Could South Carolina First Steps require families to provide Social Security numbers to receive its services?

Plain-English summary

In 2007, the South Carolina Attorney General considered whether First Steps to School Readiness could require participants to provide Social Security numbers as a condition of receiving services. He thought a court would likely find First Steps was not a government agency under Section 7 of the federal Privacy Act, despite its public funding and public officials on its board. The opinion emphasized that the agency-status question required facts about actual government control of its day-to-day operations and ultimately belonged to a court.

The AG also identified disagreement among federal courts over whether the Privacy Act applied to state and local agencies. He assumed it could apply for purposes of the opinion. If a court found First Steps covered, requiring a Social Security number without an applicable exception could violate Section 7. The AG therefore advised First Steps to comply with that provision despite his tentative view of its status.

Currency note

This opinion was issued in 2007. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Did the AG decide First Steps could require a Social Security number? A: He thought a court would likely find First Steps outside the federal Privacy Act's agency definition, but expressly left that factual decision to a court and warned that the requirement could violate the Act if a court ruled otherwise.

Q: Why did public funding not settle First Steps' status? A: The opinion said funding alone did not make a private nonprofit an agency; it focused on whether government exercised extensive control over daily operations.

Q: What would Section 7 require if it applied?
A: The opinion described a general bar on denying a benefit for refusing to disclose a Social Security number, subject to stated exceptions. For a request not made mandatory under an exception, it said the person had to be told whether disclosure was voluntary and how the number would be used.

Background and statutory framework

The opinion followed a February 2007 AG opinion that found no state-law prohibition on collecting First Steps client data but cautioned about state privacy law. This follow-up analyzed Section 7 of the federal Privacy Act, First Steps' nonprofit structure, and the degree of state or federal operational control. It noted conflicting federal appellate decisions about state agencies and expressly declined to resolve First Steps' actual agency status.

Citations and references

Federal law: Privacy Act of 1974, Pub. L. No. 93-579, 88 Stat. 1896, Section 7.

State statute: S.C. Code Ann. § 20-7-9700.

Cases: Schmitt v. City of Detroit, 395 F.3d 327 (6th Cir. 2005); Schwier v. Cox, 340 F.3d 1284 (11th Cir. 2003).

Source

• Landing page: https://www.scag.gov/opinions/opinions-archive/march-28-2007-6/
• Original PDF: https://www.scag.gov/wp-content/uploads/2011/03/wouri-d-3-28-07-os-8368-first-steps-client-data-federal-privacy-act.pdf

Original opinion text

March 28, 2007

Dan Wouri, South Carolina Readiness Officer
South Carolina First Steps
Concord Building, Suite 100
1300 Sumter Street
Columbia, South Carolina 29201
Dear Mr. Wouri:
We issue this opinion as a follow-up to an opinion issued to you on February 28, 2007. In that opinion, we addressed questions submitted by you regarding First Steps to School Readiness Initiative’s (“First Steps’”) ability to gather information about individuals benefitting from First Steps’ programs. One of your questions asked “whether there are legal prohibitions against First Steps’ requiring the provision of complete client data (first name, date of birth, gender, race, social security number and Medicaid number, if applicable) as a condition of receiving First Steps’ programming?” We analyzed this question under South Carolina law and found no provision of state law prohibiting the gathering of such information. Furthermore, we concluded based on our understanding of the legislation creating First Steps, the Legislature intended the gathering of such information to evaluate the impact of First Steps’ programs on the communities it serves. However, we also cautioned that First Steps must comply with provisions of South Carolina’s Family Privacy Protection Act. Upon further consideration of this matter, we feel we must also caution you as to the implications of federal law as well and particularly the provisions of the federal Privacy Act, which could prohibit First Steps from requiring its program participants to give their social security numbers in order to participate in First Steps’ programs. Law/Analysis As we stated in a prior opinion, “[t]he purpose of the federal Privacy Act is to curtail the growing use of social security numbers as a universal identifier, to discourage improper use of the number, to eliminate the encroachment on privacy, to provide individuals with the opportunity to make an intelligent decision whether to disclose the number, and, with some exceptions, to allow the individual the option to refuse disclosure without repercussions.” Op. S.C. Atty. Gen., July 5, 1996 (citing Yeager v. Hackensack Water, 615 F.Supp. 1087 (D.N.J. 1985); Doyle v. Wilson, 529 F.Supp. 1343 (D.Del. 1982)). Section 7 of the federal Privacy Act provides:

Mr. Wouri
Page 2
March 28, 2007

(a)(1) It shall be unlawful for any Federal, State, or local government agency to deny any individual any right, benefit or privilege provided by law because of such individual’s refusal to disclose his social security number. (2) The provisions of paragraph (1) of this subchapter shall not apply with respect to - (A) any disclosure which is required by Federal Statute, or (B) the disclosure of a social security number to any federal, state, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual. (b) Any Federal, State or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by which statutory or other authority such number is solicited, and what uses will be made of it. Privacy Act of 1974, Pub. L. No. 93-579, 88 Stat. 1896. This provision is contained in the notes to section 552a of title 5 of the United States Code, but was not codified with other provisions of the federal Privacy Act in section 552a. The fact that Congress did not chose to codify section 7 lead to much discussion about its application. However, the federal courts addressing this issue upheld the application of these provisions relying on the principle that the Statutes at Large prevail over the United States Code even if a portion of the Statutes at Large are omitted from the United States Code. See, eg., Schmitt v. City of Detroit, 395 F.3d 327 (6th Cir. 2005). Thus, the provisions of the federal Privacy Act contained in section 7 are presumed valid and retain the force of law. Recognizing section 7's enforceableability, we must consider its impact on First Steps’ ability to gather the social security numbers of its participants. In order to accomplish that task, we must consider whether First Steps’ is a state agency within the meaning of the Privacy Act. Section 552a contains a list of defined terms, which includes a definition for the term “agency.” 5 U.S.C.A. § 552a(a)(1). However, instead of separately defining the term, the federal Privacy Act refers to the definition of “agency”contained in section 552(e) of the federal Freedom of Information Act. Id. Section 552 states this term “defined in section 551(1) of this title includes any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of

Mr. Wouri
Page 3
March 28, 2007
the President), or any independent regulatory agency . . . .” 5 U.S.C.A. § 552(f). Section 551(1) defines agency as each authority of the Government of the United States, whether or not it is within or subject to review by another agency, but does not include-(A) the Congress; (B) the courts of the United States; (C) the governments of the territories or possessions of the United States; (D) the government of the District of Columbia; or except as to the requirements of section 552 of this title-(E) agencies composed of representatives of the parties or of representatives of organizations of the parties to the disputes determined by them; (F) courts martial and military commissions; (G) military authority exercised in the field in time of war or in occupied territory; or (H) functions conferred by sections 1738, 1739, 1743, and 1744 of title 12; chapter 2 of title 41; subchapter II of chapter 471 of title 49; or sections 1884, 1891-1902, and former section 1641(b)(2), of title 50, appendix; Thus, this definition does not appear to address what constitutes a “[s]tate or local government agency” referred to in section 7 above. Some federal courts considering whether particular organizations are agencies look solely to federal involvement in the organization’s activities. The Ninth Circuit Court of Appeals in St. Michael’s Convalescent Hospital v. State of California, 643 F.2d 1369 (9th Cir. 1981), considered whether California’s Department of Health Services (“DHS”), the administrator of California’s Medicaid Program, is an agency under the federal Privacy Act. The Court considered the fact that DHS receives federal funding and is highly regulated by the federal government. Id. at 1374.

Mr. Wouri
Page 4
March 28, 2007
However, the appellants do not contend nor does it appear that the federal government exercises the “extensive, detailed and virtually day-to-day supervision” over the program that is needed to characterize the state bodies as federal agencies. Thus we agree with the district court that neither the DHS nor the Commission are “agencies.” Id. Relying partly on St. Michael’s Convalescent Hospital, the Superior Court of New Jersey concluded a municipality’s public housing program was not an agency for purposes of the federal Privacy Act. Lakewood Residents Ass’n, Inc. v. Township of Lakewood, 682 A.2d 1232 (N.J.Super. Ct. Law Div. 1994). The Court pointed out that just because an entity is funded by federal grants, does not cause it to obtain “agency” status. Id. In addition, in looking at section 551(1) and 552(f) of title 5 of the United States Code, that Court noted: “Nowhere within either definition is it even remotely implied that a local governmental body or agency thereof is to be construed as a federal agency.” Id. at 1236. In accordance with these principles and based on the fact that the Court found no evidence of daily involvement of federal government in the housing program’s operations, the Court determined it did not constitute an agency for purposes of the federal Privacy Act. Id. More recently, the United Stated District Court for the District of New Jersey considered the ambiguity between section 7 of the Privacy Act, section 552a, and the federal Freedom of Information Act. Krebs v. Rutgers, 797 F.Supp. 1246 (D.N.J. 1992). That Court recognized “most of the case law which interprets the scope of sections 552a, 552(e), and 551(1) does not differentiate between the potentially varied considerations of what constitutes a state or local ‘agency.’” Id. at 1253. Thus, the Court employed the following test used by other courts in determining whether an agency existing under the federal Freedom of Information Act and the other provisions of the federal Privacy Act: “An entity has FOIA or Privacy Act agency status if the government is involved in and/or has authority over decisions affecting the ongoing, daily operations of the entity.” Id. Employing this test, the Court considered whether Rutgers University is a state agency and thus, is prohibited from collecting and using students’ social security numbers. Id. The Court considered the fact that Rutgers is a state chartered institution, receives state appropriations, and is required to abide by state laws and regulations. Id. at 1256. However, the Court also considered the vast authority of Rutgers’ Board and provisions in its enabling legislation indicating the Legislature’s intent to allow it to be a self-governing institution. Id. at 1255. Thus, based on the Court’s review of Rutgers’ government involvement, it concluded “although there are many aspects of Rutgers’ operations which touch and/or intersect with the State, the overall effect is an independent institution divorced from direct, let alone day-to-day control.” Id. at 1255. While it is possible that First Steps may receive federal funds through federal grant programs, in our research, we found no evidence that First Steps is subject to daily supervision and control by the federal government. Thus, we do not believe First Steps satisfies the definition of a federal

Mr. Wouri
Page 5
March 28, 2007
agency under sections 552(e) or 551(1) of title 5. However, employing the District Court’s analysis in Krebs, we also consider whether First Steps could be considered a state agency. As we explained in our previous opinion, the Legislature created First Steps through its enactment of statutes contained in title 59 of the South Carolina Code. Section 59-152-40 of the South Carolina Code (2004) provides that First Steps’ Board of Trustees (the “Board of Trustees”), established pursuant to section 20-7-9700 of the South Carolina Code (Supp. 2006), shall oversee First Steps. Section 20-7-9700 establishes the Board of Trustees as an eleemosynary corporation. S.C. Code Ann. § 20-7-9700. According to the provisions contained in title 20, the Governor chairs the Board of Trustees. S.C. Code Ann. § 20-7-9710 (Supp. 2006). The State Superintendent of Education, the Chairman of the Senate Education Committee, and the Chairman of the House Education and Public Works Committee, as well as the chief executive officer of the Department of Social Services, Department of Health and Environmental Control, Department of Health and Human Services, Department of Disabilities and Special Needs, Department of Alcohol and Other Drug Abuse Services, Department of Transportation, Budget and Control Boards, Division of Research and Statistics, and the State Board for Technical and Comprehensive Education, serve on the Board of Trustees along with a number of members appointed by the Governor, the President Pro Tempore of the Senate, and the Speaker of the House of Representatives. Id. In addition to the Board of Trustees, First Steps’ enabling legislation calls for the creation of County First Steps Partnerships. S.C. Code Ann. § 59-152-60 (2004). The enabling legislation requires these County Partnerships be organized as private nonprofit corporations. S.C. Code Ann. § 59-152-70(E) (2004). Section 59-152-10 of the South Carolina Code (2004), establishing First Steps, describes it as “a comprehensive, results-oriented initiative for improving early childhood development by providing, through county partnerships, public and private funds and support for high-quality early childhood development and education services for children by providing support for their families’ efforts toward enabling their children to reach school ready to learn.” (emphasis added). This provision, as well as numerous other provisions in First Steps’ enabling legislation, contemplate that First Steps will, as least in part, be funding through public funds from both the State and local governments. See S.C. Code Ann. § 59-152-70(C) (stating County First Steps Partnerships may receive federal, state, and local funds). While First Steps’ enabling legislation indicates it is funded, at least in part, by public funds, the legislation also is clear that First Steps’ Board of Trustees and First Steps affiliated County Partnerships are private nonprofit corporations. Federal courts considering whether nonprofit and other private entities receiving federal funds are agencies within the meaning of the federal Privacy Act concluded that the receipt of federal funds does not create an agency. See Sutton v. Providence St. Joseph Medical Center, 192 F.3d 826 (9th Cir. 1999); Unt v. Aerospace Corp., 765 F.2d 1440, 1448 (9th Cir. 1985). Rather, the focus of federal court’s analysis lies with whether the state government has extensive supervision and control over the entity. Unt, 765 F.2d at 1448. Thus, the receipt of funds from the State does not automatically establish First Steps as an agency for purposes of the federal Privacy Act.

Mr. Wouri
Page 6
March 28, 2007
The fact that the Legislature established First Steps by statute and the fact that the Board of Trustees consists of public officials and those appointed by public officials may support an argument that First Steps is indirectly supervised and controlled by the State. But, in our review of First Steps’ enabling legislation, the only evidence of the State’s direct supervision over and involvement in First Steps’ operations is a provision requiring the Board of Trustees to annually submit a report to the Legislature on its activities and progress. S.C. Code Ann. § 20-7-9720(10) (Supp. 2006). In our opinion, this would not amount to the extensive day to day supervision contemplated by the federal courts in their determination of whether an entity is an agency for purposes of the federal Privacy Act. However, we acknowledge that the determination of whether the State exerts sufficient involvement in and control over First Steps’ daily activities would require an extensive investigation into First Steps’ operations. “The investigation and determination of factual issues must be left to a court.” Op. S.C. Atty. Gen., January 29, 2007. Thus, while we believe First Steps does not meet the requirements of a state agency under the federal Privacy Act, such a determination must be left to a federal court to decide. In addition to our belief section 7 of the federal Privacy Act does not apply to First Steps as it is not a state agency, we also note the contention by at least one federal court that the Privacy Act does not apply to state agencies. In Schmitt v. City of Detroit, 395 F.3d 327 (6th Cir. 2005), a recent decision by the United States Court of Appeals for the Sixth Circuit, the Court took a different approach than previous courts in addressing the apparent conflict between the definition of agency, which appears only to encompass federal agencies and section 7 of the Privacy Act, dealing with state and local agencies. The Court considered whether a city is liable under the Privacy Act for failure to include disclosure notices on requests for social security numbers as is required by section 7 of the Privacy Act. Id. The Court found: The statutory definition of an agency found at § 552a(a)(1) contains no language to indicate that it does not apply to the Privacy Act as a whole. Were we to hold that § 7(b) applies to state and local agencies, we would effectively say that an unambiguous definition of a core term, which itself was promulgated by Congress, Pub.L. 93-579 § 3, 88 Stat. 1897, applies only part of the time. This we will not do. Id. at 330. Furthermore, the Court looked to the legislative history of the Privacy Act finding it supports the Court’s conclusion that the Privacy Act only applies to federal agencies. Based on this analysis, the Court concluded: The fact that the Privacy Act contains a section that defines the term “agency” as including only those agencies that fall under control the federal government, coupled with a legislative history that supports such a reading of its scope, forces us to conclude that-notwithstanding

Mr. Wouri
Page 7
March 28, 2007
the codification of § 7(b)-the Privacy Act applies exclusively to federal agencies. Id. at 331. Nonetheless, prior to the Sixth Circuit’s opinion in Schmitt, the Eleventh Circuit determined the Privacy Act applies to state agencies. In Schwier v. Cox, 340 F.3d 1284 (11th Cir. 2003), the Eleventh Circuit addressed whether plaintiffs could bring a private right of action under section 1983 against the Secretary of State for the State of Georgia due to a requirement that those registering to vote must include their social security number on their application. Thus, federal circuit courts do not appear unanimous on the issue of whether the Privacy Act applies to state and local agencies. Furthermore, in prior opinions of this Office, while not specifically addressing the application of section 7 of the federal Privacy Act to state and local agencies, we presume its application. See Ops. S.C. Atty. Gen., June 1, 1999 (stating the federal Privacy Act prevents the Department of Natural Resources from requiring social security number for watercraft registration); July 5, 1996 (concluding the South Carolina Department of Corrections is prohibited under the federal Privacy Act from requiring the social security numbers of persons visiting inmates in State prisons). Given the apparent conflict among federal courts as to whether the federal Privacy Act is applicable to state and local agencies and the fact that we recognize its application in prior opinions, for purposes of this opinion, we again presume the Privacy Act applies to state and local agencies. Accordingly, despite our belief that First Steps is not an agency and therefore, is not subject to section 7 of the Privacy Act, we find it important to consider the impact of section 7, should a court rule otherwise. As quoted above, section 7 generally prohibits state agencies from requiring the participants in its programs to give their social security numbers. However, section 7 contains two exceptions to this prohibition. One exception applies if disclosure of an individual’s social security number is required by federal law. In our research, we did not uncover a federal law mandating the release of social security numbers for those participating in programs such as those provided by First Steps. The other exception involves state agencies requiring the disclosure of social security numbers as requiring by statute or regulation prior to 1975. Because the Legislature created First Steps in 1999, we do not believe this exception applies. Thus, if a court were to find First Steps is a state agency and First Steps desires to requests the participants in its programs to disclose their social security numbers, it must inform those individuals that the request is voluntary and for what their social security number may be used. Conclusion The determination of whether First Steps is an agency under the federal Privacy Act, making the provision of section 7 of the Privacy Act applicable, is a factual determination best left to the courts to decide. However, in our review of the legislation creating First Steps, we believe a court likely would hold First Steps is not an agency and thus, is not prohibited from requiring the participants in its programs to provide their social security numbers in exchange for participation in

Mr. Wouri
Page 8
March 28, 2007
its programs. Nonetheless, should a court determine otherwise, First Steps may be held in violation of the Privacy Act if it requires the participants in its programs to provide their social security numbers in exchange for the privilege of receiving First Steps’ services. Thus, we find it advisable for First Steps to comply with the provisions of the federal Privacy Act despite the possibility that it may not apply at all to state and local agencies and our belief that First Steps would not be considered a State agency for purposes of the Federal Privacy Act. Very truly yours, Henry McMaster Attorney General

By:

REVIEWED AND APPROVED BY:

______
Robert D. Cook
Assistant Deputy Attorney General

Cydney M. Milling
Assistant Attorney General