This is an opinion of the Commissioner of Administration issued pursuant to section 13.072 of Minnesota Statutes, Chapter 13 - the Minnesota Government Data Practices Act. It is based on the facts and information available to the Commissioner as described below.

Facts and Procedural History:

For purposes of simplification, the information presented by the citizen who requested this opinion and the response from the government entity with which the citizen disagrees are presented in summary form. Copies of the complete submissions are on file at the offices of PIPA and, with the exception of any data classified as not public, are available for public access.

On December 4, 1996, PIPA received a letter dated December 2, 1996, from Margaret Jakobson. In her letter, Ms. Jakobson requested that the Commissioner issue an advisory opinion regarding her access to certain data maintained about her by Moorhead State University, hereinafter “MSU.” Ms. Jakobson also requested that the opinion address other issues regarding her rights as a subject of data. After subsequent telephone conversations with Ms. Jakobson, four issues were agreed upon.

In response to Ms. Jakobson’s request, PIPA, on behalf of the Commissioner, wrote to Roland Barden, President of MSU. The purposes of this letter dated January 14, 1997, were to inform President Barden of Ms. Jakobson’s request and to ask him or MSU’s attorney to provide information or support for MSU’s position. On February 12, 1997, PIPA received a response dated February 10, 1997, from President Barden.

A summary of the facts relating to this matter is as follows. Ms. Jakobson wrote that on May 15, 1996, she had requested access to all educational data maintained about her by MSU. She further wrote that after data access appointments had been scheduled by President Barden’s office, some of those meetings were subsequently canceled. Ms. Jakobson also wrote that she had been advised that her requests should be made to Sara Gullickson, who had been hired as an independent contractor to serve as a public information officer. Ms. Jakobson objected to the fact that Ms. Gullickson has access to her (Ms. Jakobson’s) private educational data.

In addition, Ms. Jakobson wrote that Ms. Gullickson is not listed in a public document as a “designee” of the responsible authority, and that MSU has not complied with Minnesota Statutes by providing information about the rights of data subjects.

In response, President Barden argued that Ms. Jakobson had received access to all the data she requested on May 15, 1996. In addition, he asserted that Ms. Gullickson, as public information officer, has authority under Chapter 13 to gain access to private educational data about Ms. Jakobson. Further, he argued that MSU has complied with both Section 13.05, subdivisions 1 and 8, in providing information about MSU’s responsible authority and the rights of data subjects.

Issues:

Discussion:

There is no dispute that MSU maintains data about Ms. Jakobson because she is a current or former student. Such data are classified pursuant to Minnesota Statutes Section 13.32. Generally speaking, Section 13.32, educational data, provides that data collected, created, and maintained by public educational institutions about students are private; the main exception being those data that become public through the directory information process. (See Section 13.32, subdivision 5.)

Section 13.04, subdivision 3, sets forth the rights conferred upon data subjects when they request access to data of which they are the subject. This provision states that upon request, a person shall be shown the data without any charge. The government entity must comply with a request within five working days, unless additional time is required to respond. If the entity intends to take more time, five additional working days are allowed, but the government entity must so notify the data subject. Regarding the first issue, it is not disputed that Ms. Jakobson made a written request dated May 15, 1996, addressed to President Barden. In her data request, a copy of which was provided to PIPA, Ms. Jakobson wrote:

...I herein request ACCESS, under M.S. 13.04, Subd. 3, as to a “DATA SUBJECT” and 34 CFR § 99.10 as to a “STUDENT” to inspect and review (possibly requesting copies) to all education records AND data in Moorhead State University’s Affirmative Action Office and the President’s office or to whatever office said records have been transferred to -- since Dr. Wheeler stated that your office has received all the education records and data formerly in the Speech Communications/Theatre Arts Department...Additionally, because from time-to-time I have been given every reason to believe that some of my education records, documents, information gathered on the data subject (myself), and/or data created on the data subject (myself) has found its way to the institution’s attornies’[sic] offices, including the MnSCU offices...I shall expect to see those records, documents, information and data also....I shall be coming directly to your office, please establish a time...

In her opinion request, Ms. Jakobson stated that President Barden’s office scheduled several appointments at which she would be provided her “access rights.” Apparently, some of these appointments were then canceled. Ms. Jakobson wrote:

By May 15, 1996, a follow-up request had been arranged with Dr. Barden. Ms. Ahles provided “supposed access” on May 15, 1996, as aforementioned, to all Ms. Seiler’s [MSU’s Affirmative Action Officer] “supposed”data on the data subject; and President Barden provided “supposed” access on May 17, 1996....Additional appointments were made that Maxine Pianka, Administrative Assistant/Secretary to MSU’s President Barden canceled on specific dates and times that were scheduled in advance for providing my access rights....Ms. Pianka called on the 22nd of May just twenty minutes (20 min.) prior to my appointment at [MSU] . . stating MSU needed to consult with “counsel” regarding my access rights. On June 10, 1996, when my mother and I arrived at President Barden’s office “on time,” Ms. Pianka stated that Dr. Barden was “not available” at the pre-scheduled time and she took my mother and myself to an office to inspect and review my records/data where student workers were present . . and, therefore, the office and my records /data were not secure. July 1, 1996, Ms. Pianka called to cancel my appointment of July 3, 1996 with Ms. Seiler and Dr. Barden stating that Dr. Barden, MSU’s CEO, would reschedule their appointment.

Ms. Jakobson further wrote:

On that same day, July 1, 1996, Ms. Seiler stated that she had “a whole ‘nother file’” I had not seen; and I’d have to take that up (access to Ms. Seiler’s investigations and her unproduced “file”) with J.P. Barone in the Attorney General’s Office....Subsequently, Ms. Seiler left from September, 1996 to some time in December of 1996, failing to provide access, reasonable explanations or content and meaning of records, corrections/amendments or to provide a “Record of Disclosures.”

It appears, according to Ms. Jakobson’s opinion request, that as of November 8, 1996, she had not received access to all of the data she was seeking.

In his response, President Barden stated “to the best of MSU’s understanding,” MSU did respond in a timely fashion to Ms. Jakobson’s May 15, 1996, request for access to data about her. President Barden further wrote:

The meeting to review records took place on May 17, 1996, only two days after the date of her letter requesting access. This meeting was timely....Because this first meeting did not permit Ms. Jakobson enough time to complete her review, a second meeting was scheduled for May 22, 1996. It was that second meeting that was canceled. After MSU received legal counsel from the Minnesota Attorney General’s Office, Ms. Jakobson was provided with full access....Ms. Jakobson was denied access to the interview notes of Affirmative Action Office Seiler....The Department of Education (“DOE”) issued a decision that those interview notes, believed to be sole possession records, must be disclosed. Despite MSU’s disagreement with the DOE ruling, MSU did comply with DOE’s decision when the decision was issued by producing interview notes to Ms. Jakobson.

As previously stated, pursuant to Minnesota Statutes Section 13.04, subdivision 3, upon request to a responsible authority, an individual who is the subject of stored public or private government data shall be shown the data without any charge. Subdivision 3 of Section 13.04 also states that the responsible authority shall comply immediately with such a request. If immediate compliance is not possible, the government entity must respond within five working days, or notify the data subject that the entity requires an additional five working days in which to respond. In addition, subdivision 3 of Section 13.04 requires that upon request, an individual shall be informed if that individual is the subject of stored data and whether those data are classified as private or confidential.

In the situation at hand, it is not clear whether Ms. Jakobson has gained access to all of the data she is seeking; she says no and MSU says yes. In addition, if Ms. Jakobson has received access to some of the data she is seeking, it is not clear at what point in the five to ten working day time frame she received access. However, if MSU has not yet provided Ms. Jakobson access to the data she requested, MSU has not complied with the statutory time deadline and should provide access immediately. Further, if MSU has determined that some of the data sought by Ms. Jakobson are confidential and not accessible to her, MSU should have so advised her no later than ten working days after her request.

The second issue raised by Ms. Jakobson is whether MSU improperly disseminated private educational data about her to Sara Gullickson.

In her opinion request, Ms. Jakobson wrote that she made “repeated” data access requests from May to November of 1996 to President Barden and others at MSU. She then wrote that memos were sent to school officials “stating they were not to answer my requests for my private OR public data, making me the only person that I am aware of whose requests for ‘PUBLIC’ as well as my ‘PRIVATE’ records/data must go to Sara B. Gullickson.”

Ms. Jakobson further wrote:

I obtained a copy of [Ms. Gullickson’s] contract to ascertain if her job description and appointment order (NON-EXISTENT) provided her access to private data and educational records. It does not. Ms. Gullickson continues to be provided access to my education records and private data, despite my informing MSU President Barden, CEO, to “cease and desist” MSU’s disclosures of my private data and education records.

In his response, President Barden wrote:

...MSU retained Ms. Gullickson as its Pubic Information Officer to: 1) Advise and assist MSU in responding to public information matters arising from Federal and State laws and Board policies; 2) Assist MSU in responding to media in matters involving public information; 3) Prepare protocols to guide MSU in responding to information requests arising from Federal and State laws and Board policies; 4) Assist with educating MSU employees on their responsibilities in responding to information requests from the public....she is not providing legal advice to MSU...

He asserted that any independent contractor is considered to be a staff member of MSU when working on MSU business. Therefore, he stated, because Minnesota Rules Section 1205.0400, subpart 2, provides that private data are accessible to individuals within the entity whose work assignments reasonably require access, Ms. Gullickson is entitled to gain access to private data about Ms. Jakobson. He wrote, “Not only does Ms. Gullickson’s work assignment reasonably require access, access to the data is the very essence of her work assignment. The use of the phrase ‘individuals within the entity’ is much broader than, for example, the word ‘employee.’ The Rule clearly envisions dissemination of private data to someone in Ms. Gullickson’s position.”

Because MSU is a state agency for purposes of Chapter 13 and a public educational institution receiving federal funds, it is subject to the provisions of state (Chapter 13) and federal (the Family Educational Rights and Privacy Act (FERPA)) law. Thus, Ms. Gullickson, in her role as chief information officer, should be granted access to private data about Ms. Jakobson (without Ms. Jakobson’s consent) only if her role falls within the parameters set forth in the relevant state and federal statutes and rules. In relevant part, Minnesota Rules Section 1205.0400, subpart 2, provides that private educational data are accessible to “individuals within the entity whose work assignments reasonably require access.” FERPA, however, has a stricter standard. Pursuant to 20 U.S.C. 1232g(b)(1)(A), disclosure is permitted to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests.

In his response, President Barden argued that MSU is complying with state law because Ms. Gullickson’s work assignment requires that she gain access to private data about Ms. Jakobson. However, because the federal law standard is stricter than the state law standard, the real issue is whether Ms. Gullickson’s “need to know” meets the stricter federal standard, i.e., does she have a legitimate educational interest in the private data about Ms. Jakobson.

In her role as public information officer, Ms. Gullickson is not a teacher, or a counselor, or an MSU administrator. She was not hired to provide legal advice; in fact, her contract specifically stipulates that her duties do not include providing legal services to the state within the meaning of Minnesota Statute Section 8.06. Rather, according to her contract, she assists MSU in handling matters relating to information practices policy, information requests, and procedures for handling those requests. Her role does not appear to require that she gain access to private educational data about students. All this, coupled with the fact that President Barden did not discuss the applicability of the federal standard in his response, leads the Commissioner to conclude that MSU has not established that Ms. Gullickson has a legitimate educational interest in the private data about Ms. Jakobson.

In addition, it appears President Barden is suggesting that Ms. Gullickson’s access to Ms. Jakobson’s private data is permissible because she (Ms. Gullickson) is his designee. President Barden referred, in a couple of instances, to Ms. Gullickson as his designee. In his response to Ms. Jakobson’s opinion request, Mr. Barden wrote, “Ms. Jakobson was notified that Ms. Gullickson was my designee.” (Emphasis added.) In addition, in a letter dated July 3, 1996, President Barden wrote to Ms. Jakobson and stated, “I have secured the part-time services of a very good person to assist the University and this Office in dealing with Public Information matters and the associated compliance with federal and state law and board policy. Ms. Gullickson, my designee, will be ready to address your concerns in just a few days.” (Emphasis added.)

If President Barden is stating that Ms. Gullickson should be granted access to Ms. Jakobson’s private educational data because Ms. Gullickson is his designee, the Commissioner does not agree. Pursuant to Minnesota Rules Section 1205.1100, “...the responsible authority shall, on deeming it to be in the best interest of the administration and enforcement of the act, appoint designees who shall be members of the staff of the entity.” (Emphasis added.) Ms. Gullickson’s status is unclear, and the Commissioner therefore cannot conclude the appropriateness of the appointment as President Barden’s designee.

The third issue raised by Ms. Jakobson is whether her rights as a data subject have been infringed upon by MSU’s alleged lack of information about its responsible authority in a public document. “Responsible authority” of a state agency or statewide system is defined in Section 13.02, subdivision 16, as, “...the state official designated by law or by the commissioner as the individual responsible for the collection, use and dissemination of any set of data on individuals, government data, or summary data.” Pursuant to Section 13.05, subdivision 1, the responsible authority shall prepare a public document containing the authority’s name, title, and address. This document must be updated annually and shall be available for public access as provided for in Section 13.03. Further, Minnesota Rules Section 1205.1200 requires that the responsible authority also include in this public document the name, title, and address of designees appointed by the responsible authority.

In her opinion request, Ms. Jakobson wrote that the “Public Accountability” issues “covered in M.S. [sic] 1205.1200” were not addressed in the MSU student handbook and that Ms. Gullickson was not named as a designee. In response to that allegation, President Barden wrote that MSU has listed the “University officer responsible for the storage and security of the [student record information]” in the student handbook, in the MSU catalog, in the MSU newspaper, and in the MSU data access policy. (President Barden provided to PIPA copies of the relevant pages of each of these documents.)

However, the information published in each of the provided documents is not equivalent to that which is required by Chapter 13 and the Minnesota Rules. Rather, the publications provide the following statement: “Since the University does not maintain a central repository for educational records, inquiries for access to specific educational records should be made to the University office or agency listed below who are responsible for a particular record...” There follows a list of approximately 11 categories of information and the office which presumably maintains that type of information. The following are several examples:

Admissions - Director of Admissions
Business - Business Manager
Counseling - Director of Counseling
Financial Aid - Director of Financial Aid
Graduate Studies - Coordinator of Graduate Studies

This list does not meet the requirements set forth in Section 13.05, subdivision 1, and Minnesota Rules Section 1200. The name, title, and address of the responsible authority or any designees are not provided. Therefore, Ms. Jakobson’s rights have been infringed upon because MSU has not provided this information. If individuals (either data subjects or members of the public) seeking information from a government entity such as MSU, are not instructed as to how to direct their requests for access to data, their rights have been impaired.

The fourth issue raised by Ms. Jakobson is whether her rights as a data subject have been infringed upon by MSU’s alleged lack of preparation of a public document which sets forth the rights of data subjects as well as the specific procedures in effect for access to data by the data subject. Section 13.05, subdivision 8, states, “The responsible authority shall prepare a public document setting forth in writing the rights of the data subject pursuant to section 13.04 and the specific procedures in effect in the state agency...for access by the data subject to public or private data on individuals.” Section 13.04 affords rights to data subjects regarding the collection of private data by government entities, requests by data subjects for access to data, and the challenging of accuracy and/or completeness of government data.

In his response, President Barden wrote, “MSU established a data access policy which outlines an individual’s access rights to educational records. A copy of the data access policy is attached as Exhibit F.” An examination of Exhibit F reveals that it is MSU’s FERPA policy. Part of the introduction states, “The administrative procedures outlined in this section are to be complied with by University personnel who have or accumulate educational records which are in a personally identifiable form.” While this document sets forth the policies and/or procedures required by FERPA, it outlines neither the rights afforded by Chapter 13 to data subjects nor MSU’s established procedures, pursuant to Chapter 13, for access to data.

The purpose of requiring a public document such as described in Section 13.05, subdivision 8, is so that individuals, such as Ms. Jakobson, are aware of the information policies and/or procedures specific to each government entity. Chapter 13 grants individuals certain rights. If individual government entities do not reveal how those rights can be specifically actualized in a government entity, the granting of those rights has been thwarted.

Opinion:

Based on the correspondence in this matter, my opinion on the issues raised by Ms. Jakobson is as follows:

1. The Commissioner is unable to determine whether the data subject has gained access to all of the data she requested on May 15, 1996. If the data subject received access to some of the data, it is not clear at what point in the five to ten working day time frame she received access. However, if MSU has not yet provided the data subject with access to all the data, MSU has not complied with the statutory time deadline and should provide access immediately. Further, if MSU has determined that some of the data sought by the data subject are confidential or exempt from disclosure and not accessible to her, MSU should have so advised her within ten working days of her request.
2. Pursuant to the Family Educational Rights and Privacy Act (FERPA), MSU has improperly disseminated private educational data about the data subject to MSU’s public information officer.
3. MSU had infringed upon the data subject’s rights by not including information that clearly identifies the responsible authority in the public document required by Minnesota Statutes Section 13.05, subdivision 1.
4. MSU has infringed upon the data subject’s rights by not preparing a public document required by Minnesota Statutes Section 13.05, subdivision 8, that contains the following: the rights of data subjects pursuant to Section 13.04, and the specific procedures established by MSU for access to data by data subjects.

Signed:

Elaine S. Hansen
Commissioner

March 11, 1997