Records, social security numbers

Mr. Robert M. Bradley, Jr.
Orange Park Town Attorney
Post Office Box 562
Orange Park, Florida 32067-0562

RE: RECORDS–SOCIAL SECURITY NUMBER–MUNICIPALITY--exception to confidentiality of social security number when requested by commercial entity for legitimate business purposes. s. 119.0721, Fla. Stat.

Dear Mr. Bradley:

On behalf of the Orange Park Town Council, you ask substantially the following question:

Does the "legitimate business purpose" exception in section 119.0721, Florida Statutes, authorize the town to release the social security numbers of its water and sewer system customers to a private company that intends to enter the social security numbers into a computer database and sell access to the database to other entities and individuals?

According to your letter, the Town of Orange Park has received a public records request from a company that operates a website whereby the general public, for a fee, can purchase access to a database that contains the utility records, property records, and business license data of cities and counties. The company has requested the social security numbers of all the town's water and sewer customers. You state that it is your opinion that the company's request for social security numbers held by the town's water and service department does not fit within the limited exception for "legitimate business purposes" contained in section 119.0721, Florida Statutes.
Committee Substitute for House Bill 1673, enacted as Chapter 02-256, Laws of Florida, created section 119.0721, Florida Statutes, which, among other things, establishes an exemption for social security numbers held by an agency or its agents, employees or contractors.[1] In setting forth the public necessity for the statute, the Legislature stated:

"The Legislature finds that it is a public necessity that social security numbers held by an agency be made confidential and exempt from public disclosure because such numbers are of a sensitive personal nature and are often the link to an individual's personal, financial, medical, or familial records. The social security number is the only nationwide, unique numeric form of identification in existence in the United States. Release of a social security number is of concern due to the amount of sensitive personal information which can be acquired by its use. The disclosure of such number can provide access to private information about a person which could be used to perpetrate fraud upon that person or otherwise cause great harm to that person and his or her family. Additionally, public disclosure of the social security number constitutes an unwarranted invasion into the life and personal privacy of a person. Thus, the harm from disclosing such number outweighs any public benefit that can be derived from widespread and unregulated public access to such number. However, responsible commercial use of the social security number does not result in personal or financial harm to a person but allows more complete identity verification, thereby enhancing the mutual benefits of the commercial relationship. Accordingly, the Legislature finds that an exception to the exemption for commercial entities is warranted."[2]

Section 119.0721(1), Florida Statutes, provides:

"Effective October 1, 2002, all social security numbers held by an agency or its agents, employees, or contractors are confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution. This exemption applies to all social security numbers held by an agency and its agents, employees, or contractors before, on, or after the effective date of this exemption."[3]

The statute, however, recognizes an exception to the above provision. Section 119.0721(3), Florida Statutes, provides that an agency shall not deny a commercial entity engaged in the performance of a commercial activity[4] or its agents, employees, or contractors access to social security numbers, provided the social security numbers will be used only in the normal course of business for legitimate business purposes and the commercial entity makes a verified written request for social security numbers.[5] The statute recognizes a legitimate business purpose to include

"verification of the accuracy of personal information received by a commercial entity in the normal course of its business; use in a civil, criminal, or administrative proceeding; use for insurance purposes; use in law enforcement and investigation of crimes; use in identifying and preventing fraud; use in matching, verifying or retrieving information; and use in research activities. A legitimate business purpose does not include the display or bulk sale of social security numbers to the general public or the distribution of such numbers to any customer that is not identifiable by the distributor."

As stated in the staff analysis for the bill enacted as section 119.0721, Florida Statutes,

"Private sector enterprises rely on public records, which sometimes include SSNs, as a means to "uncover fraud and identity theft, make sound credit determinations, and otherwise verify identities in order to conduct a vast amount of business transactions." SSNs are considered an integral part of many businesses' verification process. Businesses were concerned that they would no longer be able to receive large data dumps containing SSNs on everybody, thus allowing them to perform their own searches, without being dependent upon the agency to confirm identities. Because of these concerns, this exemption provides an exception for commercial entities."[6]

While the list of legitimate business purposes set forth in the statute is not all-inclusive, it does indicate the type of business purposes that the Legislature contemplated would be permitted under the statute to receive the release of otherwise confidential social security numbers.[7] Such legitimate uses involve the use of social security numbers to carry out the normal operations of a business (such as verifying the identity of clients doing business with the company), not the display or sale of such numbers being the business itself. As noted above, the statute specifically prohibits the display or bulk sale of social security numbers to the general public.

You state that the company involved in your question operates a website whereby the general public, for a fee, can purchase access to a database that contains the utility records, property records, and business license data of cities and counties. Such a use of the social security numbers would not, in my opinion, appear to constitute an acceptable business purpose as that term is used in section 119.0721, Florida Statutes.

Accordingly, I am of the opinion that the "legitimate business purpose" exception in section 119.0721, Florida Statutes, does not authorize the town to release the social security numbers of its water and sewer system customers to a private company that intends to enter the social security numbers into a computer database and sell access to the database to other entities and individuals.

Sincerely,

Charlie Crist
Attorney General

CC/tjw

----------------------------------------------------

[1] The section was designated by the Legislature as s. 119.072 in CS/HB 1673, but was redesignated as s. 119.0721 in 2002 Florida Statutes.

[2] Section 2, Ch. 02-256, Laws of Florida. And see Art. I, section 24, Fla. Const., which requires a public necessity statement for legislation creating exemptions to the open government laws. See also s. 119.0721(7), Fla. Stat., stating:

"The Legislature acknowledges that the social security number was never intended to be used for business purposes but was intended to be used solely for the administration of the federal Social Security System. The Legislature is further aware that over time this unique numeric identifier has been used extensively for identity verification purposes and other legitimate consensual purposes. The Legislature is also cognizant of the fact that the social security number can be used as a tool to perpetuate fraud against a person and to acquire sensitive personal, financial, medical, and familial information, the release of which could cause great financial or personal harm to an individual. The Legislature intends to monitor the commercial use of social security held by state agencies in order to maintain a balanced public policy."

[3] The exemption is made subject to the Open Government Sunset Review Act of 1995 and will stand repealed on October 2, 2007 unless reviewed and saved from repeal through reenactment by the Legislature. See s. 119.0721(11), Fla. Stat.

[4] See s. 14.203(1)(a), Fla. Stat., defining "[c]ommercial activity" as "an activity that provides a product or service that is available from a private source."

[5] The request must be legibly signed by an authorized officer, employee, or agent of the commercial entity, and contain the commercial entity's name, business mailing and location addresses, business telephone number, and a statement of the specific purposes for which it needs the social security numbers and how they will be used in the normal course of business. Section 92.525, Fla. Stat. provides for verification under oath or affirmation taken or administered before an officer authorized to take oaths; or by the signing of a written declaration.

[6] Comments, Florida House of Representatives Committee on State Administration Final Analysis on CS/HB 1673, dated August 8, 2002, p. 15.

[7] Cf. Cepcot Corporation v. Department of Business and Professional Regulation, Construction Industry Licensing Board, 658 So. 2d 1092 (Fla. 2d DCA 1995) (under doctrine of noscitur a sociis one examines the other words used within a string of concepts to derive the legislature's overall intent).