Tennessee Advisory Opinions January 01, 2002: TN Att. Gen. Op. 02-016

Advisory Opinion Text

2. May the State coerce permission to disseminate an individual's social security number in exchange for a state service? If so, may it coerce permission for dissemination above and beyond that needed for legitimate state purposes?

3. If a citizen has, prior to the effective date of Tenn. Code Ann. § 4-4-125, voluntarily provided his social security number, may it be inferred that this individual has given the State permission to disseminate the social security number without further authorization, either broadly or for legitimate state purposes?

4. May the State prospectively require that each new employee, as a condition of employment, authorize dissemination, either broadly or with limitations? What may be required of existing employees?

5. Is the State only prohibited from unauthorized external dissemination of social security numbers, or is unauthorized dissemination prohibited between state employees and state agencies?

6. Tenn. Code Ann. § 26-1-110 provides that if a social security number is not provided with an execution, the garnishee may, after reasonable effort, make a return "Defendant cannot be identified or distinguished from information provided on the execution." May the State provide the garnishee with the social security number without the defendant's authorization?

7. Is the newly enacted Tenn. Code Ann. § 4-4-125 constitutional?

2001 Tenn. Pub. Acts Ch. 427.

2. This Office has found no general authority under which a state agency may coerce an individual to give permission to disseminate her social security number in exchange for a state service.

3. No. Given the nature of the 2001 Act and the strength of the language prohibiting dissemination, it follows that the statute requires express permission.

4. This Office can find no authority under which a state agency may require either prospective or current employees to give their permission to disseminate their social security numbers as a condition of employment.

5. The new statute does not distinguish between external and internal dissemination of social security numbers. All dissemination is prohibited unless it falls within one of the Act's two exceptions.

6. This Office can find no authority allowing a state agency to provide a garnishee with a social security number without the defendant's authorization.

7. Under state law, the statute is presumed to be constitutional. In the instances reviewed for this opinion, we have not identified a constitutional issue.

The federal and state laws involving social security numbers are as numerous and varied as the pieces of a patchwork quilt. There are laws requiring that SSNs be collected; laws that make SSNs public record; laws that make them confidential; even laws that make unauthorized disclosure of some records with SSNs punishable as a crime. Sixty provisions of Tennessee Code Annotated refer to SSNs. The questions addressed in this opinion arise because of a new state law prohibiting dissemination of SSNs except where an individual gives permission or distribution is authorized under state or federal law. Several

state and federal laws make SSNs or the records containing them confidential. The 2001 Act makes all SSNs subject to a presumption against distribution and dissemination.

The new state statute is 2001 Tenn. Pub. Acts, Ch. 427 (the 2001 Act). Section 1 of the 2001 Act is codified at Tenn. Code Ann. § 4-4-125 and reads as follows:

Notwithstanding any provision of law to the contrary, no state department, agency or employee thereof shall disseminate the social security number of any citizen of the state unless permission is given by such citizen or distribution is authorized under state or federal law.

What does this statute say in plain terms? First, in basic effect, it protects SSNs generally against unauthorized disclosure. Second, it makes a clear statement about state government's responsibility to restrict unauthorized dissemination of SSNs. Third, it applies to all of state government, no exceptions. Fourth, it allows dissemination only with the individual's permission or when authorized by state or federal law. We interpret the act with this presumption against dissemination in mind.

The 2001 Act does not define "dissemination." To disseminate is to scatter widely or to spread abroad. American Heritage Dictionary of the English Language (4 ed. 2000). This definition suggests that the Act intends to narrow distribution of SSNs, but it does not answer the question of to whom a state agency may or may not disclose an SSN. Comments by the bill's sponsor during the legislative session suggest that the 2001 Act is intended to prevent disclosure to the public, not disclosure within or to other state agencies. House Judiciary Committee on H.B. 1889 (May 2, 2001) (Tape No. 2).

To answer your questions, we have researched several federal laws, and they include the Federal Privacy Act of 1974, 5 U.S.C. § 552a; the Internal Revenue Code, 26 U.S.C. §§ 1402(g) and 7213; The Social Security Act, 42 U.S.C. § 405; and federal statutes on child and spousal support, 42 U.S.C. §§ 654a and 666(a)(13). The state statutes reviewed include the Public Records Act, Tenn. Code Ann. §§ 10-7-503 and -504; Tenn. Code Ann. § 26-1-110 (garnishment); Tenn. Code Ann. §§ 36-5-101, et seq. (child and spousal support); Tenn. Code Ann. § 71-1-131 (confidentiality of the Department of Human Services' Title IV-D records), and numerous other related code provisions.

Most, but not all, citizens will have an SSN. 70B Am. Jur.2d, Social Security andMedicare § 1371; see also 26 U.S.C. § 1402(g) (exemption from the Social Security Act for religious reasons). The Social Security Administration assigns these numbers and uses them to identify and maintain a record of the earnings reported for each person who has an SSN. 70B Am. Jur.2d, Social Security andMedicare § 1371. SSNs are used to identify individuals under a variety of benefit laws, and are used pervasively throughout state and federal government as an individual identifier. Federal law permits states to use SSNs for the administration of any tax, general public assistance, driver's license or motor vehicle registration law. 42 U.S.C. § 405(c)(2)(C)(i). Nonetheless, the SSN was not originally designed as a universal personal identifying number, and restrictions on its disclosure at the federal and state level are numerous. See, e.g.,

42 U.S.C. § 405(c)(2)(C)(viii)(I) (2001 Supp.); Tenn. Code Ann. § 10-7-504(f); Greidinger v. Davis, 988 F.2d 1344, 1352-53 (4 Cir. 1993).

To improve effectiveness of child support enforcement, the federal government collects SSNs by requiring that the SSN of "any applicant for a professional license, driver's license, occupational license, recreational license, or marriage license be recorded on the application." 42 U.S.C. § 666(a)(13). For the same purpose, the State must ask for SSNs and maintain them, with other personal identifying information, in a secure database, in order to qualify for the federal child support program. 42 U.S.C. § 654a(a). This database is called the "case registry." 42 U.S.C. § 654a(e). This statute emphasizes information integrity and security and requires access to the database to be carefully restricted to protect the confidential program data. 42 U.S.C. § 654a(d). The State must have in effect safeguards to prevent the unauthorized disclosure or use of this information. 42 U.S.C. § 654a(d); Tenn. Code Ann. § 36-5-115(b) and -116; Tenn. Code Ann. § 71-1-131.

Thus, in certain instances, because of federal law, the State may and must collect SSNs and make them available to appropriate federal and state agencies pursuing child support enforcement. This federal requirement of collecting SSNs and giving access to them to certain governmental agencies for child support enforcement does not authorize or mandate that these applications or this information be public and open for inspection.

In addition to the case registry mentioned above, federal law addresses confidentiality of SSNs in other areas as well. For example, a prohibition against unauthorized disclosure of information in tax returns is found in the Internal Revenue Code, 26 U.S.C. § 7213. A broader statement on the confidentiality of SSNs is found in the Federal Privacy Act of1974, 5 U.S.C. § 552a. Congress passed this statute because of apprehension about the possible development of a material data bank or other information system that

42 U.S.C. § 405(c)(2)(C)(vm )(i) (2001 Supp.) reads:

Social security account numbers and related records that are obtained or maintained by authorized persons pursuant to any provision of law enacted on or after October 1, 1990, shall be confidential, and no authorized person shall disclose any such social security account number or related record.

See also Tenn. Code Ann. § 36-5-701(4) (definition of "license") and Tenn. Code Ann. § 36-5-1301(a), which

reads:

Notwithstanding any other provision of the law to the contrary, all applications for professional licenses, driver licenses, occupational licenses, hunting and fishing licenses or recreational licenses, or marriage licenses issued by any agency or any political subdivision of the state of Tennessee on and after July 1, 1997, shall contain the social security number of each applicant.

See Tenn. Code Ann. §§ 36-5-701, et seq. (enforcement of child and spousal support through license denial and revocation).

would allow speedy retrieval of all personal information about an individual. See Greidinger, 988 F.2d at 1353.

The Federal Privacy Act generally prohibits federal agencies from disclosing a record without the consent of the individual to whom the record pertains. 76 C.J.S., Records § 76. Such a record may contain the individual's SSN. The statute defines exceptions to the prohibition against disclosure, such as "routine use," statistical records (e.g., census data), law enforcement, health or safety or court orders. 76 C.J.S., Records § 77. The Tennessee 2001 Act does not contain similar specific exceptions.

The Federal Privacy Act also generally restrains state agencies from denying an individual a right, benefit or privilege to which he is otherwise entitled because he refuses to disclose his SSN, unless the disclosure falls within one of two exceptions. The statute states as follows:

(a) (1) It shall be unlawful for any Federal, State, or local government agency to deny to an individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his social security account number.

(2) the provisions of paragraph (1) of this subsection shall not apply with respect to--

(A) any disclosure which is required by Federal statute, or

(B) the disclosure of a social security number to any Federal, State or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual.

(b) Any Federal, State, or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

5 U.S.C. § 552a Note, § 7, Pub. L. 93-579, 88 Stat. 1896 (1974). 1. The 2001 Act and the Public Records Act

With these federal and state laws in mind, we turn to the 2001 Act and first address a possible inconsistency in the 2001 Act itself. The 2001 Act begins with the phrase "notwithstanding any provision of law to the contrary," which, on its face, includes the Public Records Act. At the end of the provision, the 2001 Act creates an exception to the general mandate against dissemination by allowing state agencies

Section 7 of the Federal Privacy Act of 1974, Pub. L. 93-579, appears in a note to 5 U.S.C. § 552a.

to distribute SSNs if "distribution is authorized under state or federal law." Some distribution of the information is authorized by a state law, the Public Records Act (PRA). Therefore, one could conclude that SSNs could be disclosed to the extent that the PRA makes the records containing the numbers public and open to inspection. This interpretation would, however, virtually gut the 2001 Act, and the General Assembly presumably did not intend to pass an act that, by its own language, effectively eliminated the intended effect of the Act.

Next we look at whether the 2001 Act conflicts with the PRA. We do not view the 2001 Act as conflicting with the PRA. The PRA makes all state records public and open for inspection "unless otherwise provided by state law." Tenn. Code Ann. § 10-7-503(a). Here, another state law, the 2001 Act, does provide otherwise, and although the 2001 Act does not specify that it replaces the PRA as to disclosure of SSNs in otherwise public records, it is clear that it is meant to do so. See Guzman v. Darnell, 1994 WL 585684, 2 (Tenn. App. 1994) ("[A] specific reference to the Public Records Act is not required to establish that a statute creates an exception to its requirements."). In addition, the 2001 Act is consistent with the Public Records Act, several provisions of which make records that may contain SSNs confidential. Finally, many other state statutes make records that could contain SSNs confidential. The Tennessee Code lists these statutes following Tenn. Code Ann. § 10-7-504 in the bound volume.

The 2001 Act can be interpreted in a way that is internally consistent and in harmony with the Public Records Act. Simply put, if a state agency's record is public but contains SSNs, the record can be open to public inspection after the SSNs are redacted. In this manner, the purposes of both acts are achieved. Thus, to comply with both statutes, TDEC must redact all SSNs before making public records open to inspection under the Public Records Act.

2. State Coercion of Permission to Disclose SSN

To coerce is to bring about by force or threat. The American Heritage Dictionary of the English Language (4 ed. 2000). Because federal law requires it, state agencies may and must ask for SSNs on certain licensing applications from all individuals except those who are exempt from the Social Security Act or who cannot be assigned an SSN. 42 U.S.C. § 466(a)(13). State agencies may also require SSNs if the state agency had a system of records in existence and operating before January 1, 1975, and if the disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual. 5 U.S.C. § 552a Note, § 7(a)(2)(B); McKay v. Thompson, 226 F.3d 752, 755 (6 Cir. 2000). When the State does require a SSN, it must inform the individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it. 5 U.S.C. § 552 Note, §7(b). Without a statute or regulation requiring the mandatory provision of SSNs, state agencies cannot require SSNs but may ask individuals to volunteer their SSNs. See Connecticut v. Vickery, 1991 WL 32153 (Conn. Super. Ct. 1991).

E.g., Tenn. Code Ann. §10-7-504(a)(1) (medical records); § 10-7-504(a)(2) (TBI investigative records); § 10-7-504(a)(3) (military department records).

We have, however, found no authority under which a state agency may coerce an individual to give permission to the state agency to disseminate her SSN in exchange for a state service.

3. Dissemination of SSN Publicly Known or Voluntarily Disclosed

To give permission or to permit is to consent, to allow the doing of something, to approve a course of action. See American Heritage Dictionary of the English Language (4 ed. 2000) (permit, permission, authorize). It could be argued that when an individual affirmatively places his SSN in the public domain, he no longer has a reasonable expectation of privacy. See Op. Iowa Atty. Genl. 99-10-1 (L) (October 10, 1999), 1999 WL 956288. A written notice by the state agency to the individual, e.g., on a licensing application, regarding what use the state agency will make of the SSN would support such an argument. We can find no authority, however, for disseminating the "public" or "volunteered" SSN without further authorization.

Federal law requires that when a state agency asks for an SSN, the agency must give the individual notice of whether providing the SSN is mandatory or voluntary, what the state agency's authority to require the SSN is and to what use the state agency will put the SSN. Federal Privacy Act § 7(b), 5 U.S.C. § 552a Note. Such a notice on a licensing application form might read as follows:

You must put your social security number on this form for the application to be complete. State and federal law require social security numbers on this application. Tenn. Code. Ann. § 36-5-1301(a), as authorized by 42 U.S.C. § 405(c)(2)(C)(i). The number will be used to verify your identity, to ask questions about your financial responsibility, and for any other purpose allowed by state or federal law. When you provide your social security number on this application and sign the form, you are agreeing that [state agency] may use your social security number in furtherance of federal and state law, for example, to collect delinquent fees.

If an individual completed and signed an application with this notice on it, the individual would be aware of why the state agency required his SSN and what the agency could do with the SSN. We have no facts indicating what type of notice TDEC has provided. With a notice like the one above, TDEC could then use the SSN, for example, to collect delinquent fees. TDEC still could not disseminate the SSN, that is, make the SSN open to the public at large.

Given the nature of the 2001 Act and the strength of its language prohibiting dissemination, we interpret the statute to require express permission, and we believe that using a notice like the one above would satisfy that requirement. Inferring permission from the fact that an individual's SSN is publicly known or was given voluntarily to the agency for any of several purposes does not seem consistent with a statute that so emphatically restricts dissemination of the information.

We can find no authority under which a state agency may require either prospective or current employees to give their permission to disseminate their SSNs as a condition of employment. To the contrary, under Tenn. Code Ann. § 10-7-504(f)(1), any state or local governmental entity in its capacity as employer must keep the SSNs of its employees confidential.

5. External Versus Internal Unauthorized Dissemination

The new statute does not distinguish between external and internal dissemination of SSNs and thus, on its face, prohibits all external dissemination and any kind of state agency or state employee dissemination unless it falls within one of the Act's exceptions.

State agencies lawfully collect SSNs for a number of reasons. See, e.g., McKay, 226 F.3d at 75556 (6 Cir. 2000) (Tenn. Code Ann. § 2-2-116 (voter registration)). In addition, several state statutes require one state agency to provide SSNs to another state agency. See, e.g., Tenn. Code Ann. § 8-35105; Tenn. Code Ann. § 36-5-1301(c). The 2001 Act would not prohibit these practices because they would fall within the second exception created in the 2001 Act: distribution authorized by state law. Clearly, an agency may distribute an SSN if the individual has given permission or a law authorizes it.

Your question, however, seems to raise the issue of whether state officials and state agencies can give an individual's SSN to another agency employee or to a state employee in another agency without specific statutory authority to do so. We can think of no instance in which a state official or employee in one agency may provide an individual's SSN to a state official or employee in another state agency if he is not authorized by law to do so.

We have not found statutes controlling intra-agency access to SSNs. The prohibition, however, is against dissemination or distributing broadly. If authorized agency personnel distributed individual SSNs within the agency on a limited basis for internal agency business, then we think it likely that this practice would not be dissemination as contemplated in the 2001 Act and thus would not be barred. The agency could also ask permission of the agency employee to use his SSN, and then the use of the SSN would fall within the 2001 Act's first exception.

Thus, we have concluded that the 2001 Act prohibits dissemination of any kind unless it falls within one of the Act's two exceptions. By dissemination, we mean disclosure outside the receiving state agency. Thus, we conclude that inter-agency distribution of SSNs must be authorized by law.

We have assumed "internal" means within state government and "external" means outside state government.

As we understand it, to collect overdue civil penalties and fees, TDEC uses the garnishment procedure. TDEC is the garnishor and the garnishees include entities such as banks and credit unions. It has been TDEC's practice, when it garnishes an individual's bank and other accounts, to supply the individual's SSN on the face of the garnishment as a unique personal identifier. The SSN comes from TDEC's files, or if TDEC does not have the number, from the files of another state agency.

The bank, or other garnishee, has a duty to determine whether it has an account for the individual and if so, to report this fact in answer to the garnishment. If TDEC does not have or does not supply the SSN and the bank has insufficient information to identify the individual and his accounts, the bank may return the garnishment as not found. Tenn. Code Ann. § 26-1-110.

Whether TDEC may supply an SSN on a garnishment will depend on how the SSN was collected. If TDEC has informed individuals how TDEC will use the SSNs (see }} 3 above), then TDEC could provide the SSN. If TDEC has not given notice to the individual or obtained permission from the individual by some other means, TDEC could not put the SSN on the garnishment. We can find no authority allowing a state agency to provide a garnishee with a defendant's SSN without the defendant's authorization.

7. The Constitutionality of the Newly Enacted Tenn. Code Ann. § 4-4-125

As a general rule, to the extent that a state law conflicts with a federal law, the federal law controls by virtue of the Supremacy Clause, U. S. Const. art. XI § 2. Because of the infinite variety of situations in which the (non)disclosure ofSSNs could arise, we are not able to state with specificity whether the 2001 Act is consistent with every federal or state law involving SSNs. Because the 2001 Act specifically excepts SSN distribution authorized by federal law from this prohibition, it likely would not conflict with federal law.

Under state law, the statute is presumed to be constitutional. Because of the number of state and federal laws involved, the breadth of your question and thus the extent of the research that would be involved, we decline to comment further on the constitutionality of the 2001 Act at this time.

PAUL G. SUMMERS
Attorney General and Reporter

MICHAEL E. MOORE
Solicitor General

KATE EYLER

Deputy Attorney General

Requested by:

The Honorable Milton H. Hamilton, Jr. Commissioner

Department of Environment and Conservation Nashville, TN 37243-0435