Facts and Procedural History:

On February 10, 2004, IPAD received a letter from X. In that letter, X asked the Commissioner to issue an advisory opinion regarding his/her rights as a subject of data maintained by the Minnesota Department of Public Safety ( Public Safety. )

In response to X's request, IPAD, on behalf of the Commissioner, wrote to Rich Stanek, Commissioner of Public Safety. The purposes of this letter, dated February 18, 2004, were to inform him of X's request and to ask him to provide information or support for the Department's position. On March 5, 2004, IPAD received a response from Commissioner Stanek. A summary of the facts of this matter follows.

According to X:

On the 4th of April 1998 I went to . . . renew my Minnesota Commercial Drivers License. The individual at the counter told me that I was required to provide a social security number on the application too. I told the individual that there were prerequisites that needed to be meet [sic] before they could ask for a social security number pursuant to [the] 1974 Federal Privacy Act and asked for a copy of the warning. I was then told that she would accept my application, 'as is', but that they may not accept my application at the 'State'.

On or about the 1st of May 1998 I received a letter from The [sic] Department of Public Safety, Driver and Vehicle Services Division, Driver Licensing Records that states in part, 'We are unable to process your application etc.'

X provided the Commissioner with copies of the first application s/he filled out, and a second application that Public Safety asked X to submit. According to X, the second application form has the cover page that asks for the ssn# etc.

In his comments, Commissioner Stanek stated that at the time X first applied for a commercial driver's license, it was mandatory for all commercial drivers to provide a Social Security number. Commissioner Stanek stated that it was Public Safety's position that X was given sufficient notice as required under state and federal law.

Commissioner Stanek provided copies, labeled as Exhibits A-C, of the version of the application form X submitted, the Minnesota Driver's License/Identification Card Application (PS 33100-07), which contained the following statements:

Exhibit A (front of document)
'-Social Security Number OPTIONAL for all applicants EXCEPT those applying for a Commercial Driver's License, MN Statute 171.06, Subd. 3.'

Exhibit B, item number one (back of original document) and Exhibit C, item number one:
'-NOTICE TO DRIVER LICENSE APPLICANTS
All data requested on a driver license application is required by law. The social security number is required for commercial drivers only. The information is used to identify your driving record and to determine your eligibility for issuing a permit or license. Failure to provide required information may result in denial of the permit or license. Except for medical data and social security number, all information is public and copies may be issued to anyone. Upon written request your residence address can be classified as private information.

Commissioner Stanek wrote:

Under the Federal Privacy Act of 1974, state agencies are required to notify the individual of the following three items related to collection of their social security number:

1. Whether the disclosure is mandatory or voluntary;

2. By what statutory or other authority the social security number is solicited; and

3. What uses will be made of the number.

In accordance with MN Stat. 13.04, Subd. 2, a state agency is required to notify the individual of the following additional items:

4. The purpose and intended use of the requested data;

5. Whether the individual may refuse or is legally required to supply the requested data;

6. Any known consequence arising from supplying or refusing to supply private or confidential; and

7. The identity of other persons or entities authorized by state or federal law to receive the data.

We believe the two statements printed on the Minnesota Driver's License/Identification Card Application (PS 33100-07) adequately satisfy our obligation to notify the applicant in regards to the collection of his/her social security number.

Additionally, the letter dated May 1, 1998, as well as subsequent letters from our agency, provided [X] with additional notification as well as the federal requirement for all commercial driver's license applicants to provide a social security number. Our agency attempted further clarification of the issue when [X] met with [Public Safety staff.]

It is also important to note that since [X] originally submitted his/her application, there have been changes to Minnesota statutes related to privacy as well as collection of an individual's social security number. Effective August 1, 2000, changes to MN stat. 171.12, Subd. 7, letter c, places restrictions on the dissemination of personal information. Personal information is disseminated only for the permissible purpose as outlined in U.S. Code Title 18, Section 2721 or other applicable state statutes. Effective August 1, 2003, MN Stat. 171.06 was amended to require the collection of social security numbers for all applicants. This change was required to comply with the federal Welfare Reform Act.

Issue:

In his/her request for an opinion, X asked the Commissioner to address the following issue:

Discussion:

A government entity's collection, use, and dissemination of an individual's Social Security number are subject to requirements of both state and federal law. Pursuant to Minnesota Statutes, section 13.355, subdivision 1, Social Security numbers are private data. When a government entity asks an individual to supply private data about him/herself, such as a Social Security number, the entity is required to give the individual a notice, commonly referred to as the Tennessen warning. (See section 13.04, subdivision 2.) As Commissioner Stanek noted, there are several components to the notice requirement.

In addition, as Commissioner Stanek noted above, the federal Privacy Act of 1974 requires federal, state, and local government entities requesting Social Security numbers to provide individuals with a notice. (See Section 7 (b) of Public Law 93-579, the Privacy Act of 1974. Public Law 93-579 was codified at 5 U.S.C. section 552a. Section 7 was contained in a note, and not incorporated into the U.S. Code.)

Further, federal law provides that federal, state, and local government agencies cannot deny any rights, privileges or benefits to individuals who refuse to provide their Social Security numbers unless the disclosure is required or authorized by federal statute, or the disclosure is to an agency for use in a record system which required the Social Security number before 1975. Federal law does allow a state agency to deny rights, privileges or benefits to individuals who refuse to provide their Social Security numbers to the extent that Social Security numbers are used in the administration of any tax, general public assistance, driver's license, or motor vehicle registration law within its jurisdiction. (See Tax Reform Act of 1976, 42 U.S.C. section 405(c)(2)(C)(i) and (iv).)

With respect to the Tennessen warning requirement under Minnesota Statutes, section 13.04, subdivision 2, the Commissioner is of the opinion that Public Safety did not provide X with proper notice. The notice used by the Department in 1998, the time at which X was asked to provide private data, does not contain the following required components: any known consequence arising from supplying the private or confidential data; the identity of other persons or entities authorized by state or federal law to receive the data; and, a complete description of the purpose and intended use of the data being requested within the Department of Public Safety.

It is important to note that both the Tennessen warning and the federal Privacy Act social security number notice are required to be given at the time government entities ask for the private data and, in this case, the private data which is the social security number. This timing is critical because the overall objective of both notices is to give an individual adequate notice before providing any data so that the individual can make an informed decision about sharing certain data with the government.

In situations where the state Tennessen warning requirement and the federal Privacy Act social security notice requirement intersect, it is possible to produce what amounts to a combined notice in which all the elements of both the state and federal requirements are addressed. Both of the notice requirements assume that direct and straightforward statement will be made to individuals about the data they are being requested to supply. The one area of potential confusion with the two requirements is found in how the two laws deal with the notice of uses. State law only requires that an individual be informed of uses of data within the requesting government entity. The rationale for this limited requirement is that, particularly in those situations where an entity is authorized or required to provide data to other entities, the collecting entity cannot be responsible for knowing all of the uses outside its own organization. By contrast, the language of the federal Privacy Act would seem to indicate that government entities are responsible for communicating all uses that will be made of the social security number.

In both instances, the Commissioner is of the opinion that a reasonable reading of the state and federal law requirements leads to a conclusion that entities are only required to communicate those uses of the data being collected that are reasonably known to the entity at the time the data are being collected.

In terms of a detailed evaluation of the entire notice given by Public Safety, the Commissioner is not in a position to know: all of the consequences, known to Public Safety, of X's supplying data; all of the identities of other persons or entities authorized by state or federal law to receive the private data X was being asked to supply; or, all of the uses to which Public Safety could put the private data within the Department. The rules of the Department of Administration provide a methodology to assist government entities in gathering the information and making the determinations that will assist them to provide adequate Tennessen warnings. (See Minnesota Agency Rules, Section 1205.1300.)

However, examples of statements that could have appeared in the 1998 notice are as follows.

Consequence Statement: One consequence of supplying these private data is that your driving record will be checked in other states which may lead to a decision not to issue you a license.

Dissemination Statement: Public Safety is required to disseminate private data related to the location of the debtor to the Commissioner of the Minnesota Department of Revenue or the Minnesota Attorney General, for the purposes of debt collection.

Use Statement: Your social security number will be used within the Department to identify you and to assure that data about you and your driving record are properly maintained.

With respect to the federal Privacy Act notice requirement, the Commissioner also believes that the notice on X's application form does not meet the federal Privacy Act notice requirement. As noted above, the form contains the following statement:

Social Security Number OPTIONAL for all applicants EXCEPT those applying for a Commercial Driver's License, MN Statute 171.06, Subd. 3.

That statement does not comply with the federal requirement that the notice must state the statutory or other authority under which the entity is requesting the Social Security number. Although the notice does refer to section 171.06, subdivision 3, it does not state clearly that it is Minnesota Statutes Section 171.06, subdivision 3 that mandates that an applicant for a commercial driver's license provide his/her Social Security number. In notices like these, the most direct way to deal with the federal Privacy Act requirement is to present information as follows:

Providing us with your social security number is mandatory. Our authority for requesting the number is, for example, Minnesota Statutes Section 171.06, subdivision 3. The social security number will be used, for example, to identify you.

Opinion:

Based on the facts and information provided, my opinion on the issue raised by X is as follows:

Signed:

Brian J. Lamb
Commissioner

Dated: March 31, 2004