*93 WOLLHEIM, P. J.

The Jackson County Sheriff appeals a judgment declaring that all concealed handgun licenses issued by the Sheriff of Jackson County are public records and ordering the sheriff to disclose a list of all concealed handgun licenses issued in the county in 2006 and 2007. On de novo review, ORS 192.490(1); ORS 19.415(3) (2007), 1 we affirm, because the requested documents are public records and the sheriff failed to establish that the public records are exempt from disclosure. ORS 192.410 -192.529; see Guard Publishing Co. v. Lane County School Dist., 310 Or 32, 39, 791 P2d 854 (1990) (disclosure of public records is the rule and public bodies must prove individualized bases for exemptions).

Plaintiff, a Jackson County newspaper, filed a request with the sheriff for a list of all concealed handgun licenses issued in Jackson County in 2006 and 2007. After the sheriff denied plaintiffs request, plaintiff filed an action in circuit court seeking an order requiring the sheriff to disclose the list. At trial, the sheriff argued that the list was exempt from disclosure because disclosure would unreasonably invade the personal privacy of concealed handgun licensees, ORS 192.502(2), and concealed handgun licenses are security measures that are exempt from mandatory disclosure, ORS 192.501(23).

Sergeant Grantham and Sheriff Winters testified at trial. Sergeant Grantham testified that he has spoken with “a number of applicants” for concealed handgun licenses and that he could not recall anyone giving a reason for applying for a concealed handgun license other than self-protection or security. However, Sergeant Grantham also acknowledged that a person could obtain a concealed handgun license without disclosing a reason for applying for a concealed handgun license.

Sheriff Winters also testified that he believed that concealed handgun licenses were exempt from disclosure under the security measures exemption, and a concealed *94 handgun license enhanced public safety. Releasing a list of concealed handgun licensees would create a risk to public safety by allowing individuals to target concealed handgun licensees, and also make people who did not hold concealed handgun licenses more vulnerable because an attacker would “know who to attack.” For those reasons, Winters testified that he created a policy of nondisclosure of concealed handgun licenses for the Jackson County Sheriffs Department.

Furthermore, Sheriff Winters testified that a list of concealed handgun licenses was exempt from disclosure under the personal privacy exemption provided by ORS 192.502(2). In support of that conclusion, he testified, “I’ve received emails from folks within the county, from folks all over the state of Oregon, and all over the United States and all of them but one want the records maintained and not released.”

Based on that testimony, the sheriff argued that the list was exempt from disclosure either as an unreasonable invasion of personal privacy or as a security measure. ORS 192.502(2); ORS 192.501(23); OAR 257-010-0010. The trial court rejected the sheriffs arguments. It reasoned that the sheriff had failed to make the requisite individualized showing that the records were exempt, and ordered the sheriff to disclose the list of concealed handgun licenses. On appeal, defendant abandons his argument under the administrative rule. As at trial, plaintiff argues that the sheriff failed to provide the requisite individualized evidence to prove the applicability of either exemption from mandatory disclosure. For the reasons that follow, we agree with the trial court and affirm.

“Every person has a right to inspect any public record of a public body in this state, except as otherwise expressly provided.” ORS 192.420(1). Disclosure of public records is the rule and exemptions from disclosure are to be narrowly construed, Guard Publishing Co., 310 Or at 37, and “[a]ny exemption from disclosure under the Public Records Law must be explicitly stated by statute and not merely implied by the law.” Colby v. Gunson, 224 Or App 666, 675, 199 P3d 350 (2008). That broad rule reflects the strong and enduring *95 Oregon policy that public records and government activities shall be open to the public. Jordan v. MVD, 308 Or 433, 438, 781 P2d 1203 (1989).

When a public body withholds public records from disclosure, that body carries the burden of proving an exemption on judicial review. ORS 192.490(1); Kluge v. Oregon State Bar, 172 Or App 452, 456, 19 P3d 938 (2001). To satisfy that burden, a public body must establish exemptions from disclosure “on an individualized basis.” Guard Publishing Co., 310 Or at 39. For example, in Guard Publishing Co., the school district adopted a general policy that it would not disclose the names and addresses of replacement coaches during a strike. The court held that the policy could not be justified based on the coaches’ reliance on the district’s promise not to disclose their names and addresses, nor by the coaches’ desire that the information not be disclosed. Rather, the district “had to consider each request for an exemption from disclosure on its own merits” and give the party requesting the information a reasonable opportunity to respond to the request for an exemption. Id. at 39-40.

Here, the sheriff argues that two exemptions authorize his blanket nondisclosure policy regarding the list containing the names of all concealed handgun licensees: (1) disclosure would involve an unreasonable invasion of personal privacy, ORS 192.502(2), and (2) disclosure would expose security measures, ORS 192.501(23). However, the sheriff has failed to make an individualized showing sufficient to justify the use of either exemption, see Guard Publishing Co., 310 Or at 39 (exemptions must be “made on an individualized basis,” based on a sufficient showing of justification).

We agree with, and accept, the sheriffs concession that a list of concealed handgun licenses issued in Jackson County is a public record. See ORS 192.410(4)(a) (“ ‘Public record’ includes any writing that contains information relating to the conduct of the public’s business.”). Therefore, we first consider whether the sheriff could refuse to disclose the public records under the personal privacy exemption provided by ORS 192.502(2). That provision exempts from disclosure

*96 “[i]nformation of a personal nature such as but not limited to that kept in a personal, medical or similar file, if public disclosure would constitute an unreasonable invasion of privacy, unless the public interest by clear and convincing evidence requires disclosure in the particular instance. The party seeking disclosure shall have the burden of showing that public disclosure would not constitute an unreasonable invasion of privacy.”

The personal privacy exemption may be invoked by a public custodian of records upon evidence that (1) the information is personal in nature and (2) disclosure would unreasonably invade privacy. If the public body produces evidence to satisfy those criteria, the burden shifts to the party seeking disclosure, who must show, by clear and convincing evidence, that the public interest nonetheless demands disclosure. Jordan, 308 Or at 440.

The sheriff has failed to satisfy his burden of producing evidence that disclosing the list of concealed handgun licenses would constitute an unreasonable invasion of an individual’s personal privacy. The sheriff argues that disclosure would constitute an unreasonable invasion of privacy because (1) the purpose of obtaining a concealed handgun license is to carry a weapon without public knowledge, (2) disclosure would expose concealed handgun licensees to criminal activity by creating a “virtual shopping list for anyone bent on the theft of handguns,” and (3) “gun ownership is a potentially embarrassing detail of one’s personal life.” Those hypothetical purposes do not satisfy the sheriffs burden of proof, because they do not establish individualized bases for nondisclosure. Put another way, the sheriff has failed to satisfy his burden because he has not connected his stated purposes with any particular individual, as required by Guard Publishing Co.

We turn to the question of whether the “security measures” exemption provided by ORS 192.501(23) authorizes the sheriff to refuse to disclose the requested public records. That exemption applies to

“[rlecords or Information that would reveal or otherwise identify security measures, or weaknesses or potential weaknesses in security measures, taken or recommended to be taken to protect:

*97 “(a) An individual;

“(b) Buildings or other property;

“(c) Information processing, communication or telecommunication systems, including the information contained in the systems; or

“(d) Those operations of the Oregon State Lottery the security of which are subject to study and evaluation under ORS 461.180(6).”

Even though it appears that some applicants may have applied for concealed handgun licenses as a security measure, the sheriffs argument that the security measure exemption applies to all concealed handgun licenses runs into the same problem as the sheriffs personal interest exemption argument. Accepting the sheriffs argument that some concealed handgun licensees obtained licenses for security purposes and, therefore, all licensees did so would not be consistent with the statutory policy that disclosure of public records is the rule and that exemptions from public disclosure are to be narrowly construed. See Guard Publishing Co., 310 Or at 39 (stating rule). The record contains evidence that many people applied for concealed handgun licenses for security purposes. However, the record does not establish which individuals obtained concealed handgun licenses as security measures or whether the individuals who did so actually satisfied the requirements of the security measure exemption.

Furthermore, the record also supports the inference that some concealed handgun licensees did not apply for licenses for security. The record provides no basis to separate those licensees who obtained licenses as a security measure from those who did not. Sergeant Grantham testified that he spoke with some concealed handgun license applicants who sought licenses for security. Sergeant Grantham did not testify that he spoke with all applicants, and he admitted that applicants could obtain concealed handgun licenses irrespective of a security purpose. The concealed handgun license application does not require that the applicant disclose the purpose for applying for a permit or require disclosure of the applicant’s proposed use of the concealed handgun license, and not all concealed handgun licensees necessarily own handguns. See Willis v. Winters, 235 Or App 627, 234 P3d 141 *98 (2010) (concealed handgun licensing statutes do not, themselves, authorize handgun possession). Sheriff Winters testified that the concealed handgun license statute acted as a general security measure, but he did not testify concerning any individual security measure related to the concealed handgun license statute. That problem of proof, combined with the rule that Oregon courts do not imply exemptions, Colby, 224 Or App at 676, 681, undermines the sheriffs blanket reliance on the security measures exemption. The trial court did not err in ordering the sheriff to disclose a list of all concealed handgun licenses issued in 2006 and 2007.

Affirmed.

The notice of appeal in this case was filed before June 4, 2009, which is the effective date of the modifications to ORS 19.415. Or Laws 2009, ch 231, § 3. For that reason, we refer to the 2007 version of the statute.