When must a Florida agency release social security numbers to a commercial company that asks for them?

Plain-English summary

Social security numbers held by Florida agencies are generally confidential and exempt from the Public Records Law, but the Legislature has built in exceptions. The City of Palm Coast's attorney saw what looked like a conflict between two of those exceptions, section 119.071(5)(a)6. and (5)(a)7., Florida Statutes, and asked the Attorney General to sort it out. He also asked whether the city could turn down a commercial entity that wanted social security numbers to run "single query" database searches for clients like banks, finance companies, repossession firms, and private investigators.

Attorney General Bill McCollum gave a two-part answer. First, the two subsections do not conflict. Subparagraph 6. is permissive, listing situations where an agency may disclose social security numbers, while subparagraph 7. tells an agency it may not refuse a qualifying commercial entity that submits a proper written request. Read together, they form a consistent scheme. Second, the AG declined to answer whether this particular company's database-search service fit within the statutory definition of "commercial activity." That was a mixed question of law and fact, and under section 16.01(3), Florida Statutes, the Attorney General opines only on questions of law. The opinion pointed the city to its statutory power to request more information before deciding.

Currency note

This opinion was issued in 2010. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Were the two statutes really in conflict?
A: No. The AG read subparagraph 6. as permissive, it authorizes but does not require disclosure in listed situations (court orders, the individual's written consent, certain federal-law uses, and so on). Subparagraph 7. then bars an agency from refusing a commercial entity that qualifies and submits a written request. The AG said the provisions overlap on some federal-law uses but harmonize into a single "exception to the exemption."

Q: What did a commercial entity have to do to get the numbers?
A: The statute required a written request that was verified under section 92.525, legibly signed by an authorized officer or agent, and that listed the entity's name, business mailing and location addresses, and business phone number, plus a statement of the specific purposes and how the numbers would be used in a commercial activity, including any specific law permitting the use. The agency could also ask for any other information reasonably necessary to verify identity and purpose.

Q: What counted as a "commercial activity" under the statute?
A: The statute tied it to permissible uses under the federal Driver's Privacy Protection Act, the Fair Credit Reporting Act, and the Financial Services Modernization Act, plus verifying the accuracy of personal information in the normal course of business. It expressly excluded the display or bulk sale of social security numbers to the public and distribution to customers the entity cannot identify.

Q: Why wouldn't the AG just say whether the company's searches qualified?
A: Because that turned on the facts of how the company actually used the data, not purely on a question of law. The AG noted that under section 16.01(3) his office addresses questions of law, not factual or mixed questions, and left that determination to the city, which the statute lets gather more information.

Q: Were there penalties for misusing the request process?
A: Yes. The opinion noted that making a false representation to obtain social security numbers, or willfully and knowingly violating the paragraph, was a third-degree felony, and that a public officer who violated it committed a noncriminal infraction punishable by a fine of up to $500 per violation.

Background and statutory framework

Section 119.071(5)(a), Florida Statutes, reflects the Legislature's stated intent to "monitor the use of social security numbers held by agencies in order to maintain a balanced public policy." The baseline rule in subparagraph 5. makes agency-held social security numbers confidential and exempt. The 2009 Legislature, through Chapter 2009-237 and several companion acts, modified the exceptions to that exemption. Subparagraph 6. listed permissive disclosures (federal or state law, the individual's written consent, USA Patriot Act compliance, certain employee benefit and pension administration, and disclosures to commercial entities for uses allowed under three named federal statutes). Subparagraph 7. addressed commercial entities directly, prohibiting an agency from denying access when the entity performs a qualifying commercial activity, uses the numbers only for that activity, and asks in writing.

The AG resolved the apparent tension with ordinary tools of statutory construction: a statute should be read to give effect to legislative intent (Barruzza v. Suddath Van Lines, Inc., 474 So. 2d 861 (Fla. 1st DCA 1985); Philip Crosby Associates, Inc. v. State Board of Independent Colleges, 506 So. 2d 490 (Fla. 5th DCA 1987)), and all parts of a statute must be read together as a consistent whole (Ideal Farms Drainage District v. Certain Lands, 19 So. 2d 234 (Fla. 1944); Forsythe v. Longboat Key Beach Erosion Control District, 604 So. 2d 452 (Fla. 1992); State v. Haddock, 140 So. 2d 631 (Fla. 1st DCA 1962); Wakulla County v. Davis, 395 So. 2d 540 (Fla. 1981); Garner v. Ward, 251 So. 2d 252 (Fla. 1971)). On the second question, the AG applied the long-standing limit that his office answers questions of law, not factual or mixed questions, and so left the "commercial activity" determination to the agency.

Citations and references

Florida statutes:

• s. 119.071(5), Fla. Stat. (social security numbers held by agencies; exemption and exceptions)
• s. 119.071(5)(a)6. and (5)(a)7., Fla. Stat. (permissive disclosures and commercial-entity access)
• s. 92.525, Fla. Stat. (verification of documents)
• s. 16.01(3), Fla. Stat. (Attorney General opines on questions of law)
• Chapter 2009-237, Laws of Florida (2009 amendment to the exceptions)

Federal statutes referenced:

• Driver's Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq.
• Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq.
• Financial Services Modernization Act of 1999, 15 U.S.C. ss. 6801 et seq.

Cases:

• Barruzza v. Suddath Van Lines, Inc., 474 So. 2d 861 (Fla. 1st DCA 1985)
• Philip Crosby Associates, Inc. v. State Board of Independent Colleges, 506 So. 2d 490 (Fla. 5th DCA 1987)
• Ideal Farms Drainage District v. Certain Lands, 19 So. 2d 234 (Fla. 1944)
• Forsythe v. Longboat Key Beach Erosion Control District, 604 So. 2d 452 (Fla. 1992)
• State v. Haddock, 140 So. 2d 631 (Fla. 1st DCA 1962)
• Wakulla County v. Davis, 395 So. 2d 540 (Fla. 1981)
• Garner v. Ward, 251 So. 2d 252 (Fla. 1971)

Subject

Public Records, social security numbers

Source

• Landing page: https://www.myfloridalegal.com/ag-opinions/public-records-social-security-numbers
• Original PDF: https://www.myfloridalegal.com/print/pdf/node/1721

Original opinion text

Mr. William E. Reischmann, Jr.

Brown, Garganese, Weiss & D'Agresta, P.A.

Post Office Box 2873

Orlando, Florida 32802-2873

RE: PUBLIC RECORDS – SOCIAL SECURITY NUMBERS – COMMERCIAL ENTITY – COMMERCIAL ACTIVITY – conflict in statutory provisions; denial of request for social security numbers from commercial entity. s. 119.071(5), Fla. Stat.

Dear Mr. Reischmann:

As City Attorney for the City of Palm Coast, you have asked for my opinion on substantially the following questions:

1. Whether the provisions relating to the exempt and confidential nature of social security numbers held by a public agency in subparagraphs 119.071(5)(a)6. and (5)(a)7., Florida Statutes, are in conflict?

2. Whether the City of Palm Coast may deny a request for social security numbers from a commercial entity pursuant to section 119.071(5)(a)7., Florida Statutes, when the commercial entity states that the commercial activity includes providing single query data searches of its database to its customers who are banks, finance companies, licensed repossession companies and licensed private investigative agencies?

In sum:

1. There is no conflict between subparagraphs 119.071(5)(a)6., and (5)(a)7., Florida Statutes, and these provisions should be read together and harmonized.

2. The question of whether providing "single query data searches of its database to its customers who are banks, finance companies, licensed repossession companies and licensed private investigative agencies" comes within the scope of a "commercial activity" for purposes of section 119.071(5)(a)7., Florida Statutes, cannot be resolved by this office.

Question One

Section 119.071, Florida Statutes, provides general exemptions from the inspection and copying requirements of Florida's Public Records Law. Subsection (5)(a) of the statute, which deals with the collection and maintenance of social security numbers by governmental agencies, expresses the Legislature's on-going intention to "monitor the use of social security numbers held by agencies in order to maintain a balanced public policy."[1]

Section 119.071(5)(a)5., Florida Statutes, states that social security numbers held by an agency are confidential and exempt from public disclosure requirements. However, the Legislature has adopted a number of exceptions to this exemption. The following amendment made during the 2009 legislative session,[2] subsection (5)(a)6., provides:

"6. Social security numbers held by an agency may be disclosed if any of the following apply:

a. The disclosure of the social security number is expressly required by federal or state law or a court order.

b. The disclosure of the social security number is necessary for the receiving agency or governmental entity to perform its duties and responsibilities.

c. The individual expressly consents in writing to the disclosure of his or her social security number.

d. The disclosure of the social security number is made to comply with the USA Patriot Act of 2001, Pub. L. No. 107-56, or Presidential Executive Order 13224.

e. The disclosure of the social security number is made to a commercial entity for the permissible uses set forth in the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq.; the Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq.; or the Financial Services Modernization Act of 1999, 15 U.S.C. ss. 6801 et seq., provided that the authorized commercial entity complies with the requirements of this paragraph.

f. The disclosure of the social security number is for the purpose of the administration of health benefits for an agency employee or his or her dependents.

g. The disclosure of the social security number is for the purpose of the administration of a pension fund administered for the agency employee's retirement fund, deferred compensation plan, or defined contribution plan.

h. The disclosure of the social security number is for the purpose of the administration of the Uniform Commercial Code by the office of the Secretary of State."

Staff analysis of the bill indicates that this language was intended to amend the general public records exemption for social security numbers held by an agency as provided in section 119.071(5)(a)5., Florida Statutes. The amendment was characterized as "modifying the exceptions to the exemption."[3] Thus, subparagraph 6. provides an authorization for governmental agencies to release social security numbers under those scenarios described in that section but, in light of the provisions in subparagraph 7.b., does not strictly limit the release of social security numbers to these situations.

Subparagraph 7.b. states that a governmental agency may not deny a "commercial entity" that is engaged in the performance of a "commercial activity" access to social security numbers, so long as those social security numbers will only be used in the performance of a commercial activity and on condition that the commercial entity requests the numbers in writing.[4] For purposes of the subparagraph, a "[c]ommercial activity" is defined to mean:

". . . permissible uses set forth in the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq.; the Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq.; or the Financial Services Modernization Act of 1999, 15 U.S.C. ss. 6801 et seq., or verification of the accuracy of personal information received by a commercial entity in the normal course of its business, including identification or prevention of fraud or matching, verifying, or retrieving information. It does not include the display or bulk sale of social security numbers to the public or the distribution of such numbers to any customer that is not identifiable by the commercial entity."[5]

The term "commercial entity" is also defined for purposes of the statute and includes "any corporation, partnership, limited partnership, proprietorship, sole proprietorship, firm, enterprise, franchise, or association that performs a commercial activity in this state."[6]

The statute requires that prior to releasing social security numbers to a commercial entity pursuant to subparagraph 7.b., Florida Statutes, the agency must receive a written request that satisfies several statutory conditions:

"(I) It must be verified as provided in s. 92.525;

(II) It must be legibly signed by an authorized officer, employee, or agent of the commercial entity;

(III) The written request must contain the commercial entity's name, business mailing and location addresses, and business telephone number; and

(IV) It must contain a statement of the specific purposes for which it needs the social security numbers and how the social security numbers will be used in the performance of a commercial activity, including the identification of any specific federal or state law that permits such use."[7]

The statute also authorizes an agency to "request any other information reasonably necessary to verify the identity of a commercial entity requesting the social security numbers and the specific purposes for which the numbers will be used."[8] Any person who makes a false representation in an attempt to obtain a social security number pursuant to subparagraph 7.a., Florida Statutes, or any person who "willfully and knowingly violates" the paragraph commits a third degree felony. Public officers violating this paragraph commit a noncriminal infraction punishable by a fine not to exceed $500.00 per violation.[9]

Both subparagraphs 119.071(5)(a)6. and 7., Florida Statutes, deal with the disclosure of social security numbers to commercial entities and overlap with regard to those federal provisions under which release of these numbers is authorized. Recognizing the intent of the Legislature,[10] the two provisions may be read together to accomplish the legislative goal of providing an "exception to the exemption."[11] The language of subparagraph 6. is permissive and authorizes (but does not mandate) disclosure under these specific circumstances. The language of subparagraph 6. does not foreclose the existence of other exceptions. The language of subparagraph 7.b., Florida Statutes, constitutes a recognition by the Legislature of the permissive nature of subparagraph 6. and qualifies the discretion of an agency to release social security numbers to commercial entities by prohibiting an agency from refusing to disclose this information if the commercial entity requestor qualifies under the statute and provides a written request for the information.[12]

In sum, it is my opinion that section 119.071(5)(a)6., Florida Statutes, and section 119.071(5)(a)7., Florida Statutes, do not conflict and may be read together to authorize the disclosure of social security numbers to commercial entities engaged in the commercial activities identified in the statute. Any request for the disclosure of social security numbers by a commercial entity must be made in writing and must provide the information required by the statute. These provisions also authorize the agency holding social security numbers to request additional information that is reasonably necessary to verify the identity of the commercial entity and the specific purposes for which the social security numbers will be used.

Question Two

Your second question requires resolution of a mixed question of law and fact which is beyond the authority of this office.[13] As discussed in my response to your first question, section 119.071(5), Florida Statutes, provides that a governmental agency may not deny a commercial entity access to agency-held social security numbers if the commercial entity is engaged in the performance of a commercial activity as defined in the statute and provided the commercial entity makes a written request for those social security numbers in the form prescribed by the statute.

The statute clearly recognizes that the requested social security numbers may only be used in performance of a commercial activity. The statute also provides that "verification of the accuracy of personal information received by a commercial entity in the normal course of its business" does come within the definition of a "commercial activity" for purposes of section 119.071(5)(a)7., Florida Statutes. However, the display or bulk sale of social security numbers to the public or the distribution of those numbers to customers that are not identifiable by the commercial entity are prohibited.

The question of whether providing "single query data searches of its database to its customers who are banks, finance companies, licensed repossession companies and licensed private investigative agencies" comes within the scope of a "commercial activity" for purposes of subsection (5), Florida Statutes, cannot be resolved by this office. The City of Palm Coast is authorized to request additional information reasonably necessary to determine "the specific purposes for which the [social security] numbers will be used"[14] if sufficient information upon which to base its release of this information has not been provided.

Sincerely,

Bill McCollum

Attorney General

BM/tgh

[1] Section 119.071(5)(a)1.c., Fla. Stat.

[2] See s. 1, Ch. 2009-237, Laws of Fla. And see s. 1, Ch. 2009-104, Laws of Fla.; ss. 1, 2, Ch. 2009-150, Laws of Fla.; s. 1, ch. 2009-169, Laws of Fla.; ss. 1, 2, Ch. 2009-235, Laws of Fla., for other amendments made to this section during the 2009 legislative session.

[3] See Florida House of Representatives Staff Analysis of CS/HB 7051 dated 4/14/2009.

[4] Section 119.071(5)(a)7.b., Fla. Stat.

[5] Section 119.071(5)(a)7.a.(I), Fla. Stat.

[6] Section 119.071(5)(a)7.a.(II), Fla. Stat.

[7] Section 119.071(5)(a)7.b., Fla. Stat.

[8] Section 119.071(5)(a)7.c., Fla. Stat.

[9] Section 119.071(5)(a)8.b., Fla. Stat.

[10] See Barruzza v. Suddath Van Lines, Inc., 474 So. 2d 861 (Fla. 1st DCA 1985); Philip Crosby Associates, Inc., v. State Board of Independent Colleges, 506 So. 2d 490 (Fla. 5th DCA 1987) (cardinal rule of statutory construction is that statute should be construed so as to ascertain and give effect to legislative intent expressed in statute).

[11] See Ideal Farms Drainage District et al. v. Certain Lands, 19 So. 2d 234 (Fla. 1944); Forsythe v. Longboat Key Beach Erosion Control District, 604 So. 2d 452 (Fla. 1992) (all parts of a statute must be read together in order to achieve a consistent whole); State v. Haddock, 140 So. 2d 631 (Fla. 1st DCA 1962).

[12] And see Wakulla County v. Davis, 395 So. 2d 540 (Fla. 1981) and Garner v. Ward, 251 So. 2d 252 (Fla. 1971) (a law should be construed together with any other law relating to the same purpose, such that they are in harmony).

[13] See s. 16.01(3), Fla. Stat., providing that the Attorney General may opine on questions of Florida law. And see this office's statement concerning Attorney General Opinions, available online at: www.myfloridalegal.com, which provides that Attorney General Opinions are intended to address questions of law, not questions of fact or mixed questions of law and fact.

[14] Section 119.071(5)(a)7.c., Fla. Stat.