Could Connecticut health officials obtain grocery loyalty-card customer data during a foodborne illness outbreak without consent?

Plain-English summary

In 2008, Connecticut Attorney General Richard Blumenthal concluded that health officials investigating a foodborne illness outbreak could obtain customer identifying information from retail food stores without first getting each customer's consent. Purchase records from a store card could help identify who bought a contaminated product and when. The opinion said the data had to assist the outbreak investigation or control effort, and the health department had to keep it confidential.

The AG found authority both for the state Department of Public Health and for local health directors under their own regulations. He said the department had no subpoena power for these records, but could ask a court to compel a retailer that refused to provide needed information.

Currency note

This opinion was issued in 2008. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

State and local health officials at the time

The opinion read the regulation's authority to secure "all such data as may assist" in outbreak control to include useful retail customer records. It said local directors already had their own regulatory authority and did not need a separate delegation from the state department. Both state and local officials had to maintain confidentiality.

Retail food establishments and customers at the time

The opinion treated store-card purchase and identification data as potentially useful to finding the source of a foodborne outbreak. It did not require individual customer permission before health officials obtained that data for this purpose. The AG expressly said the Department remained obligated to keep the information confidential under Conn. Gen. Stat. § 19a-215(d).

Common questions

Q: Could Connecticut health officials request grocery customer names without consent during an outbreak?
A: The 2008 opinion said yes when the records could assist investigation or control of a foodborne illness outbreak. It also said the information had to remain confidential.

Q: Did local health directors need the state's permission first?
A: No separate delegation was needed, according to the AG, because the local health director's regulation already granted authority to secure useful outbreak data.

Q: Could the Department of Public Health subpoena a retailer's customer records?
A: The AG said it had no statutory subpoena power for this. If a retailer refused needed records, the department could seek a Superior Court order compelling production.

Q: Did the opinion permit public release of customer identities?
A: No. It identified a statutory confidentiality duty for information obtained during the outbreak investigation.

Background and statutory framework

The public health department asked four questions about obtaining retail customer and product records, consent, local health authority, and compulsory process. The AG read Conn. Gen. Stat. § 19a-215 together with regulations on reportable diseases and outbreak control. He also cited the commissioner's power under § 19a-2a(8) to secure data for preventing and controlling epidemics.

For a retailer's refusal, the opinion distinguished access authority from subpoena authority. It said the department could seek a court order, while confidentiality under § 19a-215(d) continued to govern the information it obtained.

Citations and references

Statutes and regulation cited in the opinion: Conn. Gen. Stat. § 19a-215; Conn. Gen. Stat. § 19a-2a(8); Conn. Gen. Stat. § 19a-215(d); RCSA §19a-36-A6.

Case cited in the opinion: Stepney, LLC v. Town of Fairfield, 263 Conn. 558, 821 A.2d 725 (2003).

Source

• Landing page: https://portal.ct.gov/AG/Opinions
• Opinion page: https://portal.ct.gov/ag/opinions/2008-formal-opinions/honorable-j-robert-galvin-md-mph-mba-formal-opinion-2008006-attorney-general-state-of-connecticut

Original opinion text

Honorable J. Robert Galvin, M.D., M.P.H., M.B.A., Formal Opinion 2008-006, Attorney General State of Connecticut

Attorney General's Opinion

Attorney General, Richard Blumenthal

April 25, 2008

Honorable J. Robert Galvin, M.D., M.P.H., M.B.A.

Department of Public Health

410 Capitol Avenue

Hartford, CT 06134

Dear Commissioner Galvin:

Your department has requested an opinion from this office regarding the following questions:

1. What is the authority of the Commissioner of the Department of Public Health to obtain customer identifying information and related product information from a retail food establishment in order to investigate or control a foodborne illness outbreak?

2. Is the consent of the customer required in order for the Department to obtain said information?

3. What is the Department’s ability to delegate this authority to local health authorities?

4. Does the Department have the ability to obtain a court order or subpoena for customer identifying information from retail food establishments.

It is the opinion of this office that the Department has the authority to obtain, without customer consent, customer identifying information from retail food establishments in connection with a foodborne illness outbreak. Although the Department does not have subpoena power, it may seek a court order compelling production of such information. The Department need not delegate this power to local health authorities because Department regulations already provide local health authorities this power.

I.

Conn. Gen. Stat. § 19a-215 vests the Department with broad authority in protecting the public from foodborne outbreaks. That statute provides in pertinent part that:

When a local director of health or his authorized agent or the Department of Public Health receives a report of a disease or laboratory finding on the commissioner’s list of reportable disease and laboratory findings, either may contact first the reporting health care provider and then the person with the reportable finding to obtain such information as may be necessary to lead to the effective control of further spread of such disease.

Foodborne outbreaks are included in the list of reportable diseases and are defined by RCSA § 19a-36-A1 as follows:

“Foodborne outbreaks” means illness in two or more individuals acquired through the ingestion of common-source food or water contaminated with chemicals, infectious agents or their toxic products. Foodborne outbreaks include, but are not limited to, illness due to heavy metal intoxications, staphylococcal food poisoning, botulism, salmonellosis, shigellosis, Clostridium perfringens intoxication and hepatitis A.

The statutes and regulations give the Department broad power to gather data necessary to protect the public health. Our Supreme Court has noted that “the legislature has vested the commissioner of public health with expansive powers with respect to enacting and enforcing public health law…” Stepney, LLC v. Town of Fairfield, 263 Conn. 558, 821 A.2d 725 (2003). When interpreting statutes, they “…are to be construed in a manner that will not thwart [their] intended purpose…” Commission on Human Rights & Opportunities v. Sullivan Associates, 250 Conn. 763, 778, 739 A.2d 238 (1999). Generally, “statutes whose object is the protection and preservation of the public health” are considered remedial in purpose and therefore are construed liberally. Town of Wallingford v. Dep’t of Pub. Health, 262 Conn. 758, 778, 817 A.2d 644 (2003). Additionally, regulations issued by the Department are given the full force and effect of law. See Hartford Electric Light Co. v. Sullivan, 161 Conn. 145, 154 285 A.2d 352 (1971). The purpose behind the statutes and regulations relating to foodborne illness outbreaks is to protect the public and control further incidents of illness. Those statutes and regulations are, therefore, to be liberally construed.

The Department's regulations delineate the authority of the Department to investigate and control reportable diseases and outbreaks. RCSA §19a-36-A6 provides, in pertinent part, that:

The department, in cooperation with the local director of health, in the investigation and control of reportable disease shall make or cause to be made such investigation as it deems necessary and shall secure all such data as may assist it in establishing adequate control measures.

According to this regulation, the Department shall secure “all such data” as may assist it in controlling a foodborne illness outbreak. “Where the legislature uses a broad term…in an administrative context, without attempting to define that term, it evinces a legislative judgment that the agency should define the parameters of that term on a case-by-case basis. The foregoing applies to regulations which have the force and effect of law. Validly enacted regulations of an administrative agency carry the force of statutory law.” (Citations omitted; quotation marks omitted.) Kiniry v. State Dep’t of Public Health, Superior Court, judicial district of Middlesex at Middletown, Docket No. 980085189 (Hartmere, J.) (May 11, 1999). The term “all such data as may assist” in controlling the foodborne illness outbreak allows the Department to determine, on a case by case basis, which data is necessary to investigate and control a foodborne illness outbreak, including identification of a foodborne illness source. Therefore, according to RCSA §19a-36-A6, the Department is entitled to records from a retail food establishment, such as a grocery store, if that data would assist in control of a foodborne illness outbreak. Information gathered through a customer’s use of a store issued card which might reflect whether or not a certain item was purchased and the date of that purchase is critical information that can assist the Department in controlling a foodborne illness.

Further, Conn. Gen. Stat. § 19a-2a(8) provides that the Commissioner of the Department of Public Health shall have the power and duty to “…secure information and data concerning the prevention and control of epidemics and conditions affecting or endangering the public health and compile such information and statistics and shall disseminate among health authorities and the people of the state such information as may be of value to them.” This broad grant of authority supports the Department's legal right to access customer identifying information from a commercial food establishment in the event of a foodborne illness outbreak if the information would assist the Department in controlling the outbreak and preventing further illness.

We conclude, therefore, that the Department has the authority to secure all data that may assist it in establishing adequate control measures in connection with a foodborne illness outbreak. Therefore, the Department would be entitled to customer identifying records from a retail food establishment in connection with an investigation into such an outbreak.

II.

Responding to the second question presented, the Department has a broad grant of authority to access information relating to an investigation of reportable diseases and outbreaks without receiving the consent of individuals who may be affected by a reportable disease or outbreak. RCSA § 19a-36-A6 specifically allows access to “individual medical information pertaining to cases of reportable disease, persons affected by outbreaks of disease or significant increases in the rate of nonsocomial infection…” The regulation further mandates that this information “shall be provided when requested to an investigator who presents official identification of the department or the local health department.” The regulation does not require the Department to first receive consent from those individuals about whom the Department is obtaining information. Because the customers of a commercial food establishment may be "persons affected by" the outbreak of a foodborne illness, customer identifying data from a commercial food establishment is available to the Department without customer consent in controlling a foodborne illness outbreak.

Given the broad scope of the Department's authority to access private information in connection with the outbreak of a disease or illness, in the event of a foodborne illness outbreak the Department need not obtain customer consent to gain access to customer identifying information from a retail food establishment. However, the Department is under an obligation to keep such information confidential pursuant to Conn. Gen. Stat. § 19a-215(d).

III.

In responding to the third question presented, the Department need not separately delegate its authority to access customer identifying information from a retail food establishment to the local health director because Department regulations already provide the local health director such authority. The relevant regulations refer to both the Department and the local health authority. Specifically, RCSA §19a-36-A6 states that “[t]he department, in cooperation with the local director of health,…shall secure all such data as may assist it in establishing adequate control measures.” Similarly, under RCSA § 19a-36-A8, the local director of health is specifically entitled to “secure all such data as may assist the local director of health in establishing adequate control measures” in connection with an investigation.

Therefore, there is no need for the Department to separately delegate any authority to the local health authority to gain access to customer identifying information from a retail food establishment because the local health director is granted this authority under RCSA § 19a-36-A8. The local health director is similarly obligated to keep such information confidential.

IV.

In response to your fourth question, the Department does not have the statutory authority to subpoena customer identifying information, but may seek a court order to obtain that information.1 Pursuant to Conn. Gen. Stat. § 19a-2a(2), the Commissioner of the Department has the authority to “…adopt and enforce regulations…as are necessary to carry out the purposes of the department as established by statute.” RCSA § 19a-36-A6 specifically allows the department to secure all such data as may assist the department in controlling foodborne illness outbreaks. If a commercial food establishment refuses to provide the department with data necessary to assist in control measures, pursuant to Conn. Gen. Stat. § 19a-2a, the Department should contact my office to pursue an action in Superior Court seeking a court order to compel production of such information.

We trust the foregoing answers your concerns.

Very truly yours,

RICHARD BLUMENTHAL

ATTORNEY GENERAL

Jacqueline S. HoellAssistant Attorney Genera

1 The Uniform Food Drug and Cosmetic Act, Conn. Gen. Stat. § 21a-91 et seq., also gives the Commissioner of Consumer Protection broad powers to protect the public from food that is injurious to the public's health. In instances of any foodborne illness outbreak, the Department of Public Health should immediately contact the Commissioner of Consumer Protection so that both agencies may use their broad powers to protect the public.