Attorney General's Opinion
Attorney General, Richard Blumenthal
March 15, 2007
Honorable Valerie Lewis
Department of Higher Education
61 Wooland Street
Hartford, CT 06106
You have asked this office whether the Board of Governors of Higher Education ("BGHE") and the Department of Higher Education's ("DHE") have the statutory authority under Conn. Gen. Stat. § 10a-6(d) to require the constituent units of the state system of higher education (the University of Connecticut, the four Connecticut State Universities, the Community Colleges, and the Charter Oak College) to provide the Board and DHE with personally identifiable confidential student and student family information, including social security numbers. You have stated that the Board and DHE are requesting this information to review the provision of State-funded financial aid at State institutions.
Although Conn. Gen. Stat. § 10a-6(d) gives the Board and DHE the statutory authority to require the constituent units to provide the Board and DHE with information "necessary" for the Board and DHE to fulfill their statutory responsibilities, there is serious question whether the Board and DHE have the statutory authority to require the constituent units to provide personally identifiable confidential student and student family information. Legislative clarification of the Board and DHE's authority to require such information, therefore, is required.1
The Board of Governors of Higher Education is "the central policy making authority for public higher education in
To carry out its duties in overseeing the provision of public and private higher education in this state, the Board is entitled to receive "data, reports and other information from the constituent units."
While the Board's and DHE's powers are extensive, the General Assembly has limited the Board's authority to "request and receive, or be provided electronic access to, data, reports and other information from the constituent units of the state system of higher education that is necessary for the board to carry out its responsibilities." (emphasis added) Conn. Gen. Stat.10a-6(d). Section 10a-6(d) does not define the word "necessary." In the absence of an express statutory definition, courts often look to common understandings of words found in dictionaries. Jagger v.
The Board's statutory responsibilities include the establishment of statewide tuition and fees policies and statewide financial aid policies (
The constituent units objected to providing this information because of their concern for the security of this personally identifiable confidential information. Instead, the constituent units seek to provide this information in aggregated form or in a form that does not contain personally identifiable information. According to the constituent units, personally identifiable confidential student and family information is not necessary for the Board and the DHE to meet their statutory obligations, and could lead to invasions of privacy or identity theft if the information were to be disclosed to others.
In response to their concerns, you have recently informed the constituent units that the financial and other confidential information need only be accompanied by the last four digits of a student's Social Security number and the student's date of birth. The constituent units, however, continue to object to this request, stating that: "Specifically, you continue to request the last four digits in students' Social Security numbers and their dates of birth. In combination these make it easy to identify individual students, presenting security issues that are equal to those that would be associated with providing an individual student's entire Social Security number." Letter from
The constituent units are rightfully concerned about the security issues attendant to the release of personally identifiable confidential information. Their concern that the greater the dissemination of such information, the greater the chance of public disclosure of such information, through accident or otherwise, is legitimate. Security breaches involving confidential information are prevalent and identity theft is a growing and significant threat to
This office addressed a similar security concern involving the Legislative Program Review and Investigations Committee's efforts to obtain confidential taxpayer information from the Department of Revenue Services ("
Unlike the statutory authority given to the Legislative Program Review and Investigations Committee to receive confidential information the Committee "needs to fulfill its duties," Conn. Gen. Stat. § 10a-6(d) does not give the Board or DHE the express statutory authority to receive personally identifiable confidential student and student family information from the constituent units. While the legislature has generally authorized the Board to require the constituent units to provide information "necessary" for the Board to fulfill its statutory responsibilities, it has not provided the Board with the express authority to require constituent units to provide the Board with personally identifiable confidential student and student-family information in the situation at issue here. Without the specific statutory authorization to obtain personally identifiable confidential information, such personally identifiable confidential information may not have been deemed by the legislature to be "necessary" for the Board "to carry out its responsibilities."
In other instances where the legislature has authorized the Board and DHE to review personally identifiable confidential student and student family information - - including in connection with discrete financial aid programs - - it has done so specifically and directly. For example, the Board is authorized to "review and approve applications for financial assistance" under specific state financial aid programs established in Conn. Gen. Stat. 10a-163, 10a-168 and 10a-169 (relating to the teacher incentive loan program for training in areas of teacher shortages, scholarship aid for teachers of children requiring special education, and the capitol scholarship grant program) and to "receive and review records of all financial assistance granted pursuant to section 10a- 167 (relating to scholarships for Vietnam era veterans)."
We conclude, then, that if the Board and DHE request information that is not personally identifiable confidential student and student family data, the constituent units are obligated to provide such information to the Board and DHE. However, there is serious question whether the legislature has given the Board and DHE the statutory authority to require constituent units to provide personally identifiable confidential student and student family information. Legislative clarification of the Board's power to obtain personally identifiable confidential information from the constituent units is, therefore, necessary. If the legislature does determine that the Board's authority under
Very truly yours,
1 Most recently, the Board and DHE have limited their data request to student and student family information that includes only the last four digits of students' Social Security numbers and their date of birth. We have no way of knowing whether this information personally identifies the student and student family information the Board and DHE are seeking. However, because Social Security numbers are the keys to all confidential information, it must be presumed that any information containing any portion of a student's Social Security number is personally identifying.
2 If the Board and DHE are entitled receive personally identifying confidential student and student family information from the constituent units under state law, their receipt of such information would not violate either the federal Family and Educational Right to Privacy Act, 20 USC 1232g, or the Gramm-Leach-Bliley Act, 15 USC 6801, et.seq., provided there is an appropriate memorandum of understanding between the Board, DHE and the constituent units regarding implementation of the information security programs required by federal law to protect the privacy of this information.