Attorney General's Opinion

Attorney General, Richard Blumenthal

March 15, 2007

Honorable Valerie Lewis
Department of Higher Education
61 Wooland Street
Hartford, CT 06106

Dear Commissioner:

You have asked this office whether the Board of Governors of Higher Education ("BGHE") and the Department of Higher Education's ("DHE") have the statutory authority under Conn. Gen. Stat. §  10a-6(d) to require the constituent units of the state system of higher education (the University of Connecticut, the four Connecticut State Universities, the Community Colleges, and the Charter Oak College) to provide the Board and DHE with personally identifiable confidential student and student family information, including social security numbers. You have stated that the Board and DHE are requesting this information to review the provision of State-funded financial aid at State institutions. 

Although Conn. Gen. Stat. § 10a-6(d) gives the Board and DHE the statutory authority to require the constituent units to provide the Board and DHE with information "necessary" for the Board and DHE to fulfill their statutory responsibilities, there is serious question whether the Board and DHE have the statutory authority to require the constituent units to provide personally identifiable confidential student and student family information.  Legislative clarification of the Board and DHE's authority to require such information, therefore, is required.¹

   The Board of Governors of Higher Education is "the central policy making authority for public higher education in Connecticut" with extensive powers and responsibilities.  Conn. Gen. Stat. 10a-5, 10a-6.  Under your direction as the Commissioner of Higher Education, the Department of Higher Education is the "administrative arm" of the Board empowered to "administer, coordinate and supervise" the system of higher education "in accordance with the policies established by the board." 

To carry out its duties in overseeing the provision of public and private higher education in this state, the Board is entitled to receive "data, reports and other information from the constituent units." Conn. Gen. Stat. 10a-6(d). In addition, the DHE has the responsibility for maintaining a "comprehensive planning, budgeting and management information system for public higher education."

While the Board's and DHE's powers are extensive, the General Assembly has limited the Board's authority to "request and receive, or be provided electronic access to, data, reports and other information from the constituent units of the state system of higher education that is necessary for the board to carry out its responsibilities."  (emphasis added) Conn. Gen. Stat.10a-6(d).  Section 10a-6(d) does not define the word "necessary."  In the absence of an express statutory definition, courts often look to common understandings of words found in dictionaries.  Jagger v. Mohawk Mountain Ski Area, 269 Conn. 672m 682 (2004).  The word "necessary" means: "1. Absolutely essential, indispensable. 2. Needed to achieve a certain result or effect; requisite: the necessary tools."  The American Heritage Dictionary, Second Edition (1976).  Therefore, the constituent units are statutorily obligated to provide the Board and DHE with "data, reports and other information" that is "absolutely essential", "indispensable" and "requisite" for the Board and the DHE to carry out its statutory responsibilities.

The Board's statutory responsibilities include the establishment of statewide tuition and fees policies and statewide financial aid policies (Conn. Gen. Stat. 10a-6(a)(3) and (4)).  Pursuant to these responsibilities, the Board and DHE seek to review the operation of State-funded financial aid at State institutions to ensure that statewide tuition and fees policies and state goals are being fulfilled.  As part of your review of the financial aid programs administered by State institutions, you requested the constituent units to provide you with access to personally identifiable confidential information relating to students and their families, including financial records, grade point averages, social security numbers, birth dates, financial aid awards and cumulative loan debt. 

The constituent units objected to providing this information because of their concern for the security of this personally identifiable confidential information. Instead, the constituent units seek to provide this information in aggregated form or in a form that does not contain personally identifiable information. According to the constituent units, personally identifiable confidential student and family information is not necessary for the Board and the DHE to meet their statutory obligations, and could lead to invasions of privacy or identity theft if the information were to be disclosed to others. 

In response to their concerns, you have recently informed the constituent units that the financial and other confidential information need only be accompanied by the last four digits of a student's Social Security number and the student's date of birth. The constituent units, however, continue to object to this request, stating that: "Specifically, you continue to request the last four digits in students' Social Security numbers and their dates of birth.  In combination these make it easy to identify individual students, presenting security issues that are equal to those that would be associated with providing an individual student's entire Social Security number." Letter from Philip Austin to Valerie F. Lewis, February 8, 2007.  We have no way of determining which view is accurate, but because Social Security numbers are the keys to all confidential information, it must be presumed that any information containing any portion of a student's Social Security number is personally identifying.

The constituent units are rightfully concerned about the security issues attendant to the release of personally identifiable confidential information.  Their concern that the greater the dissemination of such information, the greater the chance of public disclosure of such information, through accident or otherwise, is legitimate. Security breaches involving confidential information are prevalent and identity theft is a growing and significant threat to Connecticut residents.   The issues of whether the information sought is personally identifiable confidential information is pivotal to our analysis.

This office addressed a similar security concern involving the Legislative Program Review and Investigations Committee's efforts to obtain confidential taxpayer information from the Department of Revenue Services ("DRS") in connection with the Committee's study of Connecticut's tax system.  Similar to the Board, the Legislative Committee has the statutory authority to obtain information from state agencies that the Committee determines "it needs to fulfill its duties." Conn. Gen. Stat. 2-53g.  Although DRS declined to supply confidential taxpayer information, citing the confidentiality provisions of Conn. Gen. Stat. 12-15, this office held that the Committee was entitled to receive the confidential information it requested. Specifically, this office determined that the legislature had expressly given the Committee access to confidential information, imposing on the Committee the same confidentiality requirements and penalties imposed on an agency providing the confidential information to the Committee.  According to Conn. Gen. Stat. 2-53g:  "Any statutory requirements of confidentiality regarding such records, data and other information, including penalties for violating such requirements, shall apply to the committee, its staff and its other authorized representatives in the same manner and to the same extent as such requirements and penalties apply to any public officer, department, agency or authority of the state or its political subdivisions."  Even considering that explicit statutory authority, this office advised the Committee:  "If the Committee is requesting personally identifiable or taxpayer specific information, the Committee must completely and carefully determine that such information is needed and required by the Committee and should limit its request to the minimum necessary to enable it to carry out its duties." Op. Atty. Gen., (October 18, 2005) Honorable James A. Amman, Honorable Christopher G. Donovan.

Unlike the statutory authority given to the Legislative Program Review and Investigations Committee to receive confidential information the Committee "needs to fulfill its duties," Conn. Gen. Stat. §  10a-6(d) does not give the Board or DHE the express statutory authority to receive personally identifiable confidential student and student family information from the constituent units.  While the legislature has generally authorized the Board to require the constituent units to provide information "necessary" for the Board to fulfill its statutory responsibilities, it has not provided the Board with the express authority to require constituent units to provide the Board with personally identifiable confidential student and student-family information in the situation at issue here.  Without the specific statutory authorization to obtain personally identifiable confidential information, such personally identifiable confidential information may not have been deemed by the legislature to be "necessary" for the Board "to carry out its responsibilities."

In other instances where the legislature has authorized the Board and DHE to review personally identifiable confidential student and student family information - - including in connection with discrete financial aid programs - - it has done so specifically and directly.  For example, the Board is authorized to "review and approve applications for financial assistance" under specific state financial aid programs established in Conn. Gen. Stat. 10a-163, 10a-168 and 10a-169 (relating to the teacher incentive loan program for training in areas of teacher shortages,  scholarship aid for teachers of children requiring special education, and the capitol scholarship grant program) and to "receive and review records of all financial assistance granted pursuant to section 10a- 167 (relating to scholarships for Vietnam era veterans)."  Conn. Gen. Stat. 10a-161.  Additionally, DHE is authorized to administer the minority teacher incentive program (Conn. Gen. Stat. §  10a-168a), the information technology scholarship pilot program (Conn. Gen. Stat. §  10-169a) the information technology loan reimbursement pilot program (Conn. Gen. Stat. §  10-169b), the high technology graduate assistantship program (Conn. Gen. Stat. §  10a-170b), the academic scholarship loan program (Conn. Gen. Stat. § 10a-170h) and the academic scholarship graduate student loan program (Conn. Gen. Stat. §  10a-170s). Pursuant to these programs, the Board and DHE have reported that they have access to tens of thousands of the Free Application for Federal Student Aid ("FAFSA"), which contain personally identifiable confidential information including Social Security numbers.  Finally, the legislature has established a task force to assist the DHE and the constituent units in "developing an integrated, commonly-linked higher education management and student information system" which would "promote single site information processing, resource and application sharing, and coordinated annual data processing acquisitions."  Conn. Gen. Stat. 10a-9a.  This commonly linked information system, when implemented, may provide the Board and DHE with access to personally identifiable confidential information currently in the possession of the constituent units.

We conclude, then, that if the Board and DHE request information that is not personally identifiable confidential student and student family data, the constituent units are obligated to provide such information to the Board and DHE.  However, there is serious question whether the legislature has given the Board and DHE the statutory authority to require constituent units to provide personally identifiable confidential student and student family information.  Legislative clarification of the Board's power to obtain personally identifiable confidential information from the constituent units is, therefore, necessary.  If the legislature does determine that the Board's authority under Conn. Gen. Stat. 10a-6(d) encompasses the receipt of personally identifiable confidential information when "necessary for the board to carry out its responsibilities," the Board and DHE should completely and carefully determine what information is needed and required and should limit their request to the minimum necessary for the Board and DHE to carry out their statutory responsibilities.²

Very truly yours,

RICHARD BLUMENTHAL

Back to the 2007 Opinions Page
Back to the Opinions Page