Opinion Library

To return to this list after selecting an opinion, click on the "View entire list" link above the opinion title.

RSS feed

Advisory Opinion 96-042

September 18, 1996; University of Minnesota

9/18/1996 10:14:43 AM

This is an opinion of the Commissioner of Administration issued pursuant to section 13.072 of Minnesota Statutes, Chapter 13 - the Minnesota Government Data Practices Act. It is based on the facts and information available to the Commissioner as described below.

Facts and Procedural History:

For purposes of simplification, the information presented by the person who requested this opinion and the response from the government entity with which the person disagrees are presented in summary form. Copies of the complete submissions are on file at the offices of PIPA and, with the exception of any data classified as not public, are available for public access.

On August 5, 1996, PIPA received a letter from K in which K raised certain issues. PIPA wrote to K, in a letter dated August 9, 1996, asking for clarification as to what it was K was requesting. On August 16, 1996, PIPA received a letter from K requesting this opinion. In that letter, K described what K believed to be a violation of K's rights by the University of Minnesota. K enclosed copies of related correspondence.

In response to K's request, PIPA, on behalf of the Commissioner, wrote to Tracy M. Smith, Associate General Counsel, University of Minnesota. The purposes of this letter, dated August 19, 1996, were to inform Ms. Smith of K's request, to ask her to provide information or support for the University's position, and to inform her of the date by which the Commissioner was required to issue this opinion.

On September 3, 1996, PIPA received a response from Ms. Smith. A summary of the detailed facts of this matter follows.

K is a student at the University of Minnesota. According to K, K received a failing grade in a calculus course. K investigated the failure rate among students taking calculus courses at the University, and wrote to University President Nils Hasselmo, via e-mail, to complain. K also wrote a complaint, via e-mail, to United States Representative Gil Gutknecht. After some delay in receiving a response from the University, Representative Gutknecht asked Minnesota Governor Arne Carlson to look into the matter further. K's letter to PIPA indicates that K was aware that Representative Gutknecht had contacted the Governor's office. Governor Carlson asked the University to respond to K, and asked for a copy of its response.

Dr. Willard Miller, Associate Dean of the University's Institute of Technology, and former head of the University's Mathematics Department, investigated K's complaint on behalf of the University. According to Ms. Smith, [t]o understand K's level of preparedness [for the mathematics course], Dr. Miller reviewed K's transcript.

Following his inquiry, Dr. Miller communicated his findings to K via e-mail. In his response, Dr. Miller stated Governor Carlson has asked me to respond to your e-mail message. . . . Dr. Miller copied that message to Representative Gutknecht via e-mail, and the University provided Governor Carlson with a copy of the response. K then wrote to PIPA, asserting that the University had violated K's privacy rights in the course of its response to K's complaint.

Issues:

In K's request for an opinion, K asked the Commissioner to address the following issues:

Pursuant to Minnesota Statutes Chapter 13, did Dr. Willard Miller inappropriately gain access to private data about K, a University of Minnesota student?
Did Dr. Willard Miller violate a provision of Minnesota Statutes Section 13.32, subdivision 3 (e), by not documenting the disclosure of private educational data on K?
Pursuant to Chapter 13, did Dr. Willard Miller inappropriately disseminate private data about K?

Discussion:

Provisions of both state and federal law govern data about students. Minnesota Statutes Section 13.32 incorporates by reference much of Title 20 of the United States Code, Section 1232g, the federal Family Educational Rights and Privacy Act of 1974 (FERPA), and its implementing Rules, Title 34 of the Code of Federal Regulations, Part 99.

NOTE: FERPA refers to education records and Minnesota Statutes Section 13.32 refers to educational data. For purposes of this opinion, the definitions are similar enough not to warrant distinction.

Section 13.32 provides that educational data are data about individuals maintained by a public educational agency or institution which relate to a student, and which are classified as private. The University of Minnesota is a state agency under Chapter 13, and a public educational institution that receives federal funds, and as such is subject to regulation under Section 13.32 and FERPA.
According to K, Dr. Miller did not have the right to gain access to K's transcript, because K had not given Dr. Miller written consent to do so. According to Ms. Smith:

In investigating K's complaint of unfair grading, it was entirely reasonable and permissible for Dr. Miller to consult various records, including K's student file, as Dr. Miller had a legitimate reason to know the relevant background. Dr. Miller accessed the information in compliance with the Minnesota Government Data Practices Act, which allows access to private data to individuals 'whose work assignments reasonably require access.' Minn. R. 1205.0400, subp. 2. Dr. Miller also complied with applicable federal law which allows personnel who have a 'legitimate educational interest' access to student information that might otherwise be protected. 20 U.S.C. [Section] 1232g(b)(1)(A).

Pursuant to state and federal law, under certain circumstances employees of an educational institution may gain access to private data without the written consent of the data subject. The applicable standards for access to educational data are those described above by Ms. Smith. The University did not provide the Commissioner with documentation of its policy for applying those objective standards to particular cases. It is not clear whether, in order to answer K's complaint, Dr. Miller needed to gain access to the whole of K's education record. However, the University has the discretion to make that determination. Absent any other information, it appears that Dr. Miller appropriately gained access to educational data about K.

The second issue raised by K implicates FERPA, by cross reference contained in Section 13.32, subdivision 3 (e). Educational institutions must maintain a record of requests for and disclosures of private education records, with the exception of disclosures to the parent or eligible student, to school officials with a legitimate educational interest in the record, and to those persons to whom disclosures are made with written consent. (See 20 U.S.C. 1232g (b)(4)(A).) According to Ms. Smith:

In this case, Dr. Miller noted on his correspondence to K that the correspondence was also being sent to Representative Gutknecht, the Dean's office, and the President's Office. The University has kept all records relating to this complaint and inquiry, including all records documenting that the University responded to the Governor. The University therefore has recorded all communications as required by law, and K is fully aware of all persons who have received educational data about [K] as required by law.

The applicable federal law and rule do not specify the manner in which the record of disclosures must be maintained. According to the information provided by Ms. Smith, it appears that the University has fulfilled its obligation to provide K an opportunity to learn the identity of those persons who have received K's education record. The University has on file all documents relating to K's complaint, and has indicated in correspondence with K all persons who received copies. This appears to be a record of disclosures sufficient to inform K.

The third issue is whether Dr. Miller inappropriately disseminated private data about K. According to the copy K provided of Dr. Miller's e-mail message to K, that message was copied as follows: CC: gil@hr.house.gov, vanvoorh@mailbox.mail.umn.edu, davis@fs1.itdean.umn.edu. The Commissioner was not provided any information which identifies the holders of those e-mail addresses. However, it appears that gil@hr.house.gov is the e-mail address for Representative Gutknecht, and davis@fs1.itdean.umn.edu is the e-mail address for Dean Davis of the University's Institute of Technology. The Commissioner cannot determine the identity of the holder of the e-mail address vanvoorh@mailbox.mail.umn.edu.

As discussed above, pursuant to state and federal law, private data may be disseminated without the data subject's consent to persons withinthe educational institution whose work assignments reasonably require access to, and who have a legitimate educational interest in the data. According to Ms. Smith, the University determined that the Dean and the President are such persons.

It appears from the e-mail address that the person addressed as vanvoorh@mailbox.mail.umn.edu is associated with the University. However, if vanvoorh is a member of the University staff, the University provided no information as to whether her/his work assignment reasonably required that she/he gain access to private educational data about K, and that she/he had a legitimate educational interest in the data. Therefore, it is possible that Dr. Miller inappropriately disseminated private educational data about K to someone within the University.

In general, private data may be disseminated to persons outsidethe government entity without the data subject's written consent only as specifically authorized by state statute, federal law or rule. (See Section 13.05, subdivision 4.) K maintains that Dr. Miller inappropriately disseminated private educational data about K to Representative Gutknecht and Governor Carlson, because K had not given written consent to do so. According to Ms. Smith:

As for Representative Gutknecht and Governor Carlson, K authorized them to receive information when [K] enlisted them to contact the University on [K's] behalf. . . . . A citizen who chooses to involve a government representative on his or her behalf reasonably must believe that the representative will learn the circumstances of the citizen's particular problem.

Ms. Smith appears to be saying that the University had K's implied consent to the release of K's private educational data to Governor Carlson and Representative Gutknecht. Given that K had sought assistance from Representative Gutknecht, who contacted Governor Carlson with K's knowledge, it is reasonable for the University to take that position. However, a strict reading of state and federal law would lead to the conclusion that private data may be disseminated under this kind of circumstance only with the data subject's express written consent. The interests of all parties are best protected, and best served, when the government entity secures the written consent of the data subject. However, given K's actions, it was reasonable for the University to interpret those actions as a form of implied consent.

Again, it is not possible for the Commissioner to determine whether vanvoorh@mailbox.mail.umn.edu is a person outside the University to whom it was appropriate for Dr. Miller to have sent a copy of his message to K. (Persons other than University staff have access to University e-mail accounts, which also contain the umn.edu identifier in the e-mail address.) According to K, that person's identity is unknown to K. Therefore, it is possible that Dr. Miller inappropriately disseminated private educational data about K to someone outside the University.

Finally, in K's correspondence to the Commissioner, K stated: I would also like to bring to your attention that [sic] the method in which Willard Miller disseminated that information about my transcript. Dr. Willard Miller disseminated that information through e-mail Ntilde; an unsecured transmission that anyone with access to e-mail could obtain that information. In response, Ms. Smith wrote:

There is nothing in the law that prohibits the University from using perhaps the most common means of communication on university campuses. K initiated and has continued making [K's] communications by e-mail. K e-mailed the President and Representative Gutknecht. The University merely responded in kind. (Ironically, in [K's] letter to PIPA received August 16, K complains that the University used the 'unsecured' medium of e-mail, but in the next paragraph [K] asks that PIPA contact [K] by phone, mail, or 'e-mail' concerning [K's] complaint.)

Ms. Smith is correct that there is nothing in law that specifically prohibits the transmission of private data via e-mail. However, simply because e-mail is widely used does not necessarily mean that it is appropriate for government entities to transmit private data in that manner.

Section 13.05, subdivision 5, provides that responsible authorities shall establish appropriate security safeguards for all records containing data on individuals. Therefore, in general, government entities must take adequate security precautions when transmitting private data. It may not be appropriate for government entities to use a communications medium, which is widely known to be subject to unauthorized access, to transmit unprotected private data.

However, in this case, K sent K's complaints to the University and Representative Gutknecht via e-mail. Through use of that medium, K provided K's e-mail address (and possibly no other means to contact K) to the recipients of K's e-mail messages. It is therefore reasonable for the University and Representative Gutknecht to have responded to K using the same medium. In addition, in K's correspondence with PIPA, K specifically included e-mail as an acceptable means by which PIPA might contact K to discuss K's opinion request.

Nonetheless, all government entities, for their own protection as well as for the protection of data subjects, ought to consider carefully the use of e-mail to transmit private data, in light of their obligations under Section 13.05, and the various provisions of state and federal law which classify government data as not public.

Opinion:

Based on the correspondence in this matter, my opinion on the issues raised by K is as follows:

Dr. Miller appropriately gained access to private data about K, a University of Minnesota student.
Dr. Miller adequately documented the disclosure of private educational data on K.
Dr. Miller appropriately disseminated private data about K to the University President and Institute of Technology Dean, because the University determined that their work assignments reasonably required access and they had a legitimate educational interest in the data. The University reasonably believed it had K's implied consent to disseminate private data about K to Representative Gutknecht and Governor Carlson, to whom K had taken K's complaint. However, the interests of all parties would have been better protected if the University had secured K's express written consent. Further, the status of one person to whom private data about K were disseminated is unknown. Therefore, it is possible that Dr. Miller inappropriately disseminated private educational data about K.

Signed:

Elaine S. Hansen
Commissioner

Dated: September 18, 1996

Data subjects

Educational data

Electronic data

Informed consent

FERPA (Federal Education Rights and Privacy Act)

Legitimate educational interest

Work assignment reasonably requires access

Email/internet

Implied vs. written

Work assignment reasonably requires access (1205.0400, 1205.0600)