*With special thanks to Kara Millonzi and Elsemarie Mullins
As local governments wrestle with administering American Rescue Plan Act (ARPA)-funded programs, the Low-Income Household Water Assistance Program (LIHWAP) has prompted public records and confidentiality questions. To administer LIHWAP, state and local Department of Health and Human Services (DHHS) agencies are requesting that local governments provide the names, addresses, social security numbers, utility account numbers, and utility account balances of qualifying residents. With this information, DHHS can verify residents’ identities to seamlessly make payments with minimal inconvenience. Local governments want to help, but can they?
Is Public Enterprise Billing Information Public Record?
The question of what information local governments may disclose to participate in LIHWAP implicates Section 132-1.1(c) of state public records law. This subsection excludes public enterprise billing information from the definition of a public record. Names, addresses, social security numbers, utility account numbers, and utility account balances fit squarely within that exclusion.
While subsection (c) notes that billing information is not public record, nothing in the subsection makes billing information confidential. In fact, the subsection specifically authorizes release in connection with bond issues, public safety issues, and when “necessary to assist the city, county State or public enterprise to maintain the integrity and quality of the services it provides.” LIHWAP does not involve bond or public safety issues, but the third authorized disclosure could apply. COVID-19 has caused a significant increase in delinquencies and lost revenue for utilities, potentially undermining their ability to provide services at pre-pandemic levels. Substantially increased delinquencies may constitute a necessary release under this subsection, but without judicial interpretation, the outcome of this argument is unclear.
Even if none of the authorized disclosures apply, this list is likely not exhaustive. My colleague Kara Millonzi has argued that the legislature likely did not intend this list to be exclusive, a position that the legislative history of Section 132-1.1(c) supports. The House subcommittee explicitly noted that nothing in this subsection was intended to limit the disclosure of billing information. Both the statute’s text and its history indicate that local governments are permitted, but not required, to release residents’ names, addresses, utility account numbers, and utility account balances.
What about Social Security Numbers?
A threshold consideration is Section 7 of the federal Privacy Act of 1974. Section 5 U.S.C. § 552A(b) only allows disclosure of an individual’s social security number upon written request from or written consent by the individual, with some exceptions. Additionally, subsection (e)(3) of 5 U.S.C. § 552A, as well as N.C. Gen. Stat. 143-64.60(b), require entities collecting social security numbers to notify the individuals of whether the disclosure is mandatory or voluntary, the underlying statutory or other legal authority, and the potential uses of the social security numbers. If local governments did not notify residents that their social security numbers may be used for public assistance purposes, these sections likely prohibit releasing this information without residents’ written consent.
Additionally, social security numbers are explicitly confidential pursuant to N.C. Gen. Stat. § 132-1.10. Section 132-1.10(b)(5) generally prohibits releasing social security numbers with some key exceptions. For example, subsection (c)(1) indicates that social security numbers may be released “…to another governmental entity or its agents, employees, or contractors if disclosure is necessary for the receiving entity to perform its duties and responsibilities.” Under Title V, Section 533 of the Consolidated Appropriations Act and Subtitle K, Section 2912 of the American Rescue Plan Act, DHHS is responsible for the administration of LIHWAP and has a legal duty to make LIHWAP grants available to the states. See P.L. 116-260, Title V, Sec. 533; P.L. 117-2, Subtitle K, Sec. 2912. Social security numbers are potentially necessary for DHHS to carry out these duties in order to facilitate effective identity verification for payments. The success of this argument is difficult to predict, but tying the release of social security numbers to specific statutory responsibilities and duties may be helpful to successfully assert this exception.
Even without an exception, however, the statute gives some indication that local governments may permissibly release social security numbers to DHHS as another governmental agency. Section 132-1.10(b)(5) specifically prohibits release to “the general public”, prompting the question, are local or state government agencies “the general public”?
As is clearly the theme with this post, our courts have not explicitly answered that question. However, Section 132-1.10(a)(3) states that governments should minimize the dissemination of social security numbers “either internally within government or externally with the general public.” The plain language of this subsection distinguishes between the government and the general public and denotes two separate categories of disclosure – one within government and one to the general public. As a result, the statutory language provides some support that releasing social security numbers to another government agency does not constitute a release to the general public.
Can Data Sharing Agreements Help with Releasing Social Security Numbers?
Data sharing agreements help to ensure that confidential information remains protected. Some statutes that exclude information from the definition of a public record or make information confidential specifically allow for or even require data sharing agreements to facilitate disclosure. (See N.C. Gen. Stat. § 115C-402.5(b)(2)(a)(4) and N.C. Gen. Stat. § 147-86.73(i) for examples). Here, however, there is no such statutory allowance for data sharing agreements. Consequently, while data sharing agreements may be useful to ensure the confidentiality of this information after disclosure, it is not clear under the statute that the agreements can change the nature of the information to allow for its release.
How Can Local Governments Proceed?
Since public utilities can release residents’ names, addresses, and utility account numbers and balances even without residents’ consent, the main roadblock to LIHWAP participation is the disclosure of residents’ social security numbers. One alternative approach would be to allow local governments to verify residents’ identities themselves. This process might entail a greater administrative burden for local governments, but it would also eliminate any confidentiality issues. Local governments could also seek individuals’ permission to release their social security numbers. Written consent from residents allows for release under both federal and state law.
Without written consent, social security numbers are likely confidential, but an exception may apply, and releases to other governmental agencies may be permitted under the statute. While there does not appear to be statutory authority for releasing social security numbers using a data sharing agreement, such agreements might still be helpful to protect local governments. Data sharing agreements should likely specify why social security numbers are necessary for DHHS to perform its legal duties and responsibilities. The agreements should also cite to the specific statutory duties and responsibilities prompting the need for individuals’ social security numbers. These contractual assurances may bolster local governments’ arguments for the Section 132-1.10(c)(1) exception.
