March 24, 2003
FROM: Robert J. Freeman, Executive Director
The staff of the Committee on Open Government is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the information presented in your correspondence.
Your inquiry addressed to the State Department of Health has been forwarded to the Committee on Open Government. The Committee, a unit of the Department of State, is authorized to offer advice and opinions pertaining to the state's Freedom of Information and Personal Privacy Protection Laws.
You wrote that a state agency that employs one of you "requires that each employee's Social Security Number be written on each four week time card although the SS numbers of each employee are already on file with the Agency." You added that the "time cards are routinely viewed by several people as they are processed and the Agency has a record of disclosing medical records and other documentation containing employees' SS numbers thru [sic] group e-mailings." You have asked whether "anything can be done to stop these practices."
In this regard, the authority of this office is advisory, and neither myself nor the Committee is empowered to compel an agency to stop or initiate its practices. However, it is our hope that advisory opinions, such as this, are educational and persuasive, and that they serve to resolve problems and promote understanding of and compliance with law. If you see fit to do so, you may share this opinion with your agency, and with that, I offer the following comments.
From my perspective, two statutes are pertinent to the matter.
First, although the federal Privacy Act (5 USC 552a) generally applies to federal agencies, one aspect of the Act pertains to entities of state and local government, and it relates to the ability to require that individuals provide their social security numbers. Section 7 of the Privacy Act states that:
"(a)(1) [I]t shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his social security number.
(2) the provision of paragraph (a) of this subsection shall not apply with respect to --
(A) any disclosure which is required by Federal Statute, or
(B) the disclosure of a social security number to any Federal, State, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual
(b) Any Federal, State, or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it."
The quoted provision places limitations upon the collection and use of social security numbers by government, and unless "grandfathered in" under the Privacy Act, agencies cannot require the submission of social security numbers, except in conjunction with social security or other statutorily authorized purposes. As you have described the situation, the agency that employs you cannot require you or other employees to include your social security numbers on your time cards.
Second, the state's Personal Privacy Protection Law deals in part with the authority of state agencies to collect personal information. Section 94(1) of that statute states that, unless a person, a "data subject", provides an agency with "unsolicited personal information", the agency shall "maintain in its records only such personal information which is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or executive order, or to implement a program specifically authorized by law..." While you may be required to supply certain information on a time card, I do not believe that a social security number is "relevant and necessary" to the agency to carry out its functions relating to attendance. If that is so, the agency's practice would be inconsistent with the Personal Privacy Protection Law.
I hope that I have been of assistance. Should any questions arise concerning the foregoing, please feel free to contact me.