```

[House Report 108-685]
[From the U.S. Government Publishing Office]

108th Congress                                            Rept. 108-685
                        HOUSE OF REPRESENTATIVES
 2d Session                                                      Part 1

======================================================================

 
  SOCIAL SECURITY NUMBER PRIVACY AND IDENTITY THEFT PREVENTION ACT OF 
                                  2004

                                _______
                                

               September 14, 2004.--Ordered to be printed

                                _______
                                

    Mr. Thomas, from the Committee on Ways and Means, submitted the 
                               following

                              R E P O R T

                        [To accompany H.R. 2971]

      [Including cost estimate of the Congressional Budget Office]

  The Committee on Ways and Means, to whom was referred the 
bill (H.R. 2971) to amend the Social Security Act to enhance 
Social Security account number privacy protections, to prevent 
fraudulent misuse of the Social Security account number, and to 
otherwise enhance protection against identity theft, and for 
other purposes, having considered the same, report favorably 
thereon with an amendment and recommend that the bill as 
amended do pass.

                                CONTENTS

                                                                   Page
 I. Introduction.....................................................15
        A. Purpose and Summary...................................    15
        B. Background............................................    15
        C. Legislative History...................................    16
II. Section-by-Section Summary.......................................18
III.Vote of the Committee............................................41

        A. Motion To Report the Bill.............................    41
IV. Budget Effects of the Bill.......................................42
        A. Committee Estimates of Budgetary Effects..............    42
        B. Budget Authority and Tax Expenditures.................    42
        C. Cost Estimate Prepared by the Congressional Budget 
            Office...............................................    42
 V. Other Matters To Be Discussed Under the Rules of the House.......48
        A. Committee Oversight Findings and Recommendations......    48
        B. Statement of General Performance Goals and Objectives.    48
        C. Constitutional Authority Statement....................    48
        D. Information Relating to Unfunded Mandates.............    48
VI. Changes in Existing Law Made by the Bill, as Reported............48

      The amendment is as follows:
      Strike all after the enacting clause and insert the 
following:

SECTION 1. SHORT TITLE AND TABLE OF CONTENTS.

  (a) Short Title.--This Act may be cited as the ``Social Security 
Number Privacy and Identity Theft Prevention Act of 2004''.
  (b) Table of Contents.--The table of contents is as follows:

Sec. 1. Short title and table of contents.

 TITLE I--PROVISIONS RELATING TO THE SOCIAL SECURITY ACCOUNT NUMBER IN 
                     THE PUBLIC AND PRIVATE SECTORS

Sec. 101. Restrictions on the sale or display to the general public of 
social security account numbers by governmental agencies.
Sec. 102. Regulatory authority.
Sec. 103. Prohibition of display of social security account numbers on 
checks issued for payment by governmental agencies.
Sec. 104. Prohibition of the display of social security account numbers 
on driver's licenses or motor vehicle registrations.
Sec. 105. Prohibition of the display of personal identification numbers 
on government employee identification cards or tags.
Sec. 106. Prohibition of inmate access to social security account 
numbers.
Sec. 107. Measures to preclude unauthorized disclosure of social 
security account numbers and protect the confidentiality of such 
numbers.
Sec. 108. Prohibition of sale, purchase, and display to the general 
public of the social security account number in the private sector.
Sec. 109. Confidential treatment of credit header information.
Sec. 110. Refusal to do business without receipt of social security 
account number considered unfair or deceptive Act or practice.

 TITLE II--MEASURES TO ENSURE THE INTEGRITY OF APPLICATIONS FOR SOCIAL 
     SECURITY ACCOUNT NUMBERS AND REPLACEMENT SOCIAL SECURITY CARDS

Sec. 201. Independent verification of birth records provided in support 
of applications for social security account numbers.
Sec. 202. Enumeration at birth.
Sec. 203. Study relating to use of photographic identification in 
connection with applications for benefits, social security account 
numbers, and social security cards.
Sec. 204. Restrictions on issuance of multiple replacement social 
security cards.
Sec. 205. Study relating to modification of the social security account 
numbering system to show work authorization status.

                         TITLE III--ENFORCEMENT

Sec. 301. New criminal penalties for misuse of social security account 
numbers.
Sec. 302. Extension of civil monetary penalty authority.
Sec. 303. Criminal penalties for employees of the Social Security 
Administration who knowingly and fraudulently issue social security 
cards or social security account numbers.
Sec. 304. Enhanced penalties in cases of terrorism, drug trafficking, 
crimes of violence, or prior offenses.

 TITLE I--PROVISIONS RELATING TO THE SOCIAL SECURITY ACCOUNT NUMBER IN 
                     THE PUBLIC AND PRIVATE SECTORS

SEC. 101. RESTRICTIONS ON THE SALE OR DISPLAY TO THE GENERAL PUBLIC OF 
                    SOCIAL SECURITY ACCOUNT NUMBERS BY GOVERNMENTAL 
                    AGENCIES.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) is amended by adding at the end the following new 
clause:
  ``(x)(I) An executive, legislative, or judicial agency or 
instrumentality of the Federal Government or of a State or a political 
subdivision thereof or a trustee appointed in a case under title 11, 
United States Code (or person acting as an agent of such an agency or 
instrumentality or trustee) may not sell or display to the general 
public any social security account number if such number has been 
disclosed to such agency, instrumentality, trustee, or agent pursuant 
to the assertion by such an agency, instrumentality, trustee, or agent 
to any person that disclosure of such number is mandatory. 
Notwithstanding the preceding sentence, such number may be sold or 
displayed to the general public in accordance with the exceptions 
specified in subclauses (II), (III), (IV), (V), (VI), (VII), and (VIII) 
(and for no other purpose).
  ``(II) Notwithstanding subclause (I), a social security account 
number may be sold by an agency, instrumentality, trustee, or agent 
referred to in subclause (I) to the extent that such sale is 
specifically authorized by this Act.
  ``(III) Notwithstanding subclause (I), a social security account 
number may be sold by an agency, instrumentality, trustee, or agent 
referred to in subclause (I) to the extent that is necessary or 
appropriate for law enforcement or national security purposes, as 
determined under regulations which shall be issued as provided in 
subparagraph (I) of this paragraph.
  ``(IV) Notwithstanding subclause (I), a social security account 
number may be sold by an agency, instrumentality, trustee, or agent 
referred to in subclause (I) to the extent that such sale is required 
to comply with a tax law of the United States or of any State (or 
political subdivision thereof).
  ``(V) Notwithstanding subclause (I), a social security account number 
may be sold by a State department of motor vehicles as authorized under 
subsection (b) of section 2721 of title 18, United States Code, if such 
number is to be used pursuant to such sale solely for purposes 
permitted under paragraph (1), (6), or (9) of such subsection.
  ``(VI) Notwithstanding subclause (I), a social security account 
number may be sold or otherwise made available by an agency, 
instrumentality, trustee, or agent referred to in subclause (I) to a 
consumer reporting agency (as defined in section 603(f) of the Fair 
Credit Reporting Act (15 U.S.C. 1681a(f))) for use or disclosure solely 
for permissible purposes described in section 604(a) of such Act (15 
U.S.C. 1681b(a)).
  ``(VII) Notwithstanding subclause (I), a social security account 
number may be sold by an agency, instrumentality, trustee, or agent 
referred to in subclause (I) to the extent necessary for research 
(other than market research) conducted by any agency or instrumentality 
referred to in subclause (I) (or an agent of such an agency or 
instrumentality) for the purpose of advancing the public good, on the 
condition that the researcher provides adequate assurances that the 
social security account numbers will not be used to harass, target, or 
publicly reveal information concerning any identifiable individuals, 
that information about identifiable individuals obtained from the 
research will not be used to make decisions that directly affect the 
rights, benefits, or privileges of specific individuals, and that the 
researcher has in place appropriate safeguards to protect the privacy 
and confidentiality of any information about identifiable individuals, 
including procedures to ensure that the social security account numbers 
will be encrypted or otherwise appropriately secured from unauthorized 
disclosure. In the case of social security account numbers which 
constitute personally identifiable medical information, the 
Commissioner of Social Security, with respect to medical research 
referred to in the preceding sentence, and the Attorney General of the 
United States, with respect to any medical research not referred to in 
the preceding sentence but which is treated in regulations of the 
Attorney General issued pursuant to subclause (VIII), shall maintain 
ongoing consultation with the Office for Civil Rights of the Department 
of Health and Human Services to ensure that the sale or purchase of 
such social security account numbers is permitted only in compliance 
with existing Federal rules and regulations prescribed by the Secretary 
of Health and Human Services pursuant to section 264(c) of the Health 
Insurance Portability and Accountability Act of 1996 (110 Stat. 2033).
  ``(VIII) Notwithstanding subclause (I), a social security account 
number may be sold or displayed to the general public by an agency, 
instrumentality, trustee, or agent referred to in subclause (I) under 
such other circumstances as may be specified in regulations issued as 
provided in subparagraph (I) of this paragraph.
  ``(IX) This clause does not apply with respect to a social security 
account number of a deceased individual.
  ``(X) For purposes of this clause, the term `sell' means, in 
connection with a social security account number, to accept an item of 
material value in exchange for such number.
  ``(XI) For purposes of this clause, the term `display to the general 
public' shall have the meaning provided such term in section 
208A(a)(3)(A). In any case in which an agency, instrumentality, 
trustee, or agent referred to in subclause (I) requires transmittal to 
such agency, instrumentality, trustee, or agent of an individual's 
social security account number by means of the Internet without 
reasonable provisions to ensure that such number is encrypted or 
otherwise appropriately secured from disclosure, any such transmittal 
of such number as so required shall be treated, for purposes of this 
clause, as a `display to the general public' of such number by such 
agency, instrumentality, trustee, or agent for purposes of this clause.
  ``(XII) For purposes of this clause, the term social security account 
number includes any derivative of such number. Notwithstanding the 
preceding sentence, any expression, contained in or on any item sold or 
displayed to the general public, shall not be treated as a social 
security account number solely because such expression sets forth not 
more than the last 4 digits of such number if the remainder of such 
number cannot be determined based solely on such expression or any 
other matter presented in such material.
  ``(XIII) Nothing in this clause shall be construed to supersede, 
alter, or affect any restriction or limitation on the sale or display 
to the general public of social security account numbers, provided in 
any Federal statute, regulation, order, or interpretation, if the 
restriction or limitation is greater than that provided under this 
clause, as determined under applicable regulations issued by the 
Commissioner of Social Security or by the Attorney General of the 
United States or another agency or instrumentality of the United States 
as provided in subparagraph (I) of this paragraph.''.
  (b) Effective Date and Related Rules.--
          (1) In general.--Initial final regulations prescribed to 
        carry out the provisions of section 205(c)(2)(C)(x) of the 
        Social Security Act (added by this section) shall be issued not 
        later than the last date of the 18th calendar month following 
        the date of the enactment of this Act. Such provisions shall 
        take effect, with respect to matters governed by such 
        regulations issued by the Commissioner of Social Security, or 
        (pursuant to section 205(c)(2)(I) of such Act (added by section 
        102)) by the Attorney General of the United States or any other 
        agency or instrumentality of the United States, 1 year after 
        the date of the issuance of such regulations by the 
        Commissioner, the Attorney General, or such other agency or 
        instrumentality, respectively. Such amendment shall apply in 
        the case of displays to the general public, as defined in 
        section 208A(a)(3) of such Act (added by section 108), to such 
        displays originally occurring after such 1-year period. Such 
        provisions shall not apply with respect to any display of a 
        record (containing a social security account number (or any 
        derivative thereof)) generated prior to the close of such 1-
        year period.
          (2) Sunset of exception.--The last sentence of subclause 
        (XII) of section 205(c)(2)(C)(x) of the Social Security Act 
        (added by this section) shall cease to be effective with 
        respect to sales, purchases, or displays to the general public 
        occurring after 6 years after the 18th calendar month referred 
        to in paragraph (1).

SEC. 102. REGULATORY AUTHORITY.

  Section 205(c)(2) of the Social Security Act (42 U.S.C. 405(c)(2)) is 
amended by adding at the end the following new subparagraph:
  ``(I)(i) The Attorney General of the United States shall prescribe 
regulations to carry out the provisions of subclauses (III) and (VIII) 
of subparagraph (C)(x) of this paragraph, subparagraphs (A) and (B) of 
section 208A(b)(2), section 208A(b)(3)(B), and section 208A(c)(2). In 
issuing such regulations, the Attorney General shall consult with the 
Commissioner of Social Security, the Secretary of Health and Human 
Services, the Secretary of Homeland Security, the Secretary of the 
Treasury, the Federal Trade Commission, the Federal banking agencies 
(as defined in section 3 of the Federal Deposit Insurance Act), the 
National Credit Union Administration, the Securities and Exchange 
Commission, State attorneys general, and such representatives of the 
State insurance commissioners as may be designated by the National 
Association of Insurance Commissioners. Any agency or instrumentality 
of the United States may exercise the authority of the Attorney General 
under this subparagraph, with respect to matters otherwise subject to 
regulation by such agency or instrumentality, to the extent determined 
appropriate in regulations of the Attorney General.
  ``(ii) In issuing the regulations described in clause (i) pursuant to 
the provisions of subparagraph (C)(x)(III), paragraph (A) or (B) of 
section 208A(b)(2), or section 208A(c)(2) (relating to law enforcement 
and national security), the Attorney General may authorize the sale or 
purchase of Social Security account numbers only if the Attorney 
General determines that--
          ``(I) such sale or purchase would serve a compelling public 
        interest that cannot reasonably be served through alternative 
        measures, and
          ``(II) such sale or purchase will not pose an unreasonable 
        risk of identity theft, or bodily, emotional, or financial harm 
        to an individual (taking into account any restrictions and 
        conditions that the Attorney General imposes on the sale, 
        purchase, or disclosure).
  ``(iii) In issuing the regulations described in clause (i) pursuant 
to the provisions of subparagraph (C)(x)(VIII) of this paragraph or 
section 208A(b)(3)(B), the Attorney General may authorize the sale, 
purchase, or display to the general public of social security account 
numbers only after considering, among other relevant factors--
          ``(I) the associated cost or burden to the general public, 
        businesses, commercial enterprises, non-profit organizations, 
        and Federal, State, and local governments; and
          ``(II) the associated benefit to the general public, 
        businesses, commercial enterprises, non-profit associations, 
        and Federal, State, and local governments.
  ``(iv) If, after considering the factors in clause (iii), the 
Attorney General authorizes, in regulations referred to in clause 
(iii), the sale, purchase, or display to the general public of social 
security account numbers, the Attorney General shall impose 
restrictions and conditions on the sale, purchase, or display to the 
general public to the extent necessary--
          ``(I) to provide reasonable assurances that social security 
        account numbers will not be used to commit or facilitate fraud, 
        deceptions, or crime, and
          ``(II) to prevent an unreasonable risk of identity theft or 
        bodily, emotional, or financial harm to any individual, 
        considering the nature, likelihood, and severity of the 
        anticipated harm that could result from the sale, purchase, or 
        display to the general public of social security account 
        numbers, together with the nature, likelihood, and extent of 
        any benefits that could be realized.
  ``(v) In the issuance of regulations pursuant to this subparagraph, 
notice shall be provided as described in paragraphs (1), (2), and (3) 
of section 553(b) of title 5, United States Code, and opportunity to 
participate in the rule making shall be provided in accordance with 
section 553(c) of such title.
  ``(vi) Each agency and instrumentality exercising authority to issue 
regulations under this subparagraph shall consult and coordinate with 
the other such agencies and instrumentalities for the purposes of 
assuring, to the extent possible, that the regulations prescribed by 
each such agency or instrumentality are consistent and comparable, as 
appropriate, with the regulations prescribed by the other such agencies 
and instrumentalities. The Attorney General shall undertake to 
facilitate such consultation and coordination.
  ``(vii) For purposes of this subparagraph, the terms `sell', 
`purchase', and `display to the general public' shall have the meanings 
provided such terms under subparagraph (C)(x) of this paragraph or 
under section 208A(a), as applicable.
  ``(viii) For purposes of this subparagraph, subparagraph (C)(x)(XI) 
shall apply.''.

SEC. 103. PROHIBITION OF DISPLAY OF SOCIAL SECURITY ACCOUNT NUMBERS ON 
                    CHECKS ISSUED FOR PAYMENT BY GOVERNMENTAL AGENCIES.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) (as amended by section 101) is amended further by 
adding at the end the following new clause:
  ``(xi) No executive, legislative, or judicial agency or 
instrumentality of the Federal Government or of a State or a political 
subdivision thereof or trustee appointed in a case under title 11, 
United States Code (or person acting as an agent of such an agency or 
instrumentality or trustee) may include the social security account 
number of any individual (or any derivative of such number) on any 
check issued for any payment by the Federal Government, any State or 
political subdivision thereof, or any agency or instrumentality 
thereof, or such trustee or on any document attached to or accompanying 
such a check.''.
  (b) Effective Date.--The amendment made by this section shall apply 
with respect to checks (and documents attached to or accompanying such 
checks) issued after 1 year after the date of the enactment of this 
Act.

SEC. 104. PROHIBITION OF THE DISPLAY OF SOCIAL SECURITY ACCOUNT NUMBERS 
                    ON DRIVER'S LICENSES OR MOTOR VEHICLE 
                    REGISTRATIONS.

  (a) In General.--Section 205(c)(2)(C)(vi) of the Social Security Act 
(42 U.S.C. 405(c)(2)(C)(vi)) is amended--
          (1) by inserting ``(I)'' after ``(vi)''; and
          (2) by adding at the end the following new subclause:
  ``(II) Any State or political subdivision thereof (and any person 
acting as an agent of such an agency or instrumentality), in the 
administration of any driver's license or motor vehicle registration 
law within its jurisdiction, may not display a social security account 
number issued by the Commissioner of Social Security (or any derivative 
of such number) on any driver's license or motor vehicle registration 
or any other document issued by such State or political subdivision to 
an individual for purposes of identification of such individual or 
include on any such licence, registration, or other document a magnetic 
strip, bar code, or other means of communication which conveys such 
number (or derivative thereof).''.
  (b) Effective Date.--The amendments made by this section shall apply 
with respect to licenses, registrations, and other documents issued or 
reissued after 1 year after the date of the enactment of this Act.

SEC. 105. PROHIBITION OF THE DISPLAY OF PERSONAL IDENTIFICATION NUMBERS 
                    ON GOVERNMENT EMPLOYEE IDENTIFICATION CARDS OR 
                    TAGS.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) (as amended by the preceding provisions of this 
title) is amended further by adding at the end the following new 
clause:
  ``(xii) No executive, legislative, or judicial agency or 
instrumentality of the Federal Government or of a State or political 
subdivision thereof, and no other person offering benefits in 
connection with an employee benefit plan maintained by such agency or 
instrumentality or acting as an agent of such agency or 
instrumentality, may display a social security account number (or any 
derivative thereof) on any card or tag that is commonly provided to 
employees of such agency or instrumentality (or to their family 
members) for purposes of identification or include on such card or tag 
a magnetic strip, bar code, or other means of communication which 
conveys such number.''.
  (b) Effective Date.--The amendment made by this section shall apply 
with respect to cards or tags issued after 1 year after the date of the 
enactment of this Act.

SEC. 106. PROHIBITION OF INMATE ACCESS TO SOCIAL SECURITY ACCOUNT 
                    NUMBERS.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) (as amended by the preceding provisions of this 
title) is amended further by adding at the end the following new 
clause:
  ``(xiii) No executive, legislative, or judicial agency or 
instrumentality of the Federal Government or of a State or political 
subdivision thereof (or person acting as an agent of such an agency or 
instrumentality) may employ, or enter into a contract for the use or 
employment of, prisoners in any capacity that would allow such 
prisoners access to the social security account numbers of other 
individuals. For purposes of this clause, the term `prisoner' means an 
individual confined in a jail, prison, or other penal institution or 
correctional facility.''.
  (b) Effective Date.--
          (1) In general.--Except as provided in paragraph (2), the 
        amendment made by this section shall apply with respect to 
        employment of prisoners, or entry into contract for the use or 
        employment of prisoners, on or after the date of the enactment 
        of this Act.
          (2) Treatment of current arrangements.--In the case of--
                  (A) prisoners employed as described in clause (xiii) 
                of section 205(c)(2)(C) of the Social Security Act (as 
                added by this section) on the date of the enactment of 
                this Act, and
                  (B) contracts described in such clause in effect on 
                such date,
        the amendment made by this section shall take effect 90 days 
        after the date of the enactment of this Act.

SEC. 107. MEASURES TO PRECLUDE UNAUTHORIZED DISCLOSURE OF SOCIAL 
                    SECURITY ACCOUNT NUMBERS AND PROTECT THE 
                    CONFIDENTIALITY OF SUCH NUMBERS.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) (as amended by the preceding provisions of this 
title) is amended further by adding at the end the following new 
clause:
  ``(xiv) Except as otherwise provided in this paragraph, in the case 
of any executive, legislative, or judicial agency or instrumentality of 
the Federal Government or of a State or political subdivision thereof 
and any trustee appointed in a case under title 11, United States Code 
(and any agent of such agency, instrumentality, or trustee) having in 
its possession an individual's social security account number--
          ``(I) no officer or employee thereof shall have access to 
        such number for any purpose other than the effective 
        administration of the statutory provisions governing its 
        functions,
          ``(II) such agency, instrumentality, trustee, or agent shall 
        restrict, to the satisfaction of the Commissioner of Social 
        Security, access to social security account numbers obtained 
        thereby to officers and employees thereof whose duties or 
        responsibilities require access for the administration or 
        enforcement of such provisions, and
          ``(III) such agency, instrumentality, trustee, or agent shall 
        provide such other safeguards as the Commissioner of Social 
        Security determines to be necessary or appropriate to preclude 
        unauthorized access to the social security account number and 
        to otherwise protect the confidentiality of such number.
For purposes of this clause the term social security account number 
includes any derivative thereof. ''.
  (b) Effective Date.--The amendment made by this section shall take 
effect 1 year after the date of the enactment of this Act.

SEC. 108. PROHIBITION OF THE SALE, PURCHASE, AND DISPLAY TO THE GENERAL 
                    PUBLIC OF THE SOCIAL SECURITY ACCOUNT NUMBER IN THE 
                    PRIVATE SECTOR.

  (a) In General.--Title II of the Social Security Act is amended by 
inserting after section 208 (42 U.S.C. 408) the following new section:
``prohibition of the sale, purchase, and display to the general public 
      of the social security account number in the private sector

                             ``Definitions

  ``Sec. 208A. (a) For purposes of this section:
          ``(1) Person.--
                  ``(A) In general.--Subject to subparagraph (B), the 
                term `person' means any individual, partnership, 
                corporation, trust, estate, cooperative, association, 
                or any other entity.
                  ``(B) Governmental entities.--Such term does not 
                include a governmental entity. Nothing in this 
                subparagraph shall be construed to authorize, in 
                connection with a governmental entity, an act or 
                practice otherwise prohibited under this section or 
                section 205(c)(2)(C).
          ``(2) Selling and purchasing.--
                  ``(A) In general.--Subject to subparagraph (B)--
                          ``(i) Sell.--The term `sell' in connection 
                        with a social security account number means to 
                        obtain, directly or indirectly, anything of 
                        value in exchange for such number.
                          ``(ii) Purchase.--The term `purchase' in 
                        connection with a social security account 
                        number means to provide, directly or 
                        indirectly, anything of value in exchange for 
                        such number.
                  ``(B) Exceptions.--The terms `sell' and `purchase' in 
                connection with a social security account number do not 
                include the submission of such number as part of--
                          ``(i) the process for applying for any type 
                        of Government benefits or programs (such as 
                        grants or loans or welfare or other public 
                        assistance programs),
                          ``(ii) the administration of, or provision of 
                        benefits under, an employee benefit plan, or
                          ``(iii) the sale, lease, merger, transfer, or 
                        exchange of a trade or business.
          ``(3) Display to the general public.--
                  ``(A) In general.--The term `display to the general 
                public' means, in connection with a social security 
                account number, to intentionally place such number in a 
                viewable manner on an Internet site that is available 
                to the general public or to make such number available 
                in any other manner intended to provide access to such 
                number by the general public.
                  ``(B) Internet transmissions.--In any case in which a 
                person requires, as a condition of doing business with 
                such person, transmittal to such person of an 
                individual's social security account number by means of 
                the Internet without reasonable provisions to ensure 
                that such number is encrypted or otherwise secured from 
                disclosure, any such transmittal of such number as so 
                required shall be treated as a `display to the general 
                public' of such number by such person.
          ``(4) Social security account number.--The term `social 
        security account number' has the meaning given such term in 
        section 208(c), except that such term includes any derivative 
        of such number. Notwithstanding the preceding sentence, any 
        expression, contained in or on any item sold or displayed to 
        the general public, shall not be treated as a social security 
        account number solely because such expression sets forth not 
        more than the last 4 digits of such number, if the remainder of 
        such number cannot be determined based solely on such 
        expression or any other matter presented in or on such item.

   ``Prohibition of Sale, Purchase, and Display to the General Public

  ``(b)(1) Except as provided in paragraph (2), it shall be unlawful 
for any person to--
          ``(A) sell or purchase a social security account number or 
        display to the general public a social security account number, 
        or
          ``(B) obtain or use any individual's social security account 
        number for the purpose of locating or identifying such 
        individual with the intent to physically injure or harm such 
        individual or using the identity of such individual for any 
        illegal purpose.
  ``(2) Notwithstanding paragraph (1), and subject to paragraph (3), a 
social security account number may be sold or purchased by any person 
to the extent provided in this subsection (and for no other purpose) as 
follows:
          ``(A) to the extent necessary for law enforcement, including 
        (but not limited to) the enforcement of a child support 
        obligation, as determined under regulations issued as provided 
        in section 205(c)(2)(I);
          ``(B) to the extent necessary for national security purposes, 
        as determined under regulations issued as provided in section 
        205(c)(2)(I);
          ``(C) to the extent necessary for public health purposes;
          ``(D) to the extent necessary in emergency situations to 
        protect the health or safety of 1 or more individuals;
          ``(E) to the extent that the sale or purchase is required to 
        comply with a tax law of the United States or of any State (or 
        political subdivision thereof);
          ``(F) to the extent that the sale or purchase is to or by a 
        consumer reporting agency (as defined in section 603(f) of the 
        Fair Credit Reporting Act (15 U.S.C. 1681a(f))) for use or 
        disclosure solely for permissible purposes described in section 
        604(a) of such Act (15 U.S.C. 1681b(a)); and
          ``(G) to the extent necessary for research (other than market 
        research) conducted by an agency or instrumentality of the 
        United States or of a State or political subdivision thereof 
        (or an agent of such an agency or instrumentality) for the 
        purpose of advancing the public good, on the condition that the 
        researcher provides adequate assurances that--
                  ``(i) the social security account numbers will not be 
                used to harass, target, or publicly reveal information 
                concerning any identifiable individuals;
                  ``(ii) information about identifiable individuals 
                obtained from the research will not be used to make 
                decisions that directly affect the rights, benefits, or 
                privileges of specific individuals; and
                  ``(iii) the researcher has in place appropriate 
                safeguards to protect the privacy and confidentiality 
                of any information about identifiable individuals, 
                including procedures to ensure that the social security 
                account numbers will be encrypted or otherwise 
                appropriately secured from unauthorized disclosure.
  ``(3) Notwithstanding paragraph (1), a social security account number 
assigned to an individual may be sold, purchased, or displayed to the 
general public by any person--
          ``(A) to the extent consistent with such individual's 
        voluntary and affirmative written consent to the sale, 
        purchase, or display of the social security account number, but 
        only if--
                  ``(i) the terms of the consent and the right to 
                refuse consent are presented to the individual in a 
                clear, conspicuous, and understandable manner,
                  ``(ii) the individual is placed under no obligation 
                to provide consent to any such sale, purchase, or 
                display, and
                  ``(iii) the terms of the consent authorize the 
                individual to limit the sale, purchase, or display to 
                purposes directly associated with the transaction with 
                respect to which the consent is sought, and
          ``(B) under such circumstances as may be deemed appropriate 
        in regulations issued as provided under section 205(c)(2)(I).
  ``(4) In the case of social security account numbers which constitute 
personally identifiable medical information--
          ``(A) the Commissioner of Social Security, with respect to 
        medical research referred to in paragraph (3)(A), and
          ``(B) the Attorney General of the United States, with respect 
        to any medical research not referred to in paragraph (3)(A) but 
        which is treated in regulations of the Attorney General issued 
        pursuant to paragraph (3)(B),
shall maintain ongoing consultation with the Office for Civil Rights of 
the Department of Health and Human Services to ensure that the sale or 
purchase of such social security account numbers is permitted only in 
compliance with existing Federal rules and regulations prescribed by 
the Secretary of Health and Human Services pursuant to section 264(c) 
of the Health Insurance Portability and Accountability Act of 1996 (110 
Stat. 2033).

  ``Prohibition of Unauthorized Disclosure to Government Agencies or 
                           Instrumentalities

  ``(c)(1) It shall be unlawful for any person to communicate by any 
means to any agency or instrumentality of the United States or of any 
State or political subdivision thereof the social security account 
number of any individual other than such person without the written 
permission of such individual, unless the number was requested by the 
agency or instrumentality. In the case of an individual who is legally 
incompetent, permission provided by the individual's legal 
representatives shall be deemed to be permission provided by such 
individual.
  ``(2) Paragraph (1) shall not apply to the extent necessary--
          ``(A) for law enforcement, including (but not limited to) the 
        enforcement of a child support obligation, or
          ``(B) for national security purposes,
as determined under regulations issued as provided under section 
205(c)(2)(I).

 ``Prohibition of the Displays on Cards or Tags Required for Access to 
                      Goods, Services, or Benefits

  ``(d) No person may display a social security account number on any 
card or tag issued to any other person for the purpose of providing 
such other person access to any goods, services, or benefits or include 
on such card or tag a magnetic strip, bar code, or other means of 
communication which conveys such number.

 ``Prohibition of the Displays on Employee Identification Cards or Tags

  ``(e) No person that is an employer, and no other person offering 
benefits in connection with an employee benefit plan maintained by such 
employer or acting as an agent of such employer, may display a social 
security account number on any card or tag that is commonly provided to 
employees of such employer (or to their family members) for purposes of 
identification or include on such card or tag a magnetic strip, bar 
code, or other means of communication which conveys such number.

   ``Measures to Preclude Unauthorized Disclosure of Social Security 
    Account Numbers and Protect the Confidentiality of Such Numbers

  ``(f) Subject to the preceding provisions of this section, any person 
having in such person's records the social security account number of 
any individual other than such person shall, to the extent that such 
records are maintained for the conduct of such person's trade or 
business--
          ``(1) ensure that no officer or employee thereof has access 
        to such number for any purpose other than as necessary for the 
        conduct of such person's trade or business,
          ``(2) restrict, in accordance with regulations of the 
        Commissioner, access to social security account numbers 
        obtained thereby to officers and employees thereof whose duties 
        or responsibilities require access for the conduct of such 
        person's trade or business, and
          ``(3) provide such safeguards as may be specified, in 
        regulations of the Commissioner, to be necessary or appropriate 
        to preclude unauthorized access to the social security account 
        number and to otherwise protect the confidentiality of such 
        number.

                         ``Deceased Individuals

  ``(g) This section does not apply with respect to the social security 
account number of a deceased individual.

                           ``Criminal Penalty

  ``(h) Any person who violates this section shall be guilty of a 
felony and upon conviction thereof shall be fined under title 18, 
United States Code, or imprisoned for not more than 5 years, or both.

                  ``Applicability of Other Protections

  ``(i) Nothing in this section shall be construed to supersede, alter, 
or affect any restriction or limitation on the sale, purchase, display 
to the general public, or other disclosure of social security account 
numbers, provided in any Federal statute, regulation, order, or 
interpretation, if the restriction or limitation is greater than that 
provided under this section, as determined under applicable regulations 
issued by the Commissioner of Social Security or by the Attorney 
General of the United States or another agency or instrumentality of 
the United States as provided in section 205(c)(2)(I).''.
  (b) Effective Date and Related Rules.--
          (1) In general.--Initial final regulations prescribed to 
        carry out the provisions of section 208A of the Social Security 
        Act (added by this section) shall be issued not later than the 
        last date of the 18th calendar month following the date of the 
        enactment of this Act. Such provisions shall take effect, with 
        respect to matters governed by such regulations issued by the 
        Commissioner of Social Security, or (pursuant to section 
        205(c)(2)(I) of such Act (added by section 102)) by the 
        Attorney General of the United States or any other agency or 
        instrumentality of the United States, 1 year after the date of 
        the issuance of such regulations by the Commissioner, the 
        Attorney General, or such other agency or instrumentality, 
        respectively. Section 208A(b) of such Act shall apply in the 
        case of displays to the general public (as defined in section 
        208A(a)(3) of such Act) to such displays to the general public 
        originally occurring after such 1-year period. Such provisions 
        shall not apply with respect to any such display to the general 
        public of a record (containing a social security account number 
        (or any derivative thereof)) generated prior to the close of 
        such 1-year period.
          (2) Sunset of exception.--The last sentence of section 
        208A(a)(4) of the Social Security Act (added by this section) 
        shall cease to be effective with respect to sales, purchases, 
        or displays to the general public occurring after 6 years after 
        the 18th calendar month referred to in paragraph (1).

SEC. 109. CONFIDENTIAL TREATMENT OF CREDIT HEADER INFORMATION.

  (a) In General.--Section 603 of the Fair Credit Reporting Act (15 
U.S.C. 1681a) is amended by adding at the end the following new 
subsection:
  ``(q) Confidential Treatment of Credit Header Information.--
Information regarding the social security account number of the 
consumer, or any derivative thereof, may not be furnished to any person 
by a consumer reporting agency other than in a full consumer report 
furnished in accordance with section 604 and other requirements of this 
title.''.
  (b) Effective Date.--The amendment made by this section shall take 
effect 90 days after the date of the enactment of this Act.

SEC. 110. REFUSAL TO DO BUSINESS WITHOUT RECEIPT OF SOCIAL SECURITY 
                    ACCOUNT NUMBER CONSIDERED UNFAIR OR DECEPTIVE ACT 
                    OR PRACTICE.

  (a) In General.--Any person who refuses to do business with an 
individual because the individual will not consent to the receipt by 
such person of the social security account number of such individual 
shall be considered to have committed an unfair or deceptive act or 
practice in violation of section 5 of the Federal Trade Commission Act 
(15 U.S.C. 45). Action may be taken under such section 5 against such a 
person.
  (b) Exception.--Subsection (a) shall not apply to any person in any 
case in which such person is expressly required under Federal law, in 
connection with doing business with an individual, to submit to the 
Federal Government such individual's social security account number.
  (c) Effective Date.--The preceding provisions of this section shall 
apply with respect to acts or practices committed after 180 days after 
the date of the enactment of this Act.

 TITLE II--MEASURES TO ENSURE THE INTEGRITY OF APPLICATIONS FOR SOCIAL 
     SECURITY ACCOUNT NUMBERS AND REPLACEMENT SOCIAL SECURITY CARDS

SEC. 201. INDEPENDENT VERIFICATION OF BIRTH RECORDS PROVIDED IN SUPPORT 
                    OF APPLICATIONS FOR SOCIAL SECURITY ACCOUNT 
                    NUMBERS.

  (a) Applications for Social Security Account Numbers.--Section 
205(c)(2)(B)(ii) of the Social Security Act (42 U.S.C. 
405(c)(2)(B)(ii)) is amended--
          (1) by inserting ``(I)'' after ``(ii)''; and
          (2) by adding at the end the following new subclause:
  ``(II) With respect to an application for a social security account 
number for an individual, other than for purposes of enumeration at 
birth, the Commissioner shall require independent verification of any 
birth record provided by the applicant in support of the application. 
The Commissioner may provide by regulation for reasonable exceptions 
from the requirement for independent verification under this subclause 
in any case in which the Commissioner determines there is minimal 
opportunity for fraud.''.
  (b) Effective Date.--The amendment made by subsection (a) shall apply 
with respect to applications filed after 270 days after the date of the 
enactment of this Act.
  (c) Study Regarding Applications for Replacement Social Security 
Cards.--
          (1) In general.--As soon as practicable after the date of the 
        enactment of this Act, the Commissioner of Social Security 
        shall undertake a study to test the feasibility and cost 
        effectiveness of verifying all identification documents 
        submitted by an applicant for a replacement social security 
        card. As part of such study, the Commissioner shall determine 
        the feasibility of, and the costs associated with, the 
        development of appropriate electronic processes for third party 
        verification of any such identification documents which are 
        issued by agencies and instrumentalities of the Federal 
        Government and of the States (and political subdivisions 
        thereof).
          (2) Report.--Not later than 2 years after the date of the 
        enactment of this Act, the Commissioner shall report to the 
        Committee on Ways and Means of the House of Representatives and 
        the Committee on Finance of the Senate regarding the results of 
        the study undertaken under paragraph (1). Such report shall 
        contain such recommendations for legislative changes as the 
        Commissioner considers necessary to implement needed 
        improvements in the process for verifying identification 
        documents submitted by applicants for replacement social 
        security cards.

SEC. 202. ENUMERATION AT BIRTH.

  (a) Improvement of Application Process.--
          (1) In general.--As soon as practicable after the date of the 
        enactment of this Act, the Commissioner of Social Security 
        shall undertake to make improvements to the enumeration at 
        birth program for the issuance of social security account 
        numbers to newborns. Such improvements shall be designed to 
        prevent--
                  (A) the assignment of social security account numbers 
                to unnamed children;
                  (B) the issuance of more than 1 social security 
                account number to the same child; and
                  (C) other opportunities for fraudulently obtaining a 
                social security account number.
          (2) Report to the congress.--Not later than 1 year after the 
        date of the enactment of this Act, the Commissioner shall 
        transmit to each House of the Congress a report specifying in 
        detail the extent to which the improvements required under 
        paragraph (1) have been made.
  (b) Study Regarding Process for Enumeration at Birth.--
          (1) In general.--As soon as practicable after the date of the 
        enactment of this Act, the Commissioner of Social Security 
        shall undertake a study to determine the most efficient options 
        for ensuring the integrity of the process for enumeration at 
        birth. Such study shall include an examination of available 
        methods for reconciling hospital birth records with birth 
        registrations submitted to agencies of States and political 
        subdivisions thereof and with information provided to the 
        Commissioner as part of the process for enumeration at birth.
          (2) Report.--Not later than 18 months after the date of the 
        enactment of this Act, the Commissioner shall report to the 
        Committee on Ways and Means of the House of Representatives and 
        the Committee on Finance of the Senate regarding the results of 
        the study undertaken under paragraph (1). Such report shall 
        contain such recommendations for legislative changes as the 
        Commissioner considers necessary to implement needed 
        improvements in the process for enumeration at birth.

SEC. 203. STUDY RELATING TO USE OF PHOTOGRAPHIC IDENTIFICATION IN 
                    CONNECTION WITH APPLICATIONS FOR BENEFITS, SOCIAL 
                    SECURITY ACCOUNT NUMBERS, AND SOCIAL SECURITY 
                    CARDS.

  (a) In General.--As soon as practicable after the date of the 
enactment of this Act, the Commissioner of Social Security shall 
undertake a study to--
          (1) determine the best method of requiring and obtaining 
        photographic identification of applicants for old-age, 
        survivors, and disability insurance benefits under title II of 
        the Social Security Act, for a social security account number, 
        or for a replacement social security card, and of providing for 
        reasonable exceptions to any requirement for photographic 
        identification of such applicants that may be necessary to 
        promote efficient and effective administration of this title, 
        and
          (2) evaluate the benefits and costs of instituting such a 
        requirement for photographic identification, including the 
        degree to which the security and integrity of the old-age, 
        survivors, and disability insurance program would be enhanced.
  (b) Report.--Not later than 18 months after the date of the enactment 
of this Act, the Commissioner shall report to the Committee on Ways and 
Means of the House of Representatives and the Committee on Finance of 
the Senate regarding the results of the study undertaken under 
paragraph (1). Such report shall contain such recommendations for 
legislative changes as the Commissioner considers necessary relating to 
requirements for photographic identification of applicants described in 
subsection (a).

SEC. 204. RESTRICTIONS ON ISSUANCE OF MULTIPLE REPLACEMENT SOCIAL 
                    SECURITY CARDS.

  (a) In General.--Section 205(c)(2)(G) of the Social Security Act (42 
U.S.C. 405(c)(2)(G)) is amended by adding at the end the following new 
sentence: ``The Commissioner shall restrict the issuance of multiple 
replacement social security cards to any individual to 3 per year and 
to 10 for the life of the individual, except in any case in which the 
Commissioner determines there is minimal opportunity for fraud.''.
  (b) Regulations and Effective Date.--The Commissioner of Social 
Security shall issue regulations under the amendment made by subsection 
(a) not later than 1 year after the date of the enactment of this Act. 
Systems controls developed by the Commissioner pursuant to such 
amendment shall take effect upon the earlier of the issuance of such 
regulations or the end of such 1-year period.

SEC. 205. STUDY RELATING TO MODIFICATION OF THE SOCIAL SECURITY ACCOUNT 
                    NUMBERING SYSTEM TO SHOW WORK AUTHORIZATION STATUS.

  (a) In General.--As soon as practicable after the date of the 
enactment of this Act, the Commissioner of Social Security, in 
consultation with the Secretary of Homeland Security, shall undertake a 
study to examine the best method of modifying the social security 
account number assigned to individuals who--
          (1) are not citizens of the United States,
          (2) have not been admitted for permanent residence, and
          (3) are not authorized by the Secretary of Homeland Security 
        to work in the United States, or are so authorized subject to 
        one or more restrictions,
so as to include an indication of such lack of authorization to work or 
such restrictions on such an authorization.
  (b) Report.--Not later than 1 year after the date of the enactment of 
this Act, the Commissioner shall report to the Committee on Ways and 
Means of the House of Representatives and the Committee on Finance of 
the Senate regarding the results of the study undertaken under this 
section. Such report shall include the Commissioner's recommendations 
of feasible options for modifying the social security account number in 
the manner described in subsection (a).

                         TITLE III--ENFORCEMENT

SEC. 301. NEW CRIMINAL PENALTIES FOR MISUSE OF SOCIAL SECURITY ACCOUNT 
                    NUMBERS.

  (a) In General.--Section 208(a) of the Social Security Act (42 U.S.C. 
408(a)) is amended--
          (1) in paragraph (7), by adding after subparagraph (C) the 
        following new subparagraph:
                  ``(D) with intent to deceive, discloses, sells, or 
                transfers his own social security account number, 
                assigned to him by the Commissioner of Social Security 
                (in the exercise of the Commissioner's authority under 
                section 205(c)(2) to establish and maintain records), 
                to any person; or'';
          (2) in paragraph (8), by adding ``or'' at the end; and
          (3) by inserting after paragraph (8) the following new 
        paragraphs:
          ``(9) without lawful authority, offers, for a fee, to acquire 
        for any individual, or to assist in acquiring for any 
        individual, an additional social security account number or a 
        number that purports to be a social security account number; or
          ``(10) being an officer or employee of any executive, 
        legislative, or judicial agency or instrumentality of the 
        Federal Government or of a State or political subdivision 
        thereof (or a person acting as an agent of such an agency or 
        instrumentality), willfully acts or fails to act so as to cause 
        a violation of section 205(c)(2)(C)(xi); or
          ``(11) being an officer or employee of any executive, 
        legislative, or judicial agency or instrumentality of the 
        Federal Government or of a State or political subdivision 
        thereof (or a person acting as an agent of such an agency or 
        instrumentality) in possession of any individual's social 
        security account number (or an officer or employee thereof or a 
        person acting as an agent thereof), willfully acts or fails to 
        act so as to cause a violation of clause (vi)(II), (x), (xi), 
        (xii), (xiii), or (xiv) of section 205(c)(2)(C); or
          ``(12) being a trustee appointed in a case under title 11, 
        United States Code (or an officer or employee thereof or a 
        person acting as an agent thereof), willfully acts or fails to 
        act so as to cause a violation of clause (x), (xi), or (xiv) of 
        section 205(c)(2)(C);''.
  (b) Effective Dates.--Paragraphs (7)(D) and (9) of section 208(a) of 
the Social Security Act (added by subsection (a)(2)) shall apply with 
respect to each violation occurring after the date of the enactment of 
this Act. Paragraphs (10), (11), and (12) of section 208(a) of such Act 
(added by subsection (a)(2)) shall apply with respect to each violation 
occurring on or after the effective date applicable with respect to 
such violation under title I.

SEC. 302. EXTENSION OF CIVIL MONETARY PENALTY AUTHORITY.

  (a) Application of Civil Money Penalties to Elements of Criminal 
Violations.--Section 1129(a) of the Social Security Act (42 U.S.C. 
1320a-8(a)) is amended--
          (1) by redesignating paragraphs (2) and (3) as paragraphs (4) 
        and (5), respectively;
          (2) by designating the last sentence of paragraph (1) as a 
        new paragraph (2), appearing after and below paragraph (1); and
          (3) by inserting after paragraph (2) (as designated under 
        paragraph (2) of this subsection) the following:
  ``(3) Any person (including an organization, agency, or other entity) 
who--
          ``(A) uses a social security account number that such person 
        knows or should know has been assigned by the Commissioner of 
        Social Security (in an exercise of authority under section 
        205(c)(2) to establish and maintain records) on the basis of 
        false information furnished to the Commissioner by any person;
          ``(B) falsely represents a number to be the social security 
        account number assigned by the Commissioner of Social Security 
        to any individual, when such person knows or should know that 
        such number is not the social security account number assigned 
        by the Commissioner to such individual;
          ``(C) knowingly alters a social security card issued by the 
        Commissioner of Social Security, or possesses such a card with 
        intent to alter it;
          ``(D) knowingly buys or sells a card that is, or purports to 
        be, a card issued by the Commissioner of Social Security, or 
        possesses such a card with intent to buy or sell it;
          ``(E) counterfeits a social security card, or possesses a 
        counterfeit social security card with intent to buy or sell it;
          ``(F) discloses, uses, compels the disclosure of, or 
        knowingly sells or purchases the social security account number 
        of any person in violation of the laws of the United States;
          ``(G) with intent to deceive the Commissioner of Social 
        Security as to such person's true identity (or the true 
        identity of any other person), furnishes or causes to be 
        furnished false information to the Commissioner with respect to 
        any information required by the Commissioner in connection with 
        the establishment and maintenance of the records provided for 
        in section 205(c)(2);
          ``(H) without lawful authority, offers, for a fee, to acquire 
        for any individual, or to assist in acquiring for any 
        individual, an additional social security account number or a 
        number which purports to be a social security account number;
          ``(I) with intent to deceive, discloses, sells, or transfers 
        his own social security account number, assigned to him by the 
        Commissioner of Social Security under section 205(c)(2)(B), to 
        any person;
          ``(J) being an officer or employee of any executive, 
        legislative, or judicial agency or instrumentality of the 
        Federal Government or of a State or political subdivision 
        thereof (or a person acting as an agent of such an agency or 
        instrumentality), in possession of any individual's social 
        security account number, willfully acts or fails to act so as 
        to cause a violation of clause (vi)(II), (x), (xi), (xii), 
        (xiii), or (xiv) of section 205(c)(2)(C);
          ``(K) being a trustee appointed in a case under title 11, 
        United States Code (or an officer or employee thereof or a 
        person acting as an agent thereof), willfully acts or fails to 
        act so as to cause a violation of clause (x), (xi), or (xiv) of 
        section 205(c)(2)(C);
          ``(L) violates section 208A (relating to prohibition of the 
        sale, purchase, or display of the social security account 
        number in the private sector); or
          ``(M) violates section 208B (relating to fraud by social 
        security administration employees);
shall be subject to, in addition to any other penalties that may be 
prescribed by law, a civil money penalty of not more than $5,000 for 
each violation. Such person shall also be subject to an assessment, in 
lieu of damages sustained by the United States resulting from such 
violation, of not more than twice the amount of any benefits or 
payments paid as a result of such violation.''.
  (b) Effective Dates.--The amendments made by this section shall apply 
with respect to violations committed after the date of the enactment of 
this Act, except that subparagraphs (J), (K), (L), and (M) of section 
1129(a)(3) of the Social Security Act (added by subsection (a)) shall 
apply with respect to violations occurring on or after the effective 
date provided in connection with such violations under title I.

SEC. 303. CRIMINAL PENALTIES FOR EMPLOYEES OF THE SOCIAL SECURITY 
                    ADMINISTRATION WHO KNOWINGLY AND FRAUDULENTLY ISSUE 
                    SOCIAL SECURITY CARDS OR SOCIAL SECURITY ACCOUNT 
                    NUMBERS.

  (a) In General.--Title II of the Social Security Act (as amended by 
the preceding provisions of this Act) is amended further by inserting 
after section 208A the following new section:
          ``fraud by social security administration employees
  ``Sec. 208B. (a) Whoever is an employee of the Social Security 
Administration and knowingly and fraudulently sells or transfers one or 
more social security account numbers or social security cards shall be 
guilty of a felony and upon conviction thereof shall be fined under 
title 18, United States Code, imprisoned as provided in subsection (b), 
or both.
  ``(b) Imprisonment for a violation described in subsection (a) shall 
be for--
  ``(1) not less than 1 year and up to 5 years, in the case of an 
employee of the Social Security Administration who has fraudulently 
sold or transferred not more than 50 social security account numbers or 
social security cards,
  ``(2) not less than 5 years and up to 10 years, in the case of an 
employee of the Social Security Administration who has fraudulently 
sold or transferred more than 50, but not more than 100, social 
security account numbers or social security cards, or
  ``(3) not less than 10 years and up to 20 years, in the case of an 
employee of the Social Security Administration who has fraudulently 
sold or transferred more than 100 social security account numbers or 
social security cards.
  ``(c) For purposes of this section--
          ``(1) The term `social security employee' means any State 
        employee of a State disability determination service, any 
        officer, employee, or contractor of the Social Security 
        Administration, any employee of such a contractor, or any 
        volunteer providing services or assistance in any facility of 
        the Social Security Administration.
          ``(2) The term `social security account number' means a 
        social security account number assigned by the Commissioner of 
        Social Security under section 205(c)(2)(B) or another number 
        that has not been so assigned but is purported to have been so 
        assigned.
          ``(3) The term `social security card' means a card issued by 
        the Commissioner of Social Security under section 205(c)(2)(G), 
        another card which has not been so issued but is purported to 
        have been so issued, and banknote paper of the type described 
        in section 205(c)(2)(G) prepared for the entry of social 
        security account numbers, whether fully completed or not.
  ``(d) Any employee of the Social Security Administration who attempts 
or conspires to commit any violation of this section shall be subject 
to the same penalties as those prescribed for the violation the 
commission of which was the object of the attempt or conspiracy.''.
  (b) Effective Date.--The amendments made by this section shall apply 
with respect to violations occurring on or after the date of the 
enactment of this Act.

SEC. 304. ENHANCED PENALTIES IN CASES OF TERRORISM, DRUG TRAFFICKING, 
                    CRIMES OF VIOLENCE, OR PRIOR OFFENSES.

  (a) Amendments to Title II.--Section 208 of the Social Security Act 
(42 U.S.C. 408) is amended--
          (1) in subsection (a), by striking ``shall be fined'' and all 
        that follows and inserting the following: ``shall be fined, 
        imprisoned, or both, as provided in subsection (b).'';
          (2) by striking subsection (c);
          (3) by redesignating subsection (b) as subsection (c); and
          (4) by inserting after subsection (a) the following new 
        subsection:
  ``(b) A person convicted of a violation described in subsection (a) 
shall be--
          ``(1) fined under title 18, United States Code, or imprisoned 
        for not more than 5 years, or both, in the case of an initial 
        violation, subject to paragraphs (3) and (4),
          ``(2) fined under title 18, United States Code, or imprisoned 
        for not more than 10 years, or both, in the case of a violation 
        which occurs after a prior conviction for another offense under 
        subsection (a) becomes final, subject to paragraphs (3) and 
        (4),
          ``(3) fined under title 18, United States Code, or imprisoned 
        for not more than 20 years, in the case of a violation which is 
        committed to facilitate a drug trafficking crime (as defined in 
        section 929(a)(2) of title 18, United States Code) or in 
        connection with a crime of violence (as defined in section 
        924(c)(3) of title 18, United States Code), subject to 
        paragraph (4), and
          ``(4) fined under title 18, United States Code, or imprisoned 
        for not more than 25 years, in the case of a violation which is 
        committed to facilitate an act of international or domestic 
        terrorism (as defined in paragraphs (1) and (5), respectively, 
        of section 2331 of title 18, United States Code).''.
  (b) Amendments to Title VIII.--Section 811 of such Act (42 U.S.C. 
1011) is amended--
          (1) in subsection (a), by striking ``shall be fined'' and all 
        that follows and inserting ``shall be fined, imprisoned, or 
        both, as provided in subsection (b).'';
          (2) by redesignating subsection (b) as subsection (c); and
          (3) by inserting after subsection (a) the following new 
        subsection:
  ``(b) Punishment.--A person convicted of a violation described in 
subsection (a) shall be--
          ``(1) fined under title 18, United States Code, or imprisoned 
        for not more than 5 years, or both, in the case of an initial 
        violation, subject to paragraphs (3) and (4),
          ``(2) fined under title 18, United States Code, or imprisoned 
        for not more than 10 years, or both, in the case of a violation 
        which occurs after a prior conviction for another offense under 
        subsection (a) becomes final, subject to paragraphs (3) and 
        (4),
          ``(3) fined under title 18, United States Code, or imprisoned 
        for not more than 20 years, in the case of a violation which is 
        committed to facilitate a drug trafficking crime (as defined in 
        section 929(a)(2) of title 18, United States Code) or in 
        connection with a crime of violence (as defined in section 
        924(c)(3) of title 18, United States Code), subject to 
        paragraph (4), and
          ``(4) fined under title 18, United States Code, or imprisoned 
        for not more than 25 years, in the case of a violation which is 
        committed to facilitate an act of international or domestic 
        terrorism (as defined in paragraphs (1) and (5), respectively, 
        of section 2331 of title 18, United States Code).''.
  (c) Amendments to Title XVI.--Section 1632 of such Act (42 U.S.C. 
1383a) is amended--
          (1) in subsection (a), by striking ``shall be fined'' and all 
        that follows and inserting ``shall be fined, imprisoned, or 
        both, as provided in subsection (b).'';
          (2) by redesignating subsections (b) and (c) as subsections 
        (c) and (d), respectively; and
          (3) by inserting after subsection (a) the following new 
        subsection:
  ``(b) A person convicted of a violation described in subsection (a) 
shall be--
          ``(1) fined under title 18, United States Code, or imprisoned 
        for not more than 5 years, or both, in the case of an initial 
        violation, subject to paragraphs (3) and (4),
          ``(2) fined under title 18, United States Code, or imprisoned 
        for not more than 10 years, or both, in the case of a violation 
        which occurs after a prior conviction for another offense under 
        subsection (a) becomes final, subject to paragraphs (3) and 
        (4),
          ``(3) fined under title 18, United States Code, or imprisoned 
        for not more than 20 years, in the case of a violation which is 
        committed to facilitate a drug trafficking crime (as defined in 
        section 929(a)(2) of title 18, United States Code) or in 
        connection with a crime of violence (as defined in section 
        924(c)(3) of title 18, United States Code), subject to 
        paragraph (4), and
          ``(4) fined under title 18, United States Code, or imprisoned 
        for not more than 25 years, in the case of a violation which is 
        committed to facilitate an act of international or domestic 
        terrorism (as defined in paragraphs (1) and (5), respectively, 
        of section 2331 of title 18, United States Code).''.
  (d) Effective Date.--The amendments made by this section shall apply 
with respect to violations occurring after the date of the enactment of 
this Act.

                            I. INTRODUCTION

                         A. Purpose and Summary

    The purpose of the ``Social Security Number Privacy and 
Identity Theft Prevention Act of 2004,'' H.R. 2971, is to 
enhance Social Security number privacy protections, prevent 
misuse of Social Security numbers (SSNs), and to otherwise 
enhance protections against identity theft.
    The bill would restrict the sale, purchase and display to 
the general public of SSNs in the public and private sectors; 
provide additional measures to protect SSN privacy; ensure SSNs 
are assigned accurately; and create criminal and civil monetary 
penalties for persons who misuse SSNs.

                             B. Background

    The SSN was created in 1936 to track workers' earnings for 
the purpose of paying Social Security taxes and determining 
eligibility and benefit amounts upon retirement, or later upon 
disability. Since 1936, the Social Security Administration 
(SSA) has issued more than 400 million SSNs.
    Although the SSN was originally created for administering 
the Social Security program, its use has expanded dramatically 
throughout both the public and private sectors. Federal use of 
the SSN was first mandated by President Roosevelt in 1943 with 
Executive Order 9397. This Executive Order required that any 
Federal department establishing a new system of permanent 
account numbers pertaining to an individual must exclusively 
utilize the SSN and that such personal information must be kept 
confidential. Today the SSN is required for the administration 
of a number of government benefit programs and the Federal 
income tax.
    In addition to uses mandated by Federal law, the SSN is 
also widely used in the public and private sectors for purposes 
that are neither required nor prohibited by law. As a result, 
the SSN is generally regarded as the single-most widely used 
record identifier by both government and private sectors within 
the United States.
    Ubiquitous use of SSNs and the ease with which individuals 
can access another person's SSN have raised serious concerns 
over privacy and opportunities for identity theft and fraud. 
The Federal Trade Commission (FTC), the SSA, the SSA Inspector 
General and others acknowledge that SSNs play a pivotal role in 
identity theft. Even worse, terrorists may steal, fake, or 
purchase SSNs in order to operate in our society and abet their 
nefarious acts. According to an FTC-sponsored survey conducted 
in March and April 2003, nearly 10 million people--or 4.6 
percent of the adult population--discovered that they were 
victims of some form of identity theft in the past year, and it 
collectively cost individuals and businesses more than $50 
billion during that time period. Protecting the privacy of SSNs 
will help to protect our individual and national security.
    The absence of overarching Federal law regulating the sale, 
purchase, and display to the general public of SSNs, and the 
growing threat represented by SSN misuse and identity theft, 
have prompted a need to better protect the privacy and 
integrity of SSNs.

                         C. Legislative History

    During the 106th Congress, the Subcommittee held hearings 
on Social Security program integrity on March 30, 2000 (106-
38); representative payees on May 4, 2000 (106-57); use and 
misuse of Social Security numbers on May 9 and May 11, 2000 
(106-108); and the processing of attorney's fees on June 14, 
2000 (106-70). The information gained from these hearings led 
to the introduction of H.R. 4857, the ``Privacy and Identity 
Protection Act of 2000'' on July 13, 2000. The bill enhanced 
privacy protections for individuals, prevented fraudulent 
misuse of the Social Security number, and provided additional 
safeguards for Social Security and Supplemental Security Income 
beneficiaries with representative payees. A further hearing on 
protecting privacy and preventing misuse of the Social Security 
number was held on July 17, 2000 (106-43). On July 20, 2000, 
the Subcommittee on Social Security ordered favorably reported 
H.R. 4857, as amended. The Committee on Ways and Means ordered 
the bill favorably reported, as amended on September 28, 2000 
(H. Rept. 106-996 Part 1). The bill was not considered by the 
full House, as other committees of jurisdiction did not 
complete consideration of the bill.
    During the 107th Congress, the Subcommittee held a hearing 
on protecting privacy and preventing misuse of Social Security 
numbers on May 22, 2001 (107-31). In response to information 
gathered at this hearing and previous hearings in the 106th 
Congress, Subcommittee Chairman E. Clay Shaw, Jr., introduced 
H.R. 2036, the ``Social Security Number Privacy and Identity 
Theft Prevention Act of 2001'' on May 25, 2001. The bill 
restricted the sale, purchase, and display of Social Security 
numbers, limited dissemination of Social Security numbers by 
credit reporting agencies, and made it more difficult for 
businesses to deny services if a customer refused to provide 
his or her Social Security number. Further hearings were held 
on preventing identity theft by terrorists and criminals, held 
jointly with the Committee on Financial Services, Subcommittee 
on Oversight and Investigations on November 8, 2001 (107-51); 
protecting the privacy of Social Security numbers and 
preventing identity theft on April 29, 2002 (107-71); and 
preserving the integrity of Social Security numbers and 
preventing their misuse by terrorists and identity thieves, 
held jointly with the Committee on Judiciary, Subcommittee on 
Immigration, Border Security, and Claims on September 19, 2002 
(107-81). Neither the House nor the Senate acted on the bill.
    During the 108th Congress, the Subcommittee held a hearing 
on the use and misuse of Social Security numbers on July 10, 
2003 (108-35). The General Accounting Office (GAO) witness 
testified that SSNs are widely utilized in both the public and 
private sectors as an identifier, and cited numerous examples 
where public and private databases had been compromised and 
personal data, including SSNs, had been stolen. They also found 
that in some cases, the display of SSNs in public records and 
easily accessible websites provided an opportunity for identity 
thieves. The SSA Inspector General testified that the most 
important step in preventing SSN misuse is to limit its easy 
availability through public records, sale on the open market, 
and unnecessary use. Consumer advocate witnesses testified 
regarding the growing crime of identity theft, its impact on 
victims, and the need to protect the privacy of SSNs. A law 
enforcement witness testified that SSNs are key to the takeover 
of another individual's identity, described difficulties in 
prosecuting identity theft, and stated the need to restrict SSN 
use to necessary purposes.
    Based on information gathered at this hearing and hearings 
in previous Congresses, Subcommittee Chairman E. Clay Shaw, Jr. 
introduced H.R. 2971, the ``Social Security Number Privacy and 
Identity Theft Prevention Act of 2003'' on July 25, 2003. The 
bill was referred to the Committee on Ways and Means, the 
Committee on Financial Services, and the Committee on Energy 
and Commerce. The Subcommittee held a further hearing on 
enhancing Social Security number privacy on June 15, 2004, and 
marked up the bill on July 15, 2004. The bill was reported 
favorably to the full Committee on Ways and Means on July 15, 
2004, as amended, by voice vote. On July 21, 2004, the 
Committee on Ways and Means marked up H.R. 2971, as amended by 
the Subcommittee. Chairman Thomas offered an amendment in the 
nature of a substitute, which was agreed to by voice vote. The 
Committee then ordered favorably reported H.R. 2971, as 
amended, by a roll call vote of 33 ayes to 0 nays.
    In addition, during the 106th, 107th, and 108th Congresses, 
Subcommittee Chairman Shaw asked the GAO for a number of 
reports to inform the debate on SSN privacy and integrity. He 
requested several reports explaining how government agencies 
and private sector businesses such as consumer reporting 
agencies, information resellers, and health care organizations 
collect, utilize, and safeguard SSNs (Social Security, 
Government and Commercial Use of the Social Security Number is 
Widespread, GAO/HEHS-99-28; Social Security Numbers, Government 
Benefits from SSN Use But Could Provide Better Safeguards, GAO-
02-352; Social Security Numbers, Private Sector Entities 
Routinely Obtain and Use SSNs, and Laws Limit the Disclosure of 
This Information, GAO 04-11; Social Security Numbers, Use is 
Widespread and Protections Vary, GAO-04-768T). He also 
requested a report on the Social Security Administration's 
vulnerabilities to error and fraud in issuing SSNs to 
noncitizens and initiatives to address these vulnerabilities 
(Social Security Administration, Actions Taken to Strengthen 
Procedures for Issuing Social Security Numbers to Noncitizens 
But Some Weaknesses Remain, GAO-04-12).

                     II. SECTION-BY-SECTION SUMMARY

Sec. 1. Short title

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    Section 1 provides that the Act may be cited as the 
``Social Security Number Privacy and Identity Theft Prevention 
Act of 2004.''

                           REASON FOR CHANGE

    The section identifies the short title for the bill.

 TITLE I--PROVISIONS RELATING TO THE SOCIAL SECURITY ACCOUNT NUMBER IN 
                     THE PUBLIC AND PRIVATE SECTORS

Sec. 101. Restrictions on the sale or display to the general public of 
        Social Security account numbers by governmental agencies

                              CURRENT LAW

    The SSN is required by law for the administration of a 
number of Federal programs. In addition, Federal law permits 
States to require the SSN in the administration of certain 
State programs, and in other cases Federal law requires the 
States to use the SSN in the administration of Federal or State 
programs. No Federal law regulates the overall use of SSNs by 
Federal, State or local governments. The ``Department of 
Transportation and Related Agencies Appropriations Act'' (P.L. 
106-346) amended the ``Driver's Privacy Protection Act of 
1994'' (P.L. 103-322) to require States to obtain express 
consent of drivers before sharing or selling drivers' ``highly 
restricted personal information,'' including SSNs, except under 
very limited circumstances.

                        EXPLANATION OF PROVISION

    The bill would restrict the sale or display to the general 
public of full or partial SSNs by Federal, State or local 
governmental agencies and their agents, or by a bankruptcy 
trustee. The sale of SSNs would be permitted as follows:
          1. As specifically authorized by the ``Social 
        Security Act'' (P.L. 74-271);
          2. For law enforcement or national security purposes;
          3. for tax complliance;
          4. By State departments of motor vehicles for use by 
        a government agency in carrying out its functions; for 
        use by an insurer for claims investigation, anti-fraud 
        activities, and rating or underwriting; and for use by 
        an employer to obtain or verify information about a 
        holder of a commercial driver's license;
          5. To a consumer reporting agency under the ``Fair 
        Credit Reporting Act'' (FCRA) (P.L. 91-508) solely for 
        use or disclosure for permissible purposes under the 
        FCRA as follows: as ordered by a court or a Federal 
        grand jury subpoena; as instructed by the consumer in 
        writing; for the extension of credit based on a 
        consumer's application; for review or collection of a 
        consumer's account; for employment purposes (with the 
        consumer's permission); for insurance underwriting 
        based on a consumer's application; when there is a 
        legitimate business need to process a transaction the 
        consumer initiates; to review whether a customer meets 
        the terms of his or her account; to determine a 
        consumer's eligibility for a license or other benefit 
        granted by a government agency; to analyze the credit 
        or prepayment risks associated with an existing credit 
        obligation; and for use by State and local officials 
        for child support payment purposes;
          6. For government research advancing the public good.
    In addition, the U.S. Attorney General would be permitted 
to authorize sale and display to the general public of SSNs in 
other circumstances as determined appropriate.
    The restrictions on sale or display to the general public 
of SSNs would not apply to SSNs of deceased persons.
    The restrictions that would be established under this 
provision would not override other restrictions or limitations 
in Federal law or regulations to the extent that current law 
provides greater protections for SSNs than would be created 
under this provision in the bill.
    The bill would define ``sell'' as accepting an item of 
material value in exchange for an SSN. ``Display to the general 
public'' would mean to intentionally place an SSN in a viewable 
manner on an Internet site that is available to the general 
public or to provide access to the general public by other 
means. In addition, requiring an individual to transmit his or 
her SSN over the Internet without ensuring the number is 
encrypted or otherwise protected would be considered a 
prohibited display to the general public. ``Social Security 
account number'' would include a partial SSN, except for the 
last 4 digits for a period of 6 years after the deadline to 
issue regulations implementing the provisions.

                           REASON FOR CHANGE

    The government created the SSN and requires its use for a 
broad range of interactions between individuals and the 
government, including tax administration, many benefit 
programs, and driver's and professional licenses. While there 
are laws protecting the privacy of SSNs held by certain 
agencies or under specific circumstances, there is no 
comprehensive law protecting the privacy of SSNs held by 
Federal, State, and local government agencies. As a result, 
SSNs may be sold, displayed on the Internet, or otherwise made 
available to the general public on paper, computer disk, or 
other means to individuals requesting a copy--for example 
through open court or other government records--and may be 
obtained by third parties who can subsequently sell or display 
the information to others.
    Since SSNs are the key to accessing an individual's 
financial and other personal information, the wide 
accessibility of SSNs has raised serious concerns over privacy. 
Testimony before the Subcommittee on Social Security highlights 
the relative ease by which an individual can obtain another 
person's SSN and use the information to commit identity theft 
or other crimes. Restricting the display to the general public 
and sale of SSNs by governments will help curb fraudulent 
activity by making it more difficult for criminals to access 
this personal information.
    The bill would provide specific exceptions to permit the 
continuation of SSN exchanges that provide important benefits 
in the public interest--such as law enforcement (including 
child support enforcement); administration of government 
programs, including Supplemental Security Income, Medicaid, and 
unemployment insurance; limited commercial purposes such as 
granting credit and insurance; tax administration; and 
government research advancing the public good. In addition, 
authority would be given to the U.S. Attorney General to 
authorize sale and display to the general public of SSNs as 
determined appropriate under guidelines specified in Section 
102 of the bill. Since SSN use is so pervasive in both the 
public and private sector, is linked to so many government and 
business transactions, and because of evolving needs regarding 
SSN utilization and new technologies to facilitate information 
exchanges, this exception is intended to allow the U.S. 
Attorney General or agencies to which it delegates authority to 
thoroughly evaluate how SSNs are sold and displayed, the degree 
to which they are convenient versus essential to such 
exchanges, and to modify the rules as needed. However, it is 
expected that this authority would be used extremely 
judiciously, and not merely for the sake of facilitating 
transactions or data-matching that could be reasonably 
accomplished without the use of the SSN. In comparing the costs 
and benefits of authorizing SSN sale or display to the general 
public, it is expected that the U.S. Attorney General and other 
agencies would give significant weight to the need to maintain 
individuals' privacy and safety, as well as the bill's purpose 
of preventing identity theft.
    With respect to the exception for research advancing the 
public good, the intent is to preserve the government's ability 
to conduct scientific, epidemiological, and social scientific 
research that would benefit the public. In the case of research 
involving medical information on individuals, it is expected 
that the SSA and the U.S. Attorney General will only authorize 
sale of SSNs in strict compliance with Federal rules and 
regulations on the privacy of medical information.
    The restrictions on sale and display to the general public 
of SSNs would not apply to the SSNs of deceased persons. This 
is because the sale and public availability of information on 
deceased individuals is necessary to prevent waste, fraud, and 
abuse. The SSA compiles a Death Master File (DMF), which 
contains the name, date of birth, date of death, SSN, and other 
information for about 70 million individuals. The SSA DMF is 
used by leading government, financial, investigative, and 
credit reporting organizations, in medical research and by 
other industries to verify identity as well as to prevent fraud 
and comply with the ``Uniting and Strengthening America by 
Providing Appropriate Tools Required to Intercept and Obstruct 
Terrorism Act of 2001'' (USA PATRIOT Act) (P.L. 107-56).
    The restrictions on sale and display by government 
agencies, trustees, and their agents would only apply to SSNs 
they require individuals or others to provide. During Social 
Security Subcommittee hearings on the bill, court and other 
public records administrators testified they receive numerous 
documents filed by individuals, businesses, and attorneys that 
often include SSNs the government did not require to be 
submitted, and of which they are therefore unaware. They stated 
redaction of ``incidentally'' included SSNs would create a 
serious administrative burden, and it would require significant 
resources to review each document and redact such incidental 
SSNs. Therefore, the bill would make government agencies, 
trustees, and their agents responsible only for those SSNs they 
require individuals to submit, since they should be able to 
easily locate and redact them. For example, a court requiring 
individuals to provide their SSNs on a coversheet for filed 
documents could remove the coversheet or redact the SSN before 
selling the court record or displaying it to the general 
public. With respect to SSNs submitted in court documents 
absent the court's requirement to do so, the individual 
communicating the SSN in the document, not the court, would be 
held responsible according to Section 108 of the bill.
    The restrictions established under this bill would serve as 
a floor of protection for SSNs, and are not intended to 
override SSN protections in current Federal law or regulations 
to the extent they provide greater restrictions on SSN sale, 
purchase, or display to the general public than would be 
created under the bill. For example, this bill is not intended 
to circumvent the provision included in the ``Food, 
Agriculture, Conservation, and Trade Act of 1990,'' (P.L. 101-
624) preventing the disclosure of SSNs maintained as the result 
of laws enacted on or after October 1, 1990.

                             EFFECTIVE DATE

    Final regulations to carry out the new restrictions on SSN 
sale and display to the general public created in this section 
of the bill would have to be issued by the Commissioner of 
Social Security (hereafter referred to as the Commissioner), 
the U.S. Attorney General, or any other agency to which the 
U.S. Attorney General delegates authority within 18 calendar 
months after the date of enactment. The provisions would take 
effect one year after issuance of regulations. The provisions 
would not apply to records generated prior to the date the 
provisions become effective.

Sec. 102. Regulatory authority

                              CURRENT LAW

    No provision in current law.

                        EXPLANATION OF PROVISION

    The bill would direct the U.S. Attorney General to issue 
regulations regarding the sale, purchase, or display to the 
general public of SSNs and to provide an opportunity for public 
comment on regulations in accordance with the ``Administrative 
Procedure Act'' (P.L. 79-404). The U.S. Attorney General would 
be required to consult with the Commissioner, the Secretary of 
Health and Human Services the Secretary of Homeland Security, 
the Secretary of the Treasury, the Federal Trade Commission, 
the Comptroller of the Currency, the Director of the Office of 
Thrift Supervision, the Board of Governors of the Federal 
Reserve System, the Federal Deposit Insurance Corporation, the 
National Credit Union Administration, the Securities and 
Exchange Commission, State attorneys general and 
representatives of the State insurance commissioners as 
designated by the National Association of Insurance 
Commissioners.
    When authorizing the sale, purchase, or display of SSNs for 
law enforcement or national security purposes, the U.S. 
Attorney General would be required to find that the sale, 
purchase or display would serve a compelling public interest 
that cannot reasonably be served through alternative measures, 
and would not pose an unreasonable risk of identity theft, or 
harm to an individual.
    The U.S. Attorney General would be able to authorize the 
sale, purchase, or display to the general public of SSNs for 
purposes other than law enforcement or national security, only 
after considering the costs and benefits to the general public, 
businesses, commercial enterprises, non-profit associations, 
and governments. If the U.S. Attorney General authorizes the 
sale, purchase, or display to the general public of SSNs, he or 
she would be required to impose restrictions and conditions to 
reduce the likelihood of fraud and crime and to prevent an 
unreasonable risk of identity theft or bodily, emotional or 
financial harm to individuals.

                           REASON FOR CHANGE

    The SSN is widely used throughout the public and private 
sectors. Some uses are authorized or required under law, others 
are to facilitate data-matching and record-keeping, and still 
others are simply for convenience's sake. The development of 
coordinated regulations regarding SSN sale, purchase, and 
display across such diverse agencies and businesses makes it 
necessary to centralize regulatory authority with the SSA 
(which is responsible for issuing SSNs) and the U.S. Attorney 
General (which enforces criminal penalties with respect to SSN 
misuse under current law). In addition, the U.S. Attorney 
General would have authority to delegate rulemaking to other 
Federal agencies as appropriate, and would facilitate 
coordinated and consistent rulemaking.
    In addition, to address concerns that the limited list of 
exceptions does not enumerate all instances in which the sale, 
purchase, and display of SSNs may be essential and 
irreplaceable for government and business transactions, the 
U.S. Attorney General would be given authority to authorize the 
sale, purchase or display to the general public of SSNs. The 
legislation provides guidelines to ensure SSNs are exchanged 
only when there is no other alternative that could reasonably 
accomplish the objective, and with due consideration for the 
unintended and potentially harmful consequences to individuals, 
government agencies, and businesses that may result.

                             EFFECTIVE DATE

    The regulatory authority would be effective upon enactment.

Sec. 103. Prohibition of display of Social Security account numbers on 
        checks issued for payment by governmental agencies

                              CURRENT LAW

    No Federal law regulates the overall use of SSNs by 
Federal, State, or local governments. However, the ``Social 
Security Number Confidentiality Act of 2000'' ( P.L. 106-433) 
specifically directed the Secretary of the Treasury to take 
necessary action to ensure that SSNs are not visible on or 
through unopened mailings of checks or other drafts.

                        EXPLANATION OF PROVISION

    The bill would prohibit Federal, State, or local 
governments, or bankruptcy trustees, from including full or 
partial SSNs on checks issued for payment or on any documents 
accompanying checks.

                           REASON FOR CHANGE

    The Subcommittee has heard testimony from the Postal 
Inspection Service and consumer advocates that mail theft and 
rifling through trash for discarded documents are means by 
which identity thieves gain access to personal information, 
including SSNs.

                             EFFECTIVE DATE

    Would apply with respect to checks (and documents attached 
to or accompanying such checks) issued after one year after 
enactment.

Sec. 104. Prohibition of the display of Social Security account numbers 
        on driver's licenses or motor vehicle registrations

                              CURRENT LAW

    Many States have acted voluntarily to prohibit the display 
of SSNs on driver's licenses or other identification cards; 
however some States have made changing from an SSN to another 
number an option, but not a requirement.

                        EXPLANATION OF PROVISION

    The bill would prohibit States and their political 
subdivisions from placing a person's full or partial SSN on a 
driver's license, motor vehicle registration, or on any other 
document issued for purposes of identification of an 
individual. This would include use of a magnetic strip, bar 
code, or other means of communication to convey the full or 
partial SSN.

                           REASON FOR CHANGE

    The Subcommittee has heard testimony that loss or theft of 
driver's licenses or motor vehicle registrations that display 
the SSN contributes to identity theft. In addition, identity 
thieves may obtain bar code readers or other equipment that 
enables them to access SSNs that are stored in magnetic strips, 
bar codes, or smart chips on driver's licenses. However, this 
provision is not intended to prevent inclusion of encrypted 
SSNs (those that are transformed by a secret code to appear as 
other than the nine-digit number assigned by the Commissioner 
of Social Security when read or otherwise accessed by 
unauthorized parties).

                             EFFECTIVE DATE

    Would apply to licenses, registrations, and other documents 
issued or reissued after one year after enactment.

Sec. 105. Prohibition of the display of Personal Identification Numbers 
        on government employee identification cards or tags

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    The bill would prohibit government agencies and those 
providing employee benefits for the government agency from 
displaying an individual's full or partial SSN on any 
identification card or tag issued to the employee or an 
employee's family member. This would include use of a magnetic 
strip, bar code, or other means of communication to convey the 
full or partial SSN.

                           REASON FOR CHANGE

    SSNs are often utilized as employee identification numbers 
or customer account numbers for the sake of convenience. 
However, the display of SSNs on military identification tags, 
employee identification cards, health benefit cards, customer 
cards, and on other cards or tags that are required to be 
submitted or displayed to others unnecessarily increases the 
risk of identity theft. Similar prohibitions have been enacted 
under several State laws. However, this provision is not 
intended to prevent inclusion of encrypted SSNs (those that are 
transformed by a secret code to appear as other than the nine-
digit number assigned by the Commissioner of Social Security 
when read or otherwise accessed by unauthorized parties).

                             EFFECTIVE DATE

    Would apply with respect to cards or tags issued after one 
year after enactment.

Sec. 106. Prohibition of inmate access to Social Security account 
        numbers

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    The bill would prohibit Federal, State or local governments 
from employing prisoners in any capacity that would allow 
prisoners access to the SSNs of other individuals.

                           REASON FOR CHANGE

    Prisoners, including those who may have been incarcerated 
for identity theft, should not have access to SSNs, thereby 
posing a serious risk of identity theft or fraud. The 
Subcommittee has heard testimony regarding a serious instance 
where use of prisoner labor to process personal information 
resulted in a case of stalking (Beverly Dennis, et al. v. 
Metromail, et al., No. 96-04451, Travis County, Texas).

                             EFFECTIVE DATE

    Would apply with respect to employment or entry into 
contract for employment of prisoners on or after enactment. In 
the case of employment or contracts for employment in effect on 
the date of enactment, the prohibition would take effect 90 
days after enactment.

Sec. 107. Measures to preclude unauthorized disclosure of Social 
        Security account numbers and protect the confidentiality of 
        such numbers

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    With respect to Federal, State, and local government 
employees, the bill would restrict access to SSNs to employees 
whose responsibilities require access for administration or 
enforcement of the government agency's functions. Government 
agencies would be required to provide safeguards to prevent 
unauthorized access to SSNs and protect their confidentiality.

                           REASON FOR CHANGE

    There have been numerous reported cases of computer hackers 
obtaining SSNs from universities and other institutions. In 
addition, the Subcommittee has heard testimony on how identity 
theft rings may plant an employee inside an organization to 
access SSNs and personal information.
    Government agencies often ask or require individuals to 
provide their SSN to obtain benefits or services. Therefore, 
they have a responsibility to safeguard SSNs from unauthorized 
access by employees or other individuals.
    This provision is not intended to prevent government 
employees or those to whom government agencies contract work 
from accessing SSNs in cases where it is necessary for 
performance of their duties, or to impede data exchanges 
between government agencies that include SSN information and 
are in accordance with Section 101 of the bill. For example, it 
is not the intent to prevent State unemployment insurance 
agencies from sending wage records or claim information to 
other Federal, State, or local government agencies (e.g. for 
purposes of determining eligibility or benefit amounts for 
Temporary Assistance to Needy Families, Housing and Urban 
Development assistance, Food Stamps, Supplemental Security 
Income, etc.).

                             EFFECTIVE DATE

    Would take effect one year after the date of enactment.

Sec. 108. Prohibition of the sale, purchase, and display to the general 
        public of the Social Security account number in the private 
        sector

                              CURRENT LAW

    The Gramm-Leach-Bliley Act (GLBA)(P.L. 106-102) restricts 
the ability of financial institutions to disclose nonpublic 
personal information about consumers, including SSNs, to 
nonaffiliated third parties. The ``Health Insurance Portability 
and Accountability Act'' (HIPAA) (P.L. 104-191) Privacy Rule 
limits health plans, health care clearinghouses, and health 
care providers in disclosing certain protected information, 
including SSNs. Individuals must give specific authorization 
before health care providers and other covered entities may 
disclose protected information in most non-routine 
circumstances. However, no Federal law regulates the overall 
sale, purchase, and display to the general public of SSNs in 
the private sector.

                        EXPLANATION OF PROVISION

    The bill would prohibit the sale, purchase or display to 
the general public of an SSN. It also prohibits using an SSN to 
find an individual with the intent to injure or harm the 
individual, or using the individual's identity for illegal 
purposes.
    A person who violates this section would be guilty of a 
felony, subject to fines under Title 18 of the United States 
Code and/or imprisonment for up to five years.
    The bill would provide exceptions to the prohibitions on 
SSN sale and purchase for law enforcement; national security; 
public health; emergency health safety; tax compliance; by or 
to a consumer reporting agency for use or disclosure for 
permissible purposes described in the Fair Credit Reporting 
Act; and research (for advancing the public good and with 
restrictions to protect privacy of individuals).
    The bill would also provide exceptions for sale, purchase, 
and display to the general public of SSNs with the affirmative 
written consent of the individual, and under other 
circumstances determined appropriate according to regulations 
issued by the U.S. Attorney General.
    These prohibitions would not apply to SSNs of deceased 
persons.
    The bill would also prohibit disclosure of the SSN to 
government agencies absent a request to do so or the 
individual's written permission, except for law enforcement 
(including child support enforcement) or national security 
purposes.
    In addition, the bill would prohibit the display of full or 
partial SSNs on employee identification cards or tags, or cards 
or tags businesses and others require individuals to use to 
access goods and services.
    The bill would require businesses and others that collect 
and store SSNs to prevent unauthorized access by employees or 
other individuals.
    The restrictions that would be established under this 
provision would not override other restrictions or limitations 
in Federal law to the extent that current law provides greater 
protections for SSNs than would be created under this provision 
in the bill.
    The bill would define ``sell'' as obtaining directly or 
indirectly anything of value in exchange for the SSN. 
``Purchase'' would mean to provide, directly or indirectly, 
anything of value in exchange for the SSN. The terms ``sell'' 
and ``purchase'' would not include submission of the SSN when 
applying for government benefits or programs, use of SSNs in 
administration of employee benefit plans, or the sale, lease, 
merger, transfer, or exchange of a trade or business.
    ``Display to the general public'' would mean to 
intentionally place an SSN in a viewable manner on an Internet 
site that is available to the general public or to provide 
access to the general public by other means. In addition, 
requiring an individual to transmit his or her SSN over the 
Internet without ensuring the number is encrypted or otherwise 
protected would be considered a prohibited display to the 
general public.
    ``Social Security account number'' would include a partial 
SSN, except for the last 4 digits for a period of 6 years after 
the deadline to issue regulations to implement the provisions.

                           REASON FOR CHANGE

    Use of SSNs in the private sector has proliferated for 
purposes unrelated to administration of the Social Security 
program, collection of taxes, or other purposes authorized 
under Federal law. Businesses may request a person's SSN as a 
condition of providing goods or services. Information resellers 
and consumer reporting agencies obtain SSNs and other personal 
information from customers, public records, and other sources 
to determine an individual's identity and accumulate 
information about them in order to provide that information to 
businesses or others for a fee. As a result, Americans are 
increasingly concerned that the SSN they disclose for one 
purpose may be subsequently sold to third parties and used for 
other purposes without their knowledge or consent. For example, 
an individual discloses his SSN to get a bank loan. The bank 
sends the information to a consumer reporting agency to request 
a credit report. The consumer reporting agency assembles 
information on the individual and associates it with the SSN. 
The consumer reporting agency may then incidentally or 
purposefully sell the SSN and other information to insurance 
companies, credit companies, information resellers, law 
enforcement, government agencies, private investigators, and 
others.
    In addition, such widespread use of SSNs increases the risk 
that business employees, computer hackers, or others may obtain 
unauthorized access and misuse SSNs to commit identity theft or 
other crimes. According to an FTC-sponsored survey in 2003, 
among identity theft victims who knew the identity of the 
criminal, 23 percent said the person responsible worked at a 
company or financial institution that had access to the 
victim's personal information.
    The bill would restrict the sale, purchase, and display to 
the general public of SSNs (examples of display to the general 
public, in addition to display over the Internet, would include 
making copies of SSNs available on paper, computer disk, or 
other media). The bill would also require that SSNs be 
appropriately safeguarded when collected and stored. The intent 
is to limit transmission of SSNs in order to minimize 
opportunities for SSN misuse and identity theft.
    In limiting the transmission of SSNs, it is not the intent 
to prevent individuals from voluntarily providing their own SSN 
to facilitate a transaction that they initiate or to prevent 
businesses from utilizing SSNs in a transaction that the 
individual authorizes. For example, if an individual 
voluntarily gives his or her own SSN to a business so that it 
may provide goods or services, is not the intent of the bill to 
call such an exchange the ``sale'' or ``purchase'' of the SSN 
simply because it is facilitating the transaction.
    In addition, during the course of the Subcommittee's 
consideration of the bill, the Federal Deposit Insurance 
Corporation (FDIC) expressed concern that the bill's 
restrictions on sale and purchase of SSNs could be interpreted 
to impede the FDIC's resolution or liquidation of failed 
insured depository institutions. However, the bill's language 
clarifying that ``sell'' or ``purchase'' does not include the 
sale, lease, merger, transfer, or exchange of a trade or 
business is intended to make clear that the FDIC may share SSNs 
in carrying out its responsibilities.
    The bill would provide specific exceptions to the 
restrictions on sale and purchase of SSNs for law enforcement; 
national security; emergency health situations; public health; 
compliance with tax laws; for certain credit, insurance, and 
employment purposes; and research for advancing the public 
good. The bill would provide exceptions to restrictions on 
sale, purchase, and display to the general public of SSNs with 
the individual's voluntary and affirmative consent and under 
circumstances deemed appropriate by the U.S. Attorney General.
    With respect to the exception for research advancing the 
public good, the intent is to preserve the government's ability 
to conduct scientific, epidemiological, and social scientific 
research that would benefit the public. It is not intended to 
facilitate private commercial research for product or service 
development or marketing. In the case of not-for-profit or 
other research advancing the public good, the U.S. Attorney 
General would have the ability to authorize SSN sale and 
purchase where appropriate in accordance with Section 102 of 
the bill. In the case of research involving medical information 
on individuals, it is expected that the SSA and the U.S. 
Attorney General will only authorize sale of SSNs in strict 
compliance with Federal rules and regulations on the privacy of 
medical information.
    With respect to the exception for affirmative written 
consent of the individual, the intent is to enable individuals 
to authorize the sale, purchase, and display to the general 
public of their own SSNs if they determine it is in their own 
best interest. For example, an individual may choose to provide 
his or her SSN to a business and authorize the SSN's sale in 
order to speed up a transaction. Businesses and others 
soliciting such consent from the individual must explain 
clearly and understandably what giving consent would entail and 
the uses that might be made of the individual's SSN. 
Preferably, the explanation and solicitation of consent would 
be a distinct document or other communication separate from 
other explanations or solicitations from the business or other 
persons. The terms of consent, and the explanation of the right 
to refuse consent or to limit the SSN's exchange solely to a 
specific transaction, should not be obscured by other 
explanations, authorizations, solicitations or other text that 
might be included in the same document. No individual should be 
obligated to provide consent; however, businesses and others 
may provide an explanation of the advantages and disadvantages 
(with equal prominence given to both) of providing versus 
refusing consent.
    With respect to the exception permitting the U.S. Attorney 
General to authorize SSN sale, purchase, and display to the 
general public, for the same reasons discussed under Section 
101, the expectation is that this authority would be used 
extremely judiciously and only when there are no other 
reasonable alternative measures that could attain the same 
objective.
    For the same reasons discussed under Section 105, the bill 
would prevent private sector employers and those providing 
employee benefits from displaying an individual's full or 
partial SSN on any identification card or tag issued to the 
employee or an employee's family member. In addition, the bill 
would prevent businesses from displaying full or partial SSNs 
on cards or tags used to access goods and services. Individuals 
who must carry such cards and tags with their SSNs are at 
greater risk of identity theft should their wallets or purses 
be stolen or lost. According to an FTC-sponsored survey, 14 
percent of identity theft victims said their personal 
information was obtained from a lost or stolen wallet, or 
checkbook.
    Section 101 of the bill would prohibit government agencies 
from selling or displaying to the general public SSNs they 
require individuals to disclose to the government. However, 
many of the SSNs that appear in government records, 
particularly court records, result from attorneys, title 
companies, or other businesses and individuals including a 
person's SSN on papers submitted to the court for convenience's 
sake. Government agencies do not have the resources to comb 
through innumerable documents searching for such ``incidental'' 
inclusion of SSNs. As a result, an individual's SSN could be 
displayed to the public without the individual realizing it. 
Therefore, to prevent inadvertent sale or display of SSNs by 
government agencies, the bill would prohibit the submission of 
the SSN to government agencies absent the government agency's 
requiring that the number be submitted or the individual's 
written consent.
    The restrictions on private sector sale, purchase, and 
display to the general public of SSNs would not apply to the 
SSNs of deceased persons. This is because the sale and public 
availability of information on deceased individuals is 
necessary to prevent fraud. As mentioned in the discussion 
under Section 101, the SSA DMF is used by both public and 
private sector entities to prevent fraud and comply with the 
USA PATRIOT Act. By methodically running financial, credit, 
payment and other applications against the DMF, the financial 
community, insurance companies, security firms and State and 
local governments are better able to identify and prevent 
identity fraud. The USA PATRIOT Act requires an effort to 
verify the identity of customers, including procedures to 
verify customer identity and maintaining records of information 
used to verify identity.
    As discussed under Section 101, this bill is intended to 
serve as a floor of protection for SSNs and is not intended to 
override SSN protections in current Federal law or regulations 
to the extent they provide greater restrictions. For example, 
this bill is not intended to enable SSN sale, purchase, or 
display to the general public by health providers that would 
otherwise be prohibited under the HIPAA Privacy Rule.

                             EFFECTIVE DATE

    Final regulations to carry out the new restrictions on SSN 
sale, purchase, and display to the general public created in 
this section of the bill would have to be issued by the 
Commissioner, the U.S. Attorney General, or any other agency to 
which the U.S. Attorney General delegates authority within 18 
calendar months after the date of enactment. The provisions 
would take effect one year after issuance of regulations.

Sec. 109. Confidential treatment of Credit Header information

                              CURRENT LAW

    The Fair Credit Reporting Act (FCRA) imposes certain 
restrictions on the disclosure of ``consumer report'' 
information. However, information at the top of the credit 
report, known as ``credit header'' information, which includes 
SSNs, is not subject to these restrictions. The GLBA imposed 
some restrictions on release of credit header information, but 
the exceptions under which SSNs may be released under the GLBA 
are broader than the permissible purposes for which a consumer 
report may be released.

                        EXPLANATION OF PROVISION

    The bill would include the SSN in the definition of 
``credit report'' under the FCRA so that the SSN receives the 
same privacy protections as other consumer credit information.

                           REASON FOR CHANGE

    Consumer reporting agencies compile information on 
individuals' credit worthiness, credit standing, credit 
capacity, character, general reputation, personal 
characteristics, or mode of living. This highly personal 
information may be released only for purposes specified in the 
FCRA, such as credit issuance, insurance, employment, review of 
consumer accounts, certain government licenses or benefits, 
child support determinations, and other business transactions.
    SSNs are the key to accessing information in a credit 
report, and deserve the same protection as the information 
itself. While the GLBA affords SSNs some protections, consumer 
reporting agencies may sell credit header information, 
including the SSN, for purposes beyond those permitted under 
the FCRA for credit reports or for a purpose beyond that for 
which the SSN was provided, thus increasing the risk SSNs will 
be used for identity theft or other crimes.

                             EFFECTIVE DATE

    Would take effect 90 days after enactment.

Sec. 110. Refusal to do business without receipt of Social Security 
        account number considered unfair or deceptive act or practice

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    The bill would make it an unfair or deceptive act or 
practice in violation of the Federal Trade Commission Act (15 
U.S.C. Sec. 45) for any person to refuse to do business with an 
individual because the individual will not provide his or her 
SSN. An exception is provided where the SSN is expressly 
required under Federal law.

                           REASON FOR CHANGE

    Businesses may currently request a customer's SSN without 
being required to collect it under current law. They may also 
refuse to provide goods or services if the customer refuses to 
provide it. Once a business obtains a customer's SSN, there may 
be little or no oversight or regulation over how that business 
uses or shares that key piece of personal information, 
depending on the type of business.
    The FTC, the SSA, and others warn individuals to avoid 
supplying an SSN and ask businesses to use another number 
whenever possible. Such warnings are justified, as the 
Subcommittee has heard testimony discussing identity theft 
abetted by unauthorized access to personal information by 
business employees.

                             EFFECTIVE DATE

    Would apply to acts or practices committed after 180 days 
after enactment.

 TITLE II--MEASURES TO ENSURE THE INTEGRITY OF APPLICATIONS FOR SOCIAL 
     SECURITY ACCOUNT NUMBERS AND REPLACEMENT SOCIAL SECURITY CARDS

Sec. 201. Independent verification of birth records provided in support 
        of applications for Social Security account numbers

                              CURRENT LAW

    Section 205(c)(2)(B)(ii) of the Social Security Act directs 
the Commissioner to require persons applying for an SSN to 
provide documentary evidence necessary to establish the 
individual's age, true identity, U.S. citizenship or lawful 
alien status, and any previously assigned SSNs. Section 
205(c)(2)(A) of the Social Security Act specifies that 
information obtained by or submitted to the Commissioner shall 
be subject to verification as the Commissioner deems necessary.
    As of 2002, SSA policy requires field office staff to 
obtain independent third-party verification of birth records 
for U.S.-born citizens age one and older. SSA policy does not 
require independent verification of birth records for children 
under age one (in such cases birth records are subject to 
visual inspection only).
    In addition, SSA policy requires independent third-party 
verification of the immigration and work status of non-citizens 
before issuing an SSN.

                        EXPLANATION OF PROVISION

    The bill would direct the Commissioner to require 
independent verification of birth records provided by 
individuals applying for an SSN, except in cases of enumeration 
at birth. The bill would authorize the Commissioner to issue 
regulations to provide reasonable exceptions to this 
requirement in cases where the Commissioner determines there is 
minimal opportunity for fraud.
    In addition, the bill would require the Commissioner to 
undertake a study to determine the feasibility and cost 
effectiveness of verifying all identification documents 
submitted by persons applying for a replacement Social Security 
card, including the feasibility and cost of developing 
electronic processes for third party verification of documents 
issued by Federal, State and local agencies.

                           REASON FOR CHANGE

    In testimony before the Subcommittee, the General 
Accounting Office (GAO) stated that the SSA's policies related 
to assigning SSNs to children under age one could be exploited 
by individuals seeking fraudulent SSNs. GAO investigators 
working undercover were able to obtain two SSNs by posing as 
parents of newborns and using counterfeit documents.
    Audits and testimony by the SSA Inspector General also 
identified the assignment of SSNs to children as prone to 
fraud. In a 2000 audit, the SSA Inspector General reviewed over 
3,500 original SSNs issued, and found 999 (28 percent) were 
assigned based on invalid or unacceptable documents. Of those, 
56 SSN cards were issued to non-existent children.

                             EFFECTIVE DATE

    The provision requiring independent verification of birth 
records for newly issued SSNs would take effect with regard to 
applications for SSNs filed after 270 days after the date of 
enactment. The Commissioner would be required to report the 
results of the study on requiring verification of all 
identification documents for replacement SSN cards no later 
than two years after enactment.

Sec. 202. Enumeration at birth

                              CURRENT LAW

    In States where the SSA has entered into an agreement, 
parents may request that the SSA assign an SSN to a newborn 
child as part of the official birth registration process (the 
parent need not fill out an SSN application form). In such 
cases, the State vital statistics office electronically 
transmits the request along with the child's name, date and 
place of birth, sex, mother's maiden name, father's name (if 
shown), address of the mother and birth certificate number to 
the SSA's central office in Baltimore. The SSA uses the birth 
registration information to establish the age, identity, and 
U.S. citizenship of the newborn child. The SSA then assigns an 
SSN to the child and sends the SSN card to the child at the 
mother's address.

                        EXPLANATION OF PROVISION

    The bill would require the Commissioner to make 
improvements to the application process for SSNs issued to 
newborns. Specifically, the improvements would be designed to 
prevent (a) assignment of SSNs to unnamed children; (b) 
issuance of more than one SSN to the same child; and (c) other 
opportunities for obtaining an SSN fraudulently.
    In addition, the bill would require the Commissioner to 
undertake a study to determine options for improving the 
enumeration at birth process, including an examination of 
methods available to reconcile hospital birth records with 
birth registrations submitted to State and local government 
agencies and information provided to the SSA.

                           REASON FOR CHANGE

    Nearly 4 million SSNs (more than 70 percent of new SSNs) 
were issued through the enumeration at birth (EAB) program in 
fiscal year 2003. However, a 2001 audit by the SSA Inspector 
General found several weaknesses in the EAB program. The SSA 
Inspector General found that the SSA was vulnerable to 
potential error or fraud due to lack of segregation of duties 
within hospitals' birth registration units and found instances 
where multiple SSNs were issued to a child or where SSNs were 
issued to unnamed children (e.g., with name listed as ``Baby'' 
or ``Infant'').
    The SSA Inspector General recommended that the SSA perform 
periodic independent reconciliations of registered births with 
statistics obtained from the hospitals' labor and delivery 
units and periodically verify the legitimacy of a sample of 
birth records obtained from hospitals. The SSA Inspector 
General also recommended enhancement of routines to prevent 
assignment of multiple SSNs, additional training for SSA 
personnel, and continued monitoring and improvement of the 
timeliness of Bureau of Vital Statistics submissions.

                             EFFECTIVE DATE

    The Commissioner would be required to report to Congress on 
the extent to which such improvements have been made no later 
than one year after enactment.
    The Commissioner would be required to report the results of 
the study to the House Committee on Ways and Means and the 
Senate Committee on Finance no later than 18 months after 
enactment.

Sec. 203. Study relating to use of photographic identification in 
        connection with applications for benefits, Social Security 
        account numbers, and Social Security cards

                              CURRENT LAW

    Individuals must submit proof of age, U.S. citizenship or 
lawful alien status, and identity when applying for an SSN or 
Social Security benefits (additional evidence is required for 
benefit applications). Persons applying for a replacement SSN 
card must submit proof of identity and may be required to 
submit proof of age and U.S. citizenship or lawful alien 
status. An in-person interview is required for SSN applicants 
age 12 and older and may be required for other applicants.
    Examples of documents that may be submitted as proof of 
identity include a driver's license, marriage or divorce 
record, life insurance policy or passport. Photo identification 
is preferred but not required.

                        EXPLANATION OF PROVISION

    The bill would require the Commissioner to undertake a 
study to determine the best method by which to (a) require and 
obtain photo identification of persons applying for Social 
Security benefits, an SSN, or a replacement SSN card, and (b) 
provide reasonable exceptions to this requirement to promote 
efficient and effective administration of the Social Security 
program.
    In addition, the study would be required to include an 
evaluation of the costs and benefits of photo identification, 
including the degree to which the security and integrity of the 
Social Security program would be enhanced.

                           REASON FOR CHANGE

    The SSA has conducted pilot projects in which the agency 
requested photographic identification from individuals filing 
for Social Security or SSI benefits based on a disability or 
blindness. The purpose was to gather information on the use of 
photographic identification to address the issue of complicit 
impersonation in the disability claims process. However, SSN 
issuance and other benefit applications are also vulnerable to 
fraud, and requiring photographic identification in these 
circumstances should be studied as well.

                             EFFECTIVE DATE

    The Commissioner would be required to report the results of 
the study to the House Committee on Ways and Means and the 
Senate Committee on Finance no later than 18 months after 
enactment.

Sec. 204. Restrictions on issuance of multiple replacement Social 
        Security cards

                              CURRENT LAW

    Federal regulations specify that, in the case of a lost or 
damaged Social Security card, a duplicate card bearing the same 
name and number may be issued. In the case of a name change, a 
corrected card bearing the same number and new name may be 
issued. SSA policy allows individuals to obtain up to 52 
replacement cards per year, with no lifetime limit.

                        EXPLANATION OF PROVISION

    The bill would require the Commissioner to restrict 
issuance of replacement SSN cards issued to any individual to 3 
per year and 10 for life, except in cases where the 
Commissioner determines there is minimal opportunity for fraud.

                           REASON FOR CHANGE

    Of the nearly 18 million SSN cards issued in fiscal year 
2003, more than 12 million (69 percent) were replacement cards. 
In testimony before the Committee on Ways and Means, 
Subcommittee on Social Security, the GAO stated that the SSA's 
policy for replacing Social Security cards increases the 
potential for misuse of SSNs, and recommended limiting 
replacement SSN card issuance. The ability to obtain numerous 
replacement SSN cards increases the vulnerability that 
requestors may obtain SSNs for a wide range of illicit uses, 
including selling them to non-citizens to enable them to work 
or to individuals seeking to hide their identity.
    The SSA Inspector General also stated that the SSA is at 
risk from individuals who misuse replacement SSN cards. In a 
2001 audit, the SSA Inspector General found irregularities 
among a sample of individuals issued 3-6 replacement cards 
within a year, which indicated the individuals obtained 
replacement cards for suspect reasons. These irregularities 
included SSN holders who had earnings higher than would be 
expected given the individual's age, number of employers, and 
type of employment; an improbable number of replacement cards 
issued based on the individual's age; wages reported under the 
individual's SSN but not the individual's name as stated on the 
card issued; and individuals with earnings who were also 
drawing disability benefits. The SSA Inspector General 
recommended restricting issuance of replacement SSN cards to an 
individual to 3 per year and 10 over an individual's lifetime.

                             EFFECTIVE DATE

    The Commissioner would be required to issue regulations no 
later than one year after enactment.

Sec. 205. Study relating to modification of the Social Security account 
        numbering system to show work authorization status

                              CURRENT LAW

    SSN cards issued to persons other than U.S. citizens or 
persons lawfully admitted to the U.S. with permanent work 
authorization from the Department of Homeland Security (DHS) 
(which subsumed the former Immigration and Naturalization 
Service [INS]) are annotated to indicate the individual's work 
authorization status, as follows:
          (1) SSN cards issued to persons lawfully admitted to 
        the U.S. on a temporary basis with DHS work 
        authorization are inscribed ``VALID FOR WORK ONLY WITH 
        INS AUTHORIZATION.''
          (2) SSN cards issued to persons lawfully admitted to 
        the U.S. without DHS work authorization are inscribed 
        ``NOT VALID FOR EMPLOYMENT.'' Such persons may be 
        assigned an SSN only for valid non-work purposes, such 
        as when Federal statute or regulation requires an SSN 
        to receive Federally-funded benefits, or when a State 
        or local law requires an SSN to receive general public 
        assistance benefits.
    While SSN cards (and SSA records) are annotated to indicate 
an individual's work authorization status at the time a number 
is assigned in cases described above, the current Social 
Security numbering system does not reflect an individual's work 
authorization status.

                        EXPLANATION OF PROVISION

    The bill would require the Commissioner, in consultation 
with the Secretary of Homeland Security, to undertake a study 
to determine the best method by which to modify SSNs assigned 
to persons who (1) are not United States citizens, (2) have not 
been admitted for permanent residence, and (3) are not legally 
authorized to work in the United States or are authorized to 
work in the United States with restriction, to indicate the 
individual's work authorization status.

                           REASON FOR CHANGE

    Employers are required to solicit a worker's SSN in order 
to report their wages and pay Social Security taxes. A worker 
may also submit the SSN card as part of the proof required by 
the Department of Homeland Security (Form I-9) that an 
individual is authorized to work in the United States.
    However, employers are not required to see the SSN card, 
nor are they required to verify a verbally-provided SSN with 
the SSA or confirm work authorization by contacting the 
Department of Homeland Security. Since SSNs may be issued for 
non-work purposes in limited situations, or based on temporary 
work authorization, modifying the SSN itself to indicate 
whether or not it was issued based on permanent authorization 
to work could potentially help employers determine whether an 
individual is truly authorized to work in the United States 
without placing additional documentation burdens on them.

                             EFFECTIVE DATE

    The Commissioner would be required to report the results of 
the study to the Committee on Ways and Means and the Committee 
on Finance no later than one year after enactment.

                         TITLE III--ENFORCEMENT

Sec. 301. New criminal penalties for misuse of Social Security account 
        numbers

                              CURRENT LAW

    Section 208 of the Social Security Act provides criminal 
penalties for fraudulently obtaining an SSN from the SSA or the 
misuse of an SSN. In such cases, Section 208 specifies that 
persons shall be guilty of a felony and upon conviction shall 
be fined under Title 18, United States Code (up to $250,000 for 
an individual and up to $500,000 for an organization) and/or 
imprisoned for up to five years.
    In addition, depending upon the facts, certain sections 
under Title 18 of the United States Code are applicable to the 
misuse of SSNs, including 18 U.S.C Sec. 1028(a)(7), the 
``Identity Theft and Assumption Deterrence Act of 1998'' (P.L. 
105-318), which prohibits the knowing transfer or use of 
another person's SSN without lawful authority. The ``Internet 
False Identification Prevention Act of 2000'' (P.L. 106-578) 
closed some loopholes in the ``Identity Theft and Assumption 
Deterrence Act of 1998'' by prohibiting the transfer of a false 
identification document by electronic means, including on a 
template or computer file or disc and repealed provisions of 
the Federal criminal code prohibiting the mailing of private 
identification documents without a disclaimer noting that such 
documents are not government produced.
    The ``Identity Theft Penalty Enhancement Act'' (P.L. 108-
275) establishes penalties for aggravated identity theft. The 
law prescribes sentences, to be imposed in addition to the 
punishments provided for the related felonies, of: (1) Two 
years' imprisonment for knowingly transferring, possessing, or 
using, without lawful authority, a means of identification of 
another person during and in relation to specified felony 
violations; and (2) five years' imprisonment for knowingly 
taking such action with respect to a means of identification or 
a false identification document during and in relation to 
specified felony violations pertaining to terrorist acts. The 
law also prohibits a court from: (1) Placing any person 
convicted of such a violation on probation; (2) reducing any 
sentence for the related felony to take into account the 
sentence imposed for such a violation; or (3) providing for 
concurrent terms of imprisonment for a violation of the Act and 
a violation under any other Act.
    Also, the new law expands the previous identity theft 
prohibition to: (1) Cover possession of a means of 
identification of another with intent to commit specified 
unlawful activity; (2) increase penalties for violations; and 
(3) include acts of domestic terrorism within the scope of a 
prohibition against facilitating an act of international 
terrorism.
    Lastly, P.L. 108-275 law modifies provisions regarding 
embezzlement and theft of public money, property, or records to 
provide for combining amounts from all the counts for which the 
defendant is convicted in a single case for purposes of 
determining which penalties apply.

                        EXPLANATION OF PROVISION

    The bill would expand the types of SSN misuse to which 
criminal penalties apply. Specifically, the bill would provide 
criminal penalties for persons who: (1) Disclose, sell or 
transfer their own SSN with intent to deceive; (2) offer, for a 
fee, to improperly acquire or help improperly acquire an 
additional SSN for an individual; (3) violate the prohibition 
on display of SSNs on employee identification cards or tags 
created under Section 105 of this bill; (4) violate the 
prohibitions the bill would establish under Sections 101, 103, 
104, 105, 106, or 107 of this bill (with respect to officers or 
employees of any Federal, State or local agency); or (5) 
violate Sections 101, 103, or 107 of this bill (with respect to 
bankruptcy trustees). (Note: the penalties for violations of 
Section 108 are included in Section 108 of the bill.)

                           REASON FOR CHANGE

    Identity theft often begins with the misuse of an SSN. 
While advances have been made to prosecute those individuals 
who assist another person to improperly acquire an additional 
SSN or a number that purports to be an SSN, the SSA Inspector 
General and the Department of Justice have continued to 
encounter some problems, for example in prosecuting individuals 
who operate over the Internet or at a flea market. It is 
appropriate to close loopholes to prevent individuals assisting 
another person to improperly acquire an additional SSN or a 
number that purports to be an SSN. In addition, it is 
appropriate to establish penalties for those who violate the 
prohibitions on sale, purchase and display to the general 
public established under this bill.
    In addition, the SSA Inspector General has investigated 
individuals who have sold or transferred their own SSN to a 
third person with intent to deceive and has encountered 
problems in the prosecution. While such an individual may 
potentially be prosecuted under the criminal statutes involving 
conspiracy or aiding and abetting, because of the gravity of 
SSN misuse, it is appropriate to address this problem head on 
and provide criminal penalties when an individual sells or 
transfers their SSN with intent to deceive.

                             EFFECTIVE DATE

    The criminal penalty would apply to violations that occur 
after enactment, except for violations under Title I of this 
bill. In such cases, the criminal penalty would apply to 
violations that occur on or after the applicable effective 
date.

Sec. 302. Extension of civil monetary penalty authority

                              CURRENT LAW

    Section 1129 of the Social Security Act (42 U.S.C. 
Sec. 408) authorizes the Commissioner to impose civil monetary 
penalties and assessments on any person who makes a false 
statement or representation of a material fact, or omits a 
material fact while providing a statement, for use in 
determining eligibility for Social Security or SSI benefits or 
benefit amount. The Commissioner may impose a civil monetary 
penalty of up to $5,000 for each violation, and an assessment 
of up to twice the amount of benefits or payments paid as a 
result of such violation.
    Currently, an individual who improperly obtains an SSN from 
SSA or misuses another person's SSN is not subject to civil 
monetary penalties and assessments under Section 1129, except 
in cases of SSN misuse related to the receipt of Social 
Security or SSI benefits.

                        EXPLANATION OF PROVISION

    The bill would expand the types of activities to which 
civil monetary penalties and assessments apply. Specifically, 
it would authorize the Commissioner to impose (in addition to 
any other penalties that may apply) civil monetary penalties 
and assessments on persons who: (1) Use an SSN obtained through 
false information; (2) falsely represent an SSN to be their 
own; (3) alter an SSN card; (4) buy or sell an SSN card; (5) 
counterfeit an SSN card; (6) disclose, use or compel the 
disclosure of the SSN of any person in violation of any Federal 
law; (7) provide false information to obtain an SSN; (8) offer 
to acquire, for a fee, an additional SSN for an individual; (9) 
disclose, sell or transfer a person's own SSN with intent to 
deceive; (10) violate Sections 101, 103, 104, 105, 106, or 107 
of this bill (with respect to officers or employees of a 
Federal, State or local agency); (11) violate Sections 101, 
103, or 107 of this bill (with respect to bankruptcy trustees); 
(12) violate Section 108 of this bill; or (13) violate Section 
303 of this bill (with respect to SSA employees).

                           REASON FOR CHANGE

    SSN misuse, not related to the determination of eligibility 
for, or the amount of, Social Security or SSI benefits, can 
also result in considerable costs for the government, the 
private sector, and individuals who are victims of fraud. In 
many cases, the costs of SSN misuse extend beyond monetary 
losses.
    The SSN is a valuable commodity today for criminals. As the 
Subcommittee has heard in testimony, the use of the SSN has 
grown so that it is interwoven into many aspects of every day 
life. It has become the de facto national identifier, used as a 
``breeder document'' to obtain a driver's license or a credit 
card, open a bank account or secure a loan.
    Because of the prevalence of the use of the SSN in society 
and the gravity of SSN misuse, it is appropriate to provide for 
civil monetary penalties and assessments for violations of the 
law relating to SSN misuse in general.

                             EFFECTIVE DATE

    The civil monetary penalties would apply to violations that 
occur after enactment, except with respect to violations of 
prohibitions created under this bill. In such cases, the civil 
monetary penalties would apply to violations that occur on or 
after the applicable effective date.

Sec. 303. Criminal penalties for employees of the Social Security 
        Administration who knowingly and fraudulently issue Social 
        Security cards or Social Security account numbers

                              CURRENT LAW

    SSA employees who fraudulently sell SSNs to third parties 
may be tried under a number of criminal statutes, including but 
not limited to 18 U.S.C. Sec. 371 (conspiracy) and 18 U.S.C. 
Sec. 641 (theft of government property).

                        EXPLANATION OF PROVISION

    The bill would provide for mandatory minimum criminal 
penalties for SSA employees (including contract workers, State 
Disability Determination Service workers and volunteers in an 
SSA facility) who knowingly and fraudulently sell or transfer 
SSNs or Social Security cards, with the penalty based on the 
number of SSNs or Social Security cards fraudulently issued, as 
follows: (1) 1 to 50 SSNs or cards: 1-5 years imprisonment; (2) 
51 to 100 SSNs or cards: 5-10 years imprisonment; or (3) 101 or 
more SSNs or cards: 10-20 years imprisonment.
    In addition, the bill would apply the same penalties to an 
SSA employee who attempts or conspires to commit a violation of 
this section.

                           REASON FOR CHANGE

    Crimes of fraud against the integrity of the SSN are of 
great concern because of the far reaching implication such 
crimes have upon the integrity of the SSA, the potential impact 
on innocent individuals due to identity theft, and possible 
misuse of SSNs in terrorist activities. This is especially true 
when the crime is perpetrated, at least in part, by a SSA 
employee. SSA employees issuing SSNs are in a position of 
trust. When this trust is violated, the effect on the SSA's 
programs and operations and on the public in general can be 
devastating. Fortunately, the number of SSA employees taking 
part in these crimes is small, but participation in such crimes 
by any SSA employee to any extent cannot be tolerated.
    The SSA and the SSA Inspector General are concerned that 
current laws do not provide an adequate deterrent to SSA 
employees tempted to facilitate these crimes. In several recent 
investigations involving SSA employees, the employee when 
caught, has received little, if any, prison time though the 
employee may have fraudulently issued hundreds of SSNs. The 
Committee is concerned because the SSNs issued have usually not 
previously been issued to anyone else. Even a thorough credit 
check would not show this SSN to be fraudulent. This could 
allow a criminal to more easily assimilate into our society. 
Therefore, it is appropriate to provide for enhanced criminal 
penalties for SSA employees who assist in the fraudulent 
issuance of SSNs.

                             EFFECTIVE DATE

    The penalties would apply to violations that occur on or 
after enactment.

Sec. 304. Enhanced penalties in cases of terrorism, drug trafficking, 
        crimes of violence, or prior offenses

                              CURRENT LAW

    Sections 208, 811 and 1632 of the Social Security Act 
(regarding Social Security benefits, Special Benefits for 
Certain WWII Veterans and SSI benefits, respectively) provide 
that persons who willingly and knowingly commit fraud shall be 
guilty of a felony and upon conviction shall be fined under 
Title 18, United States Code, and/or imprisoned for up to five 
years.
    Examples of violations to which penalties apply include 
making false statements or representations of fact to obtain 
benefits or increase benefit payments; failing to disclose an 
event that affects an individual's initial or continued right 
to receive benefits; and engaging in various types of SSN 
misuse or fraud (such as using an SSN obtained on the basis of 
false information; falsely representing an SSN to be one's own 
with intent to deceive; buying or selling an SSN card; 
counterfeiting an SSN card; or disclosing, using or compelling 
the disclosure of the SSN of any person in violation of any 
Federal law).
    Penalties apply to violations committed by individuals (or 
organizations) acting in the capacity of a representative payee 
(or prospective representative payee) for a beneficiary other 
than the individual's spouse. If the court determines that the 
violation also includes willful misuse of funds, the court may 
require full or partial restitution of funds to the 
beneficiary.

                        EXPLANATION OF PROVISION

    The bill would enhance criminal penalties under Sections 
208, 811 and 1632 of the Social Security Act with respect to 
(a) repeat offenders and (b) violations committed to facilitate 
a drug trafficking crime, a crime of violence, or an act of 
international or domestic terrorism.
    Specifically, the bill would provide for (1) fines and/or 
imprisonment for up to five years for first offenders; (2) 
fines and/or imprisonment for up to 10 years for repeat 
offenders; (3) fines or imprisonment for up to 20 years for 
persons convicted of violations for the purpose of facilitating 
a drug trafficking crime or a crime of violence; and (4) fines 
or imprisonment for up to 25 years for persons convicted of 
violations for the purpose of facilitating an act of 
international or domestic terrorism.

                           REASON FOR CHANGE

    The expanded use of the SSN in today's society has made it 
a very valuable commodity for criminals. As the Subcommittee 
has heard in several hearings, the SSN is considered a prime 
``breeder document'', a valuable commodity used to obtain a 
driver's license or credit cards, as well as open a bank 
account or obtain a loan. But in addition to being a lynchpin 
for identity theft crimes, it also assists terrorists in 
assimilating into our society and avoiding detection.
    The integrity of the SSN is vital. Its importance in both 
identity theft and homeland security is universally recognized. 
Providing new, enhanced, structured penalties appropriately 
reflects the vital importance of the SSN and the commitment of 
the Congress, the SSA and the SSA Inspector General to its 
protection.

                             EFFECTIVE DATE

    Would apply to violations that occur after enactment.

                       III. VOTE OF THE COMMITTEE

    In compliance with clause 3(b) of rule XIII of the Rules of 
the House of Representatives, the following statements are made 
concerning the vote of the Committee on Ways and Means in its 
consideration of the bill, H.R. 2971.

                       MOTION TO REPORT THE BILL

    The bill, H.R. 2791, as amended, was ordered favorably 
reported by a roll call vote of 33 yeas to 0 nays (with a 
quorum being present). The vote was as follows:

----------------------------------------------------------------------------------------------------------------
        Representatives             Yea       Nay     Present     Representative      Yea       Nay     Present
----------------------------------------------------------------------------------------------------------------
Mr. Thomas.....................        X   ........  .........  Mr. Rangel.......        X   ........  .........
Mr. Crane......................        X   ........  .........  Mr. Stark........  ........  ........  .........
Mr. Shaw.......................        X   ........  .........  Mr. Matsui.......  ........  ........  .........
Mrs. Johnson...................        X   ........  .........  Mr. Levin........        X   ........  .........
Mr. Houghton...................        X   ........  .........  Mr. Cardin.......        X   ........  .........
Mr. Herger.....................        X   ........  .........  Mr. McDermott....        X   ........  .........
Mr. McCrery....................        X   ........  .........  Mr. Kleczka......        X   ........  .........
Mr. Camp.......................        X   ........  .........  Mr. Lewis (GA)...  ........  ........  .........
Mr. Ramstad....................        X   ........  .........  Mr. Neal.........        X   ........  .........
Mr. Nussle.....................  ........  ........  .........  Mr. McNulty......  ........  ........  .........
Mr. Johnson....................        X   ........  .........  Mr. Jefferson....        X   ........  .........
Ms. Dunn.......................        X   ........  .........  Mr. Tanner.......        X   ........  .........
Mr. Collins....................  ........  ........  .........  Mr. Becerra......        X   ........  .........
Mr. Portman....................        X   ........  .........  Mr. Doggett......        X   ........  .........
Mr. English....................        X   ........  .........  Mr. Pomeroy......        X   ........  .........
Mr. Hayworth...................  ........  ........  .........  Mr. Sandlin......  ........  ........  .........
Mr. Weller.....................        X   ........  .........  Ms. Tubbs Jones..        X   ........  .........
Mr. Hulshof....................        X
Mr. McInnis....................        X
Mr. Lewis (KY).................        X
Mr. Foley......................        X
Mr. Brady......................        X
Mr. Ryan.......................        X
Mr. Cantor.....................        X
----------------------------------------------------------------------------------------------------------------

                     IV. BUDGET EFFECTS OF THE BILL

               A. Committee Estimate of Budgetary Effects

    In compliance with clause 3(d)(2) of rule XIII of the Rules 
of the House of Representatives, the following statement is 
made concerning the effects on the budget of this bill, H.R. 
2971 as amended and reported: The Committee agrees with the 
estimate prepared by the Congressional Budget Office (CBO), 
which is included below.

    B. Statement Regarding New Budget Authority and Tax Expenditures

    In compliance with clause 3(c)(2) of rule XIII of the Rules 
of the House of Representatives, the Committee states that H.R. 
2971 does not include any new budget authority or tax 
expenditures.

      C. Cost Estimate Prepared by the Congressional Budget Office

    In compliance with clause 3(c)(3) of rule XIII of the Rules 
of the House of Representatives, requiring a cost estimate 
prepared by the Congressional Budget Office, the following 
report by CBO is provided.

H.R. 2971--Social Security Privacy and Identity Theft Prevention Act of 
        2004

    Summary: H.R. 2971 would provide new safeguards for the use 
of Social Security numbers (SSNs) and penalties for SSN misuse. 
The bill would:
           Bar the sale, purchase, or display of the 
        SSN in both the public and private sectors, with 
        certain exceptions;
           Prohibit the display of SSNs (including 
        magnetic strips or bar codes that contain them) on 
        government checks, drivers' licenses, and motor vehicle 
        registrations, employer-issued identification cards or 
        tags and cards used to gain access to employee benefits 
        or services;
           Require government and private entities to 
        limit access to SSNs and assure that they have 
        safeguards to prevent breaches of confidentiality;
           Tighten some procedures that the Social 
        Security Administration (SSA) follows when issuing new 
        or replacement SSNs, and require SSA to study further 
        improvements; and
           Create or expand civil and criminal 
        penalties for SSN misuse.
    Implementing H.R. 2971 could affect direct spending and 
revenues, but CBO estimates that any such effects would not be 
significant. Complying with the bill's standards would also 
cause federal agencies to incur additional administrative 
expenses. Those costs--which CBO estimates at $3 million over 
the 2005-2009 period--would generally come from agencies' 
salary and expense budgets, which are subject to annual 
appropriation.
    H.R. 2971 contains a number of intergovernmental mandates 
as defined in the Unfunded Mandates Reform Act (UMRA), 
including limitations on the sale, display, and use of SSNs by 
state, local, and tribal governments. While there is some 
uncertainty about the aggregate costs of complying with those 
mandates on those governments, CBO estimates that they likely 
would exceed the intergovernmental threshold established in 
UMRA ($60 million in 2004, adjusted annually for inflation) in 
at least one of the first five years following the date the 
mandates go into effect.
    H.R. 2971 also would impose private-sector mandates, as 
defined in UMRA, on certain private entities and consumer 
reporting agencies. CBO cannot determine the total direct costs 
of complying with those mandates because the costs would depend 
on specific regulations that would be issued to implement the 
bill.
    Estimated cost to the Federal Government: The estimated 
budgetary impact of H.R. 2971 is shown in the following table. 
For this estimate, CBO assumes that the bill will be enacted in 
the fall of 2004. The costs of the legislation fall primarily 
in functions 650 (Social Security) and 750 (administration of 
justice) but--because all government agencies use the SSN--
affect numerous other budget functions as well. As explained 
below, CBO cannot estimate some potential costs in cases where 
agencies do not yet know how they would implement certain 
provisions.

----------------------------------------------------------------------------------------------------------------
                                                                       By fiscal year, in millions of dollars--
                                                                    --------------------------------------------
                                                                       2005     2006     2007     2008     2009
----------------------------------------------------------------------------------------------------------------
                                CHANGES IN SPENDING SUBJECT TO APPROPRIATION \1\

Estimated authorization level......................................        1        1        *        *        *
Estimated outlays..................................................        1        1        *        *        *
----------------------------------------------------------------------------------------------------------------
\1\ Enacting H.R. 2971 could also affect direct spending and revenues, but CBO estimates that any such effects
  would not be significant.

Note.--* = less than $500,000.

    Basis of estimate: Federal agencies already comply, or are 
moving to comply, with most requirements of H.R. 2971. The 
budgetary effects thus stem from a few provisions that would 
change agencies' practices or assign new enforcement 
responsibilities.

Current law

    Federal agencies are allowed--in fact, are usually 
required--to collect SSNs, but the Privacy Act bars the 
government from selling or renting SSNs or disclosing them 
(with certain exceptions) without the subjects' written 
consent. Agencies also must justify any matching agreements 
involving computerized records (for example, those that 
intercept tax refunds of people who have defaulted on 
government loans), must ensure computer security, and must post 
their privacy policies when conducting business electronically 
with the public.
    H.R. 2971 would require agencies that accept SSNs 
electronically from the public to ensure that the number is 
encrypted or ``otherwise appropriately secured from 
disclosure.'' SSA and the Internal Revenue Service--which 
process millions of reports that contain SSNs--now use 
encryption or are phasing out the few exceptions. No law now 
requires encryption, however, so some lower-volume users may 
use less-advanced technology.
    The Treasury Department's Financial Management Service no 
longer shows SSNs on checks, except in a few cases dictated by 
states' needs. Identification tags issued to federal civilian 
employees generally do not show or contain the SSN.

Spending subject to appropriation

    Social Security Administration and Department of Justice. 
H.R. 2971 would give specific new responsibilities to SSA and 
the Department of Justice. It would direct SSA to independently 
verify birth records for SSN applicants, except for babies who 
get SSNs through the Enumeration at Birth program. SSA already 
does so for applicants more than 1 year old, so extra costs 
would be insignificant. H.R. 2971 also would require SSA to 
prepare several studies and reports, notably on a possible 
requirement for photo identification when people apply for 
benefits or replacement SSN cards and on revising the account 
numbering system to reflect the work authorization of 
immigrants. The Department of Justice would take the lead in 
drafting regulations to govern compliance with the new law in 
both the public and private sectors and would prosecute 
violations. Based on the scope of the agencies' new tasks, CBO 
estimates costs of $2 million over the 2005-2009 period, 
assuming the availability of appropriated funds.
    That estimate contains a major caveat, however. H.R. 2971 
would require all federal agencies to demonstrate to SSA that 
they allow access only to employees who need SSNs to carry out 
their statutory responsibilities and have safeguards to prevent 
unauthorized access and breaches of confidentiality. The 
provision would apply to all SSNs in the agencies' possession, 
including paper records, not just to computerized systems. Its 
implications for contractors (who handle key responsibilities 
especially in the areas of welfare and child support 
enforcement) are unclear. According to the General 
Accountability Office (GAO), every federal agency uses the SSN 
in some way. CBO cannot estimate the cost of this provision to 
SSA or to other agencies because it would depend on SSA''s 
approach.
    Department of Defense. The bill would ban the display of 
SSNs on employee identification cards. The Geneva Convention 
calls for military personnel to have a number displayed on 
their identification cards, and the Department of Defense has 
chosen to use the SSN. Under the bill, it would have to revamp 
its records and cards to use another unique identifier for its 
2.7 million active-duty and reserve forces. Because DOD cannot 
determine at this time how it would implement the provision, 
CBO cannot estimate the cost, but it could be quite large.
    Employee Benefits. H.R. 2971 would bar administrators of 
employee-benefit plans (such as health insurers) from 
displaying the SSN on identification or membership cards. Some 
plans that participate in the Federal Employees Health Benefits 
(FEHB) program show the SSN on membership cards. Although the 
ban would technically apply only to cards issued one year after 
issuance of regulations, or about 30 months after enactment, 
CBO assumes that the affected plans would issue replacement 
cards to current members as well. (Changes to plans' 
administrative costs would likely be recouped through higher 
premiums charged to FEHB enrollees.) Because the government 
subsidizes FEHB premiums, it would bear part of the cost; CBO 
estimates the extra cost to the federal government would be 
less than $500,000. (About half would come from agencies' 
salary and expense accounts on behalf of current employees, but 
the rest would be paid on behalf of annuitants and would 
constitute direct spending.) CBO expects that the provision 
would not apply to the government's Medicare program, which 
shows the SSN on the cards of its 42 million enrollees.

Direct spending and revenues

    Civil and Criminal Penalties. Title III of H.R. 2971 would 
add or toughen civil and criminal penalties for SSN misuse. The 
Commissioner of Social Security (with permission from the 
Attorney General) could impose civil penalties of as much as 
$5,000 per offense; criminal penalties require a court 
conviction and may be as high as $250,000. Criminal fines are 
deposited in the Crime Victims Fund and later spent; 
consequently, over time, they have little net effect on the 
budget. Collections of civil fines are recorded as revenues and 
deposited in the Treasury. The penalties would apply to 
offenses committed after enactment, and CBO judges that they 
would not be significant over the 2005-2009 period.
    Regulatory Agencies. Title I would direct the Commissioner 
of SSA and the Attorney General to consult with--among others--
various banking and regulatory agencies when crafting 
regulations to end the sale or display of SSNs in the public 
and private sectors. The Federal Reserve earns interest on its 
holdings of government securities and subtracts its operating 
costs before remitting the rest to the Treasury as a revenue. 
Several other agencies--the Securities and Exchange Commission, 
the Federal Deposit Insurance Corporation, and so forth--cover 
their costs through fees or assessments. CBO expects that those 
agencies would not incur significant costs as a result of H.R. 
2971, so that any effect on direct spending or revenues would 
be negligible.
    Child Support Enforcement. Requiring government agencies to 
remove SSNs from checks could raise administrative costs to the 
child support enforcement (CSE) program or delay distribution 
of collections. Many states currently use SSNs as their primary 
identifier when distributing child support, and the federal 
government covers the bulk of states' costs for administering 
CSE. However, CBO judges that the requirement would only have a 
small impact on the federal budget.
    Estimated impact on state, local, and tribal governments: 
H.R. 2971 contains a number of intergovernmental mandates as 
defined in UMRA. Specifically, the bill would restrict or 
prohibit governmental agencies from:
           Selling or displaying Social Security 
        numbers that have been disclosed to the agency because 
        of a mandatory requirement (applicable only to 
        documents issued after the requirements become 
        effective);
           Displaying SSNs on checks or check stubs;
           Placing SSNs on drivers licenses, 
        identification cards, vehicle registrations, or 
        employee identification cards, or coding them into 
        magnetic strips or bar codes on those documents; and,
           Allowing prisoners access to SSNs of other 
        individuals.
    The bill also would require state and local governments to 
restrict access to SSNs and their derivatives to employees 
whose access is essential to effective administration of 
programs. In addition, the governments must implement 
safeguards to preclude unauthorized access to SSNs and their 
derivatives and to protect individual confidentiality.
    While state and local governments have, in recent years, 
taken steps to reduce the use of SSNs, many continue to use 
them for a variety of purposes. Based on information from the 
GAO and discussions with state and local officials, CBO 
estimates that the costs of complying with the mandates in the 
bill likely would exceed the intergovernmental threshold 
established in UMRA ($60 million in 2004, adjusted annually for 
inflation) in at least one of the first five years following 
the date the mandates go into effect.

Exceptions and requirements

    The bill would allow exceptions for the display or sale of 
SSNs when such use or display is authorized by the Social 
Security Act; necessary for law enforcement, national security, 
or tax law purposes; done in compliance with certain motor 
vehicle laws or consumer reporting practices; or for non-market 
research for advancing the public good. The bill's restrictions 
on the sale or display (which includes Internet transmissions 
that are not encrypted or otherwise secured) of SSNs would be 
prospective, and would not require state and local governments 
to redact SSNs from existing publicly available documents.
    However, if state and local governments do not currently 
have a system in place to safeguard SSNs, they would have to 
implement a new system for any documents issued when the 
regulations become effective (up to two and a half years 
following enactment). If state or local governments use SSNs on 
checks and check-stubs as part of their recordkeeping and 
tracking procedures, they would have to alter those systems and 
remove the SSNs. They also would have to implement systems for 
removing SSNs from many documents that include SSNs and that 
are available to the public. Likewise, some states may have to 
alter their document systems for driver licenses and vehicle 
registrations to remove SSNs that are coded electronically onto 
a magnetic strip or digitized as part of a bar code. Finally, 
any government agency that uses SSNs would have to implement 
safeguards to preclude unauthorized access to SSNs and their 
derivatives and to protect confidentiality.

Potential costs to state, county, and municipal governments

    Because of the large number of governments affected by 
these provisions (particularly municipal governments), even 
small changes to existing systems would result in costs that 
exceed the theshold established in UMRA. There are over 75,000 
municipal governments, so even small one-time costs--for 
example, as little as $5,000--would add up to costs over $60 
million in a given year. Counties and states, on the other 
hand, while fewer in number (there are about 3,600 counties in 
the United States) are more dependent on SSNs for various 
recordkeeping and identification purposes and are thus likely 
to face significantly higher costs because of the complexity 
and scope of their recordkeeping systems. (Some counties 
estimate that altering their systems to use identifiers other 
than SSNs or to eliminate display of SSNs would result in one-
time costs ranging from $40,000 to over $1 million, depending 
on the scope of the changes that would need to be made.)
    Estimated impact on the private sector: H.R. 2971 would 
impose private-sector mandates, as defined in UMRA, on certain 
private entities and consumer reporting agencies. CBO cannot 
determine the total direct costs of complying with those 
mandates because such costs would depend on the specific 
regulations that would be issued under the bill.

Prohibition of the sale, purchase, and disclosure of Social Security 
        numbers

    The bill would impose a private-sector mandate on certain 
private entities by generally prohibiting the purchase, sale, 
or display of a Social Security number to the general public, 
including the display of an SSN on any card or tag issued to 
another person to provide access to any goods, services, or 
benefits. Private entities also would be prohibited from 
displaying SSNs on employee identification cards or tags 
(including on magnetic strips and bar codes). In addition, 
private entities that maintain SSNs in their records for the 
conduct of their business would be required to limit access to 
those records and institute safeguards to protect the 
confidentiality of those records. The Commissioner of Social 
Security would issue regulations specifying the safeguards that 
would be required. CBO cannot estimate the direct cost to 
private entities of complying with those mandates.

Refusal to do business without receipt of Social Security numbers

    The bill would impose a new private-sector mandate by 
prohibiting certain private entities from refusing to do 
business with an individual because the individual will not 
provide his or her SSN. Such private entities that refuse to do 
business would be considered to have committed an unfair or 
deceptive act or practice in violation of federal trade law and 
would be subject to penalties. The cost of the mandate would be 
the incremental amount required to complete a business 
transaction without using a Social Security number for 
identification or credit verification. For example, a business 
may incur additional costs in verifying the credit worthiness 
of a person without an SSN for identification. According to the 
Federal Trade Commission and industry sources, few private 
entities currently refuse to do business if an individual does 
not provide his or her Social Security number. Therefore, CBO 
estimates that the direct cost to comply with the mandate would 
be small.

Prohibition of Social Security numbers in credit header information

    The bill also would impose a private-sector mandate on 
consumer reporting agencies by prohibiting such agencies from 
providing Social Security numbers, or any derivative of such 
numbers, except in a full consumer report furnished in 
accordance with the Fair Credit Reporting Act. The direct cost 
of the mandate would be the net income lost to consumer 
reporting agencies from not furnishing a consumer's Social 
Security number in the credit header information they sell to 
customers. According to industry sources, such agencies expect 
only a slight decrease in the sales of credit header 
information. Therefore, CBO estimates that the direct cost to 
comply with the mandate would be small.
    Estimate prepared by: Federal Costs: Kathy Ruffing (SSA); 
Julia Christensen (FEHB); Sheila Dacey (Child Support 
Enforcement); Kathleen Gramp (Banking Agencies); Mark Grabowicz 
(Justice); Matthew Pickford (Treasury); and Michelle Patterson 
(Defense). Impact on State, Local, and Tribal Governments: Leo 
Lex. Impact on the Private Sector: Paige Piper-Bac and Ralph 
Smith.
    Estimate approved by: Peter H. Fontaine, Deputy Assistant 
Director for Budget Analysis.

     V. OTHER MATTERS TO BE DISCUSSED UNDER THE RULES OF THE HOUSE

A. Committee Oversight Findings and Recommendations

    With respect to clause 3(c)(1) of rule XIII of the Rules of 
the House of Representatives (relating to oversight findings), 
the Committee, based on public hearing testimony, conclude that 
it is appropriate and timely to consider the bill as reported.

B. Statement of General Performance Goals and Objectives

    With respect to clause 3(c)(4) of rule XIII of the Rules of 
the House of Representatives, the Committee advises that the 
Administration has in place program goals and objectives, which 
have been reviewed by the Committee. H.R. 2971 includes 
provisions to assist the Administration in achieving its goals 
to prevent SSN misuse and strengthen the integrity of SSNs.

C. Constitutional Authority Statement

    With respect to clause (3)(d)(1) of rule XIII of the Rules 
of the House of Representatives, relating to Constitutional 
Authority, the Committee states that the Committee's action in 
reporting the bill is derived from Article I of the 
Constitution, Section 8 (``The Congress shall have power to lay 
and collect taxes, duties, imposts, and excises, to pay the 
debts and to provide for * * * the general Welfare of the 
United States.'')

D. Information Relating to Unfunded Mandates

    This information is provided in accordance with Section 423 
of the Unfunded Mandates Reform Act of 1995 (P.L. 104-4).
    The Committee has determined that the bill does impose a 
Federal intergovernmental mandate on State, local, or tribal 
governments. The Committee has determined that the bill does 
contain Federal mandates on the private sector.

       VI. CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

  In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italic, existing law in which no change is 
proposed is shown in roman):

SOCIAL SECURITY ACT

           *       *       *       *       *       *       *

TITLE II--FEDERAL OLD-AGE, SURVIVORS, AND DISABILITY INSURANCE BENEFITS

           *       *       *       *       *       *       *

           EVIDENCE, PROCEDURE, AND CERTIFICATION FOR PAYMENT

Sec. 205. (a) * * *

           *       *       *       *       *       *       *

  (c)(1) * * *
  (2)(A) * * *
  (B)(i) * * *
  (ii)(I) The Commissioner of Social Security shall require of 
applicants for social security account numbers such evidence as 
may be necessary to establish the age, citizenship, or alien 
status, and true identity of such applicants, and to determine 
which (if any) social security account number has previously 
been assigned to such individual. With respect to an 
application for a social security account number for an 
individual who has not attained the age of 18 before such 
application, such evidence shall include the information 
described in subparagraph (C)(ii).
  (II) With respect to an application for a social security 
account number for an individual, other than for purposes of 
enumeration at birth, the Commissioner shall require 
independent verification of any birth record provided by the 
applicant in support of the application. The Commissioner may 
provide by regulation for reasonable exceptions from the 
requirement for independent verification under this subclause 
in any case in which the Commissioner determines there is 
minimal opportunity for fraud.
  (C)(i) * * *

           *       *       *       *       *       *       *

  (vi)(I) For purposes of clause (i) of this subparagraph, an 
agency of a State (or political subdivision thereof) charged 
with the administration of any general public assistance, 
driver's license, or motor vehicle registration law which did 
not use the social security account number for identification 
under a law or regulation adopted before January 1, 1975, may 
require an individual to disclose his or her social security 
number to such agency solely for the purpose of administering 
the laws referred to in clause (i) above and for the purpose of 
responding to requests for information from an agency 
administering a program funded under part A of title IV or an 
agency operating pursuant to the provisions of part D of such 
title.
  (II) Any State or political subdivision thereof (and any 
person acting as an agent of such an agency or 
instrumentality), in the administration of any driver's license 
or motor vehicle registration law within its jurisdiction, may 
not display a social security account number issued by the 
Commissioner of Social Security (or any derivative of such 
number) on any driver's license or motor vehicle registration 
or any other document issued by such State or political 
subdivision to an individual for purposes of identification of 
such individual or include on any such licence, registration, 
or other document a magnetic strip, bar code, or other means of 
communication which conveys such number (or derivative 
thereof).

           *       *       *       *       *       *       *

  (x)(I) An executive, legislative, or judicial agency or 
instrumentality of the Federal Government or of a State or a 
political subdivision thereof or a trustee appointed in a case 
under title 11, United States Code (or person acting as an 
agent of such an agency or instrumentality or trustee) may not 
sell or display to the general public any social security 
account number if such number has been disclosed to such 
agency, instrumentality, trustee, or agent pursuant to the 
assertion by such an agency, instrumentality, trustee, or agent 
to any person that disclosure of such number is mandatory. 
Notwithstanding the preceding sentence, such number may be sold 
or displayed to the general public in accordance with the 
exceptions specified in subclauses (II), (III), (IV), (V), 
(VI), (VII), and (VIII) (and for no other purpose).
  (II) Notwithstanding subclause (I), a social security account 
number may be sold by an agency, instrumentality, trustee, or 
agent referred to in subclause (I) to the extent that such sale 
is specifically authorized by this Act.
  (III) Notwithstanding subclause (I), a social security 
account number may be sold by an agency, instrumentality, 
trustee, or agent referred to in subclause (I) to the extent 
that is necessary or appropriate for law enforcement or 
national security purposes, as determined under regulations 
which shall be issued as provided in subparagraph (I) of this 
paragraph.
  (IV) Notwithstanding subclause (I), a social security account 
number may be sold by an agency, instrumentality, trustee, or 
agent referred to in subclause (I) to the extent that such sale 
is required to comply with a tax law of the United States or of 
any State (or political subdivision thereof).
  (V) Notwithstanding subclause (I), a social security account 
number may be sold by a State department of motor vehicles as 
authorized under subsection (b) of section 2721 of title 18, 
United States Code, if such number is to be used pursuant to 
such sale solely for purposes permitted under paragraph (1), 
(6), or (9) of such subsection.
  (VI) Notwithstanding subclause (I), a social security account 
number may be sold or otherwise made available by an agency, 
instrumentality, trustee, or agent referred to in subclause (I) 
to a consumer reporting agency (as defined in section 603(f) of 
the Fair Credit Reporting Act (15 U.S.C. 1681a(f))) for use or 
disclosure solely for permissible purposes described in section 
604(a) of such Act (15 U.S.C. 1681b(a)).
  (VII) Notwithstanding subclause (I), a social security 
account number may be sold by an agency, instrumentality, 
trustee, or agent referred to in subclause (I) to the extent 
necessary for research (other than market research) conducted 
by any agency or instrumentality referred to in subclause (I) 
(or an agent of such an agency or instrumentality) for the 
purpose of advancing the public good, on the condition that the 
researcher provides adequate assurances that the social 
security account numbers will not be used to harass, target, or 
publicly reveal information concerning any identifiable 
individuals, that information about identifiable individuals 
obtained from the research will not be used to make decisions 
that directly affect the rights, benefits, or privileges of 
specific individuals, and that the researcher has in place 
appropriate safeguards to protect the privacy and 
confidentiality of any information about identifiable 
individuals, including procedures to ensure that the social 
security account numbers will be encrypted or otherwise 
appropriately secured from unauthorized disclosure. In the case 
of social security account numbers which constitute personally 
identifiable medical information, the Commissioner of Social 
Security, with respect to medical research referred to in the 
preceding sentence, and the Attorney General of the United 
States, with respect to any medical research not referred to in 
the preceding sentence but which is treated in regulations of 
the Attorney General issued pursuant to subclause (VIII), shall 
maintain ongoing consultation with the Office for Civil Rights 
of the Department of Health and Human Services to ensure that 
the sale or purchase of such social security account numbers is 
permitted only in compliance with existing Federal rules and 
regulations prescribed by the Secretary of Health and Human 
Services pursuant to section 264(c) of the Health Insurance 
Portability and Accountability Act of 1996 (110 Stat. 2033).
  (VIII) Notwithstanding subclause (I), a social security 
account number may be sold or displayed to the general public 
by an agency, instrumentality, trustee, or agent referred to in 
subclause (I) under such other circumstances as may be 
specified in regulations issued as provided in subparagraph (I) 
of this paragraph.
  (IX) This clause does not apply with respect to a social 
security account number of a deceased individual.
  (X) For purposes of this clause, the term ``sell'' means, in 
connection with a social security account number, to accept an 
item of material value in exchange for such number.
  (XI) For purposes of this clause, the term ``display to the 
general public'' shall have the meaning provided such term in 
section 208A(a)(3)(A). In any case in which an agency, 
instrumentality, trustee, or agent referred to in subclause (I) 
requires transmittal to such agency, instrumentality, trustee, 
or agent of an individual's social security account number by 
means of the Internet without reasonable provisions to ensure 
that such number is encrypted or otherwise appropriately 
secured from disclosure, any such transmittal of such number as 
so required shall be treated, for purposes of this clause, as a 
``display to the general public'' of such number by such 
agency, instrumentality, trustee, or agent for purposes of this 
clause.
  (XII) For purposes of this clause, the term social security 
account number includes any derivative of such number. 
Notwithstanding the preceding sentence, any expression, 
contained in or on any item sold or displayed to the general 
public, shall not be treated as a social security account 
number solely because such expression sets forth not more than 
the last 4 digits of such number if the remainder of such 
number cannot be determined based solely on such expression or 
any other matter presented in such material.
  (XIII) Nothing in this clause shall be construed to 
supersede, alter, or affect any restriction or limitation on 
the sale or display to the general public of social security 
account numbers, provided in any Federal statute, regulation, 
order, or interpretation, if the restriction or limitation is 
greater than that provided under this clause, as determined 
under applicable regulations issued by the Commissioner of 
Social Security or by the Attorney General of the United States 
or another agency or instrumentality of the United States as 
provided in subparagraph (I) of this paragraph.
  (xi) No executive, legislative, or judicial agency or 
instrumentality of the Federal Government or of a State or a 
political subdivision thereof or trustee appointed in a case 
under title 11, United States Code (or person acting as an 
agent of such an agency or instrumentality or trustee) may 
include the social security account number of any individual 
(or any derivative of such number) on any check issued for any 
payment by the Federal Government, any State or political 
subdivision thereof, or any agency or instrumentality thereof, 
or such trustee or on any document attached to or accompanying 
such a check.
  (xii) No executive, legislative, or judicial agency or 
instrumentality of the Federal Government or of a State or 
political subdivision thereof, and no other person offering 
benefits in connection with an employee benefit plan maintained 
by such agency or instrumentality or acting as an agent of such 
agency or instrumentality, may display a social security 
account number (or any derivative thereof) on any card or tag 
that is commonly provided to employees of such agency or 
instrumentality (or to their family members) for purposes of 
identification or include on such card or tag a magnetic strip, 
bar code, or other means of communication which conveys such 
number.
  (xiii) No executive, legislative, or judicial agency or 
instrumentality of the Federal Government or of a State or 
political subdivision thereof (or person acting as an agent of 
such an agency or instrumentality) may employ, or enter into a 
contract for the use or employment of, prisoners in any 
capacity that would allow such prisoners access to the social 
security account numbers of other individuals. For purposes of 
this clause, the term ``prisoner'' means an individual confined 
in a jail, prison, or other penal institution or correctional 
facility.
  (xiv) Except as otherwise provided in this paragraph, in the 
case of any executive, legislative, or judicial agency or 
instrumentality of the Federal Government or of a State or 
political subdivision thereof and any trustee appointed in a 
case under title 11, United States Code (and any agent of such 
agency, instrumentality, or trustee) having in its possession 
an individual's social security account number--
          (I) no officer or employee thereof shall have access 
        to such number for any purpose other than the effective 
        administration of the statutory provisions governing 
        its functions,
          (II) such agency, instrumentality, trustee, or agent 
        shall restrict, to the satisfaction of the Commissioner 
        of Social Security, access to social security account 
        numbers obtained thereby to officers and employees 
        thereof whose duties or responsibilities require access 
        for the administration or enforcement of such 
        provisions, and
          (III) such agency, instrumentality, trustee, or agent 
        shall provide such other safeguards as the Commissioner 
        of Social Security determines to be necessary or 
        appropriate to preclude unauthorized access to the 
        social security account number and to otherwise protect 
        the confidentiality of such number.
For purposes of this clause the term social security account 
number includes any derivative thereof.

           *       *       *       *       *       *       *

  (G) The Commissioner of Social Security shall issue a social 
security card to each individual at the time of the issuance of 
a social security account number to such individual. The social 
security card shall be made of banknote paper, and (to the 
maximum extent practicable) shall be a card which cannot be 
counterfeited. The Commissioner shall restrict the issuance of 
multiple replacement social security cards to any individual to 
3 per year and to 10 for the life of the individual, except in 
any case in which the Commissioner determines there is minimal 
opportunity for fraud.

           *       *       *       *       *       *       *

  (I)(i) The Attorney General of the United States shall 
prescribe regulations to carry out the provisions of subclauses 
(III) and (VIII) of subparagraph (C)(x) of this paragraph, 
subparagraphs (A) and (B) of section 208A(b)(2), section 
208A(b)(3)(B), and section 208A(c)(2). In issuing such 
regulations, the Attorney General shall consult with the 
Commissioner of Social Security, the Secretary of Health and 
Human Services, the Secretary of Homeland Security, the 
Secretary of the Treasury, the Federal Trade Commission, the 
Federal banking agencies (as defined in section 3 of the 
Federal Deposit Insurance Act), the National Credit Union 
Administration, the Securities and Exchange Commission, State 
attorneys general, and such representatives of the State 
insurance commissioners as may be designated by the National 
Association of Insurance Commissioners. Any agency or 
instrumentality of the United States may exercise the authority 
of the Attorney General under this subparagraph, with respect 
to matters otherwise subject to regulation by such agency or 
instrumentality, to the extent determined appropriate in 
regulations of the Attorney General.
  (ii) In issuing the regulations described in clause (i) 
pursuant to the provisions of subparagraph (C)(x)(III), 
paragraph (A) or (B) of section 208A(b)(2), or section 
208A(c)(2) (relating to law enforcement and national security), 
the Attorney General may authorize the sale or purchase of 
Social Security account numbers only if the Attorney General 
determines that--
          (I) such sale or purchase would serve a compelling 
        public interest that cannot reasonably be served 
        through alternative measures, and
          (II) such sale or purchase will not pose an 
        unreasonable risk of identity theft, or bodily, 
        emotional, or financial harm to an individual (taking 
        into account any restrictions and conditions that the 
        Attorney General imposes on the sale, purchase, or 
        disclosure).
  (iii) In issuing the regulations described in clause (i) 
pursuant to the provisions of subparagraph (C)(x)(VIII) of this 
paragraph or section 208A(b)(3)(B), the Attorney General may 
authorize the sale, purchase, or display to the general public 
of social security account numbers only after considering, 
among other relevant factors--
          (I) the associated cost or burden to the general 
        public, businesses, commercial enterprises, non-profit 
        organizations, and Federal, State, and local 
        governments; and
          (II) the associated benefit to the general public, 
        businesses, commercial enterprises, non-profit 
        associations, and Federal, State, and local 
        governments.
  (iv) If, after considering the factors in clause (iii), the 
Attorney General authorizes, in regulations referred to in 
clause (iii), the sale, purchase, or display to the general 
public of social security account numbers, the Attorney General 
shall impose restrictions and conditions on the sale, purchase, 
or display to the general public to the extent necessary--
          (I) to provide reasonable assurances that social 
        security account numbers will not be used to commit or 
        facilitate fraud, deceptions, or crime, and
          (II) to prevent an unreasonable risk of identity 
        theft or bodily, emotional, or financial harm to any 
        individual, considering the nature, likelihood, and 
        severity of the anticipated harm that could result from 
        the sale, purchase, or display to the general public of 
        social security account numbers, together with the 
        nature, likelihood, and extent of any benefits that 
        could be realized.
  (v) In the issuance of regulations pursuant to this 
subparagraph, notice shall be provided as described in 
paragraphs (1), (2), and (3) of section 553(b) of title 5, 
United States Code, and opportunity to participate in the rule 
making shall be provided in accordance with section 553(c) of 
such title.
  (vi) Each agency and instrumentality exercising authority to 
issue regulations under this subparagraph shall consult and 
coordinate with the other such agencies and instrumentalities 
for the purposes of assuring, to the extent possible, that the 
regulations prescribed by each such agency or instrumentality 
are consistent and comparable, as appropriate, with the 
regulations prescribed by the other such agencies and 
instrumentalities. The Attorney General shall undertake to 
facilitate such consultation and coordination.
  (vii) For purposes of this subparagraph, the terms ``sell'', 
``purchase'', and ``display to the general public'' shall have 
the meanings provided such terms under subparagraph (C)(x) of 
this paragraph or under section 208A(a), as applicable.
  (viii) For purposes of this subparagraph, subparagraph 
(C)(x)(XI) shall apply.

           *       *       *       *       *       *       *

                               PENALTIES

  Sec. 208. (a) Whoever--
          (1) * * *

           *       *       *       *       *       *       *

          (7) for the purpose of causing an increase in any 
        payment authorized under this title (or any other 
        program financed in whole or in part from Federal 
        funds), or for the purpose of causing a payment under 
        this title (or any such other program) to be made when 
        no payment is authorized thereunder, or for the purpose 
        of obtaining (for himself or any other person) any 
        payment or any other benefit to which he (or such other 
        person) is not entitled, or for the purpose of 
        obtaining anything of value from any person, or for any 
        other purpose--
                  (A) * * *

           *       *       *       *       *       *       *

                  (D) with intent to deceive, discloses, sells, 
                or transfers his own social security account 
                number, assigned to him by the Commissioner of 
                Social Security (in the exercise of the 
                Commissioner's authority under section 
                205(c)(2) to establish and maintain records), 
                to any person; or
          (8) discloses, uses, or compels the disclosure of the 
        social security number of any person in violation of 
        the laws of the United States; or
          (9) without lawful authority, offers, for a fee, to 
        acquire for any individual, or to assist in acquiring 
        for any individual, an additional social security 
        account number or a number that purports to be a social 
        security account number; or
          (10) being an officer or employee of any executive, 
        legislative, or judicial agency or instrumentality of 
        the Federal Government or of a State or political 
        subdivision thereof (or a person acting as an agent of 
        such an agency or instrumentality), willfully acts or 
        fails to act so as to cause a violation of section 
        205(c)(2)(C)(xi); or
          (11) being an officer or employee of any executive, 
        legislative, or judicial agency or instrumentality of 
        the Federal Government or of a State or political 
        subdivision thereof (or a person acting as an agent of 
        such an agency or instrumentality) in possession of any 
        individual's social security account number (or an 
        officer or employee thereof or a person acting as an 
        agent thereof), willfully acts or fails to act so as to 
        cause a violation of clause (vi)(II), (x), (xi), (xii), 
        (xiii), or (xiv) of section 205(c)(2)(C); or
          (12) being a trustee appointed in a case under title 
        11, United States Code (or an officer or employee 
        thereof or a person acting as an agent thereof), 
        willfully acts or fails to act so as to cause a 
        violation of clause (x), (xi), or (xiv) of section 
        205(c)(2)(C);
shall be guilty of a felony and upon conviction thereof [shall 
be fined under title 18, United States Code, or imprisoned for 
not more than five years, or both.] shall be fined, imprisoned, 
or both, as provided in subsection (b).
  (b) A person convicted of a violation described in subsection 
(a) shall be--
          (1) fined under title 18, United States Code, or 
        imprisoned for not more than 5 years, or both, in the 
        case of an initial violation, subject to paragraphs (3) 
        and (4),
          (2) fined under title 18, United States Code, or 
        imprisoned for not more than 10 years, or both, in the 
        case of a violation which occurs after a prior 
        conviction for another offense under subsection (a) 
        becomes final, subject to paragraphs (3) and (4),
          (3) fined under title 18, United States Code, or 
        imprisoned for not more than 20 years, in the case of a 
        violation which is committed to facilitate a drug 
        trafficking crime (as defined in section 929(a)(2) of 
        title 18, United States Code) or in connection with a 
        crime of violence (as defined in section 924(c)(3) of 
        title 18, United States Code), subject to paragraph 
        (4), and
          (4) fined under title 18, United States Code, or 
        imprisoned for not more than 25 years, in the case of a 
        violation which is committed to facilitate an act of 
        international or domestic terrorism (as defined in 
        paragraphs (1) and (5), respectively, of section 2331 
        of title 18, United States Code).
  [(b)] (c)(1) * * *

           *       *       *       *       *       *       *

  [(c) Any person or other entity who is convicted of a 
violation of any of the provisions of this section, if such 
violation is committed by such person or entity in his role as, 
or in applying to become, a certified payee under section 
205(j) on behalf of another individual (other than such 
person's spouse), upon his second or any subsequent such 
conviction shall, in lieu of the penalty set forth in the 
preceding provisions of this section, be guilty of a felony and 
shall be fined under title 18, United States Code, or 
imprisoned for not more than five years, or both.]

           *       *       *       *       *       *       *

PROHIBITION OF THE SALE, PURCHASE, AND DISPLAY TO THE GENERAL PUBLIC OF 
        THE SOCIAL SECURITY ACCOUNT NUMBER IN THE PRIVATE SECTOR

                              Definitions

  Sec. 208A. (a) For purposes of this section:
          (1) Person.--
                  (A) In general.--Subject to subparagraph (B), 
                the term ``person'' means any individual, 
                partnership, corporation, trust, estate, 
                cooperative, association, or any other entity.
                  (B) Governmental entities.--Such term does 
                not include a governmental entity. Nothing in 
                this subparagraph shall be construed to 
                authorize, in connection with a governmental 
                entity, an act or practice otherwise prohibited 
                under this section or section 205(c)(2)(C).
          (2) Selling and purchasing.--
                  (A) In general.--Subject to subparagraph 
                (B)--
                          (i) Sell.--The term ``sell'' in 
                        connection with a social security 
                        account number means to obtain, 
                        directly or indirectly, anything of 
                        value in exchange for such number.
                          (ii) Purchase.--The term ``purchase'' 
                        in connection with a social security 
                        account number means to provide, 
                        directly or indirectly, anything of 
                        value in exchange for such number.
                  (B) Exceptions.--The terms ``sell'' and 
                ``purchase'' in connection with a social 
                security account number do not include the 
                submission of such number as part of--
                          (i) the process for applying for any 
                        type of Government benefits or programs 
                        (such as grants or loans or welfare or 
                        other public assistance programs),
                          (ii) the administration of, or 
                        provision of benefits under, an 
                        employee benefit plan, or
                          (iii) the sale, lease, merger, 
                        transfer, or exchange of a trade or 
                        business.
          (3) Display to the general public.--
                  (A) In general.--The term ``display to the 
                general public'' means, in connection with a 
                social security account number, to 
                intentionally place such number in a viewable 
                manner on an Internet site that is available to 
                the general public or to make such number 
                available in any other manner intended to 
                provide access to such number by the general 
                public.
                  (B) Internet transmissions.--In any case in 
                which a person requires, as a condition of 
                doing business with such person, transmittal to 
                such person of an individual's social security 
                account number by means of the Internet without 
                reasonable provisions to ensure that such 
                number is encrypted or otherwise secured from 
                disclosure, any such transmittal of such number 
                as so required shall be treated as a ``display 
                to the general public'' of such number by such 
                person.
          (4) Social security account number.--The term 
        ``social security account number'' has the meaning 
        given such term in section 208(c), except that such 
        term includes any derivative of such number. 
        Notwithstanding the preceding sentence, any expression, 
        contained in or on any item sold or displayed to the 
        general public, shall not be treated as a social 
        security account number solely because such expression 
        sets forth not more than the last 4 digits of such 
        number, if the remainder of such number cannot be 
        determined based solely on such expression or any other 
        matter presented in or on such item.

    Prohibition of Sale, Purchase, and Display to the General Public

  (b)(1) Except as provided in paragraph (2), it shall be 
unlawful for any person to--
          (A) sell or purchase a social security account number 
        or display to the general public a social security 
        account number, or
          (B) obtain or use any individual's social security 
        account number for the purpose of locating or 
        identifying such individual with the intent to 
        physically injure or harm such individual or using the 
        identity of such individual for any illegal purpose.
  (2) Notwithstanding paragraph (1), and subject to paragraph 
(3), a social security account number may be sold or purchased 
by any person to the extent provided in this subsection (and 
for no other purpose) as follows:
          (A) to the extent necessary for law enforcement, 
        including (but not limited to) the enforcement of a 
        child support obligation, as determined under 
        regulations issued as provided in section 205(c)(2)(I);
          (B) to the extent necessary for national security 
        purposes, as determined under regulations issued as 
        provided in section 205(c)(2)(I);
          (C) to the extent necessary for public health 
        purposes;
          (D) to the extent necessary in emergency situations 
        to protect the health or safety of 1 or more 
        individuals;
          (E) to the extent that the sale or purchase is 
        required to comply with a tax law of the United States 
        or of any State (or political subdivision thereof);
          (F) to the extent that the sale or purchase is to or 
        by a consumer reporting agency (as defined in section 
        603(f) of the Fair Credit Reporting Act (15 U.S.C. 
        1681a(f))) for use or disclosure solely for permissible 
        purposes described in section 604(a) of such Act (15 
        U.S.C. 1681b(a)); and
          (G) to the extent necessary for research (other than 
        market research) conducted by an agency or 
        instrumentality of the United States or of a State or 
        political subdivision thereof (or an agent of such an 
        agency or instrumentality) for the purpose of advancing 
        the public good, on the condition that the researcher 
        provides adequate assurances that--
                  (i) the social security account numbers will 
                not be used to harass, target, or publicly 
                reveal information concerning any identifiable 
                individuals;
                  (ii) information about identifiable 
                individuals obtained from the research will not 
                be used to make decisions that directly affect 
                the rights, benefits, or privileges of specific 
                individuals; and
                  (iii) the researcher has in place appropriate 
                safeguards to protect the privacy and 
                confidentiality of any information about 
                identifiable individuals, including procedures 
                to ensure that the social security account 
                numbers will be encrypted or otherwise 
                appropriately secured from unauthorized 
                disclosure.
  (3) Notwithstanding paragraph (1), a social security account 
number assigned to an individual may be sold, purchased, or 
displayed to the general public by any person--
          (A) to the extent consistent with such individual's 
        voluntary and affirmative written consent to the sale, 
        purchase, or display of the social security account 
        number, but only if--
                  (i) the terms of the consent and the right to 
                refuse consent are presented to the individual 
                in a clear, conspicuous, and understandable 
                manner,
                  (ii) the individual is placed under no 
                obligation to provide consent to any such sale, 
                purchase, or display, and
                  (iii) the terms of the consent authorize the 
                individual to limit the sale, purchase, or 
                display to purposes directly associated with 
                the transaction with respect to which the 
                consent is sought, and
          (B) under such circumstances as may be deemed 
        appropriate in regulations issued as provided under 
        section 205(c)(2)(I).
  (4) In the case of social security account numbers which 
constitute personally identifiable medical information--
          (A) the Commissioner of Social Security, with respect 
        to medical research referred to in paragraph (3)(A), 
        and
          (B) the Attorney General of the United States, with 
        respect to any medical research not referred to in 
        paragraph (3)(A) but which is treated in regulations of 
        the Attorney General issued pursuant to paragraph 
        (3)(B),
shall maintain ongoing consultation with the Office for Civil 
Rights of the Department of Health and Human Services to ensure 
that the sale or purchase of such social security account 
numbers is permitted only in compliance with existing Federal 
rules and regulations prescribed by the Secretary of Health and 
Human Services pursuant to section 264(c) of the Health 
Insurance Portability and Accountability Act of 1996 (110 Stat. 
2033).

   Prohibition of Unauthorized Disclosure to Government Agencies or 
                           Instrumentalities

  (c)(1) It shall be unlawful for any person to communicate by 
any means to any agency or instrumentality of the United States 
or of any State or political subdivision thereof the social 
security account number of any individual other than such 
person without the written permission of such individual, 
unless the number was requested by the agency or 
instrumentality. In the case of an individual who is legally 
incompetent, permission provided by the individual's legal 
representatives shall be deemed to be permission provided by 
such individual.
  (2) Paragraph (1) shall not apply to the extent necessary--
          (A) for law enforcement, including (but not limited 
        to) the enforcement of a child support obligation, or
          (B) for national security purposes,
as determined under regulations issued as provided under 
section 205(c)(2)(I).

  Prohibition of the Displays on Cards or Tags Required for Access to 
                      Goods, Services, or Benefits

  (d) No person may display a social security account number on 
any card or tag issued to any other person for the purpose of 
providing such other person access to any goods, services, or 
benefits or include on such card or tag a magnetic strip, bar 
code, or other means of communication which conveys such 
number.

  Prohibition of the Displays on Employee Identification Cards or Tags

  (e) No person that is an employer, and no other person 
offering benefits in connection with an employee benefit plan 
maintained by such employer or acting as an agent of such 
employer, may display a social security account number on any 
card or tag that is commonly provided to employees of such 
employer (or to their family members) for purposes of 
identification or include on such card or tag a magnetic strip, 
bar code, or other means of communication which conveys such 
number.

Measures to Preclude Unauthorized Disclosure of Social Security Account 
        Numbers and Protect the Confidentiality of Such Numbers

  (f) Subject to the preceding provisions of this section, any 
person having in such person's records the social security 
account number of any individual other than such person shall, 
to the extent that such records are maintained for the conduct 
of such person's trade or business--
          (1) ensure that no officer or employee thereof has 
        access to such number for any purpose other than as 
        necessary for the conduct of such person's trade or 
        business,
          (2) restrict, in accordance with regulations of the 
        Commissioner, access to social security account numbers 
        obtained thereby to officers and employees thereof 
        whose duties or responsibilities require access for the 
        conduct of such person's trade or business, and
          (3) provide such safeguards as may be specified, in 
        regulations of the Commissioner, to be necessary or 
        appropriate to preclude unauthorized access to the 
        social security account number and to otherwise protect 
        the confidentiality of such number.

                          Deceased Individuals

  (g) This section does not apply with respect to the social 
security account number of a deceased individual.

                            Criminal Penalty

  (h) Any person who violates this section shall be guilty of a 
felony and upon conviction thereof shall be fined under title 
18, United States Code, or imprisoned for not more than 5 
years, or both.

                   Applicability of Other Protections

  (i) Nothing in this section shall be construed to supersede, 
alter, or affect any restriction or limitation on the sale, 
purchase, display to the general public, or other disclosure of 
social security account numbers, provided in any Federal 
statute, regulation, order, or interpretation, if the 
restriction or limitation is greater than that provided under 
this section, as determined under applicable regulations issued 
by the Commissioner of Social Security or by the Attorney 
General of the United States or another agency or 
instrumentality of the United States as provided in section 
205(c)(2)(I).

           FRAUD BY SOCIAL SECURITY ADMINISTRATION EMPLOYEES

  Sec. 208B. (a) Whoever is an employee of the Social Security 
Administration and knowingly and fraudulently sells or 
transfers one or more social security account numbers or social 
security cards shall be guilty of a felony and upon conviction 
thereof shall be fined under title 18, United States Code, 
imprisoned as provided in subsection (b), or both.
  (b) Imprisonment for a violation described in subsection (a) 
shall be for--
  (1) not less than 1 year and up to 5 years, in the case of an 
employee of the Social Security Administration who has 
fraudulently sold or transferred not more than 50 social 
security account numbers or social security cards,
  (2) not less than 5 years and up to 10 years, in the case of 
an employee of the Social Security Administration who has 
fraudulently sold or transferred more than 50, but not more 
than 100, social security account numbers or social security 
cards, or
  (3) not less than 10 years and up to 20 years, in the case of 
an employee of the Social Security Administration who has 
fraudulently sold or transferred more than 100 social security 
account numbers or social security cards.
  (c) For purposes of this section--
          (1) The term ``social security employee'' means any 
        State employee of a State disability determination 
        service, any officer, employee, or contractor of the 
        Social Security Administration, any employee of such a 
        contractor, or any volunteer providing services or 
        assistance in any facility of the Social Security 
        Administration.
          (2) The term ``social security account number'' means 
        a social security account number assigned by the 
        Commissioner of Social Security under section 
        205(c)(2)(B) or another number that has not been so 
        assigned but is purported to have been so assigned.
          (3) The term ``social security card'' means a card 
        issued by the Commissioner of Social Security under 
        section 205(c)(2)(G), another card which has not been 
        so issued but is purported to have been so issued, and 
        banknote paper of the type described in section 
        205(c)(2)(G) prepared for the entry of social security 
        account numbers, whether fully completed or not.
  (d) Any employee of the Social Security Administration who 
attempts or conspires to commit any violation of this section 
shall be subject to the same penalties as those prescribed for 
the violation the commission of which was the object of the 
attempt or conspiracy.

           *       *       *       *       *       *       *

TITLE VIII--SPECIAL BENEFITS FOR CERTAIN WORLD WAR II VETERANS

           *       *       *       *       *       *       *

SEC. 811. PENALTIES FOR FRAUD.

  (a) In General.--Whoever--
          (1) * * *

           *       *       *       *       *       *       *

[shall be fined under title 18, United States Code, imprisoned 
not more than 5 years, or both.] shall be fined, imprisoned, or 
both, as provided in subsection (b).
  (b) Punishment.--A person convicted of a violation described 
in subsection (a) shall be--
          (1) fined under title 18, United States Code, or 
        imprisoned for not more than 5 years, or both, in the 
        case of an initial violation, subject to paragraphs (3) 
        and (4),
          (2) fined under title 18, United States Code, or 
        imprisoned for not more than 10 years, or both, in the 
        case of a violation which occurs after a prior 
        conviction for another offense under subsection (a) 
        becomes final, subject to paragraphs (3) and (4),
          (3) fined under title 18, United States Code, or 
        imprisoned for not more than 20 years, in the case of a 
        violation which is committed to facilitate a drug 
        trafficking crime (as defined in section 929(a)(2) of 
        title 18, United States Code) or in connection with a 
        crime of violence (as defined in section 924(c)(3) of 
        title 18, United States Code), subject to paragraph 
        (4), and
          (4) fined under title 18, United States Code, or 
        imprisoned for not more than 25 years, in the case of a 
        violation which is committed to facilitate an act of 
        international or domestic terrorism (as defined in 
        paragraphs (1) and (5), respectively, of section 2331 
        of title 18, United States Code).
  [(b)] (c) Court Order for Restitution.--
          (1) * * *

           *       *       *       *       *       *       *

     TITLE XI--GENERAL PROVISIONS, PEER REVIEW, AND ADMINISTRATIVE 
SIMPLIFICATION

           *       *       *       *       *       *       *

SEC. 1129. CIVIL MONETARY PENALTIES AND ASSESSMENTS FOR TITLES II, VIII 
                    AND XVI.

  (a)(1) Any person (including an organization, agency, or 
other entity) who--
          (A) * * *

           *       *       *       *       *       *       *

shall be subject to, in addition to any other penalties that 
may be prescribed by law, a civil money penalty of not more 
than $5,000 for each such statement or representation or each 
receipt of such benefits or payments while withholding 
disclosure of such fact. Such person also shall be subject to 
an assessment, in lieu of damages sustained by the United 
States because of such statement or representation or because 
of such withholding of disclosure of a material fact, of not 
more than twice the amount of benefits or payments paid as a 
result of such a statement or representation or such a 
withholding of disclosure.
  (2) In addition, the Commissioner of Social Security may make 
a determination in the same proceeding to recommend that the 
Secretary exclude, as provided in section 1128, such a person 
who is a medical provider or physician from participation in 
the programs under title XVIII.
  (3) Any person (including an organization, agency, or other 
entity) who--
          (A) uses a social security account number that such 
        person knows or should know has been assigned by the 
        Commissioner of Social Security (in an exercise of 
        authority under section 205(c)(2) to establish and 
        maintain records) on the basis of false information 
        furnished to the Commissioner by any person;
          (B) falsely represents a number to be the social 
        security account number assigned by the Commissioner of 
        Social Security to any individual, when such person 
        knows or should know that such number is not the social 
        security account number assigned by the Commissioner to 
        such individual;
          (C) knowingly alters a social security card issued by 
        the Commissioner of Social Security, or possesses such 
        a card with intent to alter it;
          (D) knowingly buys or sells a card that is, or 
        purports to be, a card issued by the Commissioner of 
        Social Security, or possesses such a card with intent 
        to buy or sell it;
          (E) counterfeits a social security card, or possesses 
        a counterfeit social security card with intent to buy 
        or sell it;
          (F) discloses, uses, compels the disclosure of, or 
        knowingly sells or purchases the social security 
        account number of any person in violation of the laws 
        of the United States;
          (G) with intent to deceive the Commissioner of Social 
        Security as to such person's true identity (or the true 
        identity of any other person), furnishes or causes to 
        be furnished false information to the Commissioner with 
        respect to any information required by the Commissioner 
        in connection with the establishment and maintenance of 
        the records provided for in section 205(c)(2);
          (H) without lawful authority, offers, for a fee, to 
        acquire for any individual, or to assist in acquiring 
        for any individual, an additional social security 
        account number or a number which purports to be a 
        social security account number;
          (I) with intent to deceive, discloses, sells, or 
        transfers his own social security account number, 
        assigned to him by the Commissioner of Social Security 
        under section 205(c)(2)(B), to any person;
          (J) being an officer or employee of any executive, 
        legislative, or judicial agency or instrumentality of 
        the Federal Government or of a State or political 
        subdivision thereof (or a person acting as an agent of 
        such an agency or instrumentality), in possession of 
        any individual's social security account number, 
        willfully acts or fails to act so as to cause a 
        violation of clause (vi)(II), (x), (xi), (xii), (xiii), 
        or (xiv) of section 205(c)(2)(C);
          (K) being a trustee appointed in a case under title 
        11, United States Code (or an officer or employee 
        thereof or a person acting as an agent thereof), 
        willfully acts or fails to act so as to cause a 
        violation of clause (x), (xi), or (xiv) of section 
        205(c)(2)(C);
          (L) violates section 208A (relating to prohibition of 
        the sale, purchase, or display of the social security 
        account number in the private sector); or
          (M) violates section 208B (relating to fraud by 
        social security administration employees);
shall be subject to, in addition to any other penalties that 
may be prescribed by law, a civil money penalty of not more 
than $5,000 for each violation. Such person shall also be 
subject to an assessment, in lieu of damages sustained by the 
United States resulting from such violation, of not more than 
twice the amount of any benefits or payments paid as a result 
of such violation.
  [(2)] (4) For purposes of this section, a material fact is 
one which the Commissioner of Social Security may consider in 
evaluating whether an applicant is entitled to benefits under 
title II or title VIII, or eligible for benefits or payments 
under title XVI.
  [(3)] (5) Any person (including an organization, agency, or 
other entity) who, having received, while acting in the 
capacity of a representative payee pursuant to section 205(j), 
807, or 1631(a)(2), a payment under title II, VIII, or XVI for 
the use and benefit of another individual, converts such 
payment, or any part thereof, to a use that such person knows 
or should know is other than for the use and benefit of such 
other individual shall be subject to, in addition to any other 
penalties that may be prescribed by law, a civil money penalty 
of not more than $5,000 for each such conversion. Such person 
shall also be subject to an assessment, in lieu of damages 
sustained by the United States resulting from the conversion, 
of not more than twice the amount of any payments so converted.

           *       *       *       *       *       *       *

   TITLE XVI--SUPPLEMENTAL SECURITY INCOME FOR THE AGED, BLIND, AND 
DISABLED

           *       *       *       *       *       *       *

Part B--Procedural and General Provisions

           *       *       *       *       *       *       *

                          PENALTIES FOR FRAUD

  Sec. 1632. (a) Whoever--
          (1) * * *

           *       *       *       *       *       *       *

[shall be fined under title 18, United States Code, imprisoned 
not more than 5 years, or both.] shall be fined, imprisoned, or 
both, as provided in subsection (b).
  (b) A person convicted of a violation described in subsection 
(a) shall be--
          (1) fined under title 18, United States Code, or 
        imprisoned for not more than 5 years, or both, in the 
        case of an initial violation, subject to paragraphs (3) 
        and (4),
          (2) fined under title 18, United States Code, or 
        imprisoned for not more than 10 years, or both, in the 
        case of a violation which occurs after a prior 
        conviction for another offense under subsection (a) 
        becomes final, subject to paragraphs (3) and (4),
          (3) fined under title 18, United States Code, or 
        imprisoned for not more than 20 years, in the case of a 
        violation which is committed to facilitate a drug 
        trafficking crime (as defined in section 929(a)(2) of 
        title 18, United States Code) or in connection with a 
        crime of violence (as defined in section 924(c)(3) of 
        title 18, United States Code), subject to paragraph 
        (4), and
          (4) fined under title 18, United States Code, or 
        imprisoned for not more than 25 years, in the case of a 
        violation which is committed to facilitate an act of 
        international or domestic terrorism (as defined in 
        paragraphs (1) and (5), respectively, of section 2331 
        of title 18, United States Code).
  [(b)] (c)(1) Any Federal court, when sentencing a defendant 
convicted of an offense under subsection (a), may order, in 
addition to or in lieu of any other penalty authorized by law, 
that the defendant make restitution to the Commissioner of 
Social Security, in any case in which such offense results in--
          (A) * * *

           *       *       *       *       *       *       *

  [(c)] (d) Any person or entity convicted of a violation of 
subsection (a) of this section or of section 208 may not be 
certified as a representative payee under section 1631(a)(2).

           *       *       *       *       *       *       *

                              ----------                              

              SECTION 603 OF THE FAIR CREDIT REPORTING ACT

Sec. 603. Definitions and rules of construction

  (a) * * *

           *       *       *       *       *       *       *

  (q) Confidential Treatment of Credit Header Information.--
Information regarding the social security account number of the 
consumer, or any derivative thereof, may not be furnished to 
any person by a consumer reporting agency other than in a full 
consumer report furnished in accordance with section 604 and 
other requirements of this title.

                                  

```