The opinion of the court was delivered by: H. LEE SAROKIN
Plaintiffs, students at Rutgers University, representing themselves in a highly competent and thoughtful manner, challenge the collection and use of social security numbers by the university. Although the court determines herein that the university has the right to request and to utilize the social security numbers of its students, there is evidence that the confidentiality promised and required has been and will continue to be breached. Such future breaches must be enjoined.
The law does not prohibit the collection and use of social security numbers by Rutgers University, but it does prohibit their unauthorized dissemination, because of the vast source of personal information for which they provide access. Therefore, although plaintiffs' victory herein is partial, they have provided a much needed message to university officials of the existence of and potential for the disclosure of this confidential source of highly personal information.
Before the court is plaintiff's motion for a preliminary injunction; defendants' motion to dismiss the Complaint against Dr. Lawrence; plaintiffs' motion to amend the Complaint with respect to Dr. Lawrence; and plaintiffs' application for class certification.
On April 20, 1992, plaintiffs filed an Order to Show Cause why a preliminary injunction should not issue enjoining defendants from requesting social security numbers from students of Rutgers University for general administrative purposes without notification in accordance with the Privacy Act of 1974 that the disclosure thereof is voluntary. At the same time, plaintiffs filed a motion for a preliminary injunction, which the Order to Show Cause purports to incorporate, seeking an order enjoining the defendants from: (1) "denying to any student any benefit or access to administrative or educational functions if they decline to provide the social security number;" and (2) "disseminating the social security numbers of students already on file to any persons within or without of the University unless the university has been authorized by the statute to collect and maintain the social security numbers, specifically, in the case of employment records and federal financial aid records, and in the case of those records, only to disseminate them to the extent required by law."
Plaintiffs based this request for relief upon their filed Complaint, which alleges that Rutgers' collection and use of student social security numbers violates section 7 of the "Privacy Act," 5 U.S.C. § 555a, Historical Note.
Defendants filed opposition to plaintiffs' application, and on May 11, 1992, the court heard argument on the matter. During the course of the hearing, the parties advised the court that plaintiffs may have claims under the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232g, thereby providing an additional basis for at least some of plaintiffs' requested relief. Plaintiffs indicated their intention to amend the Complaint in order to assert FERPA claims. Accordingly, the court reserved judgment on plaintiffs' pending application for preliminary relief and advised the parties that it would rule on the application after plaintiffs had amended the Complaint and the parties had briefed the issue of the propriety of the requested relief given plaintiffs' FERPA claims.
Plaintiffs then filed their Verified First Amended Complaint and a subsequent Verified Second Amended Complaint (hereinafter "Amended Complaint"), a Motion to Amend the Complaint, a Supplemental Brief in Support of Plaintiffs' Motion for a Preliminary Injunction and to Amend the Complaint, and several supporting certifications. The Amended Complaint alleges that defendants violate FERPA, thereby depriving plaintiffs of "a right secured by the laws of the United States, in violation of 42 U.S.C. § 1983."
By letter dated June 9, 1992, counsel for the defendants advised the court that defendants did not object to the Amended Complaint except to the extent that it names Dr. Francis Lawrence, President of Rutgers, as a defendant. Thus, defendants object to the Amended Complaint naming Dr. Lawrence as a defendant, and cross-move to dismiss the original Complaint as against Dr. Lawrence. In addition, defendants have filed a Supplemental Brief in Opposition to Plaintiffs' Application for a Preliminary Injunction in which defendants' reject the applicability of plaintiffs' newly asserted FERPA claims. Plaintiffs' application for a preliminary injunction is now ready for disposition.
The court also notes that on April 20, 1992, upon the filing of plaintiffs' original Complaint, plaintiffs filed a motion for class certification at the same time that they filed their request for an Order to Show Cause and motion for a preliminary injunction. The Order to Show Cause does not refer to the motion for class certification, and defendants have not yet responded to that pending motion because the Clerk's Office listed the motion as an "application," which means that the court itself must advise the parties when and if the court will hear argument on the application.
Accordingly, currently before the court are: (1) plaintiffs' application for a preliminary injunction based on the claims asserted in the Amended Complaint; (2) defendants' motion to dismiss the original Complaint as against Dr. Lawrence; (3) plaintiffs' motion to amend the Complaint and name Dr. Lawrence as a defendant; and (4) plaintiffs' application for class certification.
Plaintiffs are seven
current and former undergraduate students of Rutgers University. They originally filed this suit pursuant to section 7 of the Privacy Act of 1974, Pub L. 93-579, which provides:
(a)(1) It shall be unlawful for any Federal, State or local government agency to deny any individual any right, benefit or privilege provided by law because of such individual's refusal to disclose his social security account number.
(b) Any Federal, State or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.
Historical Note, 5 U.S.C.A. § 552a (West 1977).
The Amended Complaint also asserts claims pursuant to the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232(g), which provides, inter alia :
No funds shall be made available under any applicable program to any educational agency or institution which has a policy or practice of permitting the release of education records (or personally identifiable information, as defined in paragraph (5) of subsection (a) of this section) of students without the written consent of their parents to any individual, agency, or organization, other than to the following -- . . . .
20 U.S.C. § 1232g(b)(1). The statute goes on to list nine categories of persons and/or agencies to whom/which education records and personally identifiable information may be released.
The relevant facts generally are not in dispute (except where otherwise noted). Plaintiffs acknowledge that Rutgers is entitled to and indeed required to obtain the social security numbers of students who have university jobs (for Internal Revenue Service reporting) and who receive Federal Student Financial Aid. (The university estimates that 40% of Rutgers students receive financial aid, while 20% are employed by the university. Buck Cert. P4; Fehn Cert. P4.) However, plaintiffs challenge Rutgers' general collection and use of student social security numbers without prior notification (1) that the students' disclosure of their numbers is voluntary, and (2) of the various uses to which the social security numbers will be put. Cplt. PP7-8. Plaintiffs allege that the "defendants also may deny to students, rights, benefits, and privileges if they fail to provide their SSNs [social security numbers] for these general administrative activities." Cplt. P7. The general administrative activities for which Rutgers uses the numbers include use of the students' social security numbers "as the prime means of student identification for general administrative and educational recordkeeping purposes, including class registrations and changes thereto, meal privilege identifications, the printing of classroom rosters and the issuance of final grades, and various other purposes." Cplt. P5. See also Fehn Cert. Exh. A (listing all the uses for which student social security numbers are used).
In opposition to plaintiffs' contentions, university officials state:
University policy and practice prohibits and discourages distribution of class rosters with SSNs to anyone other than faculty and administrators. University policy also prohibits and discourages posting of names with grades.
Norman Cert. P5. However, as recounted in the Certification of Rodney Hartnett, Associate University Vice President for Academic Affairs:
Although I do not believe it is a common practice, some faculty members (probably in large classes) might circulate the roster list throughout class to assure that the student registration for each class is correct, or possibly to take attendance.
Hartnett Cert. P7. Rutgers offers no explanation for how the plaintiffs obtained a copy of an apparent actual class roster listing students names and social security numbers, nor does Mr. Norman's Certification respond to the obvious concern that once a social security number is linked to a name, posting grades by number rather than name does not adequately address plaintiffs' concerns.
Defendants apparently concede that such a practice would violate FERPA if this were a policy or custom of the University, an assertion which defendants dispute. Nonetheless, the University appears to be unwilling to curtail any possible individual violations of this type absent court direction. According to Vice President Hartnett:
If the Court has concerns about the occasional circulation of class roster lists (to verify registration or take attendance), the University would be willing to issue a memorandum with class rosters in September advising faculty members to cut off or delete student identification numbers from any class rosters circulated in the classroom.
Hartnett Cert. P10. Mr. Hartnett does not address why the University has not yet issued such a memorandum in light of plaintiffs' complaints, similar to the memorandum issued with respect to the posting of grades with names. See id. at P5 and Exh. A.
In the past, Rutgers issued a six-digit student identification number to each incoming student, and plaintiffs propose a return to the six-digit number as a viable alternative to the increasing use and dissemination of social security numbers. Plt. Brief at 10. Rutgers has submitted Certifications of various university officials which respond that use of the social security number facilitates various aspects of university administration and decreases incidence of administrative errors which can cause great hardship to many students, such as verification of financial aid, delay in processing applications, etc. See Fehn Cert.; Iuso Cert. P4; Norman Cert. PP3-4.
These officials further indicate that any student can request a "dummy" nine-digit social security number to be used as his or her identification number, and thus, no student has been denied any services as the result of refusal to provide their social security number. Norman Cert. P7. The officials estimate that in fact, less than six students per year make such a request. Iuso Cert. P5. Rutgers does not indicate that students are routinely advised of their right to make this request. Rather, plaintiffs represent that this is the first they have heard of the "dummy" option, and that the availability of a "dummy" number has never been publicized to the student body. Plt. Reply Brief at 9.
Of further note, university officials indicate that from 1987 to 1990, the following disclaimer appeared on all Rutgers undergraduate admissions materials: