To amend title II of the Social Security Act to prohibit the sale, purchase, and display to the general public of the Social Security account number.

Summary: Social Security Number Non-Proliferation Act of 2007 - Amends title II (Old Age, Survivors and Disability Insurance) (OASDI) of the Social Security Act to prohibit the sale, purchase, and display to the general public of an individual's Social Security account number without the individual's voluntary and written consent, with certain law enforcement, national security, public health, and other exceptions.

Makes it unlawful, also, to obtain or use any individual's Social Security number for the purpose of: (1) locating or identifying the individual with the intent to physically injure or harm him or her; or (2) using the individual's identity for any illegal purpose.

Makes it unlawful for any person to communicate to any agency or instrumentality of the United States or of any state or local government the Social Security account number of an individual, other than his or her own, without the individual's written permission, unless the number was requested by the agency or instrumentality.

Prohibits displays of Social Security account numbers on cards or tags required for access to goods, services, or benefits, and displays on employee identification cards or tags.

Prescribes criminal penalties for violations of this Act.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Social Security Number Non-
Proliferation Act of 2007''.

SEC. 2. PROHIBITION OF THE SALE, PURCHASE, AND DISPLAY TO THE GENERAL 
              PUBLIC OF THE SOCIAL SECURITY ACCOUNT NUMBER.

    (a) In General.--Title II of the Social Security Act is amended by 
inserting after section 208 (42 U.S.C. 408) the following new section:

``prohibition of the sale, purchase, and display to the general public 
                 of the social security account number

    ``Sec. 208A.  (a) Definitions.--For purposes of this section:
            ``(1) Person.--
                    ``(A) In general.--Subject to subparagraph (B), the 
                term `person' means any individual, partnership, 
                corporation, trust, estate, cooperative, association, 
                or any other entity.
                    ``(B) Governmental entities.--Such term does not 
                include a governmental entity. Nothing in this 
                subparagraph shall be construed to authorize, in 
                connection with a governmental entity, an act or 
                practice otherwise prohibited under this section or 
                section 205(c)(2)(C).
            ``(2) Selling and purchasing.--
                    ``(A) In general.--Subject to subparagraph (B)--
                            ``(i) Sell.--The term `sell' in connection 
                        with a social security account number means to 
                        obtain, directly or indirectly, anything of 
                        value in exchange for such number.
                            ``(ii) Purchase.--The term `purchase' in 
                        connection with a social security account 
                        number means to provide, directly or 
                        indirectly, anything of value in exchange for 
                        such number.
                    ``(B) Exceptions.--The terms `sell' and `purchase' 
                in connection with a social security account number do 
                not include the submission of such number as part of--
                            ``(i) the process for applying for any type 
                        of Government benefits or programs (such as 
                        grants or loans or welfare or other public 
                        assistance programs),
                            ``(ii) the administration of, or provision 
                        of benefits under, an employee benefit plan, or
                            ``(iii) the sale, lease, merger, transfer, 
                        or exchange of a trade or business.
            ``(3) Display to the general public.--
                    ``(A) In general.--The term `display to the general 
                public' means, in connection with a social security 
                account number, to intentionally place such number in a 
                viewable manner on an Internet site that is available 
                to the general public or to make such number available 
                in any other manner intended to provide access to such 
                number by the general public.
                    ``(B) Internet transmissions.--In any case in which 
                a person requires, as a condition of doing business 
                with such person, transmittal to such person of an 
                individual's social security account number by means of 
                the Internet without reasonable provisions to ensure 
                that such number is encrypted or otherwise secured from 
                disclosure, any such transmittal of such number as so 
                required shall be treated as a `display to the general 
                public' of such number by such person.
            ``(4) Social security account number.--The term `social 
        security account number' has the meaning given such term in 
        section 208(c), except that such term includes any derivative 
        of such number. Notwithstanding the preceding sentence, any 
        expression, contained in or on any item sold or displayed to 
        the general public, shall not be treated as a social security 
        account number solely because such expression sets forth not 
        more than the last 4 digits of such number, if the remainder of 
        such number cannot be determined based solely on such 
        expression or any other matter presented in or on such item.
    ``(b) Prohibition of Sale, Purchase, and Display to the General 
Public.--(1) Except as provided in paragraph (2), it shall be unlawful 
for any person to--
            ``(A) sell or purchase a social security account number or 
        display to the general public a social security account number, 
        or
            ``(B) obtain or use any individual's social security 
        account number for the purpose of locating or identifying such 
        individual with the intent to physically injure or harm such 
        individual or using the identity of such individual for any 
        illegal purpose.
    ``(2) Notwithstanding paragraph (1), and subject to paragraph (3), 
a social security account number may be sold or purchased by any person 
to the extent provided in this subsection (and for no other purpose) as 
follows:
            ``(A) to the extent necessary for law enforcement, 
        including (but not limited to) the enforcement of a child 
        support obligation, as determined under regulations issued as 
        provided in subsection (j);
            ``(B) to the extent necessary for national security 
        purposes, as determined under regulations issued as provided in 
        subsection (j);
            ``(C) to the extent necessary for public health purposes;
            ``(D) to the extent necessary in emergency situations to 
        protect the health or safety of 1 or more individuals;
            ``(E) to the extent that the sale or purchase is required 
        to comply with a tax law of the United States or of any State 
        (or political subdivision thereof);
            ``(F) to the extent that the sale or purchase is to or by a 
        consumer reporting agency (as defined in section 603(f) of the 
        Fair Credit Reporting Act (15 U.S.C. 1681a(f))) for use or 
        disclosure solely for permissible purposes described in section 
        604(a) of such Act (15 U.S.C. 1681b(a)); and
            ``(G) to the extent necessary for research (other than 
        market research) conducted by an agency or instrumentality of 
        the United States or of a State or political subdivision 
        thereof (or an agent of such an agency or instrumentality) for 
        the purpose of advancing the public good, on the condition that 
        the researcher provides adequate assurances that--
                    ``(i) the social security account numbers will not 
                be used to harass, target, or publicly reveal 
                information concerning any identifiable individuals;
                    ``(ii) information about identifiable individuals 
                obtained from the research will not be used to make 
                decisions that directly affect the rights, benefits, or 
                privileges of specific individuals; and
                    ``(iii) the researcher has in place appropriate 
                safeguards to protect the privacy and confidentiality 
                of any information about identifiable individuals, 
                including procedures to ensure that the social security 
                account numbers will be encrypted or otherwise 
                appropriately secured from unauthorized disclosure.
    ``(3) Notwithstanding paragraph (1), a social security account 
number assigned to an individual may be sold, purchased, or displayed 
to the general public by any person--
            ``(A) to the extent consistent with such individual's 
        voluntary and affirmative written consent to the sale, 
        purchase, or display of the social security account number, but 
        only if--
                    ``(i) the terms of the consent and the right to 
                refuse consent are presented to the individual in a 
                clear, conspicuous, and understandable manner,
                    ``(ii) the individual is placed under no obligation 
                to provide consent to any such sale, purchase, or 
                display, and
                    ``(iii) the terms of the consent authorize the 
                individual to limit the sale, purchase, or display to 
                purposes directly associated with the transaction with 
                respect to which the consent is sought, and
            ``(B) under such circumstances as may be deemed appropriate 
        in regulations issued as provided under subsection (j).
    ``(4) In the case of social security account numbers which 
constitute personally identifiable medical information, the 
Commissioner of Social Security, with respect to medical research which 
is referred to in paragraph (3)(A) or which is treated in regulations 
of the Commissioner issued pursuant to paragraph (3)(B), shall maintain 
ongoing consultation with the Office for Civil Rights of the Department 
of Health and Human Services to ensure that the sale or purchase of 
such social security account numbers is permitted only in compliance 
with existing Federal rules and regulations prescribed by the Secretary 
of Health and Human Services pursuant to section 264(c) of the Health 
Insurance Portability and Accountability Act of 1996 (110 Stat. 2033).
    ``(c) Prohibition of Unauthorized Disclosure to Government Agencies 
or Instrumentalities.--(1) It shall be unlawful for any person to 
communicate by any means to any agency or instrumentality of the United 
States or of any State or political subdivision thereof the social 
security account number of any individual other than such person 
without the written permission of such individual, unless the number 
was requested by the agency or instrumentality. In the case of an 
individual who is legally incompetent, permission provided by the 
individual's legal representatives shall be deemed to be permission 
provided by such individual.
    ``(2) Paragraph (1) shall not apply to the extent necessary--
            ``(A) for law enforcement, including (but not limited to) 
        the enforcement of a child support obligation, or
            ``(B) for national security purposes,
as determined under regulations issued as provided under subsection 
(j).
    ``(d) Prohibition of the Displays on Cards or Tags Required for 
Access to Goods, Services, or Benefits.--No person may display a social 
security account number on any card or tag issued to any other person 
for the purpose of providing such other person access to any goods, 
services, or benefits or include on such card or tag a magnetic strip, 
bar code, or other means of communication which conveys such number.
    ``(e) Prohibition of the Displays on Employee Identification Cards 
or Tags.--No person that is an employer, and no other person offering 
benefits in connection with an employee benefit plan maintained by such 
employer or acting as an agent of such employer, may display a social 
security account number on any card or tag that is commonly provided to 
employees of such employer (or to their family members) for purposes of 
identification or include on such card or tag a magnetic strip, bar 
code, or other means of communication which conveys such number.
    ``(f) Measures To Preclude Unauthorized Disclosure of Social 
Security Account Numbers and Protect the Confidentiality of Such 
Numbers.--Subject to the preceding provisions of this section, any 
person having in such person's records the social security account 
number of any individual other than such person shall, to the extent 
that such records are maintained for the conduct of such person's trade 
or business--
            ``(1) ensure that no officer or employee thereof has access 
        to such number for any purpose other than as necessary for the 
        conduct of such person's trade or business,
            ``(2) restrict, in accordance with regulations of the 
        Commissioner, access to social security account numbers 
        obtained thereby to officers and employees thereof whose duties 
        or responsibilities require access for the conduct of such 
        person's trade or business, and
            ``(3) provide such safeguards as may be specified, in 
        regulations of the Commissioner, to be necessary or appropriate 
        to preclude unauthorized access to the social security account 
        number and to otherwise protect the confidentiality of such 
        number.
    ``(g) Deceased Individuals.--This section does not apply with 
respect to the social security account number of a deceased individual.
    ``(h) Criminal Penalty.--Any person who violates this section shall 
be guilty of a felony and upon conviction thereof shall be fined under 
title 18, United States Code, or imprisoned for not more than 5 years, 
or both.
    ``(i) Applicability of Other Protections.--Nothing in this section 
shall be construed to supersede, alter, or affect any restriction or 
limitation on the sale, purchase, display to the general public, or 
other disclosure of social security account numbers, provided in any 
Federal statute, regulation, order, or interpretation, if the 
restriction or limitation is greater than that provided under this 
section, as determined under applicable regulations issued by the 
Commissioner of Social Security or by another agency or instrumentality 
of the United States as provided in subsection (j).
    ``(j) Regulations.--(1) In issuing regulations to carry out the 
provisions of subparagraphs (A) and (B) of subsection (b)(2), 
subsection (b)(3)(B), and subsection (c)(2), the Commissioner of Social 
Security shall consult with the Attorney General of the United States, 
the Secretary of Health and Human Services, the Secretary of Homeland 
Security, the Secretary of the Treasury, the Federal Trade Commission, 
the Federal banking agencies (as defined in section 3 of the Federal 
Deposit Insurance Act), the National Credit Union Administration, the 
Securities and Exchange Commission, State attorneys general, and such 
representatives of the State insurance commissioners as may be 
designated by the National Association of Insurance Commissioners. Any 
agency or instrumentality of the United States may exercise the 
authority of the Commissioner to issue such regulations, with respect 
to matters otherwise subject to regulation by such agency or 
instrumentality, to the extent determined appropriate in regulations of 
the Commissioner.
    ``(2) In issuing the regulations described in paragraph (1) 
pursuant to the provisions of subparagraph (A) or (B) of (b)(2) or 
subsection (c)(2) (relating to law enforcement and national security), 
the Commissioner may authorize the sale or purchase of social security 
account numbers only if the Commissioner determines that--
            ``(A) such sale or purchase would serve a compelling public 
        interest that cannot reasonably be served through alternative 
        measures, and
            ``(B) such sale or purchase will not pose an unreasonable 
        risk of identity theft, or bodily, emotional, or financial harm 
        to an individual (taking into account any restrictions and 
        conditions that the Commissioner imposes on the sale, purchase, 
        or disclosure).
    ``(3) In issuing the regulations described in paragraph (1) 
pursuant to the provisions of subsection (b)(3)(B), the Commissioner 
may authorize the sale, purchase, or display to the general public of 
social security account numbers only after considering, among other 
relevant factors--
            ``(A) the associated cost or burden to the general public, 
        businesses, commercial enterprises, non-profit organizations, 
        and Federal, State, and local governments; and
            ``(B) the associated benefit to the general public, 
        businesses, commercial enterprises, non-profit associations, 
        and Federal, State, and local governments.
    ``(4) If, after considering the factors in paragraph (3), the 
Commissioner authorizes, in regulations referred to in paragraph (3), 
the sale, purchase, or display to the general public of social security 
account numbers, the Commissioner shall impose restrictions and 
conditions on the sale, purchase, or display to the general public to 
the extent necessary--
            ``(A) to provide reasonable assurances that social security 
        account numbers will not be used to commit or facilitate fraud, 
        deceptions, or crime, and
            ``(B) to prevent an unreasonable risk of identity theft or 
        bodily, emotional, or financial harm to any individual, 
        considering the nature, likelihood, and severity of the 
        anticipated harm that could result from the sale, purchase, or 
        display to the general public of social security account 
        numbers, together with the nature, likelihood, and extent of 
        any benefits that could be realized.
    ``(5) In the issuance of regulations described in paragraph (1), 
notice shall be provided as described in paragraphs (1), (2), and (3) 
of section 553(b) of title 5, United States Code, and opportunity to 
participate in the rule making shall be provided in accordance with 
section 553(c) of such title.
    ``(6) Each agency and instrumentality exercising authority to issue 
regulations under this subsection shall consult and coordinate with the 
other such agencies and instrumentalities for the purposes of assuring, 
to the extent possible, that the regulations prescribed by each such 
agency or instrumentality are consistent and comparable, as 
appropriate, with the regulations prescribed by the other such agencies 
and instrumentalities. The Commissioner shall undertake to facilitate 
such consultation and coordination.''.
    (b) Effective Date.--Initial final regulations prescribed to carry 
out the provisions of section 208A of the Social Security Act (added by 
this section) shall be issued not later than the last date of the 18th 
calendar month following the date of the enactment of this Act. Such 
provisions shall take effect 1 year after the date of the issuance of 
such regulations. Section 208A(b) of such Act shall apply in the case 
of displays to the general public (as defined in section 208A(a)(3) of 
such Act) to such displays to the general public originally occurring 
after such 1-year period. Such provisions shall not apply with respect 
to any such display to the general public of a record (containing a 
social security account number (or any derivative thereof)) generated 
prior to the close of such 1-year period.