The Public Records Act (PRA) requires state and local agencies to make all public records available for public inspection and copying unless a record falls within an exemption under the PRA or another statute that exempts or prohibits disclosure of specific information or records.  Exemptions under the PRA are permissive, meaning that an agency, although not required to disclose, has the discretion to provide an exempt record.  Generally, an agency must redact and produce the remaining parts of a record if exempt information or information that, if disclosed, would violate personal privacy or vital governmental interests, can be redacted from the specific records sought.  The PRA is liberally construed, and its exemptions are narrowly construed.

Several types of financial information are exempt under the PRA.  For example, except when disclosure is expressly required by law, credit or debit card numbers, electronic check numbers, and card expiration dates are exempt from disclosure.  Additional exempt bank or financial information includes:

• account numbers and balances;
• transactional information concerning an account;
• codes and passwords;
• social security numbers;
• tax identification numbers;
• driver's license, permit, and state identification card numbers issued by the Department of Licensing; and
• other information held for the purpose of account access or transaction initiation.

Specific to gambling, the following records received by the Gambling Commission from house-banked social card game licensees or tribes with an approved tribal compact for class III gaming are exempt from disclosure requirements:  internal control documents and independent auditor reports and financial statements, including any supporting documents.  Class III gaming is casino-style gaming including lotteries, roulette, and house-banked card games such as blackjack and baccarat.

The PRA exemption for proprietary financial and security information submitted to or obtained by the Gambling Commission is expanded to also include the following information from license applicants, licensees, gaming facilities, or tribes with an approved tribal compact:

• financial statements and transactions, except quarterly license reports, such as bank account records, player tracking records, bond issuances, loan agreements, purchase agreements, and stock buyouts;
• information that describes the internal operational system or internal procedures designed to promote efficiency, safeguard assets, and avoid fraud and error, such as security camera specifications and placement, cash out procedures and locations, cage security information, building access controls, and personally identifiable information control procedures;
• gaming facility security information that may negatively impact the security of the facility if released, such as descriptions of facility layout and schematics, firewall configurations, network topologies, source codes, software files, cryptographic hashes of software files, risk and security assessment reports, disaster recovery plans, and incident response plans; and
• gaming equipment information that may compromise the security and integrity of the equipment if released, such as firewall configurations, system components, user credentials, and field-testing data and the results.