Facts and Procedural History:

On December 10, 2008, the Information Policy Analysis Division (IPAD) received a letter dated December 8, 2008, from John Gilbertson. In his letter, Mr. Gilbertson asked the Commissioner to issue an advisory opinion regarding his right to gain access to certain data from Minnesota Management and Budget (MMB).

IPAD, on behalf of the Commissioner, wrote to Tom Hanson, Commissioner of MMB, in response to Mr. Gilbertson's request. The purposes of this letter, dated December 12, 2008, were to inform him of Mr. Gilbertson's request and to ask him to provide information or support for MMB's position. On January 5, 2009, IPAD received a response, dated December 19, 2008, from Commissioner Hanson.

A summary of the facts as Mr. Gilbertson provided them is as follows. On February 14, 2008, Mr. Gilbertson requested the following data, "I wish to make a data request for updated information as to the race, gender, disability status of state employee by agency and by the state as a whole."

MMB responded on March 14, 2008:

we have created a disk with all the information you requested and it is available Please note that this disk contains a separate pdf file for each agency and all data that could be considered private (10 or less employees in any one field) has been redacted.

Mr. Gilbertson objected to MMB's response.

On May 12, 2008, MMB responded:

Please understand that the reason for our practice of redacting private data statistics of 10 or fewer employees in any one field of a report is not to hinder you in your desired analysis but to protect the identity and private data of these individuals per M.S. 13.43. If these smaller statistics were released, regardless of your intent, a second public data request for names of people in the same group could be asked for by you, or anyone else who could come in contact with this report, and the comparison of two such requests could potentially identify these people.

I cannot speak to how this information was released in the past but it appears that it was an anomaly. While the same practice of redacting statistics of 10 employees or fewer was used it was not consistent with our practice of redacting private data fields.

Issue:

Discussion:

Pursuant to Minnesota Statutes, Chapter 13, government data are public unless otherwise classified. (Minnesota Statutes, section 13.03, subdivision 1.)

Minnesota Statutes, section 13.43, classifies data on individuals who are current or former employees of a government entity. Subdivision 2 lists the types of personnel data that are public and subdivision 4 classifies most other types of personnel data as private. Of relevance here, an employee's name is public data but his/her gender, race, and disability status are private.

In his comments to the Commissioner (of Administration), Commissioner Hanson wrote:

The department will provide data on gender, race, and disability status to the best of its ability for inquiries regarding state employee demographics. That is either at the aggregate statewide level or by department/agency. However, the department has routinely declined to issue data where the count is ten employees or fewer in any one data field. In the larger pool of aggregated data there is little danger of the information identifying a specific individual. In the smaller pool of fewer than ten employees, the probability of data identifying a specific individual increases greatly.

As an illustration, if these smaller statistics were released, regardless of intent, a second public data request for names of people in the same group could be asked for by the original requestor, or anyone else who could come in contact with this report, and the comparison of two such requests could potentially identify people.

Minnesota Statutes, section 13.02, subdivision 19, defines summary data as, "statistical records and reports derived from data on individuals but in which individuals are not identified and from which neither their identities nor any other characteristic that could uniquely identify an individual is ascertainable." Thus, in responding to requests for summary or statistical data, government entities have an obligation to release statistical information in such a way that specific individuals are not identified.

Here, Mr. Gilbertson asked for a breakdown of state employees, according to department, by race, gender and disability status (disabled or not disabled). (For reasons unknown to the Commissioner, MMB broke down the data in each department according to certain job categories.)

Mr. Gilbertson attached to his opinion request some of the data he received in response to his request. One example is from the Minnesota Department of Education. The document from MMB indicates there are 29 employees who fall within the Officials and Administrators category. In this grouping, MMB provided no statistical information regarding gender, ethnic group, or disability status presumably because there are fewer than ten employees who are either male or female; fewer than ten employees who are either disabled or not disabled; and fewer than ten employees who are white, black/African American, Hispanic/Latino, Asian/Pacific Islander, American Indian/Alaskan Native, or not specified. As MMB did not provide the Commissioner with the actual data, she cannot determine whether there was a substantial risk that Mr. Gilbertson would have been able to determine gender, disability status, or ethnic group of certain employees if he had obtained their names through a subsequent request for public data.

Another example is from the Minnesota Department of Education - the Paraprofessionals category. In this group there is only one employee. Here, if MMB had provided statistical information indicating this person was female and Mr. Gilbertson had obtained the employee's name, he would have obtained private data about the employee. If MMB had provided statistical information indicating this person was white and Mr. Gilbertson had obtained the employee's name, he would have obtained private data about the employee. If MMB had provided statistical information indicating this person was not disabled and Mr. Gilbertson had obtained the employee's name, he would have obtained private data about the employee. Here, therefore, MMB's response to Mr. Gilbertson was appropriate.

It is commendable that MMB is trying to protect its private data; however, it also has an obligation to release public data. The Commissioner is not sure that a "one size fits all" policy is the best approach to striking this balance and she is not convinced that a group size of ten or fewer is an appropriate cut off for refusing to provide any statistical information. Frequently, it is the composition of the group and not its size that raises the risk that individuals can be identified. For example, in an agency of 100 employees, if all of the employees are disabled, releasing any statistical information about disability status would identify each of the employees as being disabled. Conversely, if an agency of ten has five disabled and five non-disabled employees, the risk of identifying each employee's disability status is greatly reduced.

The difficulty in providing uniform guidance on this issue is that different government entities collect, create, and maintain different types of data that may or may not be classified similarly by Chapter 13. For example, the names of government employees are public but the names of individuals receiving public assistance are not. The names of public school students may or may not be public depending upon how each school district decides to treat the data. To respond appropriately to summary data requests, each government entity then must have a good working knowledge of how its data are classified. Thus, if uniform guidance is impractical, handling these types of requests on a case-by-case basis may make the most sense. The Commissioner encourages entities to work with data requestors on different ways to provide summary data to reduce the risk that individual data subjects would be identified, such as grouping data categories and datasets together.

That said, the Commissioner welcomes some type of clarification from the Legislature on this issue. Without additional legislative guidance, each government entity must continue to weigh the risk that summary data can be attributed to an individual and balance the entity's obligations to both protect private data and make public data available.

Opinion:

Signed:

Dana B. Badgerow
Commissioner

Dated: January 28, 2009