14FO:0006
Date: Thursday, December 18, 2014 Subject: Request for Advisory Opinion concerning the application of Iowa Code section 22.7 to personally identifiable information and social security numbers contained in public records.TO: Ed Tormey, Legal Services Bureau Chief, Iowa Department of Natural Resources
Re: Request for Advisory Opinion concerning the application of Iowa Code section 22.7 to personally identifiable information and social security numbers contained in public records.
You contacted this office for an Advisory Opinion concerning the application of Iowa Code section 22.7 to personally identifiable information and social security numbers contained in public records.
You requested that the Iowa Public Information Board (IPIB) address the following three issues: What guidelines should the DNR follow to redact records containing personally identifiable information; what guidelines should the DNR follow on the release of social security numbers; and whether there is any obligation to create a new record in response to a records request.
First, with respect to guidelines the DNR should follow to redact records containing personally identifiable information we begin by recalling the provisions of the Iowa Fair Information Practices Act, Iowa Code section 22.11 which includes these statements with our parenthetical comments:
1. Each state agency as defined in chapter 17A shall adopt rules which provide the following:
a. The nature and extent of the personally identifiable information collected by the agency, the legal authority for the collection of that information, and a description of the means of storage.(Avoid collecting information that isn’t needed.)
* * *
e. The procedures by which the subject of a confidential record may have a copy of that record released to a named third party.(A procedure for redacting certain information could be considered for inclusion.)
* * *
2. A state agency shall not use any personally identifiable information after July 1, 1988, unless it is in a record system described by the rules required by this section.(Again, avoid collecting information that isn’t needed.)
DNR Administrative Rule 561--2.2 defines personally identifiable information as “information about or pertaining to an individual in a record which identifies the individual and which is contained in a record system.” Rule 561—2.14 2 lists the records that potentially contain personally identifiable information.
DNR may wish to consider development of redaction guidelines for inclusion in Chapter 2 through the rule making process. Guidelines adopted through that process would have credibility that ad hoc decisions lack.
Chapter 22 is silent regarding the practice of redacting personally identifiable information from public records. However, Chapter 22 is not the only authority governing issues of confidentiality of public records. Redaction of personally identifiable information may be based on other statutory or regulatory provisions. The attorney general’s opinion set forth below includes information about possible grounds for redaction of personally identifiable information from a public record.
As a practice recommendation we encourage communication with records requestors as required to ensure their requests are understood. Requestors should be made aware of any legal or practical limitations to fulfillment of their request as soon as possible so that adjustments to the request may be considered on a timely basis. Agency concerns about disclosure of personally identifiable information could be a matter for discussion. That discussion could include making the requestor aware of the rights of the subject of a requested record pursuant to Iowa Code section 22.8.Our experience to date is there has been no objection to reasonable redaction of personally identifiable information based on reasonable privacy concerns except when the requestor considered some of the information necessary to the request.
Second, with respect to your inquiry concerning guidelines that the DNR should follow concerning release of social security numbers, there is an attorney general’s opinion with background information and recommendations. You are probably familiar with this opinion, but it is worth reviewing in the context of your inquiry.
Attorney General Opinion No. 99-10-1(L) addresses the handling of social security numbers by county recorders. The opinion, in part, states:
Section 7(a)(1) of the Privacy Act of 1974, Pub.L. 93-579, uncodified, but appearing in the annotated code as an historical note at 5 U.S.C. § 552a, deems it unlawful for a “Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his social security number.” The Act does not prohibit voluntary requests for an individual's social security number, but prescribes an informed consent process whereby individuals must be informed in advance whether the disclosure is mandatory or voluntary, by what statutory or other authority the number is solicited, and what uses will be made of it. Privacy Act of 1974, § 7(b).
The Privacy Act contains two express exceptions. Section 7(a)(1) does not apply when disclosure of a social security number is required by federal statute, or by federal, state or local statute or regulation for identification purposes under a system of records in existence and operating before January 1, 1978. Privacy Act of 1974, § 7(a)(2). Shortly after the passage of the Privacy Act, the Social Security Act was amended in 1976 to expressly authorize states to require disclosure of social security numbers for identification purposes in the administration of any tax, general public assistance, driver's license, or motor vehicle registration law. 42 U.S.C. § 405(c)(2)(C)(i), (vi).
Several federal statutes expressly require state or local governmental agencies to collect social security numbers. For instance, to facilitate the collection of child support, federal law started requiring in 1996 that states create procedures for placing social security numbers in the records of any individual subject to a divorce decree, support order, or paternity determination. 42 U.S.C. § 666(a)(13)(B). See Personal Responsibility and Work Opportunity Reconciliation Act of 1996, Pub.L. 104-193, § 317.
Federal law also provides that “Social security account numbers ... that are obtained or maintained by an authorized person pursuant to any provision of law, enacted on or after October 1, 1990, shall be confidential, and no authorized person shall disclose any such social security account number ....” 42 U.S.C. § 405(c)(2)(C)(viii)(I). An “authorized person” is defined in 42 U.S.C. § 405(c)(2)(C)(viii)(III) as “an officer or employee ... of any State, political subdivision of a State, or agency of a State or political subdivision of a State, and any other person (or officer or employee thereof), who has or had access to social security account numbers or related records pursuant to any provision of law enacted on or after October 1, 1990.”
(1) Should county recorders accept documents containing social security numbers which are not recorded, but are forwarded to state agencies, such as declarations of value and groundwater hazard statements? (Emphasis added.)
County recorders are clearly required under state statutes and rules to accept declarations of value and groundwater hazard statements which contain the social security numbers of sellers and buyers of real property in Iowa. Iowa Code §§ 428A.7, 558.69; 730 IAC 79.5(5), 561 IAC 9.2(4). Because state provisions of law mandating use of social security numbers for identification purposes on both forms pre-date October 1, 1990, the federal confidentiality restrictions in 42 U.S.C. § 405(c)(2)(C)(viii)(I) do not apply. (Emphasis added.)
More difficult issues arise in considering a recorder's obligation when declarations of value or groundwater hazard statements are submitted without the social security numbers required under state law. State law directs recorders not to record conveyance instruments when declarations of value or groundwater hazard statements are required and are not properly submitted. Iowa Code §§ 428A.4, 558.69. * * * Denying the benefits of Iowa's recording statutes based on a person's refusal to disclose a social security number accordingly falls within the prohibitions of section 7(a)(1) of the Privacy Act unless an exception applies.
Federal law expressly exempts state agencies and political subdivisions from complying with section 7(a)(I) of the Privacy Act when social security numbers are required in connection with the administration of tax laws. * * *In compliance with section 7(b) of the Privacy Act the form prescribed by Revenue and Finance contains the following notice:
Social Security Account numbers are required by 701 IAC 79.5(5), pursuant to Iowa Code sections 428A.1 and 428A.7, as authorized by 42 U.S.C. § 405(c)(2)(C)(i), and will be used to verify or inquire into facts relating to the sales price to be used for equalization purposes in administering the property tax.
Recorders should accordingly deny recordation of conveyance instruments in compliance with state law when declarations of value are required and are submitted without social security numbers or the affidavit alternatively permitted by rule 79.5(5). See Grabscheid v. Calvert Sales, Inc., 157 B.R. 600, 603 (E.D. Mich 1993) (secretary of state correctly refused to file financing statement which lacked debtor's tax identification number), affirmed, In re C.J. Rogers, Inc., 39 F.3d 669 (6th Cir. 1994).
The basis for requiring disclosure of social security numbers on groundwater hazard statements is less clear. The form previously prescribed by Natural Resources did not contain the notice required by section 7(b) of the Privacy Act. Our research has not found any provision of federal law which authorizes or requires states or political subdivisions to collect social security numbers in the administration of environmental laws. Denying recordation of conveyance instruments for failure of a transferor to disclose the social security number of the transferor and transferee on a groundwater hazard statement appears to conflict with section 7(a)(1) of the Privacy Act.(Emphasis added.)
Three additional factors weigh in favor of recorders accepting groundwater hazard statements even when social security numbers are not fully disclosed. First, the form has now been updated to remove all reference to social security numbers. Even though 561 IAC 9.2(4) has not yet been amended to correspond with the new form, recorders should require use of the revised form as it includes the new disclosures regarding private burial sites on transferred property. Second, as noted above, recorders were recently directed not to forward the forms to the director of Natural Resources. The forms are, thus, primarily used by the private parties to the real estate transaction, not by any governmental agency. Third, in most instances a fully completed declaration of value will be available to transferees. Iowa Code § 558.69. Because social security numbers must appear on the declaration of value unless a proper affidavit is supplied to the recorder, they will generally be available for public examination. Under current Iowa law declarations of value are public records which can be obtained if needed from the assessor or Revenue and Finance.(Emphasis added.)
In sum, recorders should accept declarations of value and groundwater hazard statements which contain social security numbers of the sellers and buyers of real estate. Recorders should refuse to record conveyance instruments when a declaration of value is required and social security numbers or a proper affidavit are not provided in compliance with lowa Code sections 428A.1, 428A.4 and 428A.7, and 701 IAC 79.5(5). Recorders should accept groundwater hazard statements which do not disclose social security numbers if otherwise complete.
(2) Does the county recorder have liability for recording documents containing social security numbers?
Numerous documents containing social security numbers are presented to county recorders for recording, such as mortgages, mortgage releases, and financing statements. Recorders play no role in the collection of these social security numbers. Recorders neither solicit the numbers nor make any use of the numbers when fulfilling statutory filing and recording duties. You have not identified any provision of law which mandates placement of social security numbers on documents typically filed with the recorder. Rather, you ask generally whether recorders incur liability for recording documents which disclose social security numbers. Clearly, Iowa law does not grant recorders any discretion on whether to record the documents in question. Thus, we interpret your question as asking whether recorders have any obligation to redact social security numbers prior to releasing public records for public examination or copying.
County recorders are generally not required by Iowa law to keep social security numbers confidential or to redact social security numbers which appear on documents recorded in the recorder's office. Iowa laws regarding the confidentiality of social security numbers are very narrowly targeted to specific circumstances. See Iowa Code §§ 22.7(33) (social security numbers of owners of unclaimed property are confidential), 421.17(25) (social security numbers provided by clerks of court to Revenue and Finance are held in confidence and used only for offset purposes), 422.72 (Revenue and Finance must remove social security numbers from sample income tax information), 595.4 (social security numbers collected by county registrars on marriage license applications are confidential), 598.22B(3)(a) (social security numbers collected by clerks of court or the child support recovery unit in connection with initial or modified orders for paternity or support are not public records), and 904.602(2) (Department of Corrections shall not disseminate social security numbers to the public). By contrast, none of the duties listed in Iowa Code section 331.602 or the recording provisions of chapter 558 specifically require or authorize county recorders to shield social security numbers from public disclosure.(Emphasis added.)
The federal Privacy Act is not implicated when social security numbers simply appear in public records maintained by state or local ministerial governmental officers as long as governmental employees or officers have not required, solicited or compiled the numbers. See Privacy Act of 1974, § 7(a); Fla. Op. Att'y Gen. (1999 WL 248344) (Privacy Act governs collection of social security numbers by state or local governmental bodies, but only applies to the executive branch of the federal government with respect to release of such numbers). The federal confidentiality provisions of 42 U.S.C. § 405(c)(2)(C)(viii)(I) only apply when social security numbers are obtained or maintained pursuant to a provision of law enacted on or after October 1, 1990. Thus, absent a constitutionally protected right of privacy, recorders would have no legal duty to shield unsolicited social security numbers from public disclosure.(Emphasis added.)
Our office has recognized that public disclosure of social security numbers may raise significant privacy issues. 1994 Op. Att'y Gen. 142, 145. Quoting from Greidinger v. Davis, 988 F.2d 1344 (4TH Cir. 1993), we stated:
At the time of [enactment of the Privacy Act of 1974], Congress recognized the dangers of widespread use of SSNs [social security numbers] as universal identifiers. In its report supporting the adoption of this provision, the Senate Committee stated that the widespread use of SSNs as universal identifiers in the public and private sectors is “one of the most serious manifestations of privacy concerns in the Nation.”
Since passage of the Privacy Act, an individual's concern over his SSNs confidentiality and misuse has become significantly more compelling. For example, armed with one's SSN, an unscrupulous individual could obtain a person's welfare benefits or Social Security benefits, order new checks at a new address on that person's checking account, obtain credit cards, or even obtain the person's paycheck. In California, reported cases of fraud involving the use of SSNs have increased from 390 cases in 1988 to over 800 in 1991. Succinctly stated, the harm that can be inflicted from the disclosure of a SSN to an unscrupulous individual is alarming and potentially financially ruinous.
Greidinger, 988 F.2d at 1353-54 (citations and footnote omitted). Congressional concern over access to social security numbers is further evidenced by the prohibition on disclosing social security numbers collected pursuant to laws enacted on or after October 1, 1990. 42 U.S.C. § 405(c)(2)(C)(viii)(1). Fraudulently obtaining a social security number or other personal information with the intent of obtaining a benefit is a central element of the new crime of identity theft in Iowa. See House File 659, 78th G.A., 1st Sess. (Iowa 1999).
While recognizing the privacy interests at stake, courts have generally not concluded that individuals have a constitutionally protected privacy interest in preventing disclosure of social security numbers. See Claugus v. Roosevelt Island Housing Management Corp., No. 96CIV8155, slip op. at 7, 1999 WL 258275 (U.S. Dist. Crt. S.D.N.Y. April 29, 1999) (no constitutionally protected privacy interest in an individual's social security number); Travis v. Reno, 12 F.Supp.2d 921, 925 (W.D. Wis. 1998) (no constitutional right to prevent disclosure of social security number because there is no legitimate expectation of privacy), reversed on other grounds, 163 F.3d 1000 (7th Cir. 1998); Condon v. Reno, 972 F.Supp. 977, 989-90, 992 (D. S.C. 1997) (disclosure of social security numbers in connection with motor vehicle records does not impair constitutional right to privacy, even if such a right exists), affirmed, 155 F.3d 453, 464-65 (4th Cir. 1998) (no constitutional right to privacy in a social security number); McElrath v. Califano, 615 F.2d 434, 441 (7th Cir. 1980) (no constitutional right to privacy in disclosure of social security number); Doyle v. Wilson, 529 F.Supp. 1343, 1348 (D. Del. 1982) (“...mandatory disclosure of one's social security number does not so threaten the sanctity of individual privacy as to require constitutional protection.”) (citations omitted); In re Rausch, Ferm v. United States Trustee, 197 B.R. 109 (Bankr. Nev. 1996), affirmed, 213 B.R. 364, 367 (D. Nev. 1997) (no fundamental constitutional right to prohibit disclosure of social security number of persons preparing bankruptcy petitions). The Ohio Supreme Court, in contrast, held in a 4-3 decision that employees of the City of Akron, Ohio, had a constitutionally protected interest in preventing disclosure of their social security numbers upon a media request to the city. State ex rel. Beacon Journal Publishing Company v. City of Akron, 70 Ohio St.3d 605, 612, 640 N.E.2d 164, 169 (1994).(Emphasis added.)
Authorities vary on whether state or local governmental officials have any duty to shield unsolicited social security numbers from public disclosure. An informal 1995 South Carolina Attorney General's opinion concluded that clerks of court should redact social security numbers from all documents disclosed to the public, including those appearing on judgments, court orders, arrest warrants, and attachments to pleadings, to protect an individual's right to privacy and preserve expectations of privacy which arose when the number was initially disclosed. So. Car. Op. Att'y Gen. 1995 WL 805780. A 1996 Ohio Attorney General's opinion, on the other hand, declined to find such a duty with respect to mortgages, mortgage releases, veterans discharges, or financing statements submitted to the county recorder for filing. Ohio Op. Att'y Gen. 96-034. Although the Ohio Supreme Court had found that city employees have a constitutionally protected privacy interest in their individual social security numbers in Beacon Journal, supra, the Ohio Attorney General determined that an individual supplying a social security number to a lender for placement on a mortgage to be recorded in public records did not have a reasonable expectation of privacy. Id. (Emphasis added.)
Iowa courts have recognized a constitutional right of privacy in certain types of personal information. McMaster v. Iowa Bd. of Psychology Examiners, 509 N.W.2d 754, 758 (Iowa 1993) (constitutional right of privacy extends to patient records of mental health professionals). The intimate, revealing, and potentially embarrassing nature of mental health records formed a key factor in the Court's holding in McMaster. 509 N.W.2d at 758. Mental health patients clearly have an expectation of privacy and a compelling interest in keeping independent the patient's choice of a mental health professional. Id. It seems unlikely the Court would extend the constitutional right of privacy to social security numbers placed on real estate instruments provided to county recorders specifically to provide public, constructive notice of the matters asserted. (Emphasis added.)
Cases in which courts have extended a constitutional right of privacy to the protection of personal information have largely involved individuals challenging governmental attempts to compel disclosure of personal information. Condon, 972 F.Supp. at 989. One court commented that it was unaware of any United States Supreme Court case in which a constitutional privacy violation has been based on public dissemination of personal information properly in the possession of the government. Id. In Iowa, actions based on invasion of privacy may not be premised upon the release of information in a public record. Howard v. Des Moines Register & Tribune, 283 N.W.2d 289, 298-300 (Iowa 1979). Further, constitutionally protected privacy interests generally relate to such matters as marriage, procreation, and family relationships -- those rights deemed “fundamental or implicit in the concept of ordered liberty.” Rausch, 213 B.R. at 367, citing, Roe v. Wade, 410 U.S. 113, 152 (1973); Planned Parenthood of Southeastern Pennsylvania v. Casey, 505 U.S. 833, 851 (1992).(Emphasis added.)
Even when a constitutional right of privacy in personal information exists, the right is not absolute. “[P]rivacy interests must always be weighed against such public interests as the societal need for information, and a compelling need for information may override the privacy interest.” McMaster, 509 N.W.2d at 759, citing Childester v. Needles, 353 N.W.2d 849, 853 (Iowa 1984). Where a constitutional right of privacy is not implicated, but private interests in confidentiality compete with the public's interest in access to public records, the Iowa Supreme Court has also employed a balancing test. See generally DeLaMater v. Marion Civil Service Com'n, 554 N.W.2d 875 (Iowa 1996) (balancing test applied to Iowa's personal records exemption in Iowa Code section 22.7(11)). As noted above, no exemption in Iowa's public record laws applies to social security numbers generally appearing on public records recorded at the offices of county recorders. If a balancing test was applied, however, the interests of the public in maintaining ready access to instruments filed with county recorders would be very strong.(Emphasis added.)
Imposing a generalized duty on county recorders to redact all social security numbers which may appear on any document submitted for recording would substantially impair the public's right of access to instruments and documents affecting title to real property in Iowa. County recorders maintain detailed index books to assure ready public access to deeds, mortgages, mortgage releases, affidavits, tax liens and other documents. See Iowa Code §§ 331.606-609, 558.49-55. Recorders commonly reproduce instruments in miniature form for ready access. Iowa Code § 331.603(3). Instruments filed and indexed in the recorder's office “shall constitute notice to all persons of the rights of grantees conferred by such instruments.” Iowa Code § 558.55.
Given the purpose for which documents are submitted to recorders, persons who place social security numbers on such documents do not have a reasonable expectation of privacy. Affirmatively placing social security numbers in the public domain is a key factor. The Ohio Supreme Court, for example, declined to treat as confidential social security numbers disclosed by the public during emergency “911” calls. State ex rel. Cincinnati Enquirer v. Hamilton County, 75 Ohio St.3d 374, 378, 662 N.E.2d 334, 337-08 (1996) (per curium). While the Court had earlier found in Beacon Journal that employees had a reasonable expectation that public employers would keep social security numbers confidential, the Court concluded in Cincinnati Enquirer that “911” callers anticipated such calls would be recorded and disseminated to the public. Thus, the fact that “911” callers may disclose a social security number in the course of the call did not transform a public record into a confidential record. Id.
In sum, county recorders have no statutory or constitutional duty to shield unsolicited social security numbers from public disclosure when the numbers are placed by third persons on instruments and documents submitted to the recorder for recording and indexing. Persons concerned about the privacy of social security numbers should take steps to preserve confidentiality before documents are submitted for filing in the public records of the county recorder.(Emphasis added.)
We are not aware of any development that would negate the advice given in the quoted opinion. In addressing the redaction issue, the nature of specific records involved and the rationale for obtaining social security numbers in the first place should be examined or reexamined. It appears that development of guidelines for the redaction of social security numbers should be addressed based on classes of documents involved distinguished by differing underlying legal requirement or other need for collection of social security numbers.
House File 625, proposed to the Iowa Eighty-Fourth General Assembly in 2011, is an example of legislation addressing the use and exposure of social security numbers in public records. While House File 625 was not enacted, it offers insight on the issue. It proposed the following:
1. To the greatest extent feasible, a government body shall not disclose a person's social security number unless the disclosure is authorized by law.
2. A government body shall make reasonable efforts to exclude social security numbers from public records, as follows:
a. Exclude social security numbers on licenses, permits, and other documents that may be readily observed by the public.
b. Give individuals the option not to submit a social security number to the government body unless submission of the social security number is essential to the provision of services by the government body or is required by law.
c. Make any other efforts to prevent social security numbers from being included in public records and to protect such numbers from disclosure.
3. If a public record contains a social security number, the government body shall, to the extent practicable, make reasonable efforts to redact the social security number prior to releasing the record if such redaction does not materially affect the value of the public record and is permitted by law. The redaction of a social security number from a public record shall not delay public access to the public record except for the time required to perform the actual redaction. As used in this subsection, “redact” means to render the social security number unreadable or truncated so that no more than the last four digits of the social security number may be accessed as part of the record.
4. A government body that solicits information containing a person's social security number or that is the lawful custodian of public records containing social security numbers shall, if subject to chapter 17A, adopt rules or, if a political subdivision or other public body, adopt guidelines to administer the use and disclosure of social security numbers consistent with this section.
Finally, you request that the IPIB determine whether there is any obligation to create a new record in response to a records request. There is no obligation for a government body to provide information in a form other than that which exists at the time of the request.
We add a cautionary note, however. As numerous courts have discovered when addressing this issue, fact variations are critical to resolving a government body’s obligations with respect to specific requests for electronic public records. Technical issues of varying degrees of complexity and significance impact judicial treatment. Response to a request could range from the simple extraction of data to complex programming. See, e.g., Data Tree, LLC v. Romaine, 9 N.Y.3d 454, 880 N.E.2d 10, 15-17, 849 N.Y.S.2d 489 (2007) (applying the public records law to electronic records requires a factual determination of whether the records are maintained in a transferable electronic format and whether the electronic records can be retrieved with reasonable effort through simple manipulation of a computer that does not involve significant time or expense, or whether the technological complexity in responding to the request would necessitate the creation of a new record that does not exist).
While the Iowa appellate courts have not provided any specific answers to the issue, we note in other court’s rulings a common theme placing emphasis on cooperating with records requesters. They appear to endorse creating a “new” record when all that is required is simple manipulation of a data base to satisfy a request. A spirit of cooperation is inherent in many instances, not limited just to technical issues, in the application of Chapter 22 in order to achieve the legislative objective of securing the right to public information essential to the functioning of a participatory democracy. We certainly agree with and urge a cooperative approach as a best practice and a part of providing the good service that Iowans have come to expect from their governments.
Pursuant to Iowa Administrative Code Section 497—1.3, this Opinion will be reviewed during the December 18, 2014, board meeting. If it is approved and its issuance directed by action of the Iowa Public Information Board, the date of issuance will be December 18, 2014.Opinions issued pursuant to Section 497—1.3 are subject to modification or reconsideration within 30 days of the date of issuance as provided in Subsection 497—1.3(3) and are not effective until 30 days have passed and any timely request for modification or reconsideration has been acted upon.
Sincerely,
Keith E. Luchtel, JD
Executive Director
Iowa Public Information Board