The Honorable Ernest Ellison Auditor General
QUESTION:
May the state educational agencies, without the written consent of the respective students, release to the Auditor General for official audit the social security number of persons included in the board of regents' student date course file since July 1, 1975?
SUMMARY:
Until legislatively or judicially determined to the contrary, the provisions of s. 228.093, F.S., prohibit state educational officials releasing a student's social security number from student files to the Auditor General without the written consent of the student's parent or guardian or of the student if he or she is qualified.
According to your letter, the Auditor General's Office has deemed it necessary to have access to the following information included in the Board of Regents' Student Data Course File since July 1, 1975, in order to perform a proper audit of the state educational agencies — the student's name and social security number, the type and date of degree awarded, and the university awarding the degree. You state that the information was requested from the interim Chancellor of the Florida Board of Regents who stated that all of the information sought, with the exception of a student's social security number, appeared to be `directory information' under s. 228.093(2)(e), F.S., and therefore may be released under s. 228.093(3)(d), F.S. A student's social security number, however, was, in his opinion, within the class of `personally identifiable records' protected from disclosure by the statutes. He therefore suggested that the opinion of this office be sought regarding the right of access to student social security numbers in connection with your audit under state law.
This opinion is expressly limited to a consideration of the state statutes regarding access to student records.
The Auditor General is charged by statute with the responsibility of making financial and performance audits of the accounts and records of all state agencies and making financial audits of the accounts and records of all district school boards and district boards of trustees of community colleges. Section 11.45(3)(a)1., F.S. See s. 11.45(1)(d), F.S., which defines `[s]tate agency' as a separate agency or unit of state government created or established by law, except any such agency or unit within the legislative branch of state government. The Auditor General is further authorized to make at any time financial and performance audits of the accounts and records of all governmental entities created pursuant to law. Such audits shall be made whenever determined by the Auditor General, whenever directed by the Legislative Auditing Committee, or whenever otherwise required by law or concurrent resolution. Section 11.45(3)(a)2., F.S.
Section 11.47(1), F.S., requires those officers whose respective offices the Auditor General is authorized to audit to enter into their public records sufficient information for the Auditor General's proper audit and to make the same available to him on his demand. See s. 11.47(3) and (4), F.S., which provide, respectively, that any person who willfully fails or refuses to furnish or produce any book, record, paper, document, data, or sufficient information necessary to a proper audit which the Auditor General is by law authorized to perform, shall be guilty of a misdemeanor of the first degree, punishable as provided in s.775.082 or s. 775.083, F.S., and shall be subject to removal from office. Thus those officers whose offices the Auditor General is authorized to audit are under an affirmative duty to produce and make available to the Auditor General such records and information deemed necessary for a proper audit.
Access to student records, however, is limited by statute. Section 228.093(3)(d), F.S., states in pertinent part:
Every pupil or student shall have a right of privacy with respect to the educational records kept on him. No state or local educational agency, board, public school, area vocational-technical center, community college, or institution of higher education in the State University System shall permit the release of personally identifiable records or reports of a pupil or student, or of any personal information contained therein, without the written consent of the pupil's or student's parent or guardian, or of the pupil or student himself if he is qualified as provided in this subsection . . . . (Emphasis supplied.)
See s. 119.07(3)(b), F.S., which exempts those public records referred to in s. 228.093 from the disclosure and inspection provisions of s. 119.07(1), F.S. Thus while officials of state educational agencies are required to provide the Auditor General with sufficient information for his audit, s. 228.093 restricts access to certain information within a student's file or records and limits the release of such information to certain enumerated individuals and agencies.
Records are defined for the purposes of s. 228.093, F.S., to mean any and all official records, files and data directly related to pupils and students which are created, maintained and used by public educational institutions; materials considered part of a student's record include identifying data. Section 228.093(2)(a), F.S. I have been informed that the Board of Regents' Student Data Course File consists of files submitted by the state universities each quarter to the Board of Regents and consists of information regarding students registered for classes at such institutions. Such a file would appear to fall within the foregoing definition of `records' for the purposes of s. 228.093, F.S. Excluded from this definition of records, however, is directory information defined by s. 228.093(2)(e) to include
. . . the pupil's or student's name, address, telephone number if it is a listed number, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended by the pupil or student.
With the exception of the student's social security number, the information requested by your office from the state educational agencies, i.e., the student's name, degree awarded, date of degree awarded, and university granting degree, appear to fall within the definition of `directory information' and thus are not records as that term is used within s. 228.093 subject to the restrictions on access contained therein. See the last paragraph of s. 228.093(3), F.S., regarding the general release of directory information. A student's social security number, however, does not appear to fall within the foregoing definition of `directory information,' nor is it included in the other records, information and data excluded from the definition of records or reports contained in s. 228.093(2)(a). See s. 228.093(2)(a)(1)-(7), F.S. While `personally identifiable' records or reports are not defined for the purposes of the statute, it appears that a student's social security number would qualify as identifying data subject to the limitations on access set forth in subsection (3)(d). Cf. 45 C.F.R. s. 99.3 defining `personally identifiable' data or information for purposes of the federal statute controlling access to student records to include `a personal identifier such as the student's social security number or student number.'
Section 228.093(3)(d), F.S., provides a limited exception to the restrictions on access to students' records by stating that personally identifiable records or reports of a student may be released to:
1. Officials of schools . . . or institutions of higher learning in which the pupil or student seeks or intends to enroll . . . .
2. Other school officials . . . who have legitimate educational interests in the information contained in the records.
3. [S]tate or local educational authorities who are authorized to receive such information subject to the conditions set forth in applicable federal statutes and regulations of the U.S. Department of Health, Education, and Welfare, or in applicable state statutes and rules of the State Board of Education.
4. Other school officials, in connection with a pupil's or student's application for, or receipt of, financial aid.
5. Individuals or organizations conducting studies for or on behalf of an institution or a board of education for the purpose of developing, validating, or administering predictive tests, administering pupil or student aid programs, or improving instruction, . . . .
6. Accrediting organizations, or order to carry out their accrediting functions.
7. For use as evidence in pupil or student expulsion hearings conducted by a district school board pursuant to the provisions of chapter 120.
8. Appropriate parties in connection with an emergency, if knowledge of the information in the pupil's or student's educational records is necessary to protect the health or safety, of the pupil, student, or other individuals.
The Auditor General, although fulfilling a public function in auditing such institutions, does not appear to fall within those persons or organizations authorized to receive such personally identifiable information as a student's social security number from the student's file. While s. 11.47, F.S., requires public officials to make available to the Auditor General sufficient information for the Auditor General to properly audit their offices, in light of the specific provisions of s. 228.093, F.S., restricting access to student records and prescribing with particularity those persons to whom such information may be released, I cannot say that such `personally identifiable' information as a student's social security number may be released to the Auditor General in the absence of the consent of the student or his or her parent or guardian.
Section 11.47, F.S., concerns the general responsibilities of those agencies audited by the Auditor General while s. 228.093, F.S., deals particularly with the release of information contained in student records. Generally, the statute relating to the particular part of the general subject will operate as an exception to, or qualification of, the general terms of the more comprehensive statute to the extent of any repugnancy between the two. State ex rel. Loftin v. McMillan, 45 So. 882 (Fla. 1908); Stewart v. Deland-Lake Helen Special Road and Bridge District,71 So. 42 (Fla. 1916); American Bakeries Company v. City of Haines City, 180 So. 524 (Fla. 1938); Adams v. Culver, 111 So. 2d 665 (Fla. 1959). Accordingly, I am of the opinion that until judicially or legislatively determined to the contrary, the state educational agencies may not release to the Auditor General the social security number of students from student files without the written consent of the student's parent or guardian or of the student if he or she is qualified.
In a subsequent conversation with your office, this office was informed that the social security numbers of students are needed in order to retrieve information necessary to conduct an audit of the educational institution, i.e., the student's name, type and date of degree awarded and the university awarding the degree. Such information may, in my opinion, be released as directory information as provided for in s. 228.093. As school officials are under a mandatory duty to provide the Auditor General with such information as is necessary for him to perform his job and as the information needed for the audit, i.e., the student's name, degree awarded, date of degree and university awarding degree, may be released as directly information subject to the provisions of s. 228.093, F.S., such information should be provided to the Auditor General. If, however, the student's social security number is also needed for the Auditor General to properly perform his audit, it would then appear that the statute must be amended to permit the Auditor General to have access to such `personally identifiable' information contained in student records and a recommendation to that effect should be made to the Legislature.
It should be noted, however, that the release of student records is also regulated by federal law. See 20 U.S.C. § 1232g(b)(1), which provides that `[n]o funds shall be made available under any applicable program to any educational agency or institution which has a policy or practice of permitting the release of educational records (or personally identifiable information contained therein other than directory information . . .) of students without the written consent of their parents to any individual, agency, or organization' other than as provided therein. `Personally identifiable' is defined in 45 C.F.R. s. 99.3 to mean, inter alia, `a personal identifier such as the student's social security number or student number.' The federal statute, however, provides that `[n]othing in this section shall be construed to prohibit State and local educational officials from having access to student or other records which may be necessary in connection with the audit and evaluation of any federally or state supported education program . . . .' 20 U.S.C. § 1232g(b)(5). See also45 C.F.R. § 99.33(a) which provides that an educational agency or institution may disclose personally identifiable information from the education records of a student only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior written consent of the parent of the student or the eligible student, except that the personally identifiable information which is disclosed to an institution, agency or organization may be used by its officers, employees and agents but only for the purposes for which the disclosure was made.
Prepared by: Joslyn Wilson, Assistant Attorney General