Keith KREBS, et al., Plaintiffs,
v.
RUTGERS, the State University of New Jersey, and Francis L. Lawrence, Defendants.
Civ. No. 92-1682 (HLS).
United States District Court, D. New Jersey.
July 22, 1992.*1247 *1248 Gregory B. Reilly, Lowenstein, Sandler, Kohl, Fisher & Boylan, Roseland, N.J., for defendants.
OPINION
SAROKIN, District Judge.
Introduction
Plaintiffs, students at Rutgers University, representing themselves in a highly competent and thoughtful manner, challenge the collection and use of social security numbers by the university. Although the court determines herein that the university has the right to request and to utilize the social security numbers of its students, there is evidence that the confidentiality promised and required has been and will continue to be breached. Such future breaches must be enjoined.
The law does not prohibit the collection and use of social security numbers by Rutgers University, but it does prohibit their unauthorized dissemination, because of the vast source of personal information for which they provide access. Therefore, although plaintiffs' victory herein is partial, they have provided a much needed message to university officials of the existence of and potential for the disclosure of this confidential source of highly personal information.
Before the court is plaintiff's motion for a preliminary injunction; defendants' motion to dismiss the Complaint against Dr. Lawrence; plaintiffs' motion to amend the Complaint with respect to Dr. Lawrence; and plaintiffs' application for class certification.
Procedural History
On April 20, 1992, plaintiffs filed an Order to Show Cause why a preliminary injunction should not issue enjoining defendants from requesting social security numbers from students of Rutgers University for general administrative purposes without notification in accordance with the Privacy Act of 1974 that the disclosure thereof is voluntary. At the same time, plaintiffs filed a motion for a preliminary injunction, which the Order to Show Cause purports to incorporate, seeking an order enjoining the defendants from: (1) "denying to any student any benefit or access to administrative or educational functions if they decline to provide the social security number;" and (2) "disseminating the social security numbers of students already on file to any persons within or without of the University unless the university has been authorized by the statute to collect and maintain the social security numbers, specifically, *1249 in the case of employment records and federal financial aid records, and in the case of those records, only to disseminate them to the extent required by law."[1] Plaintiffs based this request for relief upon their filed Complaint, which alleges that Rutgers' collection and use of student social security numbers violates section 7 of the "Privacy Act," 5 U.S.C. § 552a, Historical Note.
Defendants filed opposition to plaintiffs' application, and on May 11, 1992, the court heard argument on the matter. During the course of the hearing, the parties advised the court that plaintiffs may have claims under the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232g, thereby providing an additional basis for at least some of plaintiffs' requested relief. Plaintiffs indicated their intention to amend the Complaint in order to assert FERPA claims. Accordingly, the court reserved judgment on plaintiffs' pending application for preliminary relief and advised the parties that it would rule on the application after plaintiffs had amended the Complaint and the parties had briefed the issue of the propriety of the requested relief given plaintiffs' FERPA claims.
Plaintiffs then filed their Verified First Amended Complaint and a subsequent Verified Second Amended Complaint (hereinafter "Amended Complaint"), a Motion to Amend the Complaint, a Supplemental Brief in Support of Plaintiffs' Motion for a Preliminary Injunction and to Amend the Complaint, and several supporting certifications. The Amended Complaint alleges that defendants violate FERPA, thereby depriving plaintiffs of "a right secured by the laws of the United States, in violation of 42 U.S.C. § 1983."[2] By letter dated June 9, 1992, counsel for the defendants advised the court that defendants did not object to the Amended Complaint except to the extent that it names Dr. Francis Lawrence, President of Rutgers, as a defendant. Thus, defendants object to the Amended Complaint naming Dr. Lawrence as a defendant, and cross-move to dismiss the original Complaint as against Dr. Lawrence. In addition, defendants have filed a Supplemental Brief in Opposition to Plaintiffs' Application for a Preliminary Injunction in which defendants' reject the applicability of plaintiffs' newly asserted FERPA claims. Plaintiffs' application for a preliminary injunction is now ready for disposition.
The court also notes that on April 20, 1992, upon the filing of plaintiffs' original Complaint, plaintiffs filed a motion for class certification at the same time that they filed their request for an Order to Show Cause and motion for a preliminary injunction. The Order to Show Cause does not refer to the motion for class certification, and defendants have not yet responded to that pending motion because the Clerk's Office listed the motion as an "application," which means that the court itself must advise the parties when and if the court will hear argument on the application.
Accordingly, currently before the court are: (1) plaintiffs' application for a preliminary injunction based on the claims asserted in the Amended Complaint; (2) defendants' motion to dismiss the original Complaint as against Dr. Lawrence; (3) plaintiffs' motion to amend the Complaint and name Dr. Lawrence as a defendant; and (4) plaintiffs' application for class certification.
*1250 Factual Background
Plaintiffs are seven[3] current and former undergraduate students of Rutgers University. They originally filed this suit pursuant to section 7 of the Privacy Act of 1974, Pub L. 93-579, which provides:
(a)(1) It shall be unlawful for any Federal, State or local government agency to deny any individual any right, benefit or privilege provided by law because of such individual's refusal to disclose his social security account number.
. . . . .
(b) Any Federal, State or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.
Historical Note, 5 U.S.C.A. § 552a (West 1977).[4] The Amended Complaint also asserts claims pursuant to the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232g, which provides, inter alia:
No funds shall be made available under any applicable program to any educational agency or institution which has a policy or practice of permitting the release of education records (or personally identifiable information, as defined in paragraph (5) of subsection (a) of this section) of students without the written consent of their parents to any individual, agency, or organization, other than to the following ....
20 U.S.C. § 1232g(b)(1). The statute goes on to list nine categories of persons and/or agencies to whom/which education records and personally identifiable information may be released.
The relevant facts generally are not in dispute (except where otherwise noted). Plaintiffs acknowledge that Rutgers is entitled to and indeed required to obtain the social security numbers of students who have university jobs (for Internal Revenue Service reporting) and who receive Federal Student Financial Aid. (The university estimates that 40% of Rutgers students receive financial aid, while 20% are employed by the university. Buck Cert. ¶ 4; Fehn Cert. ¶ 4.) However, plaintiffs challenge Rutgers' general collection and use of student social security numbers without prior notification (1) that the students' disclosure of their numbers is voluntary, and (2) of the various uses to which the social security numbers will be put. Cplt. ¶¶ 7-8. Plaintiffs allege that the "[d]efendants also may deny to students, rights, benefits, and privileges if they fail to provide their SSNs [social security numbers] for these general administrative activities." Cplt. ¶ 7. The general administrative activities for which Rutgers uses the numbers include use of the students' social security numbers "as the prime means of student identification for general administrative and educational recordkeeping purposes, including class registrations and changes thereto, meal privilege identifications, the printing of classroom rosters and the issuance of final grades, and various other purposes." Cplt. ¶ 5. See also Fehn Cert. Exh. A (listing all the uses for which student social security numbers are used).
The affidavits and briefs submitted in support of plaintiffs' applications further elaborate Rutgers' various uses of social security numbers. The social security numbers are imprinted on student identification cards, as well as placed on course rosters next to each student's name. These class rosters are often passed out to attending students for verification. Komuves Aff't ¶¶ 6-7; Lockard Aff't Exh. E (copy of class roster). See also Krebs Cert. (asserting class rosters with names and social security numbers passed around university classroom); Komuves Cert. *1251 (same); Pemberton Cert. (same). As a result, any student in the class can obtain the social security number of any other student in the class, thereby obtaining the means to discover confidential information such as grades (which are posted by social security number), credit history (e.g., from TRW or any other credit agency), etc.
In opposition to plaintiffs' contentions, university officials state:
[U]niversity policy and practice prohibits and discourages distribution of class rosters with SSNs to anyone other than faculty and administrators. University policy also prohibits and discourages posting of names with grades.
Norman Cert. ¶ 5. However, as recounted in the Certification of Rodney Hartnett, Associate University Vice President for Academic Affairs:
Although I do not believe it is a common practice, some faculty members (probably in large classes) might circulate the roster list throughout class to assure that the student registration for each class is correct, or possibly to take attendance.
Hartnett Cert. ¶ 7. Rutgers offers no explanation for how the plaintiffs obtained a copy of an apparent actual class roster listing students names and social security numbers, nor does Mr. Norman's Certification respond to the obvious concern that once a social security number is linked to a name, posting grades by number rather than name does not adequately address plaintiffs' concerns.
Defendants apparently concede that such a practice would violate FERPA if this were a policy or custom of the University, an assertion which defendants dispute. Nonetheless, the University appears to be unwilling to curtail any possible individual violations of this type absent court direction. According to Vice President Hartnett:
If the Court has concerns about the occasional circulation of class roster lists (to verify registration or take attendance), the University would be willing to issue a memorandum with class rosters in September advising faculty members to cut off or delete student identification numbers from any class rosters circulated in the classroom.
Hartnett Cert. ¶ 10. Mr. Hartnett does not address why the University has not yet issued such a memorandum in light of plaintiffs' complaints, similar to the memorandum issued with respect to the posting of grades with names. See id. at ¶ 5 and Exh. A.
In the past, Rutgers issued a six-digit student identification number to each incoming student, and plaintiffs propose a return to the six-digit number as a viable alternative to the increasing use and dissemination of social security numbers. Plt. Brief at 10. Rutgers has submitted Certifications of various university officials which respond that use of the social security number facilitates various aspects of university administration and decreases incidence of administrative errors which can cause great hardship to many students, such as verification of financial aid, delay in processing applications, etc. See Fehn Cert.; Iuso Cert. ¶ 4; Norman Cert. ¶¶ 3-4.
These officials further indicate that any student can request a "dummy" nine-digit social security number to be used as his or her identification number, and thus, no student has been denied any services as the result of refusal to provide their social security number. Norman Cert. ¶ 7. The officials estimate that in fact, less than six students per year make such a request. Iuso Cert. ¶ 5. Rutgers does not indicate that students are routinely advised of their right to make this request. Rather, plaintiffs represent that this is the first they have heard of the "dummy" option, and that the availability of a "dummy" number has never been publicized to the student body. Plt. Reply Brief at 9.
Of further note, university officials indicate that from 1987 to 1990, the following disclaimer appeared on all Rutgers undergraduate admissions materials:
It is requested that you voluntarily give your social security number which will be used to process your admissions and financial aid applications. If you enroll in the university, your social security number *1252 will be used for registration and will become your student identification number. If you choose not to give your social security number, an identification number will be assigned.
Mitchell Cert. ¶ 3, Exh. A. A similar disclaimer appeared on all Rutgers graduate school admissions materials from 1985 to 1990. Taylor Cert. ¶ 3, Exh. A. In both cases, the university removed the disclaimers after 1990 with the understanding that the university was not subject to the Privacy Act of 1974 and in the hope that more applicants would then disclose their social security numbers, thereby eliminating administrative errors and conserving the additional university resources required to resolve such mismatches. Mitchell Cert. ¶ 5; Taylor Cert. ¶ 4. The University does not indicate how many applicants refused to provide their social security numbers during the years that the disclaimers appeared on the application materials.[5]
Plaintiffs who are each "trustees" of the Rutgers University Legislative Affairs Council, Inc., a student advocacy group (Memorandum in Support of Class Certification) have been negotiating with university officials regarding the collection and dissemination of student social security numbers. By letter dated March 25, 1992, Richard Norman, Vice President for Administration and Associate Treasurer for Rutgers, advised plaintiffs that the Privacy Act did not apply to Rutgers, and that the University was not aware of any complaint regarding misuse of a student's social security number. Mr. Norman further advised plaintiffs that Rutgers would continue to review its use of social security numbers in order to safeguard against any misuse of the numbers. Plt.App. to Brief in Support of Motion for Preliminary Injunction. Not satisfied with this response, plaintiffs initiated the instant suit.
Discussion
A. Plaintiffs' Application for a Preliminary Injunction
In order to grant a preliminary injunction, the moving party must show "(1) a reasonable probability of eventual success in the litigation and (2) that the movant will be irreparably injured pendente lite if relief is not granted." In addition, the court should consider the possibility of harm to other interested parties, as well as harm to the public interest, if the requested relief is granted. In re Arthur Treacher's Franchise Litigation, 689 F.2d 1137, 1143 (3d Cir.1982); Opticians Ass'n of America v. Indep. Opticians of America, 920 F.2d 187, 191-92 (3d Cir.1990).
1. Plaintiffs' Likelihood of Success on the Merits
The Privacy Act Claim
As previously indicated, plaintiffs seek preliminary injunctive relief pursuant to section 7 of the Privacy Act of 1974. In opposition to the instant application, defendants argue that plaintiffs have not demonstrated a likelihood of success on the merits because Rutgers is not an "agency" as defined by the Privacy Act, and thus, Rutgers has discretion whether to voluntarily abide by its terms or not. Because defendants' argument against plaintiffs' likelihood of success turns on the question of whether the Privacy Act of 1974 applies to Rutgers, final resolution of that point of law resolves many other questions which surround the instant application for a preliminary injunction. For instance, if the Privacy Act applies to Rutgers, there is no dispute that Rutgers violates the Act by not providing a disclaimer when it requests social security numbers.
Fed.R.Civ.P. 65(a)(2) authorizes the court to consolidate a preliminary injunction hearing with a trial on the merits. Although *1253 the court has not specifically advised the parties that it intends to make such a consolidation,[6] the parties' submissions anticipate that any determination as to plaintiffs' likelihood of success on the merits involves consideration of a pure point of law whether the Privacy Act applies to Rutgers which the parties have fully briefed. See Plt. Reply Brief at 16 (suggesting that waiver of the bond requirement is appropriate because defendants will essentially have a final ruling on the merits of plaintiffs' claims).
Because the court concludes that the Privacy Act does not apply to Rutgers, the court will treat the pending application as a motion for summary judgment on the Privacy Act claims. Fed.R.Civ.P. 56(c) authorizes the court to grant summary judgment if there are no issues of material fact and a party is entitled to judgment as a matter of law.
Plaintiffs' Privacy Act claims hinge on whether the Act applies to Rutgers. Paragraph (a)(1) of Section 7 of the Privacy Act, supra page 1250, makes the Act applicable to "any Federal, State or local government agency." If Rutgers is not a government "agency" as defined by the statute, then Rutgers is free to request social security numbers without any notice to the students that the use of the numbers is limited or that the disclosure is voluntary.
Paragraph (a)(1) of Section 7 was never codified. It appears in the annotated code as an historical note to 5 U.S.C. § 552a. Section 552a, which is within the Administrative Procedure section of the Code, is titled "Records maintained on individuals." Section 552a(a)(1), the definitional portion of section 552a, references to 5 U.S.C. § 552(e) of the Code, the FOIA statute, for the applicable definition of the term "agency." Section 552(e) provides:
[T]he term "agency" as defined in section 551(1) of this title includes any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the Executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency.
Section 551(1), the general definition section of the Administrative Procedure Act, lists the various federal agencies to which the Administrative Procedure Act applies.
The Privacy Act's incorporation of these references upon references to older and broader statutes generates ambiguity as to what "agency" actually means for purposes of the social security provision. The APA, FOIA, and section 552a itself apply exclusively to federal agencies, whereas section 7 of the Privacy Act extends to federal, state, and local "agencies," without any further indication of how state and local "agencies" are to be identified. Thus, most of the case law which interprets the scope of sections 552a, 552(e), and 551(1) does not differentiate between the potentially varied considerations of what constitutes a state or local "agency."
Defendants rely heavily on the FOIA and APA case law to support their argument that "[t]he Privacy Act requires a threshold showing of substantial governmental control or supervision over the day-to-day operations of an organization to result in `agency' classification." Def. Brief at 12-13. See Def. Brief at 14-18. Defendants are correct; the FOIA cases focus on ultimate government control. An entity has FOIA or Privacy Act agency status if the government is involved in and/or has authority over decisions affecting the ongoing, daily operations of the entity. See Rocap v. Indiek, 539 F.2d 174, 177 (D.C.Cir.1976) (FHLMC is a FOIA agency based on substantial federal control over day-to-day operations); Washington Research Project, Inc. v. HEW, 504 F.2d 238, 248, 245-46 (D.C.Cir.1974), cert. denied, 421 U.S. 963, 95 S.Ct. 1951, 44 L.Ed.2d 450 (1975) (organization's authority to make final decisions is indicative of government-controlled, FOIA agency status, although "each arrangement must be examined anew and in its own context").
*1254 Plaintiffs generally insist that because FOIA's section 552(e) is narrower than the Privacy Act in the sense that it does not apply to state and local agencies, the precedential value of the FOIA cases is diminished. Plt. Reply Brief at 2.[7] Indeed, while the FOIA cases are certainly relevant given the Privacy Act's cross-reference to 552(e), the case law focuses on federal, FOIA scenarios rather than on factors relevant to identification of covered state and local agencies. Plaintiffs' argument holds as a general matter of interpretation, but it is in some sense academic. Plaintiffs cannot and do not dispute that the relevant inquiry is the nature and extent of government control of and involvement in Rutgers' operations.[8]
While distancing themselves from the defendants' FOIA cases, plaintiffs agree that government control is the relevant inquiry and suggest that the same type of factors or criteria at issue in the FOIA cases are relevant. Extrapolating from Rocap v. Indiek, 539 F.2d 174 (D.C.Cir.1976),[9] plaintiffs propose the following indicia of government agency status: (1) government charter; (2) government appointment of Directors; (3) close governmental supervision over business transactions; (4) government audit and reporting requirements; (5) express designation as an agency; (6) employees are considered public for a number of purposes; and (7) regulatory powers to make regulations and to carry out its functions. Plt. Reply Brief at 5.
The parties and the court agreeing that the relevant inquiry is government control over and involvement in Rutgers' operations, the court turns to a fact-specific assessment of Rutgers' status as a government controlled corporation under the Privacy Act. Defendants stress the relevancy of Kovats v. Rutgers, the State University, 822 F.2d 1303 (3d Cir.1987) to this inquiry. In Kovats, the Third Circuit held that Rutgers was not a division of the State for purposes of receiving Eleventh Amendment immunity. In arriving at this conclusion, the court engaged in an extensive, particularized inquiry into Rutgers specific links with the State of New Jersey. Significantly, the court did not follow decisions holding that many other public universities were entitled to Eleventh Amendment immunity.
Our examination of the circumstances surrounding Rutgers leads us to conclude that a majority of the relevant criteria weigh against considering Rutgers an arm of the state entitled to Eleventh Amendment immunity. Rutgers was originally a private institution. Though *1255 it is now, at least in part, a state created entity which serves a state purpose with a large degree of financing, it remains under state law an independent entity able to direct its own actions and responsible on its own for judgments resulting from those actions.
822 F.2d at 1312. While obviously not dispositive in the case at hand, the Circuit's Eleventh Amendment considerations and conclusions are clearly relevant to this court's necessary determination as to whether Rutgers is so controlled by the State that it qualifies as an "agency" or "government controlled corporation" under the Privacy Act. The court cannot ignore the powerful similarity to the considerations in Kovats and those which this court must now make.
Based upon its own consideration of Rutgers' government involvement, the court concludes that although there are many aspects of Rutgers' operations which touch and/or intersect with the State, the overall effect is an independent institution divorced from direct, let alone day-to-day control.
Rutgers was a private institution until 1956, when the New Jersey Legislature enacted a separate enabling statute which rendered the university an "instrumentality of the state." N.J.S.A. 18A:65-2. Plaintiffs stress this provision as an expression of legislative intent that Rutgers be considered a state agency for purposes such as the Privacy Act. Defendants rely on Ehm v. National R.R. Passenger Corp., 732 F.2d 1250 (5th Cir.1984), cert. denied, 469 U.S. 982, 105 S.Ct. 387, 83 L.Ed.2d 322 (1984), in which the court held that Amtrak was not a FOIA "government controlled corporation," despite government appointment of a majority of directors and financial accountability. Similarly, Railway Labor Executives' Ass'n v. Consol. Rail Corp., 580 F.Supp. 777 (D.D.C.1984) held that Conrail was not a FOIA "government controlled corporation" despite government financial audits. To be sure, government charter does not imply government control. Moreover, like Forsham and Dennie, government-required audits of organizations which receive government funds do not indicate that government officials and agencies have authority over the entity in question. However, most significantly, plaintiffs point out that in both those cases, the courts examined the statutory language and the Congressional intent that those agencies "not be deemed agencies of the federal government." 45 U.S.C. 741(b) (Conrail "shall not be an agency or instrumentality of the Federal Government"); 45 U.S.C. 541 (Amtrak "will not be an agency or establishment of the United States Government"). Such provisions can provide a basis for non-agency status. See Public Citizen Health Research Group v. Dept. of H.E.W., 668 F.2d 537 (D.C.Cir. 1981) (government created Professional Standards Review Organization not a FOIA "agency" where enabling statute's legislative history specifically indicates that organization should be viewed as independent). Plaintiffs turn this case law around and argue that the Legislature intended Rutgers to be understood as a public agency.[10]
However, the Legislature's intent is more directly and fully expressed in N.J.S.A. 18A:65-27(I)(a), captioned as the "Public policy of state," which provides: "[T]he corporation and the university shall be and continue to be given a high degree of self-government[.]" Similarly on point to the "control" inquiry, the enabling statute provides the Board with authority that is "without recourse or reference to any department or agency of the state, except as otherwise expressly provided by this chapter or other applicable statutes." N.J.S.A. 18A:65-28. Indeed, the New Jersey Chancellor of Higher Education, charged by statute with review power over actions of state colleges, has held that Rutgers is not subject to his review because it is not a "state college." Gilbert v. Rutgers, the State University, No. 91-7 (State *1256 Dept. of Higher Ed., October 7, 1991) at 3, Def. Exh. 1. In fact, the only limitations the State imposes on Rutgers is to remain within its state budget appropriation,[11] N.J.S.A. 18A:65-25(d), (h), (i), and to comply with applicable state laws and regulations. N.J.S.A. 18A:65-34.
Plaintiffs rely on other "government" aspects of Rutgers which are, in toto, trivial. Plt. Reply Brief at 6. For instance, plaintiffs contend that Rutgers makes "rules and regulations" affecting students and teachers, including hiring, firing, and admission decisions. The court concludes that these factors reflect a self-operating, independent public institution rather than a public entity subject to external management and review. Moreover, the Third Circuit's consideration of Rutgers' government entanglement in Kovats, while not dispositive, clearly weighs against plaintiffs' position. Thus, the court concludes that although Rutgers is state chartered, Rutgers is not a state agency or government controlled corporation subject to the Privacy Act.
Under these circumstances, the court cannot conclude that plaintiff has a "substantial likelihood of success on the merits" of their Privacy Act claim. To the contrary, the defendants are entitled to summary judgment on this claim.
The FERPA Claims
As an initial matter, defendants contend that plaintiffs do not have a likelihood of success of the merits of their FERPA claims because (1) FERPA does not provide a private cause of action; and (2) plaintiffs are not entitled to bring a section 1983 claim since they have failed to exhaust their administrative remedies under FERPA. The court rejects both of these arguments.
Plaintiffs recognize and accept that every court which has addressed the issue has concluded that FERPA does not provide a private cause of action. Plt.Supp. Brief at 8, citing Girardier v. Webster College, 563 F.2d 1267, 1276-77 (8th Cir. 1977). However, those same courts have concluded that plaintiffs may assert section 1983 claims premised on FERPA violations. See Fay v. South Colonie Cent. School Dist., 802 F.2d 21, 33 (2d Cir.1986) ("FERPA creates an interest that may be vindicated in a section 1983 action because Congress did not create so comprehensive a system of enforcing the statute as to demonstrate an intention to preclude a remedy under section 1983"); Tarka v. Cunningham, 917 F.2d 890 (5th Cir.1990) ("an action under 42 U.S.C. § 1983 may nevertheless be premised on an alleged violation of FERPA rights"); Tarka v. Franklin, 891 F.2d 102, 105 (5th Cir.1989), cert. denied, 494 U.S. 1080, 110 S.Ct. 1809, 108 L.Ed.2d 940 (1990). Nonetheless, defendants contend that none of these courts paid enough attention to the issue, and that their holdings are incorrect. The court disagrees. Section 1983 is an appropriate vehicle for redressing official interference with an individual's guaranteed civil rights.
However, even accepting arguendo that plaintiffs may pursue FERPA-based section 1983 claims, defendants argue that these plaintiffs are not entitled to bring a section 1983 claim because they have failed to exhaust their administrative remedies under FERPA. Defendants rely on Patsy v. Bd. of Regents, 457 U.S. 496, 502 n. 4, 102 S.Ct. 2557, 2560 n. 4, 73 L.Ed.2d 172 (1982) for the proposition that in "determining whether application of the exhaustion of federal administrative remedies is required, courts generally focus on the role Congress has assigned to the relevant federal agency, and tailor the exhaustion rule to fit the particular administrative scheme created by Congress." Citing McKart v. U.S., 395 U.S. 185, 193-95, 89 S.Ct. 1657, 1662-63, 23 L.Ed.2d 194 (1969). Defendants argue that the FERPA administrative enforcement scheme suggests that a federal remedies exhaustion requirement would be appropriate in cases of this type. Most notably, Congress assigned the Secretary of Education the task of enforcing *1257 FERPA, 20 U.S.C. § 1232g(f), and through regulations, the Secretary has established a detailed process whereby a review board adjudicates individual FERPA grievances.[12]
However, as defendants themselves recognize, McKart did not involve a section 1983 claim, and Patsy's specific holding was that exhaustion of state remedies generally is not required for section 1983 claims. See Def. Supp. Brief at 16-17. Thus, there is strong reason to doubt defendants' proposed application of an exhaustion requirement in this section 1983 context. Nonetheless, defendants rely on Judge Debevoise's Opinion in Ryans v. New Jersey Comm'n for the Blind, 542 F.Supp. 841, 850 (D.N.J.1982), which holds: When "a Section 1983 action is brought for the vindication of rights under a federal statute which contains its own administrative remedies, exhaustion of those remedies, if they are adequate, is required."
Although it would appear to be a more efficient allocation of resources if there was a FERPA exhaustion requirement, this court can not infer such a requirement from the statute. As the Ryans court recognized, and as Patsy specifically holds (supra page 1256), the touchstone of a federal statutory exhaustion requirement is Congressional intent. 542 F.Supp. at 850. See also Alacare v. Baggiano, 785 F.2d 963, 967 (11th Cir.1986) (evidence of Congressional intent to impose exhaustion requirement must be clear); Wright v. Roanoke Redev. & Housing Auth., 479 U.S. 418, 423-29, 107 S.Ct. 766, 770-73, 93 L.Ed.2d 781 (1987) (holding that section 1983-based private cause of action under federal statute will be allowed notwithstanding well-developed administrative agency enforcement mechanism where no evidence of Congressional intent to provide otherwise). Although FERPA directs the establishment of an administrative enforcement scheme, there is no explicit exhaustion requirement, nor is there any other indication of an implicit exhaustion requirement.
The complete inadequacy of the Secretary's regulations, coupled with the statute's failure to require more complete relief for aggrieved individuals, confirms the absence of an implicit exhaustion requirement in FERPA. The 1991 regulations suggest that the Secretary may withhold authorized federal funding if an educational institution fails to correct an identified violation. But the Secretary cannot be expected to threaten and/or act upon this drastic remedy for each and every minor FERPA violation, nor does this enforcement threat necessarily respond to the harm suffered by aggrieved individuals. Indeed, for minor FERPA violations, an exhaustion requirement would have the effect of "exhausting" the complainant without any meaningful possibility of enforcement by the Secretary. Although such a scheme would leave the complainant free to then institute an individual section 1983 action, the relevant inquiry here is Congressional intent. In light of Congress' failure to require more particularized mechanisms for individual relief, as confirmed by the very general relief provided by the Secretary's regulations, the court concludes that FERPA does not contain an implied exhaustion requirement.
Furthermore, in reaching this conclusion, this court is mindful of section 1983's particular role in allowing aggrieved persons to sue for relief. As the Alacare court convincingly reasoned, section 1983 claims are presumed to be without an exhaustion requirement, even where there is a federal *1258 statutory right accompanied by an administrative agency enforcement scheme.
First, we must always bear in mind the purpose Congress had in adopting Section 1983: to provide an alternate, supplemental avenue for relief to persons who almost always have an additional available remedy at state law....
[Moreover, there is] no principled basis for limiting that holding [imposing an exhaustion requirement]. The result would be a major, dramatic narrowing of the scope of relief available under Section 1983.
Alacare, 785 F.2d at 967-68 (emphasis in original) (citations omitted).
Accordingly, the court proceeds to the merits of plaintiffs' FERPA-based section 1983 claims (hereinafter referred to as plaintiffs' "FERPA claims").
As recounted supra, FERPA bars disbursement of federal funds to educational institutions which have "a policy or practice of permitting the release of education records [] or personally identifiable information [to unauthorized persons] without written consent[.]" 20 U.S.C. § 1232g(b)(1). There is no dispute that FERPA applies to Rutgers and that student social security numbers are considered "education records" and/or "personally identifiable information" under the statute. In addition, there is no dispute that students have not given their consent to the dissemination of their social security numbers to their fellow classmates. Most importantly, defendants do not dispute that a policy or practice of disseminating class rosters with names and social security numbers would violate FERPA. Rather, defendants contend that the instances of dissemination cited by plaintiffs in their various Certifications are isolated occurrences, and do not reflect a practice or policy within the university. Hartnett Cert. at ¶ 9. (However, defendants are apparently unwilling to announce voluntarily a policy prohibiting the practice, should it exist. Hartnett Cert. ¶¶ 7-10.)
The many occurrences recounted in plaintiffs' many Certifications support plaintiffs' contention that the distribution of class rosters with social security numbers is indeed a "practice" within the university. This possibility is confirmed by defendants' failure to respond to this alleged practice in the same way that it responded to the allegations of posting names with grades, i.e., by advising teachers not to engage in such a practice. See Hartnett Cert. at ¶ 5. Accordingly, based on the limited record with which the court has been presented, the court concludes that plaintiffs have demonstrated a likelihood of success on their FERPA-based section 1983 claims to the extent that they are based on the alleged university practice of disseminating class rosters with students names and undisguised social security numbers.
In addition to the distribution of class rosters, plaintiffs identify two other factual premises for their FERPA claims. First, the Amended Complaint states that defendants allow the practice of posting grades with names. However, only the Komuves Certification identifies this practice, and even then, only on a single occasion. Komuves Cert. at ¶ 7. The university admits that such a practice, were it to occur, violates FERPA, and the university has since taken steps to assure that such an occurrence does not happen again. Hartnett Cert. ¶¶ 4-6 and Exh. A. This immediate correction prompts the court to conclude, at least on the basis of this preliminary evidence, that the posting of names with grades is not a university practice, especially in light of the fact that plaintiffs have identified only one such instance. Thus, the court must conclude that plaintiffs do not have a likelihood of success on this aspect of their FERPA claims.
Second, the Amended Complaint also identifies the printing of social security numbers on identification cards as a violation of FERPA. Plaintiffs allege that the mandatory presence of the numbers on identification cards requires students to disseminate their numbers "to, inter alia, personnel of the Rutgers post offices, meal services, other student life services, and police department, unrelated to legitimate educational functions of the University." In addition, the university distributes lists *1259 of student names and social security numbers to these services.
With respect to the lists, the university asserts that "[t]hese vital services are deemed by the University to be an important and necessary facet of student campus life and therefore have a `legitimate educational interest' under 34 C.F.R. Subtitle A § 99.31(a)(1).'" Hartnett Cert. ¶ 13. This contention would qualify as an exception to FERPA's anti-dissemination rule. However, the regulations do not suggest, and it is far from clear, that distribution of social security numbers to post office personnel serves a "legitimate educational interest." That is a question open to further discovery.
In addition, with respect to the identification cards, the university blithely contends that "[s]tudents are not required to show these cards to other students or non-faculty or non-administrators, except those with specific authority to act on behalf of the University." Id. at ¶ 11. Nowhere in defendants' submissions do they explain whether FERPA or the implementing regulations make an exception for other individuals acting "on behalf of the university." Without further elaboration, this failure of explanation could be viewed as an implicit admission that the required showing of these identification cards may, in certain circumstances, violate FERPA.
Accordingly, the court concludes that plaintiffs have a likelihood of success on the merits of at least some of their section 1983 claims premised on FERPA violations, specifically, the claim that there is a university practice of disseminating class rosters with student names and social security numbers. On all other FERPA-based claims, the court cannot conclude at this juncture that plaintiffs have demonstrated a likelihood of success given the need for further elaboration. However, as indicated above, some of those claims are viable.
2. Plaintiffs' Allegations of Irreparable Harm
Plaintiffs' argue that the important privacy interests protected by the Privacy Act and FERPA reflect the fact that any violations of those protected rights presents serious, "irreparable" injury. Privacy Act case law and legislative history support this assertion.
[I]n its report supporting the adoption of the [Privacy Act], the Senate Committee stated that the extensive use of Social Security numbers as universal identifiers in both the public and private sectors is "one of the most serious manifestations of privacy concerns in the Nation." S.Rep. No. 1183, 93rd Cong., 2d Sess., reprinted in 1974 U.S.Code Cong. & Admin.News 6916, 6943.
IBEW No. 5 v. U.S. Dept. of HUD, 852 F.2d 87, 89 (3d Cir.1988).[13] In addition, as a general matter, plaintiffs cite the published writings of Rutgers' President, which read: "[T]he intrusion [into privacy] is demeaning to individuality, is an affront to human dignity." Plt. Reply Brief at 11, citing Bloustein, Privacy As an Aspect of Human Dignity, 39 NYU Law Rev. 962, 973 (1964).
Notwithstanding plaintiffs' broad assertions of harm and indignity, plaintiffs' point is very well taken, especially in light of the antagonistic and dismissive attitude which the university has taken during the parties' initial negotiations. The university recognizes that class rosters with social security numbers should not be distributed to students, and yet the university has no meaningful response to the uncontested allegation that this is common practice. Indeed, where did plaintiffs obtain the copy of such a class roster appended as exhibit E to the Lockard affidavit? This practice allows any student to decode another student's grades, obtain a credit report, etc. The plaintiffs have every right to feel violated, and certainly have a strong interest in rapidly insuring limited dissemination of collected numbers.
3. Harm to the University and to the Public Interest
The certifications submitted by defendant clearly describe the dramatic disruption *1260 which would entail should the university be precluded from soliciting and properly utilizing applicants' social security numbers. Because the court concludes that the Privacy Act does not apply to defendants, and because FERPA only prohibits certain types of dissemination, plaintiffs are not entitled to this aspect of their requested relief.
However, with respect to plaintiffs' viable FERPA claims, defendants do not explain what possible potential harm could result from a narrowly tailored injunction prohibiting the dissemination of class rosters which list students by name and full social security number. An injunction to that effect responds to plaintiffs' FERPA claims without jeopardizing defendants' identification system in any way. Although defendants' may not want to admit that a "custom" or "practice" exists, they implicitly concede that if it did exist, it would violate FERPA, and that a simple notice to all faculty might cure the problem. See Hartnett Cert. at ¶ 10. In light of this concession and of plaintiffs' viable FERPA claim, such an injunction would be appropriate.
4. The Court Will Grant in Part and Deny in Part Plaintiffs' Application for a Preliminary Injunction
The court will not order the university to provide a Privacy Act disclaimer because defendants are entitled to summary judgment on plaintiffs' Privacy Act claims. However, plaintiffs have demonstrated a likelihood of success on their FERPA-based section 1983 claims premised upon the distribution of class rosters with social security numbers. The plaintiffs have demonstrated irreparable harm as a result of that alleged practice, and neither the university or the public interest would be harmed by an order directing the university to take steps towards eliminating that alleged practice. Accordingly, the court will issue an injunction to that effect.
With respect to plaintiffs' FERPA claims premised on the posting of names with grades, plaintiffs have not demonstrated a likelihood of success because there is not sufficient evidence from which the court might conclude that this is a practice or policy of the university. Moreover, to the extent that this has occurred on one or more occasions, the university has taken steps towards eliminating such occurrences.
Finally, although plaintiffs have presented viable FERPA claims premised upon the dissemination of student social security numbers to various university personnel, the evidence and arguments adduced to date are insufficient to allow this court to conclude that plaintiffs have a likelihood of success on these claims. Accordingly, the court will not order preliminary injunctive relief with respect to those claims at this time.
B. Defendants Motion to Dismiss the Complaint Against Dr. Lawrence
Plaintiffs concede that the Privacy Act does not apply to individuals. Dennie v. Univ. of Pittsburgh, 589 F.Supp. 348, 352 (D.V.I.1984), aff'd, 770 F.2d 1068 (3rd Cir.1985); Parks v. IRS, 618 F.2d 677, 684 (10th Cir.1980); Plt. Supp. Brief at 10. However, plaintiffs argue that they can assert a section 1983 claim against Dr. Lawrence on the basis of "his deprivation of rights secured by the laws of the United States, specifically, the Privacy Act." Plt. Supp. Brief at 10. However, in light of the court's foregoing conclusion that the Privacy Act does not apply to Rutgers, plaintiffs have failed to state a section 1983 claim against Dr. Lawrence with respect to the original Complaint's Privacy Act claims. Accordingly, the court will grant defendants' motion to dismiss the original Complaint against Dr. Lawrence.
C. Plaintiffs' Motion to Amend the Complaint With Respect to Dr. Lawrence
Although the Privacy Act prohibits relief against individuals such as Dr. Lawrence, FERPA, as applied through section 1983, is not so limited. Indeed, defendants do not dispute that if plaintiffs allege facts which link Dr. Lawrence to the alleged FERPA violations, then they would be entitled to an injunction directed against Dr. Lawrence. See Def. Supp. Brief at 30-31. *1261 Rather, defendants contend that plaintiffs simply have failed to allege facts which link Dr. Lawrence to any policies or customs which violate FERPA.
The Amended Complaint alleges that "Defendants [] maintain a practice of allowing lists of students' names and SSNs to be circulated to and/or observed by students in the classrooms[;]" and that "Defendants acted with actual malice and/or reckless disregard of plaintiffs' rights to privacy secured by FERPA." Although plaintiffs submit Certifications which attest that such activities have occurred repeatedly, see e.g. Krebbs Cert., the Complaint does not specify how Dr. Lawrence might be involved with his alleged practice. Under these circumstances, the court can only concur with defendants that plaintiffs have not presented any facts or inferences suggesting the knowledge and/or acquiescence of Dr. Lawrence with respect to the alleged FERPA violations. Accordingly, the court will deny plaintiffs' motion to amend the Complaint with respect to Dr. Lawrence.[14]
D. Plaintiffs' Application for Class Certification
As mentioned supra, plaintiffs have also filed a motion/application for class certification pursuant to Fed.R.Civ.P. 23(b). Plaintiffs argue that the size of the proposed class current and former Rutgers students who disclosed their social security numbers pursuant to defendants' request without a sufficient disclaimer or notice is so numerous as to make joinder unfeasible. There are currently approximately 47,000 students matriculated at Rutgers. Plaintiffs further argue that there are common questions of law and fact, as well as common claims and defenses to all members of the proposed class; that there is a risk of inconsistent adjudications; and that the defendants act on grounds generally applicable to the class. The court agrees that plaintiffs' action appears to be well suited to resolution in a class action context. However, class certification is unnecessary. A declaratory judgment invalidating certain university practices and an injunction enjoining those practices would provide relief to all members of plaintiffs' proposed class.
In addition, the court has serious reservations regarding plaintiffs' application. Fed.R.Civ.P. 23(a)(4) provides: "One or more members of a class may sue or be sued as representative parties on behalf of all if ... the representative parties will fairly and adequately protect the interests of the class." Plaintiffs contend that they will provide adequate protection of the class interests because they "have a close link to the college community" as are each members of a student advocacy group "charged with the fiduciary duty of being vigorous advocates of student interests." Plt. Mem. in Support of Class Certification.
The problem here is that plaintiffs intend to prosecute this action pro se. While plaintiffs' performance has been more than adequate, plaintiffs are undergraduates without law degrees. The court has some pause certifying these representatives given the absence of qualified counsel.
Given the adequacy of relief which will flow from a judgment in favor of the individual name plaintiffs, the court concludes that class certification is unnecessary. In addition, in light of plaintiffs' pro se status, class certification is inappropriate. Accordingly, the court denies plaintiffs' application for class certification.
Conclusion
For the foregoing reasons, defendants' motion to dismiss the Complaint against defendant Lawrence is granted, and plaintiffs' motion to amend the Complaint as against Dr. Lawrence is denied. In addition, plaintiffs' application for a preliminary injunction is granted in part and denied in part. The court will enjoin defendants from allowing the unprotected distribution of class rosters containing social security numbers and names of students. Finally, the court denies plaintiffs' application for class certification.
*1262 ORDER
This matter having come before the court upon the motion of plaintiffs for a preliminary injunction; and upon the motion of defendants to dismiss the Complaint against Dr. Lawrence; and upon the motion of plaintiffs to amend the Complaint with respect to Dr. Lawrence; and upon plaintiffs' application for class certification; and the court having considered the submissions of the parties and the arguments of counsel; and for the reasons expressed in the accompanying Opinion; and for good cause shown;
IT IS this 22 day of July, 1992, hereby
ORDERED that plaintiffs' motion for preliminary injunctive relief be and hereby is granted in part and denied in part; and it is further
ORDERED that defendants be and hereby are enjoined from allowing the unprotected distribution of class rosters with students' names and undisguised social security numbers; and it is further
ORDERED that summary judgment be and hereby is entered in favor of defendants with respect to plaintiffs' Privacy Act claims; and it is further
ORDERED that defendants' motion to dismiss the Complaint against Dr. Lawrence be and hereby is granted; and it is further
ORDERED that plaintiffs' motion to amend the Complaint with respect to Dr. Lawrence be and hereby is denied; and it is further
ORDERED that plaintiffs' application for class certification be and hereby is denied.
NOTES
[1] In the Complaint, plaintiffs seek a permanent injunction tracking their request for preliminary injunctive relief, as well as an order requiring the defendants to "destr[oy] all social security numbers of students which the University currently has on file, in any medium whatsoever, which were collected in violation of the Privacy Act."
[2] In their Amended Complaint, plaintiffs seek additional preliminary and permanent injunctive relief: (1) enjoining the distribution or release of social security numbers and other educational records to persons outside the purview of FERPA; (2) prohibiting lists of student names or social security numbers with grades to be posted in public places in University facilities; and (3) prohibiting the requirement that students utilize identification cards which display social security numbers.
[3] The original Complaint was filed by six name plaintiffs, and those six have added a seventh name plaintiff in their Amended Complaint. To the extent that defendants have consented to the Amended Complaint, except as against Dr. Lawrence, the court accepts all other aspects of the Amended Complaint.
[4] Section 7 of the Privacy Act of 1974 was never incorporated into the U.S.Code. Accordingly, the court cites the Act as reprinted in the Historical Note to the statute.
[5] By letter dated May 8, 1992, counsel for the defendants advised the court that because of printing deadlines, the University has reinserted a notice in the 1993 application materials which advises that the applicant's disclosure of her social security number is voluntary. However, defendants continue to insist that the Privacy Act does not require them to include such a notice, and they do not promise to include any such notice in future materials.
As indicated at oral argument, plaintiffs continue to insist that the Privacy Act applies to defendants and that the 1993 notice is inadequate under the Privacy Act. May 11, 1992 Trans. at 2.
[6] But see Trans. of May 11, 1992 Hearing at 5-6 (plaintiffs indicate that the only reason not to resolve the entire matter is the then anticipated amending of the Complaint).
[7] Plaintiffs also meaningfully distinguish many of defendants' citations. For instance, plaintiffs note that defendants' FOIA cases primarily involve private entities being deemed "public," whereas with Rutgers, the university is public from the start. Defendants point to Forsham v. Harris, 445 U.S. 169, 179, 100 S.Ct. 977, 983, 63 L.Ed.2d 293 (1980), which holds that federal agency grants to a private physicians group does not render the group an "agency" for FOIA purposes. See also Dennie v. University of Pittsburgh School of Medicine, 589 F.Supp. 348 (D.V.I.1984), aff'd, 770 F.2d 1068 (3d Cir.1985), cert. denied, 474 U.S. 849, 106 S.Ct. 144, 88 L.Ed.2d 119 (1985) (same); Irwin Memorial, etc. v. American Nat. Red Cross, 640 F.2d 1051 (9th Cir.1981) (Red Cross not a FOIA agency despite use of government buildings and compliance with government audit requirements). The court agrees, as would plaintiffs, that mere receipt of public funds by a private organization can rarely, if ever, constitute the sufficient degree of government involvement and control to justify FOIA or Privacy Act "agency" status.
[8] Indeed, section 552(e) covers a government controlled corporation, not mere government created corporations.
[9] Plaintiffs also stress the precedential value of Yeager v. Hackensack Water Co., 615 F.Supp. 1087 (D.N.J.1985), the one case which does address the scope of state agencies under the Privacy Act. However, Yeager is of little relevance or help to plaintiffs' position. In Yeager, Judge Fisher held that the Hackensack Water Company, a private entity, violated the Privacy Act when it demanded water customers' social security numbers pursuant to the Governor's Executive Order that the company take steps to assure compliance with emergency water rationing. However, the court never considered whether the water company was a state "agency." Rather, Judge Fisher specifically concluded that the company was acting as a state actor at the behest of the Governor, thereby bringing these particular actions under the Privacy Act. 615 F.Supp. at 1091. In the case at hand, plaintiffs do not argue, nor could they, that Rutgers acts as a direct agent of the State when it distributes admission applications.
[10] Plaintiffs recognize that the New Jersey Legislature's description of Rutgers' status is significant but not binding on a federal court interpreting the scope of a federal statute, such as is the situation here. Plt. Reply Brief at 4. Therefore, the reasoning of Public Citizen Health Research Group v. Dept. of H.E.W., supra, in which the court enforced Congress' express intent that the agency be viewed as independent, does not bind resolution of the instant inquiry.
[11] In addition, Rutgers is not required to manage its funds as public monies, N.J.S.A. 18A:65-25(c), (d), (g), nor is it required to comply with state civil service, competitive bidding, and administrative procedure requirements. Kovats, 822 F.2d at 1311, 1317.
[12] Section 1232g(g) provides:
The Secretary shall establish or designate an office and review board within the Department of Education for the purpose of investigations, processing, reviewing and adjudicating violations of [FERPA] and complaints which may be filed concerning alleged violations of [FERPA].
The Secretary's enforcement regulations establish an office (the Family Policy and Regulations Office) for receiving and adjudicating complaints. If the Office concludes that an educational institution is in violation of the law, the Office advises the institution as to what it must do to come into compliance. If the institution does not comply with the Office's suggestions, then the Secretary may take enforcement action, including termination of federal funding. 34 C.F.R. Subtitle A §§ 99.60-.67 (1991). No other remedy is provided to the aggrieved individual.
[13] Although the court grants defendants summary judgment on plaintiffs' Privacy Act claims, the cited Privacy Act case law and legislative history are relevant for understanding the privacy interests at issue in the alleged (mis)use of social security numbers.
[14] The court also notes that plaintiffs do not need to assert a claim against Dr. Lawrence, since their requested injunctive relief would apply to the university and its agents, including Dr. Lawrence.