Denver’s Office of the Clerk and Recorder does not have a consistent practice of redacting personal identifying information for city records, and denied auditors access to relevant information for their examination into the recording division, Auditor Timothy M. O’Brien’s office disclosed in a report released on Thursday.
“The office operates without sufficient policies and procedures and is not taking adequate measures to protect individuals’ personally identifiable information,” wrote O’Brien, noting his office conveyed some of its recommendations confidentially to the clerk because of the “sensitive nature” of some information. “We also note that office leadership initially denied our ability to access copies of legal documents required to complete our analysis. We encountered significant delays before the information was eventually provided.”
The clerk and recorder administers elections for Denver, handles foreclosures and collects ethics disclosures, but its recording division enters into county records real estate documents, marriage and civil union licenses.
The current clerk, Paul López, asked the auditor to review recording protocols shortly after his election in 2019. In response to the findings, the clerk’s office indicated it had adopted a strategic plan as of last month to address gaps in its records management.
“When Clerk Lopez requested this audit, he invited recommendations to improve operations, including additional controls to promote the privacy of personally identifiable information under public records statutes,” wrote Victoria Ortega, the deputy clerk and recorder. “He, like many public records custodians, wrestles with the long-standing problem of protecting individual privacy rights while at the same time ensuring public access to the public land records system.”
When a person submits a document to the office for recording, staff digitize and upload the paperwork into a publicly-searchable database, containing records dating to 1859. Not all types of information are retained permanently, but the clerk’s office may destroy paper records or erase electronic ones if they are eligible.
After auditors noted the lack of a strategic plan for records management, officials from the clerk’s office blamed López’s predecessor, Debra Johnson, for leaving “no documented policies or procedures to review when the new administration took office, and they had to first focus on understanding day-to-day work and ensuring that work was being performed correctly.”
Partly as a consequence, the recording division had no plan or timeline for digitizing records, and staff had no idea exactly how many records have yet to be scanned. The one employee responsible for scanning older records has been unable to perform that task due to filling in for other vacant positions.
“We are aware of current staffing issues, particularly within the City Clerk department and will plan a workforce analysis to evaluate current needs,” Ortega conceded in response.
Using more general terms in the publicly-released audit than what O’Brien’s office communicated to the clerk, auditors discovered several counties comparable to Denver both inside and outside of Colorado do not post personal identifying information with online records. O'Brien acknowledged state law does not require it, but standard practices weigh in favor of redaction.
“Denver residents and other individuals could be exposed to identity theft if their personally identifiable information is posted publicly in the Office of the Clerk and Recorder’s online records database,” the report noted. “The Office of the Clerk and Recorder should take efforts as soon as possible to protect individuals’ personally identifiable information.”
Some personnel always redact identifying information, while others do not. The clerk’s office does not disclose or only discloses in a limited manner to individuals and organization when their documents are part of the public record. While staff at the clerk’s office tell people the forms they are submitting will be part of the public record, they do not mention the documents will be visible online.
According to the audit, O’Brien’s office told clerk staff on Jan. 20 that “certain personally identifiable information could be accessed publicly on the office’s website and that the information was being mishandled by the office. Office management did not respond until Feb. 12, 2021, and disagreed with our assertion that they were mishandling certain personally identifiable information.”
Ortega countered that just because other jurisdictions do have redaction policies does not mean that every record of theirs will be devoid of people’s personal information. Nonetheless, she agreed the office would research redaction practices and seek funding for retroactive redaction.
Among other findings, the audit warned the clerk’s office was not making the best use of customer service feedback, that storage spaces may be susceptible to water damage, and the office had more than 9,300 records eligible for destruction — not all of which may have historical significance — which still remained in tact.