Advisory Opinion 07-009

Facts and Procedural History:

On January 18, 2007, IPAD received a letter dated January 17, 2007, from Daniel Becker, an attorney representing a student enrolled in Independent School District 720, Shakopee. In his letter, Mr. Becker asked the Commissioner to issue an advisory opinion regarding his client's rights as a data subject under Minnesota Statutes, Chapter 13.

IPAD, on behalf of the Commissioner, wrote to John McBroom, Superintendent of the District, in response to X's request. The purposes of this letter, dated January 24, 2007, were to inform him of X's request and to ask him to provide information or support for the District's position. On February 5, 2007, IPAD received a response, dated same, from Gregory Madsen, an attorney representing the District.

A summary of the facts as Mr. Becker provided them is as follows. He wrote in his opinion request:

[X] is a student [On a day in 2006, X] was interviewed by [school administrative staff]. During the interview of [X], [X] repeatedly was asked to supply private data concerning other students. The questions related to [out of school activities]. [X] declined to do so.

[School administrative staff] then proceeded to request that [X] provide private data about [him/herself]. At this point, [X] definitely should have received a Tennessen warning in accordance with Minnesota Statutes, Section 13.04, Subdivision 2. [X] never received one at any time, however. [X] also was not provided a valid warning at any subsequent interviews, such as one that occurred later that same day with [X's parent] present. For example, [X] was not told in either interview that [X] could refuse to supply the requested information. [X] also was not told about any consequences that might arise from either supplying or refusing to provide the data. [X] certainly was not advised that the information [X] provided might be used by the School against [X] in disciplinary proceedings, or that it would be shared with other school officials, or that it could be disclosed to the Minnesota State High School League.

In response to repeated questioning by school officials [on that same day], [X] disclosed private data about [him/herself] to the School. This constituted the collection of private data by the School District in violation of [Chapter 13].On the basis of this private data, [school officials] made a determination that [X] had violated a bylaw of the Minnesota State High School League and made a determination that [X] was ineligible.This action constituted a further violation of [Chapter 13] because of the School District's use of the private data .Finally, the school District continues to maintain the illegally obtained data in its files.

Issues:

Based on Mr. Becker's opinion request, the Commissioner agreed to address the following issues:

Did Independent School District 720, Shakopee, comply with Minnesota Statutes, Chapter 13, if it collected private data about a student from the student without providing the Tennessen warning notice required by section 13.04, subdivision 2? If Independent School District 720, Shakopee, did not provide a Tennessen warning notice when it collected private data about the student from the student, did it comply with Minnesota Statutes, Chapter 13, when it used data it collected from the student?

---

Discussion:

Issue 1

Did Independent School District 720, Shakopee, comply with Minnesota Statutes, Chapter 13, if it collected private data about a student from the student without providing the Tennessen warning notice required by section 13.04, subdivision 2?

Pursuant to Minnesota Statutes, section 13.04, subdivision 2, when a government entity collects private or confidential data from an individual about that individual, the entity is required to provide a notice, commonly referred to as the Tennessen warning. The notice must contain the following four elements: (1) the purpose and intended use of the data; in other words, why the entity is collecting the data and how it will use the data; (2) whether the individual can refuse or is legally required to provide the requested data; (3) what the consequences are of supplying or not supplying the data; and (4) what agencies or persons outside the collecting entity legally will be able to get the data.

In his comments to the Commissioner, Mr. Madsen related that the District had several conversations with X and/or X's parent(s) on the day Mr. Becker referenced in his opinion request. Mr. Madsen described the first two meetings as interviews and the third as a meeting. Apparently, the final conversation that day about the matter took place over the telephone, in the evening. The Commissioner has not seen a transcript of the meetings. However, based on the description Mr. Madsen gives of the first two meetings and some of the questions he says District staff asked of X and some of the answers he says X gave, it seems clear the District was asking X to provide private data about him/herself.

(Minnesota Statutes, section 13.32, classifies data on individuals that are about students. Generally, pursuant to section 13.32 and federal law, data about students are private.)

Regarding whether the District provided X with a Tennessen warning notice, Mr. Madsen wrote that during the first interview, X was not told that X could refuse to answer certain questions. Mr. Madsen did not provide information explaining when, or if, the District verbally provided the other elements of the notice or that the notice had been given to X in writing. Mr. Madsen further wrote, Even if the [Commissioner] were to determine that [X] received an incomplete Tennessen warning notice it is clear that, in the context of this matter, any such deficiency in the notice was at most a de minimus violation.

The Commissioner disagrees. Because the District seemingly collected private data about X from X, during at least the first two meetings, the District should have provided X with a Tennessen warning notice. Because the District apparently provided no notice, it did not comply with Chapter 13.

Issue 2

If Independent School District 720, Shakopee, did not provide a Tennessen warning notice when it collected private data about the student from the student, did it comply with Minnesota Statutes, Chapter 13, when it used data it collected from the student?

Section 13.05, subdivision 4, states that private or confidential data shall not be collected, stored, used, or disseminated by a government entity for any purposes other than those stated to the individual at the time of collection in accordance with section 13.04.

In Advisory Opinion 95-028, the Commissioner wrote:

The Legislature, by connecting the notice requirement of Section 13.04, subdivision 2, with the limitations on uses and disseminations of data established by Section 13.05, subdivision 4, also provided a consequence for government entities which do not meet their statutory obligation regarding the collection of private or confidential data. If a government entity does not administer a Tennessen Warning that meets the requirements of Section 13.04, subdivision 2, there are strict limitations imposed on the entity regarding any data it collects without giving the notice required by statute. That is, those data may not be stored, used or disseminated except as provided in Section 13.05, subdivision 4, as cited above.

Mr. Madsen asserts that after the first day in which District officials interviewed X, all subsequent admissions by [X], [X's] parents and their lawyer were voluntary and no Tennessen warning notices were required. He added:

Consequently, it was proper for the School District to rely on the multiple admissions . . . and to fulfill its obligations as a MSHSL [Minnesota State High School League] - member school to impose the MSHSL-mandated penalty. Equally significant, pursuant to the release signed by [X] and [X's] parent, they consented to the School District's documentation and use of such admissions in connection with the eligibility determination.

The Commissioner has examined the document Mr. Madsen provided entitled 2006-2007 MSHSL Athletic Eligibility Statement. It appears to have been created by the MSHSL and was signed by X and X's parent(s). It discusses the Student Code of Responsibilities. Of relevance here, the document contains the following statement, The student/parent authorizes the release of documents and other pertinent information by the school in order to determine student eligibility.

As the Commissioner previously has opined, an individual cannot consent to have certain data released if s/he does not know what data will be released. When X and his/her parent signed the consent document, the data at issue in this opinion had not yet been collected from X. In Advisory Opinion 04-009, the Commissioner wrote, In the present case, X was asked to sign the informed consent before GFA collected data about him/her. Therefore, the Commissioner opines that GFA violated X's rights by having him/her give informed consent before X knew what data GFA would be collecting from X.

Thus, because the consent signed by X does not seem valid, and the District apparently did not provide a Tennsessen warning notice when it collected certain private data from X about X, pursuant to section 13.04, subdivision 4, the District did not comply with Chapter 13 when it used those data.

---

Opinion:

Based on the facts and information provided, my opinion on the issues that Mr. Becker raised is as follows:

Independent School District 720, Shakopee, did not comply with Minnesota Statutes, Chapter 13, when it collected private data about a student from the student without providing the Tennessen warning notice required by section 13.04, subdivision 2. Because Independent School District 720, Shakopee, did not provide a Tennessen warning notice when it collected private data about the student from the student, it did not comply with Minnesota Statutes, Chapter 13, when it used data it collected from the student.

Signed:

Dana B. Badgerow
Commissioner

Dated: March 9, 2007

---