out and profit from it. I mean, is that kind of a fair summary of what you’re saying?

SHON MORGAN: Yeah, that’s exactly where we stand.

JOHN QUINN: Now we were, our firm was involved in, this is probably completely different and it may be a detour, but I’m interested in your reaction to this. Our firm was involved in a case called, HIQ versus LinkedIn many years ago, which has become a leading case on whether parties can scrape information from websites and use information that’s publicly available.

In the case of LinkedIn information, I think HIQ was scraping information off of LinkedIn and using it for its own purposes. LinkedIn objected to that. I get, I assume, I wasn’t involved in the case personally, but I assume that they’re making a similar argument that, you know, this is a database that we’ve spent a lot of time on. We maintain, we collected this information, we have a property interest in it.

In that case, LinkedIn’s position was not upheld. The scraper, our client HIQ’s position was upheld. Does that have any relevance here or what’s your thinking about that case and how it relates to the work that you’re doing?

SHON MORGAN: Well, I mean, what you’re describing is sort of the third variant, right? So we’ve got people who claim the information at its creation is not protectable. Then you’ve got constituents who are saying, this is my personal information that’s being used and what you just described is another version of this, which is businesses scraping from other businesses and the two of them having litigation over this.

And so yeah, there is that variant as well, where companies have the ability to crawl on the internet and mine information from other for-profit sites, not just information that’s out there, you know, publicly, like the Quinn Emanuel website.

And there has been some litigation along those lines too. And I think that’s another area where the lines are not completely defined. You know, for instance, can I have a company that goes, and even if I’m not taking data from that another website, can I overlay my search capabilities onto that other website and say, oh, you can use my search function on this website.

I’m not really disturbing your website, I’m not accessing it or changing it, but I’m overlaying my capabilities onto that and sort of piggybacking. And so we’ve seen claims on that issue as well, so that, you know, there are all sorts of variants, you know, anytime I think you’ve got successful product that’s been monetized, you’re gonna have people fighting about, you know, who’s got ownership rights in it.

JOHN QUINN: This is really interesting ’cause so much information is available, it’s freely accessible from public sources on the internet and it really does raise the question under what circumstances can others create things which are in effect or really property interests, protectable property interests from assembling that information.

And on the other side, what kinds of claims might they be facing from people whose data is collected?

SHON MORGAN: And historically, you know, you see analogs for patent and copyright, right? That’s exactly what they’re trying to strike a balance between is who has added value here that we need to protect as a property? Right? What’s interesting here is that these historical structures, whether it’s, you know, copyright, right of publicity laws, some of the privacy laws.

They’re not really keeping pace with the realities of the technological change. And so, you know, a lot of these privacy laws, for instance, about publication of cell phone numbers, those statutes were enacted in a completely different context with very different interests in mind, and now they’re being applied in a completely different age where, you know, there are vastly different concerns at issue.

So it’s almost impossible for legislatures to keep pace with change. And so the courts are being left to decide these on an ad hoc basis. And when you’re a business trying to plan and assess liability, you know, that’s a very difficult space to be in because you don’t know where the rules are going to ultimately, you know, come down.

JOHN QUINN: Yeah, we’re seeing this in so many different areas. AI being another obvious one about traditional legal concepts being adapted to changes, new situations, novel situations, which are posed by the new technology. Is there anything, guys, is there anything else we should talk about here or we basically covered it, do you think?

SHON MORGAN: I think that’s it.

JOHN QUINN: That’s it. Okay.

JACK BAUMANN: No, I think we covered it.

JOHN QUINN: Thanks very much, gentlemen. This is John Quinn. This has been Law, disrupted. We’ve been speaking with my partner Shon Morgan and Jack Baumann about the availability of information and the legal liabilities that it’s presenting. Lemme start that over again. This has been John Quinn. This has been Law, disrupted.

We’ve been speaking with my partner Shon Morgan and Jack Baumann about the availability of public information. And the legal liabilities that that creates. And that’s a wrap.

---

Published: Apr 24 2026