Schools, release of social security numbers

Mr. J. Paul Carland, II
General Counsel
The School Board of Broward County
600 Southeast Third Avenue, 11th Floor
Fort Lauderdale, Florida 33301-3125

Dear Mr. Carland:

On behalf of the School Board of Broward County, you have asked this office to determine whether the district must release social security numbers of district employees to the local teachers union. The following general discussion is provided in order to be of assistance.

You state that the School Board of Broward County has received a request from the Broward Teachers Union (union), a certified bargaining agent, for the social security numbers of all "members of the bargaining unit," regardless of whether such individuals are dues paying members of the union. While the union characterizes the individuals as "members of the bargaining unit" the discussion herein will refer to the individuals as "employees of the district," to avoid any confusion as to whether such employees are members of the union.

The union asserts that it is a "commercial entity" as defined in section 119.071(5)(a)7., Florida Statutes, in that it "will use the social security numbers in the normal course of its business to verify the accuracy of information received from the School District, including identification or prevention of fraud and matching information received from the District to the union’s records."[1] The union also states that historically, when employees of the district called the union, the social security numbers of such employees were used by the union to match and verify the employees’ identities and prevent identification fraud.

In enacting section 119.071(5)(a), Florida Statutes, the Legislature has acknowledged that while social security numbers were never intended to be used for business purposes, over time they have been used for "identity verification purposes and other legitimate consensual purposes."[2] (e.s.) The Legislature has further recognized that the "social security number can be used as a tool to perpetuate[3] fraud against an individual and to acquire sensitive personal, financial, medical, and familial information, the release of which could cause great financial or personal harm to an individual."[4] Accordingly, the Legislature has enacted legislation that makes social security numbers held by an agency "confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution."[5]

Section 119.071(5)(a)6., Florida Statutes, however, provides exceptions to the exemption whereby social security numbers held by an agency may be disclosed under specified circumstances.[6] Section 119.071(5)(a)7.b., Florida Statutes, further provides that an agency may not deny a commercial entity engaged in the performance of a commercial activity access to social security numbers, provided the social security numbers will be used only in the performance of a commercial activity and provided the commercial entity makes a written request for the social security numbers. The written request must:

"(I) Be verified as provided in s. 92.525;
(II) Be legibly signed by an authorized officer, employee, or agent of the commercial entity;
(III) Contain the commercial entity’s name, business mailing and location addresses, and business telephone number; and
(IV) Contain a statement of the specific purposes for which it needs the social security numbers and how the social security numbers will be used in the performance of a commercial activity, including the identification of any specific federal or state law that permits such use."[7]

The agency which has been requested to provide the social security numbers, however, may request any other information reasonably necessary to verify the identity of a commercial entity making the request and the specific purposes for which the numbers will be used.[8]

A "commercial entity" is defined as "any corporation, partnership, limited partnership, proprietorship, sole proprietorship, firm, enterprise, franchise, or association that performs a commercial activity in this state."[9] (e.s.) For purposes of the act, "commercial activity" means:

"the permissible uses set forth in the federal Driver’s Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq.: the Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq.; or the Financial Services Modernization Act of 1999, 15 U.S.C. ss. 6801 et seq., or verification of the accuracy of personal information received by a commercial entity in the normal course of its business, including identification or prevention of fraud or matching, verifying, or retrieving information. It does not include the display or bulk sale of social security numbers to the public or the distribution of such numbers to any customer that is not identifiable by the commercial entity."[10] (e.s.)

Whether the union is performing a "commercial activity" as defined in section 119.071(5)(a), Florida Statutes, is a mixed question of law and fact that may not be resolved by this office, but must be determined by the school board. The factual determination of whether the union is verifying the accuracy of personal information it already has received in the normal course of its business is one that must be made by the school board.[11]

As noted above, the written request to obtain the social security numbers must contain a statement of the specific purposes for which it needs the social security numbers and how the social security numbers will be used in the performance of a commercial activity, including the identification of any specific federal or state law that permits such use.[12] While citation to section 119.071(5)(a)7.a.1., Florida Statutes, may appear to satisfy the requirement that the union cite to the federal or state statute permitting the use of social security numbers, such citation alone is not sufficient. The statute requires a recitation of the specific purposes for which the numbers are requested and how those numbers will be used. Moreover, section 119.071(5)(a)7.c., Florida Statutes, authorizes the school board to request additional information reasonably necessary to verify the identity of a commercial entity making the request and the specific purposes for which the numbers will be used.

The union has stated that it will use the social security numbers requested from the school board in the normal course of its business to verify the accuracy of information received from the School District. However, section 119.071(5)(a)7.a.1, Florida Statutes, requires that the requested social security numbers be used to verify personal information which the commercial entity has already received in the normal course of its business. In this instance, the personal information which has previously been received by the union would by necessity be limited to social security numbers. The term "verify," while not defined in the statute, means "[t]o prove to be true; to confirm or establish the truth or truthfulness of; to authenticate."[13] If the union has already received the social security numbers in the normal course of its business, the statute would allow access to such numbers held by the school board which would then be used to verify the accuracy of the social security numbers already in the union’s possession. I cannot conclude, however, that the fact that the union may have received information such as the names and addresses of school district employees through a public records request to the school board would entitle the union to then obtain access to the employees' social security numbers which the union has not previously received in the normal course of its business.

I note, for example, that the statute permits the release of social security numbers to a commercial entity for the permissible uses set forth in the federal Driver’s Privacy Protection Act of 1994.[14] Pursuant to that act, personal information may be disclosed:

"(3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only –
(A) to verify the accuracy of personal information submitted by the individual to the business or its agent, employees, or contractors; and
(B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual." (e.s.)

While section 119.071(5)(a)7.a.(I), Florida Statutes, does not specify that the individual whose social security number is sought by the commercial entity must be the source of the personal information to be verified, the underlying premise that the information to be verified must be received by the commercial entity in the normal course of business is the same. Thus, regardless of the relationship the individual may have with the union, it would appear that the union’s access to social security numbers is limited to those social security numbers which will be used to verify the accuracy of numbers which the union has already received in the normal course of its business. I cannot conclude that sensitive information such as social security numbers may be released except under the strict conditions imposed by the statute.[15]

I trust that these informal comments will be of assistance to you in resolving this issue.

Sincerely,

Lagran Saunders
Assistant Attorney General

ALS/tsh
______________________________________________________________________

[1] Letter to Mr. Donnie Carter, Interim Superintendent of Schools, Broward County Public Schools, from Mr. Patrick A. Santeramo, President, Broward Teachers Union, August 2, 2011.

[2] Section 119.071(5)(a)1.a., Fla. Stat.

[3] See s. 14, Ch. 2006-1, Laws of Fla., amending s. 119.071(5)(a), Fla. Stat., stating, in pertinent part: "The Legislature is also cognizant of the fact that the social security number can be used as a tool to perpetuate fraud against a person . . ." (e.s.) But see s. 2, Ch. 2002-256, Laws of Fla., stating in pertinent part: "The disclosure of such number can provide access to private information about a person which could be used to perpetrate fraud upon that person or otherwise cause great ham to that person and his or her family." (e.s.)

[4] Section 119.071(5)(a)1.b., Fla. Stat.

[5] Section 119.071(5)(a)5., Fla. Stat.

[6] See s. 119.071(5)(a)6., Fla. Stat., stating:

"Social security numbers held by an agency may be disclosed if any of the following apply:
a. The disclosure of the social security number is expressly required by federal or state law or a court order.
b. The disclosure of the social security number is necessary for the receiving agency or governmental entity to perform its duties and responsibilities.
c. The individual expressly consents in writing to the disclosure of his or her social security number.
d. The disclosure of the social security number is made to comply with the USA Patriot Act of 2001, Pub. L. No. 107-56, or Presidential Executive Order 13224.
e. The disclosure of the social security number is made to a commercial entity for the permissible uses set forth in the federal Driver’s Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq.; the Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq.; or the Financial Services Modernization Act of 1999, 15 U.S.C. ss. 6801 et seq., provided that the authorized commercial entity complies with the requirements of this paragraph.
f. The disclosure of the social security number is for the purpose of the administration of health benefits for an agency employee or his or her dependents.
g. The disclosure of the social security number is for the purpose of the administration of a pension fund administered for the agency employee’s retirement fun, deferred compensation plan, or defined contribution plan."

[7] Section 119.071(5)(a)7.b., Fla. Stat.

[8] Section 119.071(5)(a)7.c., Fla. Stat.

[9] Section 119.071(5)(a)7.a.(II), Fla. Stat.

[10] Section 119.071(5)(a)7.a.(I), Fla. Stat.

[11] See s. 16.01(3), Fla. Stat., providing that the Attorney General may opine on questions of Florida law. And see this office's statement concerning Attorney General Opinions, available online at: www.myfloridalegal.com, which provides that Attorney General Opinions are intended to address questions of law, not questions of fact or mixed questions of law and fact.

[12] Section 119.071(5)(a)7.b.(IV), Fla. Stat.

[13] Black’s Law Dictionary (8th ed., 2004), p. 1594. See also Webster’s Third New International Dictionary (unabridged, 1981), p. 2543, defining "verify" as "to check or test the accuracy or exactness of: confirm the truth or truthfulness of by or as if by comparison with known data or a recognized standard or authority."

[14] 18 USC ss. 2721 et seq.

[15] Cf. Florida Department of Education v. NYT Management Services, Inc., 895 So. 2d 1151 (Fla. 1st DCA 2005) (newspaper not entitled to social security numbers of teachers pursuant to a public records request, since disclosure of such numbers was limited to the purpose of administration of child support enforcement program which was not furthered by release of such information to the newspaper).