Public Records, social security numbers

Mr. William E. Reischmann, Jr.
Brown, Garganese, Weiss & D'Agresta, P.A.
Post Office Box 2873
Orlando, Florida 32802-2873

RE: PUBLIC RECORDS – SOCIAL SECURITY NUMBERS – COMMERCIAL ENTITY – COMMERCIAL ACTIVITY – conflict in statutory provisions; denial of request for social security numbers from commercial entity. s. 119.071(5), Fla. Stat.

Dear Mr. Reischmann:

As City Attorney for the City of Palm Coast, you have asked for my opinion on substantially the following questions:

1. Whether the provisions relating to the exempt and confidential nature of social security numbers held by a public agency in subparagraphs 119.071(5)(a)6. and (5)(a)7., Florida Statutes, are in conflict?

2. Whether the City of Palm Coast may deny a request for social security numbers from a commercial entity pursuant to section 119.071(5)(a)7., Florida Statutes, when the commercial entity states that the commercial activity includes providing single query data searches of its database to its customers who are banks, finance companies, licensed repossession companies and licensed private investigative agencies?

In sum:

1. There is no conflict between subparagraphs 119.071(5)(a)6., and (5)(a)7., Florida Statutes, and these provisions should be read together and harmonized.

2. The question of whether providing "single query data searches of its database to its customers who are banks, finance companies, licensed repossession companies and licensed private investigative agencies" comes within the scope of a "commercial activity" for purposes of section 119.071(5)(a)7., Florida Statutes, cannot be resolved by this office.

Question One

Section 119.071, Florida Statutes, provides general exemptions from the inspection and copying requirements of Florida's Public Records Law. Subsection (5)(a) of the statute, which deals with the collection and maintenance of social security numbers by governmental agencies, expresses the Legislature's on-going intention to "monitor the use of social security numbers held by agencies in order to maintain a balanced public policy."[1]

Section 119.071(5)(a)5., Florida Statutes, states that social security numbers held by an agency are confidential and exempt from public disclosure requirements. However, the Legislature has adopted a number of exceptions to this exemption. The following amendment made during the 2009 legislative session,[2] subsection (5)(a)6., provides:

"6. Social security numbers held by an agency may be disclosed if any of the following apply:
a. The disclosure of the social security number is expressly required by federal or state law or a court order.
b. The disclosure of the social security number is necessary for the receiving agency or governmental entity to perform its duties and responsibilities.
c. The individual expressly consents in writing to the disclosure of his or her social security number.
d. The disclosure of the social security number is made to comply with the USA Patriot Act of 2001, Pub. L. No. 107-56, or Presidential Executive Order 13224.
e. The disclosure of the social security number is made to a commercial entity for the permissible uses set forth in the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq.; the Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq.; or the Financial Services Modernization Act of 1999, 15 U.S.C. ss. 6801 et seq., provided that the authorized commercial entity complies with the requirements of this paragraph.
f. The disclosure of the social security number is for the purpose of the administration of health benefits for an agency employee or his or her dependents.
g. The disclosure of the social security number is for the purpose of the administration of a pension fund administered for the agency employee's retirement fund, deferred compensation plan, or defined contribution plan.
h. The disclosure of the social security number is for the purpose of the administration of the Uniform Commercial Code by the office of the Secretary of State."

Staff analysis of the bill indicates that this language was intended to amend the general public records exemption for social security numbers held by an agency as provided in section 119.071(5)(a)5., Florida Statutes. The amendment was characterized as "modifying the exceptions to the exemption."[3] Thus, subparagraph 6. provides an authorization for governmental agencies to release social security numbers under those scenarios described in that section but, in light of the provisions in subparagraph 7.b., does not strictly limit the release of social security numbers to these situations.

Subparagraph 7.b. states that a governmental agency may not deny a "commercial entity" that is engaged in the performance of a "commercial activity" access to social security numbers, so long as those social security numbers will only be used in the performance of a commercial activity and on condition that the commercial entity requests the numbers in writing.[4] For purposes of the subparagraph, a "[c]ommercial activity" is defined to mean:

". . . permissible uses set forth in the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq.; the Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq.; or the Financial Services Modernization Act of 1999, 15 U.S.C. ss. 6801 et seq., or verification of the accuracy of personal information received by a commercial entity in the normal course of its business, including identification or prevention of fraud or matching, verifying, or retrieving information. It does not include the display or bulk sale of social security numbers to the public or the distribution of such numbers to any customer that is not identifiable by the commercial entity."[5]

The term "commercial entity" is also defined for purposes of the statute and includes "any corporation, partnership, limited partnership, proprietorship, sole proprietorship, firm, enterprise, franchise, or association that performs a commercial activity in this state."[6]

The statute requires that prior to releasing social security numbers to a commercial entity pursuant to subparagraph 7.b., Florida Statutes, the agency must receive a written request that satisfies several statutory conditions:

"(I) It must be verified as provided in s. 92.525;
(II) It must be legibly signed by an authorized officer, employee, or agent of the commercial entity;
(III) The written request must contain the commercial entity's name, business mailing and location addresses, and business telephone number; and
(IV) It must contain a statement of the specific purposes for which it needs the social security numbers and how the social security numbers will be used in the performance of a commercial activity, including the identification of any specific federal or state law that permits such use."[7]

The statute also authorizes an agency to "request any other information reasonably necessary to verify the identity of a commercial entity requesting the social security numbers and the specific purposes for which the numbers will be used."[8] Any person who makes a false representation in an attempt to obtain a social security number pursuant to subparagraph 7.a., Florida Statutes, or any person who "willfully and knowingly violates" the paragraph commits a third degree felony. Public officers violating this paragraph commit a noncriminal infraction punishable by a fine not to exceed $500.00 per violation.[9]

Both subparagraphs 119.071(5)(a)6. and 7., Florida Statutes, deal with the disclosure of social security numbers to commercial entities and overlap with regard to those federal provisions under which release of these numbers is authorized. Recognizing the intent of the Legislature,[10] the two provisions may be read together to accomplish the legislative goal of providing an "exception to the exemption."[11] The language of subparagraph 6. is permissive and authorizes (but does not mandate) disclosure under these specific circumstances. The language of subparagraph 6. does not foreclose the existence of other exceptions. The language of subparagraph 7.b., Florida Statutes, constitutes a recognition by the Legislature of the permissive nature of subparagraph 6. and qualifies the discretion of an agency to release social security numbers to commercial entities by prohibiting an agency from refusing to disclose this information if the commercial entity requestor qualifies under the statute and provides a written request for the information.[12]

In sum, it is my opinion that section 119.071(5)(a)6., Florida Statutes, and section 119.071(5)(a)7., Florida Statutes, do not conflict and may be read together to authorize the disclosure of social security numbers to commercial entities engaged in the commercial activities identified in the statute. Any request for the disclosure of social security numbers by a commercial entity must be made in writing and must provide the information required by the statute. These provisions also authorize the agency holding social security numbers to request additional information that is reasonably necessary to verify the identity of the commercial entity and the specific purposes for which the social security numbers will be used.

Question Two

Your second question requires resolution of a mixed question of law and fact which is beyond the authority of this office.[13] As discussed in my response to your first question, section 119.071(5), Florida Statutes, provides that a governmental agency may not deny a commercial entity access to agency-held social security numbers if the commercial entity is engaged in the performance of a commercial activity as defined in the statute and provided the commercial entity makes a written request for those social security numbers in the form prescribed by the statute.

The statute clearly recognizes that the requested social security numbers may only be used in performance of a commercial activity. The statute also provides that "verification of the accuracy of personal information received by a commercial entity in the normal course of its business" does come within the definition of a "commercial activity" for purposes of section 119.071(5)(a)7., Florida Statutes. However, the display or bulk sale of social security numbers to the public or the distribution of those numbers to customers that are not identifiable by the commercial entity are prohibited.

The question of whether providing "single query data searches of its database to its customers who are banks, finance companies, licensed repossession companies and licensed private investigative agencies" comes within the scope of a "commercial activity" for purposes of subsection (5), Florida Statutes, cannot be resolved by this office. The City of Palm Coast is authorized to request additional information reasonably necessary to determine "the specific purposes for which the [social security] numbers will be used"[14] if sufficient information upon which to base its release of this information has not been provided.

Sincerely,

Bill McCollum
Attorney General

BM/tgh

-----------------------------------------------------

[1] Section 119.071(5)(a)1.c., Fla. Stat.

[2] See s. 1, Ch. 2009-237, Laws of Fla. And see s. 1, Ch. 2009-104, Laws of Fla.; ss. 1, 2, Ch. 2009-150, Laws of Fla.; s. 1, ch. 2009-169, Laws of Fla.; ss. 1, 2, Ch. 2009-235, Laws of Fla., for other amendments made to this section during the 2009 legislative session.

[3] See Florida House of Representatives Staff Analysis of CS/HB 7051 dated 4/14/2009.

[4] Section 119.071(5)(a)7.b., Fla. Stat.

[5] Section 119.071(5)(a)7.a.(I), Fla. Stat.

[6] Section 119.071(5)(a)7.a.(II), Fla. Stat.

[7] Section 119.071(5)(a)7.b., Fla. Stat.

[8] Section 119.071(5)(a)7.c., Fla. Stat.

[9] Section 119.071(5)(a)8.b., Fla. Stat.

[10] See Barruzza v. Suddath Van Lines, Inc., 474 So. 2d 861 (Fla. 1st DCA 1985); Philip Crosby Associates, Inc., v. State Board of Independent Colleges, 506 So. 2d 490 (Fla. 5th DCA 1987) (cardinal rule of statutory construction is that statute should be construed so as to ascertain and give effect to legislative intent expressed in statute).

[11] See Ideal Farms Drainage District et al. v. Certain Lands, 19 So. 2d 234 (Fla. 1944); Forsythe v. Longboat Key Beach Erosion Control District, 604 So. 2d 452 (Fla. 1992) (all parts of a statute must be read together in order to achieve a consistent whole); State v. Haddock, 140 So. 2d 631 (Fla. 1st DCA 1962).

[12] And see Wakulla County v. Davis, 395 So. 2d 540 (Fla. 1981) and Garner v. Ward, 251 So. 2d 252 (Fla. 1971) (a law should be construed together with any other law relating to the same purpose, such that they are in harmony).

[13] See s. 16.01(3), Fla. Stat., providing that the Attorney General may opine on questions of Florida law. And see this office's statement concerning Attorney General Opinions, available online at: www.myfloridalegal.com, which provides that Attorney General Opinions are intended to address questions of law, not questions of fact or mixed questions of law and fact.

[14] Section 119.071(5)(a)7.c., Fla. Stat.