Facts and Procedural History:

On April 25, 2013, the Information Policy Analysis Division (IPAD) received an email from "X," in which X asked the Commissioner to issue an advisory opinion about whether Independent School District 743, Sauk Centre, violated his/her child's ("Y") rights as a data subject. Parents of two other District students provided statements in support of X's description of the issue.

IPAD, on behalf of the Commissioner, wrote to Dan Brooks, Superintendent of the District, in response to X's request. The purposes of this letter, dated April 25, 2013, were to inform him of X's request and to ask him to provide information or support for the District's position. On May 13, 2013, IPAD received a response, dated same, from Susan E. Torgerson, attorney for the District.

A summary of the facts as X provided them follows. X wrote that Y, a District student, was questioned by two District staff regarding an incident that occurred off school property. According to X, the District staff questioned Y "about [Y's] actions in the incident, where [Y] was, and who [Y] was with. [Y] was not given the Tennessen warning orally or in writing prior to the questioning. I was present during the questioning."

The District also questioned the other students about their involvement in the incident. The parents, who were present when the District questioned their children, stated that the District also did not give their children Tennessen warning notices.

Issue:

Based on X's opinion request, the Commissioner agreed to address the following issue:

Discussion:

Pursuant to Minnesota Statutes, Chapter 13, government data are public unless otherwise classified. (Minnesota Statutes, section 13.03, subdivision 1.)

Data about students are governed by both Minnesota and federal law. Minnesota Statutes, section 13.32, classifies data relating to students, and incorporates by reference much of the federal Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. section1232g, and its implementing regulations, 34 C.F.R. Part 99. Subject to limited exceptions, data about students and their parents are private, and may not be released without statutory authority or consent.

When a government entity collects private or confidential data about an individual from that individual, the entity must provide a notice, commonly referred to as a Tennessen warning. (Minnesota Statutes, section 13.04, subdivision 2.) This notice must contain the following: (a) the purpose and intended use of the data; (b) whether the individual can refuse or is legally required to provide the requested data; (c) what the consequences are of supplying or not supplying the data; and (d) the identity of other persons or entities outside of the collecting agency authorized by state or federal law to receive the data.

The Commissioner previously has opined that if an entity does not give an individual a Tennessen notice when circumstances warrant it or if an entity's notice is inadequate, the entity cannot store, use, or disclose any of the data it collected from the individual. (Minnesota Statutes, section 13.05, subdivision 4.)

In her comments to the Commissioner, Ms. Torgerson wrote:

....The student received the notice required by law. The District obtained information about [Y] from a variety of sources, including the data subject, after an incident in the fall of 2011. The information about [Y's] violation was not shared outside the District by anyone in the District. ....

....
At the start of each interview, each interview subject, including [Y], was told by [District administrator] the purpose/reason for the interview, that they had the right to refuse responding to the questioning, and that the information was to be used to help in the determination of their involvement in the situation and potential disciplinary action. They were also informed that the information would remain within the School District.

Ms. Torgerson submitted an affidavit from the District employee who questioned the students

I interviewed 13 students with regard to the incident I gave each of them the same notice at the beginning of the interview. I told them:

a. The purpose of the interview was to find out who was responsible for the [incident of vandalism]
b. I stated this clearly and repeatedly that they did not have to answer questions;
c. If they did not answer I would need to draw conclusions without their input;
d. That the information would be used to determine consequences/discipline for them and maybe for others; and
e. That the information would be used within the District as necessary.

As the Commissioner has discussed in many previous advisory opinions, the purpose of the Tennessen notice is to provide individuals with sufficient information to decide whether to provide the requested data. Here, the District told Y why the entity is collecting the data and how it will use the data, and that Y was not legally required to answer. However, the oral notice described above does not meet the full statutory notice requirements for the following reasons.

First, it doesn't clearly state the consequences to Y of providing or not providing the requested data. It just states that if Y does not provide the data, the District will reach its conclusions without Y's input. According to Ms. Torgerson:

The MSHSL (Minnesota High School League) rules do apply to student athletes. The District's activities director determined that [Y]'s participation in the incident constituted a violation of MSHSL Bylaw 206, Good Standing and General Eligibility requirements. [Y] was required to refrain from participation in actual contest activities for a period of two weeks. Each student athlete and a parent, sign an MSHSL Eligibility Statement at the start of the school year. The Eligibility Statement acknowledges the expectations and the consequences of violations. In this instance, the nature of the violation allowed the local district to impose the consequence and did not require any reporting of the violation to the MSHSL.

Evidently the District knew of at least one consequence to Y if Y provided data that confirmed his/her involvement in the incident, and it should have included that in its Tennessen notice.

Second, the District told Y that the data would be used within the District "as necessary," but it did not identify those persons outside the District to whom it was authorized to disseminate the data, regardless of its intention to do so. For example, pursuant to Minnesota Statutes, section 13.32, subdivision 8(b)(5), the District had authority under certain conditions to disseminate the data about Y to the juvenile justice system. In addition, the District had authority to share the data pursuant to a court order. At minimum, the District needed to inform Y of those authorized disseminations.

The Commissioner notes that although section 13.04 does not require written Tennessen notices, the factual dispute here demonstrates the importance for an entity to document in some manner that it gave proper notice. A simple way to do that is to provide the notice in writing, and ask the data subject to sign and date it.

Opinion:

Based on the facts and information provided, the Commissioner's opinion on the issue raised by X is as follows:

Signed:

Spencer Cronk
Commissioner

Dated: June 14, 2013.