Note: In 2014, the Legislature amended Minnesota Statutes, section 13.05, subd. 11(a), related to government contracts.

Facts and Procedural History:

On January 16, 2004, IPAD received a letter from X, dated January 15, 2004. In the letter, X asked the Commissioner to issue an advisory opinion regarding a possible violation of X's Chapter 13 rights by Gary L. Fischler Associates (GFA), an organization that contracts with the Minnesota Department of Employment and Economic Development (DEED).

In response to X's request, IPAD, on behalf of the Commissioner, wrote to Gary Fischler. The purposes of this letter, dated January 21, 2004, were to inform him of X's request and to ask him to provide information or support for his position. On February 5, 2004, IPAD received a response, dated same, from Mark Anfinson, an attorney representing GFA.

A summary of the facts as X presented them is as follows. X explained that s/he is losing his/her hearing and sought assistance from the Vocational Rehabilitation Services Division (VR) of DEED. X wrote:

On March 19, 2003, [VR staff] told me he would like me to have vocational interest and abilities testing. In actuality, instead of vocational interest testing, [the VR staff] ordered a psychological assessment from the 3rd party vendor Gary Fischler and Associates....

I went to the offices of Gary Fischler and Associates thinking I was having vocational interest and abilities testing. I was asked to sign a consent for release of information to VR immediately upon arrival at this vendor's office, before I learned the nature of the data I would be asked to provide. I was not told what type of data I was being asked to provide, the intended use of the data, nor the consequences for either providing or not providing this data. There was nothing on the consent for release of information form I signed at the vendor's office detailing the nature of this data, and I had no reason to believe that it was not about my vocational interests and abilities. I had no reservations about sharing information about my vocational interests and abilities with the VR counselor, so I signed the form at the outset of the testing when I was asked. A later email from Gary Fischler to [the VR staff] shows that I was asked to sign a consent for release of information to VR at the outset of the testing, before the data was in existence.

When I signed the release of information agreement for VR at the outset of the testing, I had absolutely no idea what data they were going to collect, the intended use of the data, or the consequences for both providing and not providing the data to Gary Fischler and Associates, before they collected the data. I was not told this office would be attempting a medical diagnosis, or recommending limitations of my work based on the data they were collecting....I certainly was not told that the consequences for both providing or not providing the data was a possibility that I would be diagnosed and labeled with a mental illness, and that actual limitations would be recommended for my future work based on this diagnosis . I also was not told that the consequences for my choosing not to provide some private data would be insults to my character....

I do not believe I was given a Tennessen Warning before collecting this data from me, and I do not believe the vendor should have asked me to sign a consent for release of information before the data was collected. I do not believe an informed consent for release of data can be, in any way, informed if the data is not already in existence when the release agreement is signed....

Issues:

In his/her request for an opinion, X asked the Commissioner to address the following issues:

Discussion:

To determine the contractual relationship between DEED and GFA, IPAD contacted DEED's Data Practices Compliance Official and requested copies of the contract. IPAD received one contract dated 4/2/03 and one contract dated 4/21/03. Each contract is one page in length. The contract dated 4/2/03 contains the following language: All deliveries hereunder shall comply in every respect with all applicable laws of the Federal Government and/or State of Minnesota... The contract dated 4/21/03 does not contain this language. In his comments to the Commissioner, Mr. Anfinson wrote, My client is a vendor to [DEED], and thus would seem to be within the scope of Minn. Stat. section13.05, subd.6.

Minnesota Statutes, section 13.05, subdivision 6, states:

...in any contract between a governmental unit subject to this chapter and any person, when the contract requires that data on individuals be made available to the contracting parties by the governmental unit, that data shall be administered consistent with this chapter. A contracting party shall maintain the data on individuals which it received according to the statutory provisions applicable to the data. [Emphasis added.]

It is the Commissioner's opinion that section 13.05, subdivision 6, does not apply in the present case because there is no language in the contract between DEED and GFA requiring that DEED make data on individuals available to GFA.

During the 1999 Legislative Session, the Legislature enacted a provision intended to augment previous language in Chapter 13 relating to contracts between government entities and other persons. It is section 13.05, subdivision 11, and went into effect on August 1, 1999.

Pursuant to section 13.05, subdivision 11(a):

If a government entity enters into a contract with a private person to perform any of its functions, the government entity shall include in the contract terms that make it clear that all of the data collected, received, stored, used, maintained, or disseminated by the private person in performing those functions is subject to the requirements of this chapter and that the private person must comply with those requirements as if it were a government entity....

The Commissioner has issued several opinions relating to the obligations of contractors when their contract with a government entity is silent in regard to Chapter 13 or does not contain the express language discussed in section 13.05, subdivision 11. In Advisory Opinion 03-033, the Commissioner stated:

In the case at hand, the District's contracts with the bus companies do not contain the type of clause required by section 13.05, subdivision 11. Rather, the relevant provisions in the District's bid specification state that the District will treat personal information on contractor school bus drivers, including names as confidential information to the extent possible under [Chapter 13].

The Commissioner has opined, in previous opinions, that if the privatization clause is not contained in a contract, its presence nonetheless should be inferred to give effect to the Legislature's intent. The Commissioner reached that conclusion based on advice from the Office of the Minnesota Attorney General (OAG). In Advisory Opinion 01-075 the Commissioner wrote:

...The language in subdivision 11 is mandatory so its omission would pose a problem for both Mounds View and Kennedy Graven for which there are two possible remedies. The first is to infer the term's presence in the contract. The second is to find the contract void or voidable. The Commissioner finds it preferable to keep the contract in effect and infer the presence of the above provision rather than voiding the contract in its entirety.

The Commissioner notes he is aware of a recent District Court Opinion in which the Court disagreed with the analysis in the advisory opinion. (See WDSI, Inc. v. The County of Steele, File No. C4-02-1285 (Third Judicial District Steele County State of Minnesota).) The court in that case was not aware the Commissioner reached his conclusion in, 01-075 based on the OAG's advice.

On December 30, 2003, the Minnesota Court of Appeals reversed part of the District Court's decision in WDSI, Inc. The Appellate Court wrote:

[Chapter 13] provides that a private party who has contracted with a governmental entity to perform a governmental function has a duty to provide the public with governmental data unless the governmental entity has the data...If a private party fails to comply with [Chapter13], the remedy is against the private party....To accept WDSI's argument and the district court's reasoning would be to simply ignore the mandate of the statute. Although that mandate was not expressly reflected in the contract, it applies nevertheless, and neither contracting parties nor courts can simply ignore it....

(See WDSI, Inc. v. The County of Steel, 672 N.W.2d 617 (Minn.App. 2003).)

Although neither of the contracts DEED submitted to IPAD contain the language required by section 13.05, subdivision 11, it is the Commissioner's opinion, as buttressed by the Appellate Court's recent decision in WDSI, Inc., v. The County of Steele, that GFA must comply with the requirements of Chapter 13.

Issue 1:

Pursuant to Minnesota Statutes, Chapter 13, did Gary Fischler and Associates violate a data subject's rights by not providing a Tennessen warning notice prior to collecting data as part of a psychological evaluation?

Responding to both of the issues raised by X requires an analysis of the relationship between the Tennessen warning notice (see Minnesota Statutes, section 13.04, subdivision 2) and an informed consent (see section 13.05, subdivision 4(d)). The Tennessen warning notice is given to individuals from whom the government entity seeks private or confidential data. If, after having received the notice, an individual provides the requested data, no consent to use or disseminate the data is required as long as any uses and disseminations are consistent with the notice. The rationale underlying the notice is that when the individual provides the data, s/he has turned down the opportunity to protect his/her privacy and accepts the possible uses, consequences, and disseminations described in the notice.

By contrast, if the entity has collected the data and then wishes or is required to disseminate the data to a person or entity not described in the Tennessen warning notice, the entity must obtain the data subject's informed consent. An entity subject to Chapter 13 gives a Tennessen warning notice when it collects private or confidential data about an individual from that individual. An entity subject to Chapter 13 obtains an informed consent from a data subject when the entity wishes to use or disseminate private or confidential data in a manner different than that described in the Tennessen warning notice. An entity gives a Tennessen warning notice prior to or at the time of data collection, whereas the entity obtains informed consent after it has collected the data.

The Tennessen warning notice contains four components: (a) the purpose and intended use of the requested data within the entity; (b) whether the individual may refuse or is legally required to supply the requested data; (c) any known consequences arising from supplying or refusing to supply private or confidential data; and (d) the identity of other persons or entities authorized by state or federal law to receive the data.

Pursuant to Minnesota Statutes, section 268A.05, data DEED collects and maintains about its clients are private.

In his comments to the Commissioner, Mr. Anfinson wrote:

...I believe that my client did provide a proper and adequate Tennessen warning...Specifically, the Authorization for Release of Information form used by my client for referrals from the [VR] expressly contains most of the elements of the Tennessen warning...

Even if [the Tennessen warning requirement] had not been [complied with], it seems clear from the documentation sent by your office that none of the private or confidential data that might have been collected as part of the assessment process was in any way disseminated by my client until after X had consented to the dissemination....For this reason, it would appear that any issue raised by imperfect compliance with the Tennessen warning requirement was effectively resolved when my client honored the requester's objection to dissemination until [X] subsequently consented.

The form to which Mr. Anfinson refers is entitled Authorization for Release of Information - Rehabilitation Services [VR]. The top line is meant to be filled in with the name of VR client. The form further states:

I authorize [blank space for the name of the Gary Fischler Associates staff ] (The Examiners) to release information to my [VR] counselor...I understand that my counselor will also be providing information to the Examiners that may include psychological testing reports, consultation reports, and other information that is included in my vocational rehabilitation records. I further understand, and agree to the following:

• The Examiners have been hired as consultants to [VR] to provide them with information that will be useful in vocational rehabilitation planning and determining what services I may receive from [VR].
• The Examiners will be providing oral and written reports of the psychological evaluation to my [VR] counselor.
• I am under no obligation to provide any information to the Examiners. However, at their discretion, any or all of the information gathered, including any information I may provide after the written report has been issued, may be reported to [VR].
• I have certain rights to my records, as provided by Minnesota law. However, in accordance with APA guidelines, an explanation of the results of my examination by the Examiners may be precluded with respect to this evaluation.
• If I request additional information or explanation about this evaluation directly from the Examiners and without authorization from [VR], and they agree to provide them, they may charge me a reasonable fee for their time and other expenses incurred.

Although Mr. Anfinson argues that the first, second, and third bullets on the form constitute a valid Tennessen warning notice, the Commissioner respectfully disagrees. The primary purpose of the notice required by section 13.04, subdivision 2, is to offer the individual asked to supply the data an opportunity to decide whether to provide certain information to the government or, in this case, a contractor to the government. If the individual does not like how the entity will use the data or the possible consequences of supplying the data, and is willing to suffer the consequences of not providing the data, s/he can elect not to provide the information. Obviously, for an individual to be afforded this right, the entity must provide the notice prior to collecting data from the individual. It is the Commissioner's opinion that the first, second, and third bullets on the form do not provide enough information to allow an individual such as X to make an informed decision as to whether or not to provide data.

For example, to comply with the requirements of section 13.04, subdivision 2, GFA must clearly explain to X any consequences to X, which are known to GFA, arising from X supplying or refusing to supply private or confidential data about her/himself to GFA. Regarding his client's compliance with this requirement, Mr. Anfinson wrote, The known consequences of supplying the data are described ('at their discretion, any or all of the information gathered, including any information I may provide after the written report has been issued, may be reported to [VR]'). (See the third bullet on the form.)

The form identifies a single consequence to X if s/he provides private data about her/himself to GFA: that the data may be reported to VR. The form does not advise X that data s/he supplies may be used to make certain assessments. Further, if there are no known consequences from refusing to supply the data to GFA, the notice should so state.

Mr. Anfinson also states, The form tells the person that s/he may refuse to supply the data ('I am under no obligation to provide any information to the Examiners'). In the Commissioner's mind, this is not the same as informing X, clearly and specifically, whether s/he may refuse or is legally required to supply the requested data. (See the third bullet on the form.)

Issue 2:

Pursuant to Minnesota Statutes, Chapter 13, did Gary Fischler and Associates violate a data subject's rights by having the subject sign an informed consent for data that were not in existence at the time the subject signed the consent?

Pursuant to section 13.05, subdivision 4(d), private data may be used and disseminated to any person or agency if the data subject has given his/her informed consent. Minnesota Rules, section 1205.1400, subparts 3 and 4, provide further guidance for complying with this requirement. Pursuant to subpart 3 of Minnesota Rules, section 1205.1400, informed consent means, ...the data subject possesses and exercises sufficient mental capacity to make a decision which reflects an appreciation of the consequences of allowing the entity to initiate a new purpose or use of the data in question.

Subpart 4 of Minnesota Rules, section 1205.1400, provides that the responsible authority must not coerce a data subject to give informed consent, that informed consents must be in writing, and that informed consents must identify the consequences of the giving of informed consent.

In his comments to the Commissioner, Mr. Anfinson wrote, As an initial matter, I have been unable to locate language in Chapter 13 stating that an informed consent cannot be provided prior to collection of data.

In Advisory Opinion 01-035, the Commissioner wrote:

The Commissioner has additional comments. First, pursuant to the provisions of the applicable rule quoted above, the County was required to communicate the consequences to X of providing the consent sufficiently to enable X to give her informed consent. The County consent form X signed makes no mention of the consequences of giving the consent. Accordingly, the County did not meet its obligation under section 13.05 or Minnesota Rules, part 1205.1400.

In addition, the County asked X to provide her consent to release data that were not in existence at the time the consent was executed, i.e., Z's hospital records before Z was born. X could not provide informed consent to release data when she had no way of knowing which data she was consenting to release. In this respect also, the County did not meet its obligation under section 13.05 to secure X's informed consent.

In the present case, X was asked to sign the informed consent before GFA collected data about him/her. Therefore, the Commissioner opines that GFA violated X's rights by having him/her give informed consent before X knew what data GFA would be collecting from X.

The following note is in order. The form used by GFA is entitled, Authorization for Release of Information - Rehabilitation Service [VR], and arguably serves as a data release form as well as a Tennessen warning notice. The Commissioner is of the opinion that a Tennessen warning notice and an informed consent both cannot be adequately clear and straightforward if they are merged. The Tennessen warning notice and an informed consent play different and distinct roles; combining them makes it difficult for a data subject to understand the function of each. As the Commissioner previously stated, an entity subject to Chapter 13 gives a Tennessen warning notice prior to or at the time of data collection, whereas the entity obtains informed consent after it has collected the data. Further, because Tennessen warning notices and informed consents serve as communication tools, they become ineffective if designed in ways such that data subjects are confused. Surely, this is not what the Legislature intended.

The Commissioner believes that for GFA to provide adequate notice to individuals of their rights under section 13.04, subdivision 2, the Tennessen warning notice needs to be separated from the informed consent. The Commissioner offers the services of IPAD if GFA desires assistance preparing Tennessen warning notices and informed consents. In addition, a document entitled, Model Policy: Public Access to Government Data and Rights of Subjects of Data, is available from IPAD. A portion of this model policy offers guidance in creating Tennessen warning notices and informed consents. Another model policy entitled, Model Informed Consent for Release of Government Data, also is available from IPAD.

Opinion:

Based on the facts and information provided, my opinion on the issues that X raised is as follows:

Signed:

Brian J. Lamb
Commissioner

Dated: March 2, 2004