```

[House Hearing, 108 Congress]
[From the U.S. Government Publishing Office]

      PROTECTING THE PRIVACY OF CONSUMERS' SOCIAL SECURITY NUMBERS

=======================================================================

                                HEARING

                               before the

                            SUBCOMMITTEE ON
                COMMERCE, TRADE, AND CONSUMER PROTECTION

                                 of the

                    COMMITTEE ON ENERGY AND COMMERCE
                        HOUSE OF REPRESENTATIVES

                      ONE HUNDRED EIGHTH CONGRESS

                             SECOND SESSION

                               __________

                           SEPTEMBER 28, 2004

                               __________

                           Serial No. 108-128

                               __________

      Printed for the use of the Committee on Energy and Commerce

 Available via the World Wide Web: http://www.access.gpo.gov/congress/
                                 house

                               __________

                     U.S. GOVERNMENT PRINTING OFFICE
96-100PDF                 WASHINGTON : 2004

For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512-1800  
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001

                    COMMITTEE ON ENERGY AND COMMERCE

                      JOE BARTON, Texas, Chairman

W.J. ``BILLY'' TAUZIN, Louisiana     JOHN D. DINGELL, Michigan
RALPH M. HALL, Texas                   Ranking Member
MICHAEL BILIRAKIS, Florida           HENRY A. WAXMAN, California
FRED UPTON, Michigan                 EDWARD J. MARKEY, Massachusetts
CLIFF STEARNS, Florida               RICK BOUCHER, Virginia
PAUL E. GILLMOR, Ohio                EDOLPHUS TOWNS, New York
JAMES C. GREENWOOD, Pennsylvania     FRANK PALLONE, Jr., New Jersey
CHRISTOPHER COX, California          SHERROD BROWN, Ohio
NATHAN DEAL, Georgia                 BART GORDON, Tennessee
RICHARD BURR, North Carolina         PETER DEUTSCH, Florida
ED WHITFIELD, Kentucky               BOBBY L. RUSH, Illinois
CHARLIE NORWOOD, Georgia             ANNA G. ESHOO, California
BARBARA CUBIN, Wyoming               BART STUPAK, Michigan
JOHN SHIMKUS, Illinois               ELIOT L. ENGEL, New York
HEATHER WILSON, New Mexico           ALBERT R. WYNN, Maryland
JOHN B. SHADEGG, Arizona             GENE GREEN, Texas
CHARLES W. ``CHIP'' PICKERING,       KAREN McCARTHY, Missouri
Mississippi, Vice Chairman           TED STRICKLAND, Ohio
VITO FOSSELLA, New York              DIANA DeGETTE, Colorado
STEVE BUYER, Indiana                 LOIS CAPPS, California
GEORGE RADANOVICH, California        MICHAEL F. DOYLE, Pennsylvania
CHARLES F. BASS, New Hampshire       CHRISTOPHER JOHN, Louisiana
JOSEPH R. PITTS, Pennsylvania        TOM ALLEN, Maine
MARY BONO, California                JIM DAVIS, Florida
GREG WALDEN, Oregon                  JANICE D. SCHAKOWSKY, Illinois
LEE TERRY, Nebraska                  HILDA L. SOLIS, California
MIKE FERGUSON, New Jersey            CHARLES A. GONZALEZ, Texas
MIKE ROGERS, Michigan
DARRELL E. ISSA, California
C.L. ``BUTCH'' OTTER, Idaho
JOHN SULLIVAN, Oklahoma

                      Bud Albright, Staff Director

                   James D. Barnette, General Counsel

      Reid P.F. Stuntz, Minority Staff Director and Chief Counsel

                                 ______

        Subcommittee on Commerce, Trade, and Consumer Protection

                    CLIFF STEARNS, Florida, Chairman

FRED UPTON, Michigan                 JANICE D. SCHAKOWSKY, Illinois
ED WHITFIELD, Kentucky                 Ranking Member
BARBARA CUBIN, Wyoming               CHARLES A. GONZALEZ, Texas
JOHN SHIMKUS, Illinois               EDOLPHUS TOWNS, New York
JOHN B. SHADEGG, Arizona             SHERROD BROWN, Ohio
  Vice Chairman                      PETER DEUTSCH, Florida
GEORGE RADANOVICH, California        BOBBY L. RUSH, Illinois
CHARLES F. BASS, New Hampshire       BART STUPAK, Michigan
JOSEPH R. PITTS, Pennsylvania        GENE GREEN, Texas
MARY BONO, California                KAREN McCARTHY, Missouri
LEE TERRY, Nebraska                  TED STRICKLAND, Ohio
MIKE FERGUSON, New Jersey            DIANA DeGETTE, Colorado
DARRELL E. ISSA, California          JIM DAVIS, Florida
C.L. ``BUTCH'' OTTER, Idaho          JOHN D. DINGELL, Michigan,
JOHN SULLIVAN, Oklahoma                (Ex Officio)
JOE BARTON, Texas,
  (Ex Officio)

                                  (ii)

                            C O N T E N T S

                               __________
                                                                   Page

Testimony of:
    Bovbjerg, Barbara, Director, Education, Workforce and Income 
      Security, Government Accountability Office.................    15
    Hoofnagle, Chris Jay, Associate Director, Electronic Privacy 
      Information Center.........................................    26
    Leary, Thomas B., Commissioner, Federal Trade Commission.....     6
Additional material submitted for the record:
    ACA International, prepared statement of.....................    43
    Financial Services Coordinating Council, prepared statement 
      of.........................................................    44
    Leary, Thomas B., Commissioner, Federal Trade Commission, 
      letter dated October 20, 2004, enclosing response for the 
      record.....................................................    59
    O'Carroll, Patrick P., Jr., Acting Inspector General, Social 
      Security Administration, prepared statement of.............    54

                                 (iii)

  

 
      PROTECTING THE PRIVACY OF CONSUMERS' SOCIAL SECURITY NUMBERS

                              ----------                              

                      TUESDAY, SEPTEMBER 28, 2004

              House of Representatives,    
              Committee on Energy and Commerce,    
                       Subcommittee on Commerce, Trade,    
                                   and Consumer Protection,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 2 p.m., in 
room 2123, Rayburn House Office Building, Hon Cliff Stearns 
(chairman) presiding.
    Members present: Representatives Stearns, Barton (ex 
officio), Schakowsky, and Green.
    Also present: Representative Shaw.
    Staff present: David Cavicke, majority counsel; Chris 
Leahy, policy coordinator; Shannon Jacquot, majority counsel; 
Brian McCullough, majority professional staff member; William 
Harvard, legislative clerk; and Ashley Groesbeck, minority 
research assistant.
    Mr. Stearns. The subcommittee will come to order.
    Good afternoon. I am pleased to hold this important hearing 
on H.R. 2971, the Social Security Privacy Identity Theft 
Prevention Act of 2003. The committee received a referral on 
the bill, and this subcommittee will take a good look at the 
issues which surround this legislation.
    My colleague from Florida, Congressman Shaw, has done a 
great deal of work on this bill and in this area. I commend him 
for his work as an advocate for protecting the privacy of 
consumers and maintaining the integrity of Social Security 
numbers.
    Balancing the benefits that accrue to consumers from 
private use of Social Security numbers with the harm caused by 
identity theft is a difficult feat. Now, my colleagues, 
identity theft is a very important consumer protection issue. 
Federal Trade Commission data indicates in a 1-year period, 
from September 2002 to September 2003, over 10 million people 
were victims of identity theft. That also means 297 million 
hours were spent in the year 2003 cleaning up the identity 
theft problem. So people talk about the numbers in terms of 
people and money spent, but the hours are also a great deal.
    I also point out that the loss to businesses were $48 
billion in 2003 and $5 billion in 2003 to individuals. So, 
frankly, this is a significant cost to consumers and businesses 
both in terms of money lost and time spent trying to clear up 
their names and, obviously, correct their credit reports.
    The Federal Trade Commission has done a tremendous job in 
gathering important statistical information regarding identity 
theft. This will help us in policy decisions we have to make as 
legislators. I look forward to a general update from the 
Federal Trade Commission on the state of identity theft today 
and would like to hear what ideas the Commission itself has for 
reducing the occurrence of this problem.
    This committee has extensive knowledge on issues relating 
to information privacy and information security. In fact, 
ladies and gentlemen, this will be my eighth privacy hearing on 
this subcommittee in the past 3 years dealing with privacy and 
information security. I have a privacy bill, which I introduced 
in the 170th Congress and which the committee has had extensive 
dialog on, providing privacy and security protection for Social 
Security numbers and other personal identifiable information. 
So I will continue to work on this problem in this Congress 
and, God willing, the next Congress.
    The anti-spyware bill that was reported by the full 
committee in July also came through this subcommittee, provides 
for strong enforcement against spyware practices that, frankly, 
facilitate identity theft. Phishing and keystroke logging are 
explicitly prohibited in the bill, and the bill provides that 
the Federal Trade Commission will have strong enforcement tools 
to go after these practices. We expect this spyware to be voted 
in the House this week, hopefully, on the floor under 
suspension.
    So our subcommittee and Congresswoman Mary Bono, who 
authored the bill and went through our committee, and the great 
staff we have have made this possible. So we are hoping it will 
be on the floor this week.
    I know the chairman of the full committee, Joe Barton, has 
intense interest in information and privacy; and I expect this 
committee will continue to work on it in the 109th Congress.
    The heart of this committee's jurisdiction over H.R. 2971 
obviously is the Federal Trade Commission and its enforcement 
practices, and that is going to be a piece of this legislation. 
That provision makes it an unfair and deceptive act or practice 
under the Federal Trade Commission for any person to refuse to 
do business with an individual because the individual will not 
consent to that person's receipt of his personal Social 
Security number. The section provides an exception for any case 
in which a business is required by law to submit to the Federal 
Government the consumer's Social Security number.
    I ask our panel whether there are any other uses of Social 
Security numbers that are outlawed by this provision but, given 
appropriate safeguards, would benefit to consumers. That 
perhaps is one thing you will need to address. I would like to 
know from this panel what types of information security 
practice should be implemented when Social Security numbers are 
exchanged. So I look forward to a frank discussion on this bill 
at this hearing.
    We have a distinguished panel of experts to educate us 
about this identity theft, privacy in general and importance of 
the integrity of Social Security numbers. I thank the witness 
from the Federal Trade Commission, and I thank GAO and EPIC for 
their participation today.
    With that, I welcome the opening statement of the ranking 
member, the gentlelady, Ms. Schakowsky.
    Ms. Schakowsky. Thank you, Chairman Stearns, and thank you 
for holding today's hearing on H.R. 2971, the Social Security 
Number Privacy and Identity Theft Protection Act. This bill, 
which would restrict what both the public and private sectors 
can do with Social Security numbers, is an important tool in 
the fight against identity theft.
    Identity theft, as you mentioned, Mr. Chairman, is one of 
the fastest-growing financial crimes in the United States, with 
the number of victims doubling each year over the past 3 years. 
As the Federal Trade Commission reports, in 2003, there were 
nearly 10 million Americans victimized by this crime. Over the 
past 5 years, there have been 27 million victims. Both of our 
States, Chairman Stearns, rank in the top ten for identity 
theft occurrences. Florida is fifth, and Illinois is ninth.
    Although nearly half of the victims do not know how their 
personal information was stolen, we do know that Social 
Security numbers are one of the most important means that 
identity thieves use to financially establish themselves as 
someone else. When we consider what the financial door of 
Social Security numbers can unlock and the pervasiveness of the 
use of these numbers, then the rising number of occurrences of 
identity theft should come as no surprise.
    As we have all personally experienced, everyone wants our 
Social Security number. It is not just when we open a bank 
account or apply for a credit card or even when we accept a new 
job. Our Social Security number is requested when we get an 
insurance policy, open a new phone account, or sign a lease.
    So many times when we establish a business relationship, 
the other party wants our number, whether there is a legitimate 
need for it or not. Most times, consumers provide it. We feel 
we have to do so. But we are so used to being asked for our 
Social Security number that we may not give enough thought to 
what the other party might do with it. That company may sell 
them. The numbers may be transmitted over the Internet for 
legitimate purposes but may not be protected in those 
transmissions. Our new accounts may be linked to our Social 
Security numbers. The numbers may be displayed on forms or 
files that are not adequately protected.
    These possibilities should give everyone pause. If we can 
limit how other parties, public and private, use our numbers, 
then we can establish a good framework to prevent the misuse of 
the key to our personal financial information.
    We know that identity theft is financially and emotionally 
devastating. It can take years to discover that one has been 
victimized or even longer to repair that damage. That is why I 
am very pleased we are considering H.R. 2971 today.
    Again, it is truly an important start. However, I also 
believe that we can and need to do more. We, as government 
officials, need to make sure there are adequate resources for 
consumers both to prevent them from becoming victims and to 
help them if they are victimized. We need to make sure we are 
also helping consumers protect themselves by giving them the 
information they need to do so. We need to make sure everyone 
knows how to check their credit reports regularly. That is how 
most people find out that they were victimized. We need to make 
sure that there is help available for victims to recover their 
losses and to clean up their credit reports with as little 
hassle and frustration as possible. We need to be as proactive 
and responsive as we can.
    I look forward to continuing the conversation about what we 
need to do; and, although we have a small panel of witnesses 
before our subcommittee, I am pleased you could join us today. 
I look forward to hearing from you.
    [Additional statements submitted for the record follow:]
   Prepared Statement of Hon. George Radanovich, a Representative in 
                 Congress from the State of California
    Mr. Chairman, I would like to thank you for holding this important 
hearing today on the privacy of consumers' social security numbers.
    The social security number was created to identify each U.S. 
citizen for the sole purpose of tracking employment and benefits 
however, over time our social security number has been used by both 
public and private entities for purposes both related and unrelated to 
the social security program. The usage of this unique identifier has 
benefited both businesses and consumers, but unfortunately it has led 
to misuse and most importantly identity theft.
    The FTC has reported that over 10 million people were victims of 
identity theft in one year and they estimate that this translates into 
upwards of a $48 billion loss for businesses and $5 billion loss for 
consumers, but a price tag can not be put on the loss of one's 
identity.
    I look forward to hearing our witness' testimony today. Hopefully 
this will help us determine if our current laws are adequate enough to 
protect the integrity of our social security numbers and if not, what 
we need to do to protect them.
                                 ______
                                 
Prepared Statement of Hon. John Sullivan, a Representative in Congress 
                       from the State of Oklahoma
    Thank you, Mr. Chairman, for holding this hearing.
    This is an important issue for the First district of Oklahoma. 
Oklahomans have a firm appreciation for, and dedication to, the concept 
of individual liberty. While we conform to our nation's laws, we demand 
that the federal government respects our liberties and privacy. And 
this includes first and foremost, our social security number.
    The social security number (SSN) was first introduced as a device 
for keeping account of contributions to the Social Security system. 
Through the years, however, the government and the private sector have 
expanded the use of this identifying number. In the view of some, 
including many of my constituents, a person's SSN has essentially 
attained the status of a national identification number. SSN's can be 
required to obtain a driver's license, apply for public assistance, 
donate blood, take out a loan, access insurance records, track down 
student loan defaulters, or compile direct marketing mailing lists. 
Private sector use of the social security number is widespread, and 
continues to be unregulated by the federal government. This is 
unacceptable.
    H.R. 2971, Social Security Number Privacy and Identity Theft 
Prevention Act of 2003, prohibits Federal, State, and local governments 
from requiring the display of SSNs to the general public, displaying 
SSNs on checks, driver's licenses, and motor vehicle registrations. It 
would prohibit from employing prisoners in jobs that provide them with 
access to SSNs. Requiring the transmission of SSNs over the Internet 
without encryption or other security measures would also become 
illegal.
    Additionally, the private sector could not sell, purchase, or 
display a SSN to the general public. Businesses would be discouraged 
from denying services to individuals who refuse to provide their SSNs, 
unless required by law, by subjecting them to penalties under Federal 
law. It would create new criminal and civil penalties for violations of 
this law.
    I strongly support H.R. 2971 and the spirit of liberty it upholds. 
The people of my district, and of all of Oklahoma, commend the 
gentleman Mr. Shaw for his hard work on this bill. I encourage all 
members of this Committee to look at this issue very closely, and to 
support this legislation in order to protect your constituent's 
privacy.
    Thank you, Mr. Chairman.
                                 ______
                                 
 Prepared Statement of Hon. Joe Barton, Chairman, Committee on Energy 
                              and Commerce
    Thank you Mr. Chairman for holding this hearing on H.R. 2971, the 
Social Security Privacy and Identity Theft Prevention Act of 2003. The 
Committee received a referral on the bill and we intend to give this 
issue a fair hearing.
    Identity theft is a burgeoning problem for consumers and 
businesses. Approximately 3.23 million consumers were victims of 
identity theft in 2003. Losses to business were estimated at $48 
billion and losses to individuals were estimated at $5 billion. It is 
estimated that in 2003, identity theft victims spent 297 million hours 
trying to clear up the problems and their reputation. Unfortunately, 
the one unique number than can be used to verify an individual can 
create hazardous results when it is in the hands of the wrong people.
    This Committee has a deep bench of experts in the areas of identity 
theft and privacy. Over the past three years, Chairman Stearns has held 
numerous hearings parsing through important issues surrounding 
information privacy. I too have a very strong interest in information 
privacy.
    Representative Shadegg was the author of an important public law, 
the Identity Theft and Assumption Deterrence Act of 1998. That Act has 
provided significant tools for enforcement against identity theft. It 
also directed the Federal Trade Commission to set up an identity theft 
consumer resource center. That center has been a success as it has 
gathered important information regarding identity theft, acted as a 
central repository for complaints, and provided important consumer 
education.
    We have also worked hard at this Committee to shut down new 
electronic means to identity theft. The anti-spyware bill sponsored by 
Representatives Bono and Towns provides the Federal Trade Commission 
with powerful tools against spyware programs, in particular keystroke 
logging programs, used to steal personally identifiable information, 
including a social security number. The bill also includes a 
prohibition against Phishing, the practice of inducing a consumer to 
provide personally identifiable information by misrepresenting the 
identity of the person seeking the information.
    I look forward to hearing from our witnesses today on this 
important topic. Thank you and I yield back.
                                 ______
                                 
  Prepared Statement of Hon. Gene Green, a Representative in Congress 
                        from the State of Texas
    I'd like to thank Chairman Stearns and Ranking member Schakowsky 
for their leadership on this issue.
    I have been a long time supporter of protecting our citizens from 
identity theft. In fact, every year we hold a ``How to Prevent Identity 
Theft'' workshop for senior citizens in our district. This has become 
one of our more popular community events with senior citizens.
    Today's seniors did not grow up in the digital age and new 
technologies can often be confusing. This is why I'm glad to be holding 
this hearing to ensure we protect senior citizens and the rest of us 
from identity theft. Advances in technology have led to advances in 
identity theft and many of the seniors in our district feel vulverable.
    Our social security numbers are widely used in both the public and 
private sectors. Our medical histories and credit records are often 
tied to our social security number. Given this fact, it is important 
for both the government and the private sector to maintain the highest 
degree of security surrounding these numbers.
    I support limiting the sale of social security numbers to the 
general public. However, I also support each of our ability to access 
those numbers when it comes to checking our own records regarding our 
personal financial histories or medical histories.
    I hope we examine the need to strengthen privacy restrictions 
pertaining to our social security numbers as we move forward with this 
legislation.
    We will hear testimony today that billions of dollars are lost on 
identity theft each year. Both business and consumers lose out when 
identity thieves open bogus accounts and spend money that isn't theirs.
    We need to make sure it's as difficult as possible for people to 
take our money and destroy our credit history.
    I look forward to hearing what we can do to make our social 
security numbers more secure and I thank our panel for coming here 
today to testify.
    Thank you and I yield the balace of my time.

    Mr. Stearns. With that, we will move to our panel, if you 
will come to the table here.
    We have the Honorable Thomas Leary, Commissioner of the 
Federal Trade Commission; and we have Barbara Bovbjerg, 
Director of Education, Workforce and Income Security, 
Government Accountability Office; and Chris J. Hoofnagle, 
Associate Director of Electronic Privacy Information Center. We 
welcome your opening statement.
    Commissioner, we will start with you. Thank you for your 
time, and the floor is yours.

  STATEMENTS OF THOMAS B. LEARY, COMMISSIONER, FEDERAL TRADE 
COMMISSION; BARBARA D. BOVBJERG, DIRECTOR, EDUCATION, WORKFORCE 
  AND INCOME SECURITY, GOVERNMENT ACCOUNTABILITY OFFICE; AND 
  CHRIS JAY HOOFNAGLE, ASSOCIATE DIRECTOR, ELECTRONIC PRIVACY 
                       INFORMATION CENTER

    Mr. Leary. Again, thank you, Mr. Chairman. It is a pleasure 
to be here.
    My written statement has been submitted for the record, and 
that reflects the views collectively of the Commission. My oral 
responses to you are my own.
    As you mentioned in your opening statement--and I won't 
repeat the numbers--identity theft is a significant problem, 
and our data indicate that it is a problem which is growing. 
However, we are heartened somewhat by the fact that most of the 
recent increase seems to involve misuse of existing accounts 
rather than opening new credit lines, which is an activity that 
is somewhat less harmful and somewhat easier for consumers to 
rectify. We also anticipate that the recently enacted Fair and 
Accurate Credit Transactions Act of 2003, FACTA, will make 
inroads into the identity theft problem, but it is much too 
early to see the results.
    We have, as you probably know, a complex rulemaking task 
under that statute. Notice and comment rulemaking is 
necessarily a somewhat lengthy process, and we are still in the 
process. I have a chart that shows the progress of our 
rulemaking thus far. That process is still under way. And of 
course, once the rules are in place, it takes some time for 
business to adjust to a new regime.
    So it is too early to tell now whether or not that statute 
will do what it is intended to do. However, the survey results 
that we have up to now demonstrate the need for a concerted 
effort between the public and the private sectors to reduce 
identity theft.
    A second point. If we focus specifically on Social Security 
numbers, we have to recognize that the effects of their 
disclosure can be beneficial as well as harmful, as you pointed 
out in your opening statement, Mr. Chairman. There is no 
question that identity thieves use the Social Security number 
as the key to access other peoples' financial resources. ID 
theft will be we reduced to the extent we make it hard for 
thieves to get these numbers.
    On the other hand, Social Security numbers are essential 
for the operation of our financial system. Instant access to 
credit, which we all use for both large and small transactions, 
would be compromised if Social Security numbers could not be 
used to match consumers to their financial information.
    We must find, as you pointed out, the proper balance 
between the need to keep Social Security numbers out of the 
hands of identity thieves and the need for businesses to have 
sufficient information to catch fraud and to match financial 
records with the right person. Achievement of this goal depends 
not only on Congress and government agencies but on private 
business initiatives and prudent actions by consumers 
themselves.
    Three, Congress created important new protections in FACTA. 
Many of the provisions of the Fair and Accurate Credit 
Transactions Act of 2003 aim to prevent ID theft and facilitate 
early detection by the victims:
    A, free annual file disclosures. The law requires that 
consumers be given free access to their credit reports 
annually. This will enhance their ability to discover and 
correct errors and detect identity theft early.
    B, National Fraud Alert System. The National Fraud Alert 
System created by this statute will put potential creditors on 
notice that they must proceed with caution when granting credit 
in a consumer's name.
    C, the so-called ``red-flag'' rulemaking, which will 
require financial institutions to analyze identity theft 
patterns.
    And, D, the disposal rule. Rules on the disposal of 
consumer report information and records will help to ensure 
that sensitive consumer information, including Social Security 
numbers, is not simply thrown out with the trash.
    When fully implemented, these provisions should help to 
reduce the incidence of identity theft and help victims recover 
when problems do occur.
    Point four, the role of the Federal Trade Commission. The 
Commission's law enforcement role in this area is limited. We 
do not have criminal authority; and criminal sanctions, are, of 
course, the principal deterrent to crimes such as these. Our 
primary role today is to maintain a central repository of ID 
theft complaints for the benefit of other law enforcement 
agencies. We also work with businesses on developing better 
ways to protect valuable consumer information. We have a kit 
available on-line which provides guidance for businesses on 
this subject. The Commission is also required by FACTA to study 
how credit reporting agencies use identifying information to 
match consumers to their credit reports before releasing them.
    And finally, and perhaps most important, are education and 
assistance for consumers. We have published booklets with basic 
information and specific guidelines for actual victims in both 
English and in Spanish. I have brought some samples of these 
booklets today. These have been distributed in the millions. I 
don't have the exact figure, but it is in the millions.
    Mr. Stearns. We will have the staff bring them up so the 
ranking member and I can look at them.
    Mr. Leary. In this area, as in other areas, the consumers 
are better informed; and more wary consumers are always the 
first line of defense.
    In conclusion, let me just say there is no magic bullet 
that will eliminate identity theft. The basic problem is that 
the dissemination of personal identifiers is essential for 
maintaining our financial system that runs on credit, but that 
same information in the wrong hands can cause immense harm. An 
appropriate balance of public and private efforts will help to 
contain the problem, and we in the Commission are determined to 
do our part.
    Thank you very much, Mr. Chairman.
    [The prepared statement of Thomas B. Leary follows:]
Prepared Statement of Hon. Thomas B. Leary, Commissioner, Federal Trade 
                               Commission
        
                          I. INTRODUCTION
    Mr. Chairman, and members of the Subcommittee, I am Commissioner 
Thomas B. Leary of the Federal Trade Commission (``FTC'' or 
``Commission'').1 I appreciate the opportunity to present 
the Commission's views on identity theft and Social Security numbers. 
The Federal Trade Commission has a broad mandate to protect consumers, 
and controlling identity theft is an important issue of concern to all 
consumers. Through this testimony, the Commission will describe the 
results of a recent survey on the prevalence and impact of identity 
theft, the ways in which Social Security numbers are collected and 
used, new protections for consumers and identity theft victims, and the 
Commission's identity theft program.
---------------------------------------------------------------------------
    \1\ The views expressed in this statement represent the views of 
the Commission. My oral presentation and responses to questions are my 
own and do not necessarily represent the views of the Commission or any 
other Commissioner.
---------------------------------------------------------------------------

             II. UNDERSTANDING THE IMPACT OF IDENTITY THEFT
    On November 1, 1999, the Commission began collecting identity theft 
complaints from consumers in its national database, the Identity Theft 
Data Clearinghouse (the ``Clearinghouse'').2 Every year 
since has seen an increase in complaints.3 The Clearinghouse 
now contains over 666,000 identity theft complaints taken from victims 
across the country. By itself, though, these self-reported data do not 
allow the FTC to draw any firm conclusions about the incidence of 
identity theft in the general population. To address this important 
issue, the FTC commissioned a survey last year to gain a better picture 
of the incidence of identity theft and the impact of the crime on its 
victims.4 The results were startling. The data showed that 
within the 12 months preceding the survey, 3.23 million persons 
discovered that an identity thief opened new accounts in their names. 
An additional 6.6 million consumers learned of the misuse of an 
existing account.5 Overall, nearly 10 million people--or 4.6 
percent of the adult population--discovered that they were victims of 
some form of identity theft. These numbers translate to nearly $48 
billion in losses to businesses, nearly $5 billion in losses to 
individual victims, and almost 300 million hours spent by victims 
trying to resolve their problems.
---------------------------------------------------------------------------
    \2\ See infra Section V for a discussion of the Commission's 
mandate to maintain an identity theft complaint database pursuant to 
the 1998 Identity Theft Assumption and Deterrence Act.
    \3\ Charts that summarize data from the Clearinghouse can be found 
at http://www.consumer.gov/idtheft/stats.html and http://
www.consumer.gov/sentinel/index.html.
    \4\ The research took place during March and April 2003. It was 
conducted by Synovate, a private research firm, and involved a random 
sample telephone survey of over 4,000 U.S. adults. The full report of 
the survey can be found at http://www.consumer.gov/idtheft/stats.html.
    \5\ These 6.6 million victims include 5.1 million victims who 
experienced only the unauthorized use of their existing credit card 
accounts, and 1.5 million who reported the misuse of other existing 
accounts, such as their checking or telecommunications accounts. Of the 
cases involving only the misuse of existing credit cards, 26% of the 
victims (which represents 4.6% of all identity theft victims) reported 
that the suspect was a family member. Some in the financial services 
industry do not consider unauthorized use of existing credit card 
accounts ``identity theft'' unless accompanied by an ``account 
takeover,'' meaning that the thief has impersonated the victim to the 
credit card issuer and has taken actions such as changing the victim's 
billing address, having a replacement or additional credit card sent 
out, or changing the victim's password. Federal criminal law, however, 
defines identity theft to include the misuse of existing accounts. 18 
U.S.C. Sec. 1028(a)(7). Of the 5.1 million victims reporting only the 
unauthorized use of an existing credit card account, 16% reported 
account takeover.
---------------------------------------------------------------------------
    Moreover, identity theft is a growing crime. The survey indicated a 
significant increase in the previous 2-3 years--nearly a doubling from 
one year to the next, although the research showed that this increase 
has recently slowed. Notably, this recent increase primarily involved 
the misuse of an existing account, which tends to cause less economic 
injury to victims and is generally easier for them to identify and fix. 
Overall, the 2003 survey analysis puts the incidence rates of identity 
theft into sharper focus, and demonstrates the need for a concerted 
effort between the public and private sectors to act aggressively to 
reduce identity theft.

          III. SOCIAL SECURITY NUMBER USES AND IDENTITY THEFT
    Social Security numbers play a pivotal role in identity theft. 
Identity thieves use the Social Security number as a key to access the 
financial benefits available to their victims. Preventing identity 
thieves from obtaining Social Security numbers will help to protect 
consumers from this pernicious crime. The potential for misuse arises 
because Social Security numbers are crucial to the proper functioning 
of our financial system. Social Security numbers are used to match 
consumers to their credit and other financial information. Without 
them, information may be attributed to the wrong consumer, and the 
accuracy of credit reports may be degraded. Enabling Social Security 
numbers to be used appropriately will help to ensure that consumers 
continue to enjoy the benefits of our current credit system. The 
Commission is studying ``the efficacy of increasing the number of 
points of identifying information that a credit reporting agency is 
required to match to ensure that a consumer is the correct individual 
to whom a consumer report relates before releasing a consumer report to 
a user'' as required by the Fair and Accurate Credit Transactions Act 
of 2003.6 This study, to be completed by December, 2004, 
should greatly increase our knowledge of the importance of Social 
Security numbers in the matching process. The Commission looks forward 
to reporting its findings to Congress.
---------------------------------------------------------------------------
    \6\ Pub. L. No. 108-159, Sec. 318 (2003).
---------------------------------------------------------------------------
    Social Security numbers are collected by public and private 
entities for various purposes, and several federal and state laws 
restrict the use or disclosure of Social Security numbers, depending on 
the source.7 The nationwide credit bureaus are primary 
private sources of Social Security numbers, collecting information from 
financial institutions for credit reporting purposes. This information 
typically includes a consumer's identifying information--such as name, 
address, and Social Security number--as well as information related to 
the consumer's credit accounts. The identifying information collected 
by the credit bureaus is one of the most reliable and comprehensive 
sources of this information, because individuals tend to provide their 
financial institutions with accurate and up-to-date identifying 
information and the credit bureau databases contain information for 
over 200 million consumers.8
---------------------------------------------------------------------------
    \7\ As GAO has reported, government and commercial entities use 
Social Security numbers for a number of different purposes, including 
to verify the eligibility of applicants, manage records, and conduct 
research. U.S. General Accounting Office, Social Security: Government 
and Commercial Use of the Social Security Number is Widespread, GAO/
HEHS-99-28 (Washington, D.C.: Feb. 16, 1999) and Social Security 
Numbers: Government Benefits from SSN Use but Could Provide Better 
Safeguards, GAO-02-352 (Washington, D.C.: May 31, 2002). As examined in 
GAO's most recent report of January 2004, information resellers, 
consumer reporting agencies, and health care organizations obtain 
social security numbers both directly from consumers and other 
businesses, and the entities use them for various purposes, including 
identification and to match the consumer to information stored in the 
consumer's credit report. See U.S. General Accounting Office, Social 
Security Numbers: Private Sector Entities Routinely Obtain and Use SSNs 
and Laws Limit the Disclosure of This Information, GAO-04-11 
(Washington, D.C.: Jan. 22, 2004).
    \8\ See Consumer Data Industry Association's Web site, available at 
http://www.cdiaonline.org/about.cfm.
---------------------------------------------------------------------------
    The Gramm-Leach-Bliley Act (``GLBA'') 9 imposes certain 
restrictions on the reuse and redisclosure of the identifying 
information--including Social Security numbers--that is collected by 
credit bureaus from financial institutions.10 As a general 
matter, the GLBA prohibits financial institutions from disclosing 
nonpublic personal information ((NPI() to nonaffiliated third parties 
without first providing consumers with notice and the opportunity to 
opt out of such disclosure. This general restriction, however, is 
subject to certain exceptions. The information may flow from financial 
institutions to others for certain purposes specified in the statute 
and rule, including, for example, to process transactions or to report 
consumer information to credit bureaus.11 When information 
is disclosed under these GLBA exceptions, the recipient may not use or 
disclose that NPI except (in the ordinary course of business to carry 
out the activity covered by the exception under which . . . the 
information [was received].( 12
---------------------------------------------------------------------------
    \9\ 15 U.S.C. Sec. 6801 et seq.
    \10\ The GLBA applies to any ``nonpublic personal information'' 
(``NPI'') that a financial institution collects about an individual in 
connection with providing a financial product or service to an 
individual, unless that information is otherwise publicly available. 
This includes basic identifying information about individuals, such as 
name, Social Security number, address, telephone number, mother's 
maiden name, and prior addresses. See, e.g., 65 Fed. Reg. 33,646, 33680 
(May 24, 2000) (the FTC's Privacy Rule). This identifying information 
generally is not covered by the Fair Credit Reporting Act. See FTC v. 
Trans Union, Dkt. 9255, Op. of the Commission at pp. 30-31 (Mar. 1, 
2000) (holding that consumer name, Social Security number, address, 
telephone number, and mother's maiden name do not constitute a consumer 
report under the FCRA).
    \11\ These exceptions are found in Sec. 502(e) of the GLBA, and in 
Sec.Sec.313.14 and 313.15 of the FTC's privacy rule. The other GLBA privacy 
rules contain substantially similar provisions. The Sec. 313.14 exceptions 
relate to the processing and servicing of transactions at the 
consumer's request, and the Sec. 313.15 exceptions contain a broad range 
of unrelated exceptions, such as preventing fraud, assisting law 
enforcement, complying with subpoenas, and reporting to credit bureaus. 
Section 313.13 also contains an exception to the notice and opt out 
requirement, but that section is not relevant here because it relates 
to contractual arrangements with service providers and joint marketers.
    \12\ 16 C.F.R. 313.11(a)(1)(iii), (c)(3) (2000).
---------------------------------------------------------------------------

             IV. NEW PROTECTIONS FOR IDENTITY THEFT VICTIMS
    On December 4, 2003, the Fair and Accurate Credit Transactions Act 
of 2003 (``FACTA'') was enacted.13 Many of the provisions 
amend the Fair Credit Reporting Act (``FCRA''),14 and 
provide new and important measures to prevent identity theft and 
facilitate identity theft victims' recovery. Some of these measures 
will take effect this year.15 They will codify many of the 
voluntary measures initiated by the private sector and improve other 
recovery procedures already in place.
---------------------------------------------------------------------------
    \13\ Pub. L. No. 108-159 (2003) (codified at 15 U.S.C. Sec. 1681 et 
seq.).
    \14\ 15 U.S.C. Sec. 1681 et seq.
    \15\ The statute set effective dates for certain sections and 
required the Commission and the Federal Reserve Board jointly to set 
effective dates for the remaining sections. See Effective Dates for the 
Fair and Accurate Credit Transactions Act of 2003, 16 C.F.R. Sec. 602.1 
(2004).
---------------------------------------------------------------------------
    One prominent benefit of these amendments to the FCRA is the 
greater access to free consumer reports.16 Previously under 
the FCRA, consumers were entitled to a free consumer report only under 
limited circumstances.17 Beginning in December of this year 
with a regional rollout, nationwide and nationwide specialty consumer 
reporting agencies 18 must provide free credit reports to 
consumers once annually, upon request.19 Free reports will 
enhance consumers' ability to discover and correct errors, thereby 
improving the accuracy of the system, and also enable consumers to 
detect identity theft early.
---------------------------------------------------------------------------
    \16\ Pub. L. No. 108-159, Sec. 211 (2003).
    \17\ Previously, free reports were available only pursuant to the 
FCRA when the consumer suffered adverse action, believed that 
fraudulent information may be in his or her credit file, was 
unemployed, or was on welfare. Absent one of these exceptions, 
consumers had to pay a statutory ``reasonable charge'' for a file 
disclosure; this fee is set each year by the Commission and is 
currently $9. See 15 U.S.C. Sec. 1681j. In addition, a small number of 
states required the CRAs to provide free annual reports to consumers at 
their request.
    \18\ Section 603(w) of the FCRA defines a ``nationwide specialty 
consumer reporting agency'' as a consumer reporting agency that 
compiles and maintains files on consumers relating to medical records 
or payments, residential or tenant history, check writing history, 
employment history, or insurance claims, on a nationwide basis. 15 
U.S.C. Sec. 1681a(w).
    \19\ See Free Annual File Disclosures, 16 C.F.R. Sec.Sec.610.1 and 698.1 
(2004).
---------------------------------------------------------------------------
    Other measures that act to prevent identity theft include:

 National fraud alert system: 20 Consumers who reasonably 
        suspect they have been or may be victimized by identity theft, 
        or who are military personnel on active duty away from 
        home,21 can place an alert on their credit files. 
        The alert will put potential creditors on notice that they must 
        proceed with caution when granting credit in the consumer's 
        name. The provision also codified and standardized the ``joint 
        fraud alert'' initiative administered by the three major credit 
        reporting agencies. After receiving a request from an identity 
        theft victim for the placement of a fraud alert on his or her 
        consumer report and for a copy of that report, each credit 
        reporting agency now shares that request with the other two 
        nationwide credit reporting agencies, thereby eliminating the 
        need for the victim to contact each of the three agencies 
        separately.
---------------------------------------------------------------------------
    \20\ Pub. L. No. 108-159, Sec. 112 (2003).
    \21\ The Commission is developing a rule on the duration of this 
active duty alert. See Related Identity Theft Definitions, Duration of 
Active Duty Alerts, and Appropriate Proof of Identity Under the Fair 
Credit Reporting Act, 69 Fed. Reg. 23370, 23372 (April 28, 2004) (to be 
codified at 16 C.F.R. pt. 613).
---------------------------------------------------------------------------
 Truncation of credit and debit card receipts: 22 In some 
        instances, identity theft results from thieves obtaining access 
        to account numbers on credit card receipts. FACTA seeks to 
        reduce this source of fraud by requiring merchants to truncate 
        the full card number on electronic receipts. The use of 
        truncation technology is becoming widespread, and some card 
        issuers already require merchants to truncate.23
---------------------------------------------------------------------------
    \22\ Pub. L. No. 108-159, Sec. 113 (2003).
    \23\ FACTA creates a phase-in period to allow for the replacement 
of existing equipment.
---------------------------------------------------------------------------
 ``Red flag'' indicators of identity theft: 24 The banking 
        regulators and the FTC will jointly develop a rule to identify 
        and maintain a list of ``red flag'' indicators of identity 
        theft. The goal of this provision is for financial institutions 
        and creditors to analyze identity theft patterns and practices 
        so that they can take appropriate action to prevent this crime.
---------------------------------------------------------------------------
    \24\ Pub. L. No. 108-159, Sec. 114 (2003).
---------------------------------------------------------------------------
 Disposal of Consumer Report Information and Records: 25 
        The banking regulators and the FTC are coordinating a 
        rulemaking to require proper disposal of consumer information 
        derived from consumer reports.26 This requirement 
        will help to ensure that sensitive consumer information, 
        including Social Security numbers, is not simply left in a 
        trash dumpster, for instance, once a business no longer needs 
        the information.27
---------------------------------------------------------------------------
    \25\ Id. Sec. 216.
    \26\ Disposal of Consumer Report Information and Records, 69 Fed. 
Reg. 21388 (April 20, 2004) (to be codified at 16 C.F.R. pt. 682).
    \27\ In its outreach materials, the FTC also advises consumers to 
shred any sensitive information before disposing of it.
---------------------------------------------------------------------------
    FACTA also includes measures that will assist victims with their 
recovery. These provisions include:

 Identity theft account blocking: 28 This provision 
        requires credit reporting agencies immediately to cease 
        reporting, or block, allegedly fraudulent account information 
        on consumer reports when the consumer submits an identity theft 
        report,29 unless there is reason to believe the 
        report is false. Blocking would mitigate the harm to consumers' 
        credit records that can result from identity theft. Credit 
        reporting agencies must also notify information furnishers who 
        must then cease furnishing the fraudulent information and may 
        not sell, transfer, or place for collection the debt resulting 
        from the identity theft.
---------------------------------------------------------------------------
    \28\ Pub. L. No. 108-159, Sec. 152 (2003).
    \29\ The Commission is developing a rule to define the term 
``identity theft report.'' See Related Identity Theft Definitions, 
Duration of Active Duty Alerts, and Appropriate Proof of Identity Under 
the Fair Credit Reporting Act, 69 Fed. Reg. 23370, 23371 (April 28, 
2004) (to be codified at 16 C.F.R. pt. 603).
---------------------------------------------------------------------------
 Information available to victims: 30 A creditor or other 
        business must give victims copies of applications and business 
        records relating to the theft of their identity at the victim's 
        request. This information can assist victims in proving that 
        they are, in fact, victims. For example, they may be better 
        able to prove that the signature on the application is not 
        their signature.
---------------------------------------------------------------------------
    \30\ Pub. L. No. 108-159, Sec. 151 (2003).
---------------------------------------------------------------------------
 Prevention of re-reporting fraudulent information: 31 
        Consumers can provide identity theft reports directly to 
        creditors or other information furnishers to prevent them from 
        continuing to furnish fraudulent information resulting from 
        identity theft to the credit reporting agencies.
---------------------------------------------------------------------------
    \31\ Id. Sec. 154.
---------------------------------------------------------------------------
    When fully implemented, these provisions should help to reduce the 
incidence of identity theft, and help victims recover when the problem 
does occur.

   V. THE FEDERAL TRADE COMMISSION(S ROLE IN COMBATING IDENTITY THEFT
    The FTC's role in combating identity theft derives from the 1998 
Identity Theft Assumption and Deterrence Act (``the Identity Theft 
Act'' or ``the Act'').32 The Identity Theft Act strengthened 
the criminal laws governing identity theft 33 and focused on 
consumers as victims.34 The Act directed the Federal Trade 
Commission to establish the federal government's central repository for 
identity theft complaints, to make available and to refer these 
complaints to law enforcement for their investigations, and to provide 
victim assistance and consumer education. Thus, the FTC's role under 
the Act is primarily one of facilitating information sharing among 
public and private entities.35
---------------------------------------------------------------------------
    \32\ Pub. L. No. 105-318, 112 Stat. 3007 (1998) (codified at 18 
U.S.C. Sec. 1028).
    \33\ 18 U.S.C. Sec. 1028(a)(7) made identity theft a crime by focusing 
on the unlawful use of an individual's ``means of identification,'' 
which broadly includes ``any name or number that may be used, alone or 
in conjunction with any other information, to identify a specific 
individual,'' including, among other things, name, address, Social 
Security number, driver's license number, biometric data, access 
devices (i.e., credit cards), electronic identification number or 
routing code, and telecommunication identifying information.
    \34\ Because individual consumers' financial liability is often 
limited, prior to the passage of the Act, financial institutions, 
rather than individuals, tended to be viewed as the primary victims of 
identity theft. Setting up an assistance process for consumer victims 
is consistent with one of the Act's stated goals: to recognize the 
individual victims of identity theft. See S. Rep. No. 105-274, at 4 
(1998).
    \35\ Most identity theft cases are best addressed through criminal 
prosecution. The FTC itself has no direct criminal law enforcement 
authority. Under its civil law enforcement authority provided by 
Section 5 of the FTC Act, the Commission may, in appropriate cases, 
bring actions to stop practices that involve or facilitate identity 
theft. See, e.g., FTC v. Corporate Marketing Solutions, Inc., CIV-02 
1256 PHX RCB (D. Ariz. Feb. 3, 2003) (final order) (defendants 
``pretexted'' personal information from consumers and engaged in 
unauthorized billing of consumers' credit cards); FTC v. C.J., CIV-03 
5275 GHK (RZx) (C.D. Cal. July 24, 2003) (final order); FTC v. Hill, 
CV-H-03-5537 (S.D. Tex. Dec. 3, 2003) (final order); and FTC v. M.M., 
CV-04-2086 (E.D.N.Y. May 18, 2004) (final order) (defendants sent 
``phishing'' spam purporting to come from AOL or Paypal and created 
look-alike websites to obtain credit card numbers and other financial 
data from consumers that defendants used for unauthorized online 
purchases). In addition, the FTC brought six complaints against 
marketers for purporting to sell international driver's permits that 
could be used to facilitate identity theft. Press Release, Federal 
Trade Commission, FTC Targets Sellers Who Deceptively Marketed 
International Driver's Permits over the Internet and via Spam (Jan. 16, 
2003) (at http://www.ftc.gov/opa/2003/01/idpfinal.htm).
---------------------------------------------------------------------------
    To fulfill the Act's mandate, the Commission implemented a program 
that focuses on three principal components: (1) collecting complaints 
and providing victim assistance through a telephone hotline and a 
dedicated website, (2) maintaining and promoting the Clearinghouse, a 
centralized database of victim complaints that serves as an 
investigative tool for law enforcement, and (3) outreach and education 
to consumers, law enforcement, and private industry.
A. Assisting Identity Theft Victims
    The Commission takes complaints from victims through a toll-free 
hotline, 1-877-ID THEFT (438-4338),36 and a secure online 
complaint form on its website, www.consumer.gov/idtheft. In addition, 
the FTC provides advice on recovery from identity theft. Callers to the 
hotline receive telephone counseling from specially trained personnel 
who provide general information about identity theft and help guide 
victims through the steps needed to resolve the problems resulting from 
the misuse of their identities.37 Victims are currently 
advised to: 38 (1) obtain copies of their credit reports 
from the three national consumer reporting agencies and have a fraud 
alert placed on their credit reports; 39 (2) contact each of 
the creditors or service providers where the identity thief has 
established or accessed an account, to request that the account be 
closed and to dispute any associated charges; and (3) report the 
identity theft to the police and get a police report, which is very 
helpful in demonstrating to would-be creditors and debt collectors that 
the consumers are genuine victims of identity theft.
---------------------------------------------------------------------------
    \36\ The Commission has a separate toll-free line (877-FTC-HELP) to 
serve those with general consumer protection complaints.
    \37\ Spanish speaking counselors are available for callers who 
select the Spanish-language option on the toll-free line.
    \38\ As the relevant provisions of FACTA become effective, the 
Commission will update its advice to victims on their new rights and 
procedures for recovery.
    \39\ These fraud alerts indicate that the consumer is to be 
contacted before new credit is issued in that consumer's name.
---------------------------------------------------------------------------
    Counselors also advise victims having particular problems about 
their rights under relevant consumer credit laws including the 
FCRA,40 the Fair Credit Billing Act,41 the Truth 
in Lending Act,42 and the Fair Debt Collection Practices 
Act.43 If another federal agency can assist victims because 
the nature of the victims' identity theft falls within such agency's 
jurisdiction, callers also are referred to those agencies.
---------------------------------------------------------------------------
    \40\ 15 U.S.C. Sec. 1681 et seq.
    \41\ Id. Sec. 1666. The Fair Credit Billing Act generally applies to 
``open end'' credit accounts, such as credit cards, revolving charge 
accounts, and overdraft checking accounts. It does not cover 
installment contracts, such as loans or extensions of credit that are 
repaid on a fixed schedule.
    \42\ Id. Sec. 1601 et seq.
    \43\ Id. Sec. 1692 et seq.
---------------------------------------------------------------------------
    The FTC's identity theft website, located at www.consumer.gov/
idtheft, provides equivalent service for those who prefer the immediacy 
of an online interaction. The site contains a secure complaint form, 
which allows victims to enter their identity theft information into the 
Clearinghouse. Victims also immediately can read and download all of 
the resources necessary for reclaiming their credit record and good 
name, including the FTC's tremendously successful consumer education 
booklet, Identity Theft: When Bad Things Happen to Your Good 
Name.44 The 26-page booklet, now in its fourth edition, 
comprehensively covers a range of topics, including the first steps to 
take for victims and how to correct more intensive credit-related 
problems that may result from identity theft. It also describes other 
federal and state resources that are available to victims who may be 
having particular problems as a result of the identity theft. The FTC 
alone has distributed more than 1.4 million copies of the booklet since 
its release in February 2000, and recorded over 1.6 million visits to 
the Web version.45
---------------------------------------------------------------------------
    \44\ Identity Theft: When Bad Things Happen to Your Good Name and 
the secure complaint form are available in Spanish.
    \45\ Other government agencies, including the Social Security 
Administration, the SEC, and the FDIC, also have printed and 
distributed copies of Identity Theft: When Bad Things Happen to Your 
Good Name.
---------------------------------------------------------------------------
B. The Identity Theft Data Clearinghouse
    One of the primary purposes of the Identity Theft Act was to enable 
criminal law enforcement agencies to use a single database of victim 
complaints to support their investigations. To ensure that the database 
operates as a national clearinghouse for complaints, the FTC accepts 
complaints from external sources such as other state or federal 
agencies as well as directly from consumers through its call center and 
online complaint form. For example, in February 2001, the Social 
Security Administration Office of Inspector General (SSA-OIG) began 
providing the FTC with complaints from its fraud hotline, significantly 
enriching the FTC's database.
    The Clearinghouse provides a picture of the nature, prevalence, and 
trends of the identity theft victims who submit complaints. The 
Commission publishes annual charts showing the prevalence of identity 
theft complaints by states and by cities.46 Law enforcement 
and policy makers at all levels of government use these reports to 
better understand the challenges identity theft presents.
---------------------------------------------------------------------------
    \46\ Charts that summarize data from the Clearinghouse can be found 
at http://www.consumer.gov/idtheft/stats.html and http://
www.consumer.gov/sentinel/index.html.
---------------------------------------------------------------------------
    Since the inception of the Clearinghouse in July of 2000, more than 
1042 law enforcement agencies, from the federal to the local level, 
have signed up for secure online access to the database. Individual 
investigators within those agencies have the ability to access the 
system from their desktop computers 24 hours a day, seven days a week.
    The Commission actively encourages even greater use of the 
Clearinghouse. Beginning in 2002, in an effort to further expand the 
use of the Clearinghouse among law enforcement, the FTC, in cooperation 
with the Department of Justice, the United States Postal Inspection 
Service, and the United States Secret Service, initiated full day 
identity theft training seminars for state and local law enforcement 
officers. To date, seminars have been held in Washington, D.C., Des 
Moines, Chicago, San Francisco, Las Vegas, Dallas, Phoenix, New York 
City, Seattle, San Antonio, Orlando, Raleigh, Rochester, and Denver. 
The FTC also helped the Kansas and Missouri offices of the U.S. 
Attorney and State Attorney General conduct a training seminar in 
Kansas City. More than 1800 officers have attended these seminars, 
representing more than 680 different agencies. Future seminars are 
being planned for additional cities.
    The FTC staff also developed an identity theft case referral 
program.47 The staff creates preliminary investigative 
reports by examining significant patterns of identity theft activity in 
the Clearinghouse and refining the data through the use of additional 
investigative resources. Then the staff refers the investigative 
reports to appropriate Financial Crimes Task Forces and other law 
enforcers throughout the country for further investigation and 
potential prosecution. The FTC is aided in this work by its federal law 
enforcement partners, including the United States Secret Service, the 
Federal Bureau of Investigation, and the United States Postal 
Inspection Service. Recently, an FBI analyst has worked intensively 
with the Clearinghouse complaints, using sophisticated analytical 
software to find related complaints and combine the information with 
other data sources available to the FBI.
---------------------------------------------------------------------------
    \47\ The referral program complements the regular use of the 
database by all law enforcers from their desktop computers.
---------------------------------------------------------------------------
C. Outreach and Education
    The Identity Theft Act also directed the FTC to educate consumers 
about identity theft. Recognizing that law enforcement and private 
industry each play an important role in helping consumers both to 
minimize their risk and to recover from identity theft, the FTC 
expanded its outreach and education mission to include these sectors.
    (1) Consumers: The FTC has taken the lead in the development and 
dissemination of comprehensive consumer education materials for victims 
of identity theft and those concerned with preventing this crime. The 
FTC's extensive consumer and business education campaign includes print 
and online materials, media mailings, and radio and television 
interviews. The FTC also maintains the identity theft website, 
www.consumer.gov/idtheft, which includes the publications and links to 
testimony, reports, press releases, identity theft-related state laws, 
and other resources.
    To increase awareness for the average consumer and provide tips for 
minimizing the risk of identity theft, the FTC developed a new primer 
on identity theft, ID Theft: What's It All About?.48 Taken 
together with the detailed victim recovery guide, Identity Theft: When 
Bad Things Happen to Your Good Name, the two publications help to 
educate consumers.
---------------------------------------------------------------------------
    \48\ Since its release in May 2003, the FTC has distributed more 
than 972,000 paper copies and over 119,300 web versions, and developed 
a Spanish version.
---------------------------------------------------------------------------
    (2) Law Enforcement: Because law enforcement at the state and local 
level can provide significant practical assistance to victims, the FTC 
places a premium on outreach to such agencies. In addition to the 
training described previously (see infra Section V.B), the staff joined 
with North Carolina's Attorney General Roy Cooper to send letters to 
every other Attorney General about the FTC's identity theft program and 
how each Attorney General could use the resources of the program to 
better assist residents of his or her state. Other outreach initiatives 
include: (i) participation in a ``Roll Call'' video produced by the 
Secret Service, which has been sent to thousands of law enforcement 
departments across the country to instruct officers on identity theft, 
investigative resources, and assisting victims; and (ii) the redesign 
of the FTC's website to include a section for law enforcement with tips 
on how to help victims as well as resources for investigations.
    (3) Industry: The private sector can help with the problem of 
identity theft in several ways. From prevention through better security 
and authentication, to helping victims recover, businesses play a key 
role in reducing the impact of identity theft.
    (a) Information Security Breaches: The FTC works with institutions 
that maintain personal information to identify ways to help keep that 
information safe from identity theft.49 In 2002, the FTC 
invited representatives from financial institutions, credit issuers, 
universities, and retailers to an informal roundtable discussion of how 
to prevent unauthorized access to personal information in employee and 
customer records.
---------------------------------------------------------------------------
    \49\ The Commission also has law enforcement authority relating to 
information security. In addition to developing the Disposal Rule 
pursuant to FACTA, see supra Section IV, the Commission also is 
responsible for enforcing its GLBA Safeguards Rule, which requires 
financial institutions under the FTC's jurisdiction to develop and 
implement appropriate physical, technical, and procedural safeguards to 
protect customer information. FTC Safeguards Rule, 16 C.F.R. Sec. 314.1 
(2002). In brief, the Safeguards Rule requires financial institutions 
to develop a written information security plan that includes certain 
elements that are basic to security.
    In the past few years, the FTC has also brought enforcement actions 
against four companies that the Commission alleged made false promises 
about securing sensitive consumer information, in violation of Section 
5 of the FTC Act. 15 U.S.C. Sec. 45(a). These actions resulted in 
settlements with those companies that collected sensitive information 
from consumers while making such promises. Those actions arose out of 
the Commission's finding that these companies' security measures were 
inadequate and their information security claims therefore were 
deceptive. See, e.g., In re Microsoft Corp., FTC Dkt. C-4069, Final 
Decision and Order available at http://www.ftc.gov/os/2002/12/
microsoftdecision.pdf at (Dec. 20, 2002).
---------------------------------------------------------------------------
    As awareness of the FTC's role in identity theft has grown, 
businesses and organizations that have suffered compromises of personal 
information have begun to contact the FTC for assistance.50 
To provide standardized assistance in these types of cases, the FTC 
developed a kit, Information Compromise and the Risk of Identity Theft: 
Guidance for Your Business, that is available on the identity theft 
website. The kit provides advice on contacting consumers, law 
enforcement agencies, business contact information for the three major 
credit reporting agencies, information about contacting the FTC for 
assistance, and a detailed explanation of what information individuals 
need to know to protect themselves from identity theft.
---------------------------------------------------------------------------
    \50\ See, e.g., the incidents involving TriWest (Adam Clymer, 
Officials Say Troops Risk Identity Theft After Burglary, N.Y. Times, 
Jan. 12, 2003, Sec. 1 (Late Edition), at 12) and Ford/Experian (Kathy M. 
Kristof and John J. Goldman, 3 Charged in Identity Theft Case, LA 
Times, Nov. 6, 2002, Main News, Part 1 (Home Edition), at 1).
---------------------------------------------------------------------------
    (b) Victim Assistance: Identity theft victims may spend substantial 
time and effort restoring their good names and financial records. As a 
result, the FTC devotes substantial resources to conducting outreach 
with the private sector on ways to improve victim assistance 
procedures. One such initiative arose from the burdensome requirement 
that victims complete a different fraud affidavit for each different 
creditor with whom the identity thief had opened an 
account.51 To reduce that burden, the FTC worked with 
industry and consumer advocates to create a standard form for victims 
to use in resolving identity theft debts. From its release in August 
2001 through April 2004, the FTC has distributed more than 293,000 
print copies of the ID Theft Affidavit. There have also been more than 
643,000 hits to the Web version. The affidavit is available in both 
English and Spanish.
---------------------------------------------------------------------------
    \51\ See ID Theft: When Bad Things Happen to Your Good Name: 
Hearing Before the Subcomm. on Technology, Terrorism and Government 
Information of the Senate Judiciary Comm. 106th Cong. (2000) (statement 
of Mrs. Maureen Mitchell, Identity Theft Victim).
---------------------------------------------------------------------------

                             VI. CONCLUSION
    Identity theft places substantial costs on individuals and 
businesses. The Commission looks forward to working with businesses on 
better ways for them to protect the valuable information of consumers 
with which they are entrusted as well as other means of preventing 
identity theft. The Commission anticipates that as the new provisions 
of FACTA take effect, they will further help to reduce identity theft 
as well as its impact on victims.

    Mr. Stearns. Thank you, Commissioner.
    Ms. Bovbjerg.

                STATEMENT OF BARBARA D. BOVBJERG

    Ms. Bovbjerg. Thank you, Mr. Chairman, Ms. Schakowsky. I am 
pleased to be here today to discuss issues associated with the 
use and misuse of the Social Security number.
    Although the SSN was originally created as a means to track 
workers' earnings and eligibility for Social Security benefits, 
today the numbers are used for many non-Social Security 
purposes in both the public and the private sectors. This wide 
use of SSNs cause us concern because these numbers are among 
the personal identifiers most sought by identity thieves.
    Today, I will present results of our work on a variety of 
issues associated with the SSN. I would like to focus mainly on 
private sector use of the SSN and the protections that private 
companies apply and then more briefly on public sector uses and 
protections. My testimony is based on reports we have prepared 
over the last several years on this topic.
    First, the SSN and the private sector. We reported last 
January that consumer reporting agencies, health care 
organizations and information resellers use the SSN for a 
variety of purposes, only some of which are restricted by law, 
and virtually all of these entities have come to rely on the 
SSN as an identifier. Some businesses use the SSN to facilitate 
activities by assessing credit risk, locating bankruptcy assets 
or tracking patient care. For example, consumer reporting 
agencies, or CRAs, build and maintain credit histories around 
individuals' names, addresses, and SSNs. CRAs obtain SSNs from 
individuals who seek credit and from information resellers and 
public records. The SSNs are combined with information about a 
consumer's financial transactions such as charges, loans and 
credit repayments to ensure the consumer account data are 
matched correctly.
    Some businesses that function as information resellers 
aggregate information, including SSNs, from various public and 
private sources for resale. They obtain data from public 
records like bankruptcy proceedings, tax liens and voter 
registration rolls and from private compilations like phone 
books. These businesses resell this information to a variety of 
customers.
    Those we contacted told us that, to comply with current 
law, they limit their services to customers who establish 
accounts with them and with whom they have contracts that 
restrict the extent to which the data purchased can be 
redisclosed. Many say they truncate the SSN if they provide it 
all.
    Indeed, Federal and State laws have helped to control 
access to and distribution of personal information like the 
SSN. At the Federal level, the Fair Credit Reporting Act, 
Gramm-Leach-Bliley and HIPAA, among others, have restricted 
use, distribution and display of the SSN in specific 
industries. Several States, most notably California, have 
enacted laws restricting display and use of SSNs; and although 
these are limited to a particular State, such restrictions have 
caused some private companies to alter their policies 
nationwide. No law, however, restricts use and display of the 
SSN in all industries in all locations, leaving the potential 
for misuse when protections are inadequate.
    Let me turn now to the public sector. As we have reported 
previously, Federal, State and county government agencies rely 
extensively on the SSN to maintain records with unique 
identifiers and maintain program integrity. Although government 
agencies told us of the various steps they take to safeguard 
the SSNs they use, we found the key protections are not 
uniformly in place. For example, some Federal agencies and many 
of the State and county agencies maintain public records that 
contain SSNs.
    Public records are documents routinely made available to 
the public for inspection, such as marriage licenses and 
property transactions, and represent a primary source of data 
for information resellers. GAO has expressed concern that such 
records create opportunities for identity thieves and has 
called on government at all levels to consider better 
protections.
    In conclusion, although SSNs are used for many beneficial 
purposes, the widespread use and retention of SSNs in both the 
public and private sectors creates opportunities for identity 
theft. Although both government and private companies have 
strengthened their protections of personal data and have 
reduced display of this information, these actions are far from 
uniform and leave troubling gaps. Nonetheless, restrictions on 
SSN use and the protections that would ensue must be weighed 
against the effect of such measures on governments and 
businesses now reliant on the SSN.
    I welcome this committee's interest on this important 
policy area and look forward to helping to provide information 
and analysis needed to assure that America's personal 
information is safe and secure. I thank you for your attention, 
and I would be happy to answer any questions you have.
    [The prepared statement of Barbara D. Bovbjerg follows:]
    Prepared Statement of Barbara D. Bovbjerg, Director, Education, 
    Workforce, and Income Security Issues, United States Government 
                         Accountability Office
    Mr. Chairman and Members of the Subcommittee: I am pleased to be 
here today to discuss private and public sector entities' use of Social 
Security numbers (SSNs). Although the Social Security Administration 
(SSA) originally created SSNs as a means to track workers' earnings and 
eligibility for Social Security benefits, over time the SSN has come to 
be used for a myriad of purposes; individuals are frequently asked to 
supply personal information, including their SSNs, to both public and 
private sector entities. In addition, individuals' SSNs can be found in 
a number of public sources such as records displayed to the public. 
Given the uniqueness and broad applicability of the SSN, many private 
and public sector entities rely extensively on the SSN sometimes as a 
way to accumulate and identify information for their databases, 
sometimes to comply with federal regulations, and other times for 
various business purposes. The potential for misuse of the SSN has 
raised questions about how private and public sector entities obtain, 
use, and protect SSNs.
    Although Congress has passed a number of laws to protect the 
security of personal information, the continued use of and reliance on 
SSNs by both private and public sector entities underscores the 
importance of determining if appropriate safeguards are in place to 
protect individuals' private information or if enhanced protection of 
individuals' personal information is needed. Accordingly, you asked us 
to talk about how certain types of private and public sector entities 
obtain SSNs and what protections, if any, exist to govern their use. My 
remarks today will focus on describing (1) how private sector entities 
obtain, use, and protect SSNs and (2) public sector uses and 
protections.
    To determine how private sector entities obtain, use, and protect 
SSNs, we relied on our previous work that looked at how private sector 
entities obtain and use SSNs and the laws that limit disclosure of this 
use.1 To determine how the public sector uses and protects 
SSNs, we also relied on our previous work that looked at the 
government's use and protection of SSNs.2 In addition, we 
are conducting structured interviews of federal agencies concerning the 
display of SSNs.
---------------------------------------------------------------------------
    \1\ GAO, Social Security Numbers: Private Sector Entities Routinely 
Obtain and Use SSNs, and Laws Limit the Disclosure of This Information, 
GAO-04-11 (Washington D.C.: January 22, 2004).
    \2\ See GAO, Social Security Numbers: Government Benefits from SSN 
Use but Could Provide Better Safeguards, GAO-02-352 (Washington, D.C.: 
May 31, 2002).
---------------------------------------------------------------------------
    In summary, entities such as information resellers, consumer 
reporting agencies (CRAs), and health care organizations routinely 
obtain SSNs from their business clients and from public sources, such 
as marriage licenses, paternity determinations, and professional 
licenses. Businesses use SSNs for various purposes, such as to build 
databases, verify individuals' identities, or match existing 
records.3 Given the various types of services these 
companies offer, we found that all of these entities have come to rely 
on the SSN as an identifier, which they say helps them determine a 
person's identity for the purpose of providing the services they offer. 
However, certain federal laws have helped to limit the disclosures of 
personal information these private sector entities are allowed to make 
to their customers. Private sector entities are either subject to the 
laws directly, given the nature of their business, or indirectly, 
through their business clients who are subject to these laws. Some 
states have also enacted laws to restrict the private sector's use of 
SSNs. However, such restrictions vary by state.
---------------------------------------------------------------------------
    \3\ GAO-04-11 (Washington D.C.: January 2004).
---------------------------------------------------------------------------
    Public sector entities also rely extensively on SSNs. These 
agencies often obtain SSNs for compliance with federal laws and 
regulations and for their own agencies' purposes. We found that 
federal, state, and county government agencies rely extensively on the 
SSN to manage records, verify benefit eligibility, collect outstanding 
debt, conduct research and program evaluations, and verify information 
provided to state drivers' licensing agencies.4 Given that 
SSNs are often the identifier of choice among individuals seeking to 
create false identities, these agencies are taking steps to safeguard 
SSNs. Yet despite these actions, SSNs appear in records displayed to 
the public such as documents that record financial transactions or 
court documents. In a previous report, we proposed that Congress 
consider developing a unified approach to safeguarding SSNs used in all 
levels of government and particularly those displayed in public 
records, and we continue to believe that this approach has 
merit.5
---------------------------------------------------------------------------
    \4\ GAO-02-352 (Washington D.C.: May 2002).
    \5\ GAO-02-352 (Washington D.C.: May 2002).
---------------------------------------------------------------------------

                               BACKGROUND
    The Social Security Act of 1935 authorized SSA to establish a 
record-keeping system to help manage the Social Security program, and 
this resulted in the creation of the SSN. Through a process known as 
enumeration, unique numbers are created for every person as a work and 
retirement benefit record for the Social Security program. SSA 
generally issues SSNs to most U.S. citizens, and SSNs are also 
available to noncitizens lawfully admitted to the United States with 
permission to work. SSA estimates that approximately 277 million 
individuals currently have SSNs. The SSN has become the identifier of 
choice for government agencies and private businesses, and thus it is 
used for a myriad of non-Social Security purposes.
    The growth in the use of SSNs is important to individual SSN 
holders because these numbers, along with names and birth certificates, 
are among the three personal identifiers most often sought by identity 
thieves.6 In addition, SSNs are used as breeder information 
to create additional false identification documents, such as drivers' 
licenses. Recent statistics collected by federal agencies and CRAs 
indicate that the incidence of identity theft appears to be 
growing.7 The Federal Trade Commission (FTC), the agency 
responsible for tracking identity theft, reported that consumer fraud 
and identity theft complaints grew from 404,000 in 2002 to 516,740 in 
2003. In 2003, consumers also reported losses from fraud of more than 
$437 million, up from $343 million in 2002. In addition, identity 
crimes account for over 80 percent of SSN misuse allegations according 
to the SSA. Also, officials from two of the three national CRAs report 
an increase in the number of 7-year fraud alerts placed on consumer 
credit files, which they consider to be reliable indicators of the 
incidence of identity theft.8 Law enforcement entities 
report that identity theft is almost always a component of other 
crimes, such as bank fraud or credit card fraud, and may be prosecuted 
under the statutes covering those crimes.
---------------------------------------------------------------------------
    \6\ United States Sentencing Commission, Identity Theft Final Alert 
(Washington, D.C.: Dec. 15, 1999).
    \7\ GAO, Identity Theft: Prevalence and Cost Appear to be Growing, 
GAO-02-363 (Washington, D.C.: Mar. 1, 2002).
    \8\ A fraud alert is a warning that someone may be using the 
consumer's personal information to fraudulently obtain credit. When a 
fraud alert is placed on a consumer's credit card file, it advises 
credit grantors to conduct additional identity verification before 
granting credit. The three consumer reporting agencies offers fraud 
alerts that can vary from 2 to 7 years at the discretion of the 
individual.
---------------------------------------------------------------------------
private sector entities routinely obtain and use ssns, and certain laws 
               affect the disclosure of this information
    Private sector entities such as information resellers, CRAs, and 
health care organizations routinely obtain and use SSNs.9 
Such entities obtain the SSNs from various public sources and their 
business clients wishing to use their services. We found that these 
entities usually use SSNs for various purposes, such as to build tools 
that verify an individual's identity or match existing records. Certain 
federal laws have limited the disclosures private sector entities are 
allowed to make to their customers, and some states have also enacted 
laws to restrict the private sector's use of SSNs.
---------------------------------------------------------------------------
    \9\ Information resellers, sometimes referred to as information 
brokers, are businesses that specialize in amassing consumer 
information that includes SSNs for informational services. CRAs, also 
known as credit bureaus, are agencies that collect and sell information 
about the creditworthiness of individuals. Health care organizations 
generally deliver their services through a coordinated system that 
includes health care providers and health plans, also referred to as 
health care insurers.
---------------------------------------------------------------------------
Private Sector Entities Obtain SSNs from Public and Private Sources and 
        Use SSNs for Various Purposes
    Private sector entities such as information resellers, CRAs, and 
health care organizations generally obtain SSNs from various public and 
private sources and use SSNs to help identify individuals. Of the 
various public sources available, large information resellers told us 
they obtain SSNs from various records displayed to the public such as 
records of bankruptcies, tax liens, civil judgments, criminal 
histories, deaths, real estate ownership, driving histories, voter 
registrations, and professional licenses. Large information resellers 
said that they try to obtain SSNs from public sources where possible, 
and to the extent public record information is provided on the 
Internet, they are likely to obtain it from such sources. Some of these 
officials also told us that they have people that go to courthouses or 
other repositories to obtain hard copies of public records. 
Additionally, they obtain batch files of electronic copies of all 
public records from some jurisdictions.
    Given the varied nature of SSN data found in public records, some 
reseller officials said they are more likely to rely on receiving SSNs 
from their business clients than they are from obtaining SSNs from 
public records. These entities obtain SSNs from their business clients, 
who provide SSNs in order to obtain a reseller's services or products, 
such as background checks, employee screening, determining criminal 
histories, or searching for individuals. Large information resellers 
also obtain SSN information from private sources. In many cases such 
information was obtained through review of data where a customer has 
voluntarily supplied information resellers with information about 
himself or herself. In addition, large reseller officials said they 
also use their clients' records in instances where the client has 
provided them with information.
    We also found that Internet-based resellers rely extensively on 
public sources and records displayed to the public. These resellers 
listed on their Web sites public information sources, such as 
newspapers, and various kinds of public record sources at the county, 
state, and national levels. During our investigation, we determined 
that once Internet-based resellers obtained an individual's SSN they 
relied on information in public records to help verify the individual's 
identity and amass information around the individual's SSN.
    Like information resellers, CRAs also obtain SSNs from public and 
private sources as well as from their customers or the businesses that 
furnish data to them. CRA officials said that they obtain SSNs from 
public sources, such as bankruptcy records, a fact that is especially 
important in terms of determining that the correct individual has 
declared bankruptcy. CRA officials also told us that they obtain SSNs 
from other information resellers, especially those that specialize in 
obtaining information from public records. However, SSNs are more 
likely to be obtained from businesses that subscribe to their services, 
such as banks, insurance companies, mortgage companies, debt collection 
agencies, child support enforcement agencies, credit grantors, and 
employment screening companies. Individuals provide these businesses 
with their SSNs for reasons such as applying for credit, and these 
businesses voluntarily report consumers' charge and payment 
transactions, accompanied by SSNs, to CRAs.
    We found that health care organizations were less likely to rely on 
public sources for SSN data. Health care organizations obtain SSNs from 
individuals themselves and from companies that offer health care plans. 
For example, subscribers or policyholders provide health care plans 
with their SSNs through their company or employer group when they 
enroll in health care plans. In addition to health care plans, health 
care organizations include health care providers, such as hospitals. 
Such entities often collect SSNs as part of the process of obtaining 
information on insured people. However, health care officials said 
that, particularly with hospitals, the medical record number rather 
than the SSN is the primary identifier.
    Information resellers, CRAs, and health care organization officials 
all said that they use SSNs to verify an individual's identity. Most of 
the officials we spoke to said that the SSN is the single most 
important identifier available, mainly because it is truly unique to an 
individual, unlike an individual's name and address, which can often 
change over an individual's lifetime. Large information resellers said 
that they generally use the SSN as an identity verification tool. Some 
of these entities have incorporated SSNs into their information 
technology, while others have incorporated SSNs into their clients' 
databases used for identity verification. For example, one large 
information reseller that specializes in information technology 
solutions has developed a customer verification data model that aids 
financial institutions in their compliance with some federal laws 
regarding ``knowing your customer.'' We also found that Internet-based 
information resellers use the SSN as a factor in determining an 
individual's identity. We found these types of resellers to be more 
dependent on SSNs than the large information resellers, primarily 
because their focus is more related to providing investigative or 
background-type services to anyone willing to pay a fee. Most of the 
large information resellers officials we spoke to said that although 
they obtain the SSN from their business clients, the information they 
provide back to their customers rarely contains the SSN. Almost all of 
the officials we spoke to said that they provide their clients with a 
truncated SSN, an example of which would be xxx-xx-6789.
    CRAs use SSNs as the primary identifier of individuals, which 
enables them to match the information they receive from their business 
clients with the information stored in their databases on 
individuals.10 Because these companies have various 
commercial, financial, and government agencies furnishing data to them, 
the SSN is the primary factor that ensures that incoming data is 
matched correctly with an individual's information on file. For 
example, CRA officials said they use several factors to match incoming 
data with existing data, such as name, address, and financial account 
information. If all of the incoming data, except the SSN, match with 
existing data, then the SSN will determine the correct person's credit 
file. Given that people move, get married, and open new financial 
accounts, these officials said that it is hard to distinguish among 
individuals. Because the SSN is the one piece of information that 
remains constant, they said that it is the primary identifier that they 
use to match data.
---------------------------------------------------------------------------
    \10\ We found that CRAs and information resellers can sometimes be 
the same entity, a fact that blurs the distinction between the two 
types of businesses but does not affect the use of SSNs by these 
entities. Five of the six large information resellers we spoke to said 
they were also CRAs. Some CRA officials said that information reselling 
constituted as much as 40 percent of CRAs' business.
---------------------------------------------------------------------------
    Health care organizations also use the SSN to help verify the 
identity of individuals. These organizations use SSNs, along with other 
information, such as name, address, and date of birth, as a factor in 
determining a member's identity. Health care officials said that health 
care plans, in particular, use the SSN as the primary identifier of an 
individual, and it often becomes the customer's insurance number. 
Health care officials said that they use SSNs for identification 
purposes, such as linking an individual's name to an SSN to determine 
if premium payments have been made. They also use the SSN as an online 
services identifier, as an alternative policy identifier, and for 
phone-in identity verification. Health care organizations also use SSNs 
to tie family members together where family coverage is used, 
11 to coordinate member benefits, and as a cross-check for 
pharmacy transactions. Health care industry association officials also 
said that SSNs are used for claims processing, especially with regard 
to Medicare. According to these officials, under some Medicare 
programs, SSNs are how Medicare identifies benefits provided to an 
individual.
---------------------------------------------------------------------------
    \11\ During the enrollment process, subscribers have a number of 
options, one of which is decided whether they would like single or 
family coverage. In cases where family coverage is chosen, the SSN is 
the key piece of information generally allowing the family members to 
be linked.
---------------------------------------------------------------------------
Certain Laws Limit the Private Sectors' Disclosure of Personal 
        Information That Includes SSNs
    Certain federal and state laws have placed restrictions on certain 
private sector entities use and disclosure of consumers' personal 
information that includes SSNs. Such laws include the Fair Credit 
Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the Drivers 
Privacy Protection Act (DPPA), and the Health Insurance Portability and 
Accountability Act (HIPAA). As shown in table 1, the laws either 
restrict the disclosures that entities such as information resellers, 
CRAs, and health care organizations are allowed to make to specific 
purposes or restrict whom they are allowed to give the information to. 
Moreover, as shown in table 1, these laws focus on limiting or 
restricting access to certain personal information and are not 
specifically focused on information resellers. See appendix I for more 
information on these laws.

 Table 1: Aspects of Federal Laws That Affect Private Sector Disclosure
                         of Personal Information
------------------------------------------------------------------------
               Federal Laws                         Restrictions
------------------------------------------------------------------------
Fair Credit Reporting Act.................  Limits access to credit data
                                             that includes SSNs to those
                                             who have a permissible
                                             purpose under the law.
Gramm-Leach-Bliley Act....................  Creates a new definition of
                                             personal information that
                                             includes SSNs and limits
                                             when financial institutions
                                             may disclose the
                                             information to non-
                                             affiliated third parties.
Drivers Privacy Protection Act............  Prohibits obtaining and
                                             disclosing SSNs and other
                                             personal information from a
                                             motor vehicle record except
                                             as expressly permitted
                                             under the law.
Health Insurance Portability and            Protects the privacy of
 Accountability Act.                         health information that
                                             identifies an individual
                                             (including by SSNs) and
                                             restricts health care
                                             organizations from
                                             disclosing such information
                                             to others without the
                                             patient's consent.
------------------------------------------------------------------------
Source: GAO analysis.

    We reviewed selected legislative documents of 18 states and found 
that at least 6 states have enacted their own legislation to restrict 
either the display or use of SSNs by the private sector.12 
Notably, in 2001, California enacted Senate Bill (SB) 168, restricting 
private sector use of SSNs. Specifically, this law generally prohibits 
companies and persons from certain uses such as, posting or publicly 
displaying SSNs and printing SSNs on cards required to access the 
company's products or services. Furthermore, in 2002, shortly after the 
enactment of SB 168, California's Office of Privacy Protection 
published recommended practices for protecting the confidentiality of 
SSNs. These practices were to serve as guidelines to assist private and 
public sector organizations in handling SSNs.
---------------------------------------------------------------------------
    \12\ On the basis of our interviews with private sector businesses 
and organizations, contacts with some state offices of attorney 
general, and identification of state laws and legislative initiatives 
related to the use of SSNs, we did a legislative review of 18 states 
that were identified as having laws or proposed laws governing SSN use. 
In the 18 states we researched, we reviewed more than 40 legislative 
documents, including relevant laws, proposed laws, legislative 
summaries, and other related documents, such as state regulations, 
executive orders, and referendums.
---------------------------------------------------------------------------
    Similar to California's law, Missouri's law (2003 Mo. SB 61), which 
is not effective until July 1, 2006, bars companies from requiring 
individuals to transmit SSNs over the Internet without certain safety 
measures, such as encryption and passwords. However, while SB 61 
prohibits a person or private entity from publicly posting or 
displaying an individual's SSN ``in any manner,'' unlike California's 
law, it does not specifically prohibit printing the SSN on cards 
required to gain access to products or services. In addition, Arizona's 
law (2003 Ariz. Sess. Laws 137), effective January 1, 2005, restricts 
the use of SSNs in ways very similar to California's law. However, in 
addition to the private sector restrictions, it adds certain 
restrictions for state agencies and political 
subdivisions.13 For example, state agencies and political 
subdivisions are prohibited from printing an individual's SSN on cards 
and certain mailings to the individual. Last, Texas prohibits the 
display of SSNs on all cards, while Georgia and Utah's laws are 
directed at health insurers and, therefore, pertain primarily to 
insurance identification cards.14 None of these three laws 
contain the provisions mentioned above relating to Internet safety 
measures and mailing restrictions. Table 2 lists states that have 
enacted legislation and related provisions.
---------------------------------------------------------------------------
    \13\ Political subdivisions would include counties, cities, and 
towns.
    \14\ Georgia's law (O.C.G.A. Sec. 33-24-57.1(f)) and Utah's law (Utah 
Code Ann. Sec. 31-22-634) were both effective July 1, 2004. However, 
Utah's law provides certain extensions until March 1, 2005. Texas' law 
(2003 Tex. Gen. Laws 341) is effective March 1, 2005.

      Table 2: Provisions Included in Enacted Legislation Reviewed
------------------------------------------------------------------------
                                              States Where Provision or
                 Provision                       Restriction Enacted
------------------------------------------------------------------------
Specifically prohibits display on
 cardsgDAZ, CA, GA, TX, UT.
Requires Internet safety measures.........  AZ, CA, MO
Restricts mailing of SSNs.................  AZ, CA
------------------------------------------------------------------------
Source: GAO analysis.

PUBLIC SECTOR ENTITIES ALSO USE SSNS AND SOME AGENCIES LIMIT THEIR USE 
                              AND DISPLAY
    Agencies at all levels of government frequently obtain and use 
SSNs. A number of federal laws require government agencies to obtain 
SSNs, and these agencies use SSNs to administer their programs, verify 
applicants' eligibility for services and benefits, and do research and 
evaluation. In addition, given the open nature of certain government 
records, SSNs appear in some records displayed to the public. Given the 
potential for misuse, some government agencies are taking steps to 
limit their use and display of SSNs and prevent the proliferation of 
false identities.
Public Sector Entities Are Required by Laws and Regulations to Obtain 
        SSNs and Use SSNs for Various Purposes
    Government agencies obtain SSNs because a number of federal laws 
and regulations require certain programs and federally funded 
activities to use the SSN for administrative purposes.15 
Such laws and regulations require the use of the SSN as an individual's 
identifier to facilitate automated exchanges that help administrators 
enforce compliance with federal laws, determine eligibility for 
benefits, or both. For example, the Internal Revenue Code and 
regulations, which govern the administration of the federal personal 
income tax program, require that individuals' SSNs serve as taxpayer 
identification numbers.16 A number of other federal laws 
require program administrators to use SSNs in determining applicants' 
eligibility for federally funded benefits. The Social Security Act 
requires individuals to provide their SSNs in order to receive benefits 
under the SSI, Food Stamp, Temporary Assistance for Needy Families, and 
Medicaid programs.17 In addition, the Commercial Motor 
Vehicle Safety Act of 1986 requires the use of SSNs to identify 
individuals and established the Commercial Driver's License Information 
System, a nationwide database where states may use individuals' SSNs to 
search the database for other state-issued licenses commercial drivers 
may hold.18 Federal law also requires the use of SSNs in 
state child support programs to help states locate noncustodial 
parents, establish and enforce support orders, and recoup state welfare 
payments from parents.19 The law also requires states to 
record SSNs on many other state documents, such as professional, 
occupational, and marriage licenses; divorce decrees; paternity 
determinations; and death certificates.
---------------------------------------------------------------------------
    \15\ GAO, Social Security Numbers: Government and Commercial Use of 
the Social Security Number is Widespread, GAO/HEHS-99-28 (Washington 
D.C.: February 1999).
    \16\ This means that employers and others making payments to 
individuals must include the individuals' SSNs in reporting to IRS many 
of these payments. In addition, the Code and regulations require 
individuals filing personal income tax returns to include their SSNs as 
their taxpayer identification number, the SSNs of people whom they 
claim as dependents, and the SSNs of spouses to whom they paid alimony.
    \17\ Applicants give program administrators information on their 
income and resources, and program administrators use applicants' SSNs 
to match records with those of other organizations.
    \18\ States may also use SSNs to search another database, the 
National Driver's Registry, to determine whether an applicant's license 
has been cancelled, suspended, or revoked by another state. In these 
situations, the states use SSNs to limit the possibility of 
inappropriately licensing applicants.
    \19\ The law requires states to maintain records that include (1) 
SSNs for individuals who owe or are owed support for cases in which the 
state has ordered child support payments to be made, the state is 
providing support, or both, and (2) employers' records of new hires 
identified by SSN.
---------------------------------------------------------------------------
    Government agencies use SSNs for a variety of reasons. We found 
that most of these agencies use SSNs to administer their programs, such 
as to identify, retrieve, and update their records. In addition, many 
agencies also use SSNs to share information with other entities to 
bolster the integrity of the programs they administer. As unique 
identifiers, SSNs help ensure that the agency is obtaining or matching 
information on the correct person.
    Government agencies also share information containing SSNs for the 
purpose of verifying an applicant's eligibility for services or 
benefits, such as matching records with state and local correctional 
facilities to identify individuals for whom the agency should terminate 
benefit payments. SSNs are also used to ensure program integrity. 
Agencies use SSNs to collect delinquent debts and even share 
information for this purpose. In addition, SSNs are used for 
statistics, research, and evaluation. Agencies responsible for 
collecting and maintaining data for statistical programs that are 
required by statute, make use of SSNs. In some cases, these data are 
compiled using information provided for another purpose. For example, 
the Bureau of the Census prepares annual population estimates for 
states and counties using individual income tax return data linked over 
time by SSN to determine immigration rates between 
localities.20 SSNs also provide government agencies and 
others with an effective mechanism for linking data on program 
participation with data from other sources to help evaluate the 
outcomes or effectiveness of government programs. In some cases, 
records containing SSNs are sometimes matched across multiple agency or 
program databases.21
---------------------------------------------------------------------------
    \20\ The Bureau of the Census is authorized by statute to collect a 
variety of information, and the Bureau is also prohibited from making 
it available, except in certain circumstances.
    \21\ The statistical and research communities refer to the process 
of matching records containing SSNs for statistical or research 
purposes as ``record linkage.'' See U.S. General Accounting Office, 
Record Linkage and Privacy: Issues in Creating New Federal Research and 
Statistical Information, GAO-01-126SP (Washington, D.C.: Apr. 2001).
---------------------------------------------------------------------------
    Government agencies also use employees' SSNs to fulfill some of 
their responsibilities as employers. For example, personnel departments 
of these agencies use SSNs to help them maintain internal records and 
provide employee benefits. In addition, employers are required by law 
to use employees' SSNs when reporting wages. Wages are reported to SSA, 
and the agency uses this information to update earnings records it 
maintains for each individual. The Internal Revenue Service (IRS) also 
uses SSNs to match the employer wage reports with amounts individuals 
report on personal income tax returns. Federal law also requires that 
states maintain employers' reports of newly hired employees, identified 
by SSNs. States must forward this information to a national database 
that is used by state child support agencies to locate parents who are 
delinquent in child support payments.
    Finally, SSNs appear in some government records that are open to 
the public. For example, SSNs may already be a part of a document that 
is submitted to a recorder for official preservation, such as veterans' 
discharge papers. Documents that record financial transactions, such as 
tax liens and property settlements, also contain SSNs to help identify 
the correct individual. Government officials are also required by law 
to collect SSNs in numerous instances, and some state laws allow 
government entities to collect SSNs on voter registries to help avoid 
duplicate registrations. In addition, courts at all three levels of 
government also collect and maintain records that are routinely made 
available to the public. SSNs appear in court documents for a variety 
of reasons such as on documents that government officials create like 
criminal summonses, and in many cases, SSNs are already a part of 
documents that are submitted by attorneys or individuals as part of the 
evidence for a proceeding or a petition for an action. In some cases, 
federal law requires that SSNs be placed in certain records that courts 
maintain, such as child support orders.
Government Agencies Are Taking Steps to Limit the Use and Display of 
        SSNs
    Despite the widespread use of SSNs at all levels of government, not 
all agencies use SSNs. We found that some agencies do not obtain, 
receive, or use SSNs of program participants, service recipients, or 
individual members of the public.22 Moreover, not all 
agencies use the SSN as their primary identification number for record-
keeping purposes. These agencies maintain an alternative number that is 
used in addition to or in lieu of SSNs for certain activities.
---------------------------------------------------------------------------
    \22\ GAO-02-352 (Washington D.C.: May 2002).
---------------------------------------------------------------------------
    Some agencies are also taking steps to limit SSNs displayed on 
documents that may be viewed by others who may not have a need to view 
this personal information. For example, the Social Security 
Administration has truncated individuals' SSNs that appear on the 
approximately 120 million benefits statements it mails each year. Some 
states have also passed laws prohibiting the use of SSNs as a student 
identification number. Almost all states have modified their policies 
on placing SSNs on state drivers' licenses.
    At the federal level, SSA has taken steps in its enumeration 
process and verification service to help prevent SSNs from being used 
to proliferate false identities. SSA has formed a task force to address 
weaknesses in its enumeration process and has (1) increased document 
verifications and developed new initiatives to prevent the 
inappropriate assignment of SSNs to noncitizens, and (2) undertaken 
initiatives to shift the burden of processing noncitizen applications 
from its field offices.23 SSA also helps prevent the 
proliferation of false identities through its verification service, 
which allows state driver licensing agencies to verify the SSN, name, 
and date of birth of customers with SSA's master file of Social 
Security records.24 Finally, SSA has also acted to correct 
deficiencies in its information systems' internal controls. These 
changes were made in response to the findings of an independent audit 
that found that SSA's systems were exposed to both internal and 
external intrusion, increasing the possibility that sensitive 
information such as SSNs could be subject to unauthorized access, 
modification, and disclosure, as well as the risk of fraud.
---------------------------------------------------------------------------
    \23\ See GAO, Social Security Administration: Actions Taken to 
Strengthen Procedures for Issuing Social Security Numbers to 
Noncitizens but Some Weakness Remain, GAO-04-12 (Washington D.C.: 
October 15, 2003). See GAO, Social Security Numbers: Improved SSN 
Verification and Exchange of States' Driver Records Would Enhance 
Identity Verification, GAO-03-920 (Washington D.C.: September 15, 
2003).
    \24\ GAO-03-920 (Washington D.C.: September 2003).
---------------------------------------------------------------------------
    With regard to the courts, in a prior report we suggested that 
Congress consider addressing SSN security and display issues in state 
and local government and in public records, including those maintained 
by the judicial branch of government at all levels.25 We 
proposed that Congress convene a representative group of officials from 
all levels of government to develop a unified approach to safeguard 
SSNs used in all levels of government and particularly those displayed 
in public records.
---------------------------------------------------------------------------
    \25\ GAO-02-352 (Washington D.C.: May 2002)
---------------------------------------------------------------------------

                              CONCLUSIONS
    Public and private entities use SSNs for many legitimate and 
publicly beneficial purposes. However, the more frequently SSNs are 
obtained and used, the more likely they are to be misused. Individuals 
may voluntarily provide their SSNs to the private and public sectors to 
obtain services, but they should be able to be confident that their 
personal information is safe and secure. As we continue to learn more 
about the entities that obtain SSNs and the purposes for which they 
obtain them, policy makers will be able to determine if there are ways 
to limit access to this valuable piece of information and prevent it 
from being misused. However, restrictions on access or use may make it 
more difficult for businesses and government agencies to verify an 
individual's identity. Accordingly, policy makers will have to balance 
the potential benefits of restrictions on the use of SSNs on the one 
hand with the impact on legitimate needs for the use of SSNs on the 
other.
    We are continuing our work on protecting the privacy of SSNs in the 
private and public sectors, and we are pleased that this Subcommittee 
is considering this important policy issue. That concludes my 
testimony, and I would be pleased to respond to any questions the 
subcommittee has.
Contacts and Acknowledgments
    For further information regarding this testimony, please contact 
Barbara D. Bovbjerg, Director or Tamara Cross, Assistant Director at 
(202) 512-7215.
  Appendix I: Federal Laws Affecting Information Resellers, CRAs, and 
                       Health Care Organizations:
                     gramm-leach-bliley act (glba):
    GLBA requires companies to give consumers privacy notices that 
explain the institutions' information-sharing practices. In turn, 
consumers have the right to limit some, but not all, sharing of their 
nonpublic personal information. Financial institutions are permitted to 
disclose consumers' nonpublic personal information without offering 
them an opt-out right in the following circumstances:

 to effect a transaction requested by the consumer in connection with 
        a financial product or service requested by the consumer; 
        maintaining or servicing the consumer's account with the 
        financial institution or another entity as part of a private 
        label credit card program or other extension of credit; or a 
        proposed or actual securitization, secondary market sale, or 
        similar transaction;
 with the consent or at the direction of the consumer;
 to protect the confidentiality or security of the consumer's records; 
        to prevent actual or potential fraud, for required 
        institutional risk control or for resolving customer disputes 
        or inquiries, to persons holding a legal or beneficial interest 
        relating to the consumer, or to the consumer's fiduciary;
 to provide information to insurance rate advisory organizations, 
        guaranty funds or agencies, rating agencies, industry standards 
        agencies, and the institution's attorneys, accountants, and 
        auditors;
 to the extent specifically permitted or required under other 
        provisions of law and in accordance with the Right to Financial 
        Privacy Act of 1978, to law enforcement agencies, self-
        regulatory organizations, or for an investigation on a matter 
        related to public safety;
 to a consumer reporting agency in accordance with the Fair Credit 
        Reporting Act or from a consumer report reported by a consumer 
        reporting agency;
 in connection with a proposed or actual sale, merger, transfer, or 
        exchange of all or a portion of a business if the disclosure 
        concerns solely consumers of such business;
 to comply with federal, state, or local laws; an investigation or 
        subpoena; or to respond to judicial process or government 
        regulatory authorities.
    Financial institutions are required by GLBA to disclose to 
consumers at the initiation of a customer relationship, and annually 
thereafter, their privacy policies, including their policies with 
respect to sharing information with affiliates and non-affiliated third 
parties.
    Provisions under GLBA place limitations on financial institutions 
disclosure of customer data, thus affecting some CRAs and information 
resellers. We found that some CRAs consider themselves to be financial 
institutions under GLBA.26 These entities are therefore 
directly governed by GLBA's restrictions on disclosing nonpublic 
personal information to non-affiliated third parties. We also found 
that some of the information resellers we spoke to did not consider 
their companies to be financial institutions under GLBA. However, 
because they have financial institutions as their business clients, 
they complied with GLBA's provisions in order to better serve their 
clients and ensure that their clients are in accordance with GLBA. For 
example, if information resellers received information from financial 
institutions, they could resell the information only to the extent that 
they were consistent with the privacy policy of the originating 
financial institution.
---------------------------------------------------------------------------
    \26\ Under GLBA, the term financial institution is defined as ``any 
institution the business of which is engaging in financial activities 
as described in section 4(k) of the Bank Holding Company Act of 1956,'' 
which goes into more detail about what are ``activities that are 
financial in nature.'' These generally include banking, insurance, and 
investment industries.
---------------------------------------------------------------------------
    Information resellers and CRAs also said that they protect the use 
of non-public personal information and do not provide such information 
to individuals or unauthorized third parties. In addition to imposing 
obligations with respect to the disclosures of personal information, 
GLBA also requires federal agencies responsible for financial 
institutions to adopt appropriate standards for financial institutions 
relating to safeguarding customer records and information. Information 
resellers and CRA officials said that they adhere to GLBA's standards 
in order to secure financial institutions' information.
                 drivers privacy protection act (dppa):
    The DPPA specifies a list of exceptions when personal information 
contained in a state motor vehicle record may be obtained and used (18 
U.S.C. Sec. 2721(b)). These permissible uses include:

 for use by any government agency in carrying out its functions;
 for use in connection with matters of motor vehicle or driver safety 
        and theft; motor vehicle emissions; motor vehicle product 
        alterations, recalls, or advisories; motor vehicle market 
        research activities, including survey research;
 for use in the normal course of business by a legitimate business, 
        but only to verify the accuracy of personal information 
        submitted by the individual to the business and, if such 
        information is not correct, to obtain the correct information 
        but only for purposes of preventing fraud by pursuing legal 
        remedies against, or recovering on a debt or security interest 
        against, the individual;
 for use in connection with any civil, criminal, administrative, or 
        arbitral proceeding in any federal, state, or local court or 
        agency;
 for use in research activities;
 for use by any insurer or insurance support organization in 
        connection with claims investigation activities;
 for use in providing notice to the owners of towed or impounded 
        vehicles;
 for use by a private investigative agency for any purpose permitted 
        under the DPPA;
 for use by an employer or its agent or insurer to obtain information 
        relating to the holder of a commercial driver's license;
 for use in connection with the operation of private toll 
        transportation facilities;
 for any other use, if the state has obtained the express consent of 
        the person to whom a request for personal information pertains;
 for bulk distribution of surveys, marketing, or solicitations, if the 
        state has obtained the express consent of the person to whom 
        such personal information pertains;
 for use by any requester, if the requester demonstrates that it has 
        obtained the written consent of the individual to whom the 
        information pertains;
 for any other use specifically authorized under a state law, if such 
        use is related to the operation of a motor vehicle or public 
        safety.
    As a result of DPPA, information resellers said they were 
restricted in their ability to obtain SSNs and other driver license 
information from state motor vehicle offices unless they were doing so 
for a permissible purpose under the law. These officials also said that 
information obtained from a consumer's motor vehicle record has to be 
in compliance with DPPA's permissible purposes, thereby restricting 
their ability to resell motor vehicle information to individuals or 
entities not allowed to receive such information under the law. 
Furthermore, because DPPA restricts state motor vehicle offices' 
ability to disclose driver license information, which includes SSN 
data, information resellers said they no longer try to obtain SSNs from 
state motor vehicle offices, except for permissible purposes.
      health insurance portability and accountability act (hipaa):
    The HIPAA privacy rule also defines some rights and obligations for 
both covered entities and individual patients and health plan members. 
Some of the highlights are:

 Individuals must give specific authorization before health care 
        providers can use or disclose protected information in most 
        nonroutine circumstances, such as releasing information to an 
        employer or for use in marketing activities.
 Covered entities will need to provide individuals with written notice 
        of their privacy practices and patients' privacy rights. The 
        notice will contain information that could be useful to 
        individuals choosing a health plan, doctor, or other service 
        provided. Patients will be generally asked to sign or otherwise 
        acknowledge receipt of the privacy notice.
    Covered entities must obtain an individual's specific authorization 
before sending them marketing materials.
    Health care organizations, including health care providers and 
health plan insurers, are subject to HIPAA's requirements. In addition 
to providing individuals with privacy practices and notices, health 
care organizations are also restricted from disclosing a patient's 
health information without the patient's consent, except for purposes 
of treatment, payment, or other health care operations. Information 
resellers and CRAs did not consider themselves to be ``covered 
entities'' under HIPAA, although some information resellers said that 
their customers are considered to be business associates under HIPAA. 
As a result, they said they are obligated to operate under HIPAA's 
standards for privacy protection, and therefore could not resell 
medical information without having made sure HIPAA's privacy standards 
were met.
                   fair credit reporting act (fcra):
    Congress has limited the use of consumer reports to protect 
consumers' privacy. All users must have a permissible purpose under the 
FCRA to obtain a consumer report (15 USC 1681b). These permissible 
purposes are:

 as ordered by a court or a federal grand jury subpoena;
 as instructed by the consumer in writing;
 for the extension of credit as a result of an application from a 
        consumer or the review or collection of a consumer's account;
 for employment purposes, including hiring and promotion decisions, 
        where the consumer has given written permission;
 for the underwriting of insurance as a result of an application from 
        a consumer;
 when there is a legitimate business need, in connection with a 
        business transaction that is initiated by the consumer;
 to review a consumer's account to determine whether the consumer 
        continues to meet the terms of the account;
 to determine a consumer's eligibility for a license or other benefit 
        granted by a governmental instrumentality required by law to 
        consider an applicant's financial responsibility or status;
 for use by a potential investor or servicer or current insurer in a 
        valuation or assessment of the credit or prepayment risks 
        associated with an existing credit obligation; and
 for use by state and local officials in connection with the 
        determination of child support payments, or modifications and 
        enforcement thereof.
    Under FCRA, Congress has limited the use of consumer reports 
27 to protect consumers' privacy and limits access to credit 
data to those who have a legally permissible purpose for using the 
data, such as the extension of credit, employment purposes, or 
underwriting insurance. However, these limits are not specific to SSNs. 
All of the CRAs that we spoke to said that they are considered consumer 
reporting agencies under FCRA. In addition, some of the information 
resellers we spoke to who handle or maintain consumer reports are 
classified as CRAs under FCRA. Both CRAs and information resellers said 
that as a result of FCRAs restrictions they are limited to providing 
credit data to their customers that have a permissible purpose under 
FCRA. Consequently, they are restricted by law from providing such 
information to the general public.
---------------------------------------------------------------------------
    \27\ The FTC has determined that certain types of information, 
including SSNs, do not constitute as consumer report under FCRA because 
they are not factors in determining credit eligibility.

    Mr. Stearns. I thank you.
    Mr. Hoofnagle.

                STATEMENT OF CHRIS JAY HOOFNAGLE

    Mr. Hoofnagle. Thank you, Chairman Stearns and Ranking 
Member Schakowsky, for this opportunity today to speak about 
the privacy of Social Security numbers.
    My name is Chris Hoofnagle, and I am Associate Director 
with the Electronic Privacy Information Center here in 
Washington, D.C. We were established in 1994 to protect 
privacy, the first amendment and constitutional values. Since 
our founding in 1994, we have been active in trying to protect 
the Social Security number.
    As you are well aware, today the Social Security number 
plays an unparalleled role in the identification, 
authentication and tracking of Americans. This widespread use 
exacerbates several privacy problems. Since it is used as both 
an identifier and an authenticator, that is, some businesses 
use it as a record locator or a way to amass personal 
information about individuals, other businesses use it as a 
password, and that creates many of the problems that we are 
experiencing today in identity theft and privacy more 
generally.
    Serious security problems are raised in any system where a 
single device is used as both identifier and password. Just 
imagine if your bank account assigned you an account number and 
a PIN that were the same. Anyone who was able to recover a 
cashed check or one of your account statements could very 
easily plunder your account or in a similar situation when it 
comes to the SSN. Because the SSN is used in this way so 
prevalently in the public and private sector, it is so relied 
upon by business, it has become the identifier that criminals 
use when they want to commit fraud and identity theft.
    There is now a rich history in identity theft litigation 
showing that the crime is exacerbated by creditors who issue 
new accounts based on an SSN match alone. Creditors are 
ignoring incorrect information on credit applications and 
granting credit even where the SSN matches but other critical 
pieces of information such as name, date of birth and address 
do not match.
    In May, the Salt Lake Tribune reported that businesses 
granting credit did little to ensure that Social Security 
numbers and names match. The same newspaper argued there are 
credit bureaus that allow perpetrators to establish credit 
files using other people's Social Security numbers. That 
article also reports on an inspector general from the Social 
Security Administration, who then at the time stated that SSN-
only fraud makes up the majority of cases of identity theft in 
Utah and the surrounding region. We think this is further 
evidence that there needs to be less reliance on the Social 
Security number and more care in credit transactions in 
particular.
    But let me be clear about this. This in no way threatens 
instant credit or access to services. All we are arguing is 
that greater care needs to be made available so that 
individuals are not able to be victimized so easily. Congress' 
goal in addressing identity theft and privacy issues should 
seek to limit the availability of the SSN generally and induce 
businesses to rely upon alternative identifiers.
    Several provisions of H.R. 2971 are very important and 
should be included in any legislation considered by this 
committee, for instance, a prohibition on coercive disclosure. 
That is the practice where a business denies a service or 
access to a product based on a customer's withholding of the 
SSN. We think it is very important to address that practice.
    Any Social Security number bill should also include a 
provision that moves the identifier below the line on a credit 
report. That is, a company should not be able to sell the 
Social Security number unless they have a valid, permissible 
purpose under the Fair Credit Reporting Act. H.R. 2971 does 
enact that protection.
    I wish to highlight two important changes that should be 
made to the bill as amended.
    First, our reading of the bill shows that Social Security 
numbers are only protected when the government requires their 
disclosure and actually states that their disclosure is 
mandatory. This is key to protection in a privacy act that 
requires the government and States to tell people whether or 
not disclosure of their SSN is mandatory. A lot of States are 
not complying with the privacy act and not telling people that 
they don't need to provide their SSN and, as a result, they 
wouldn't have protections under the bill.
    We think it is important to strengthen the standards that 
the Attorney General will use in determining whether or not 
businesses should be able to use their Social Security number 
in the private sector. In the public sector, the SSN would be 
able to be disclosed where there was a compelling interest that 
could not be served by alternative means.
    However, in the private sector, the standard is much 
looser. We really think that the private sector should be held 
to a similar standard to induce it to use alternative 
identifiers.
    We also think that any exception that is made that allows 
disclosure of the SSN should be limited in time. Because if you 
create an exception that exists forever, businesses will 
solidify their use of the SSN, and they will continue to use 
it.
    Let me conclude by thanking you for holding this hearing 
and continuing to develop a legislative history on the privacy 
of the Social Security number.
    [The prepared statement of Chris Jay Hoofnagle follows:]
    Prepared Statement of Chris Jay Hoofnagle, Associate Director, 
                 Electronic Privacy Information Center
    Chairman Stearns, Ranking Member Schakowsky, and Members of the 
Subcommittee, thank you for extending the opportunity to testify on 
protecting Social Security Numbers.
    My name is Chris Hoofnagle and I am associate director with the 
Electronic Privacy Information Center (EPIC), a not-for-profit research 
organization based in Washington, D.C. Founded in 1994, EPIC has 
participated in cases involving the privacy of the Social Security 
Number (SSN) before federal courts and, most recently, before the 
Supreme Court of New Hampshire.1 EPIC has also taken a 
leading role in campaigns against the use of globally unique 
identifiers (GUIDs) involving the Intel Processor Serial Number and the 
Microsoft Corporation's Passport identification and authentication 
system. EPIC maintains an archive of information about the SSN online 
at http://www.epic.org/privacy/ssn/.
---------------------------------------------------------------------------
    \1\ Estate of Helen Remsburg v. Docusearch, Inc., et al, C-00-211-B 
(N.H. 2002). In Remsburg, the ``Amy Boyer'' case, Liam Youens was able 
to locate and eventually murder Amy Boyer through hiring private 
investigators who tracked her by her date of birth, Social Security 
Number, and by pretexting. EPIC maintains information about the Amy 
Boyer case online at http://www.epic.org/privacy/boyer/.
---------------------------------------------------------------------------
    In previous testimony to Congress, EPIC has recommended a strong 
framework of Fair Information Practices to create rights and 
responsibilities for individuals and collectors of the SSN. In 2001, 
EPIC Executive Director Marc Rotenberg traced the history of the SSN as 
an identifier, highlighted the use of the SSN in the financial services 
sector, and raised privacy issues associated with the Social Security 
Administration's Death Master File.2 In 2002, EPIC testified 
that the problem of identity theft had grown worse, that the states 
were acting to limit collection and disclosure of the SSN, and that 107 
H.R. 2036, the Social Security Number Privacy and Identity Theft 
Protection Act of 2001 could limit misuse of the SSN.3 In 
2003, EPIC appeared again to testify in favor of privacy protections, 
highlighting recent abuses, the continuing unnecessary use of the SSN 
as an identifier by both private and public sector entities, and the 
developing trends of state legislation crafted to limit collection and 
use of the identifier.4 In June 2004, EPIC provided an 
overview and recommendations for 108 H.R. 2971, the Social Security 
Number Privacy and Identity Theft Prevention Act of 2003.5 
We testified that the bill was a good start, but could use improvement.
---------------------------------------------------------------------------
    \2\ Social Security Numbers and Identity Theft, Joint Hearing 
Before the House Financial Services Subcommittee on Oversight and 
Investigations and the House Ways and Means Subcommittee on Social 
Security, Nov. 8, 2001 (testimony of Marc Rotenberg, Executive 
Director, EPIC), available at http://www.epic.org/privacy/ssn/
testimony--11--08--2001.html.
    \3\ Hearing on Preserving the Integrity of Social Security Numbers 
and Preventing Their Misuse by Terrorists and Identity Thieves, Joint 
Hearing Before the House Ways and Means Subcommittee on Social Security 
and the House Judiciary Subcommittee on Immigration, Border Security, 
and Claims, Sept. 19, 2002 (testimony of Chris Jay Hoofnagle, 
Legislative Counsel, EPIC), available at http://www.epic.org/privacy/
ssn/ssntestimony9.19.02.html.
    \4\ Hearing on Use and Misuse of the Social Security Number, 
Hearing Before the House Ways and Means Subcommittee on Social 
Security, July 10, 2003 (testimony of Chris Jay Hoofnagle, Deputy 
Counsel, EPIC), available at http://www.epic.org/privacy/ssn/
testimony7.10.03.html.
    \5\ Hearing on Enhancing Social Security Number Privacy, Before the 
House Ways and Means Subcomm. on Social Security, 108th Cong. (2004) 
(statement of Chris Hay Hoofnagle, associate director, Electronic 
Privacy Information Center), available at http://www.epic.org/privacy/
ssn/ssntestimony6.15.04.html
---------------------------------------------------------------------------
    In today's testimony, we highlight a substitute version of 108 H.R. 
2971. We make recommendations to strengthen the bill. We then cite 
examples of state SSN regulation that could be adopted at the federal 
level to provide an umbrella of protections for the SSN.
   i. recommendations for 108 h.r. 2971, the social security number 
           privacy and identity theft prevention act of 2003
    Introduced in July 2003, H.R. 2971 is the latest of a series of 
bills designed to enhance protections for the SSN and to promote the 
integrity of the identifier. It enjoys bipartisan support in the House 
of Representatives. The substitute measure contains many of the 
protections we recommended in our June 2004 testimony. However, some 
sections have been changed to the detriment of privacy. We highlight 
those sections below.
    Title I of the bill sets forth limitations on government disclosure 
of SSNs. Broadly put, this title would prohibit executive, legislative, 
or judicial entities from disclosing the SSN, subject to certain 
exceptions.
    We think it critical to make several changes to section 101. First, 
the legislation amends 42 U.S.C. Sec. 405(c)(2)(C) to protects SSNs where 
the identifier has been given to an agency ``pursuant to the assertion 
by such agency . . . that disclosure of such number is mandatory.'' 
This is a serious weakness in the bill that is keyed upon a requirement 
in the Privacy Act that government entities disclose whether SSN 
collection is mandatory or voluntary. Many state entities, in 
particular, do not comply with this disclosure requirement in the 
Privacy Act. As a result, individuals do not always understand whether 
SSN collection is mandatory or voluntary. Oddly, the legislation as 
drafted would reward agencies that didn't comply with the Privacy Act's 
voluntary/mandatory notice requirements by also immunizing them from 
prohibitions on SSN disclosure. We recommend striking this language.
    We recommend removal of exemption VI in section 101, which gives 
credit reporting agencies wholesale access to SSNs in the hands of the 
government. It is not the role of government to collect SSNs from 
citizens, who are often under legal compulsion to provide the 
identifier, and then release the SSNs to the private sector for the 
purpose of compiling dossiers. Professor Daniel Solove has fully 
articulated how this model of information flow is unfair to individuals 
and privacy invasive:
          Imagine that the government had the power to compel 
        individuals to reveal a vast amount of personal information 
        about themselves--where they live, their phone numbers, their 
        physical description, their photograph, their age, their 
        medical problems, all of their legal transgressions throughout 
        their lifetimes whether serious crimes or minor infractions, 
        the names of their parents, children, and spouses, their 
        political party affiliations, where they work and what they do, 
        the property that they own and its value, and sometimes even 
        their psychotherapists' notes, doctors' records, and financial 
        information.
          Then imagine that the government routinely poured this 
        information into the public domain--by posting it on the 
        Internet where it could be accessed from all over the world, by 
        giving it away to any individual or company that asked for it, 
        or even by providing entire databases of personal information 
        upon request. In an increasingly ``wired'' society, with 
        technology such as sophisticated computers to store, transfer, 
        search, and sort through all this information, imagine the way 
        that the information could be combined or used to obtain even 
        more personal information.6
---------------------------------------------------------------------------
    \6\ Professor Daniel Solove describes this problem in Access and 
Aggregation: Public Records, Privacy, and the Constitution, 86 
Minnesota Law Review 1137 (2002), available at http://papers.ssrn.com/
sol3/papers.cfm?abstract_id=283924.
---------------------------------------------------------------------------
    In section 101, we recommend harmonizing the definition of ``sale'' 
(to be codified at 42 U.S.C. Sec. 405(c)(2)(C)(x)(IX)) with other 
references to the term that appear in the legislation. The definition 
appearing in section 108, which defines sell as ``to obtain, directly 
or indirectly, anything of value in exchange for such number,'' is more 
appropriate.
    In section 101, we recommend removal of language that would allow 
continued disclosure of just the last four digits of the SSN, even with 
the six-year sunset. These last four digits are the unique portion of 
the SSN, and the legislation's protections are significantly weakened 
if this portion can sill be displayed.
    Section 102 specifies the authority of the Attorney General to 
create exemptions to the general prohibition on government disclosure 
of the SSN. We agree with the standard set forth by the legislation--
that SSNs should not be disclosed absent a compelling interest that 
cannot be served through the employment of alternative measures. This 
same standard should apply to sale of the SSN to the general public. 
Currently, the substitute measure would require the Attorney General to 
engage in a balancing test of the benefits and harms associated with 
the sale of the SSN to the private sector.
    We think that exceptions to the general prohibition should be 
limited in duration. A time limit will encourage users of the SSN to 
transition to alternative identifiers. Exceptions that are not time 
limited will ensure that SSN users never transition to alternative 
measures.
    Section 103 would codify an important safeguard--a prohibition of 
printing SSNs on checks issued by governments. This is a common sense 
protection against identity theft. It is necessary because a standard 
check with a SSN contains all the personal information necessary for 
commission of identity theft.
    Section 104 would prohibit states from displaying the SSN on 
driver's licenses. Again, this is a common sense approach to preventing 
identity theft. Indeed, many states already incorporate a ban on 
printing the SSN on driver's licenses.7 Such a prohibition 
makes it more likely that the SSN will not appear in the wallet of 
individuals, thus reducing the risk that a lost or stolen wallet will 
provide the personal information necessary to commit identity theft.
---------------------------------------------------------------------------
    \7\ See Ariz. Rev. Stat. Sec. 28-3158; C.R.S. Sec. 42-2-107; C.R.S. Sec. 42-
3-302; D.C. Code Ann. Sec. 50-402; O.C.G.A. Sec. 40-3-23; HRS Sec. 286-109; HRS 
Sec. 286-239; Idaho Code Sec. 49-306; Idaho Code Sec. 49-2444; Ky. Rev. Stat. 
Ann. Sec. 186.412; Mont. Code Ann. Sec. 61-5-111(2)(b); Nev. Rev. Stat. Ann. 
Sec. 483.345; N.H. Rev. Stat. Ann. Sec. 263:40-a; N.D. Cent. Code 39-06-14; 
Ohio Rev. Code Ann. Sec. 4501.31; Okla. Stat. Ann. tit. 47, Sec. 6-106 
(2002); Pa. Cons. Stat. Ann. Sec. 1510; Tenn Code Ann. Sec. 55-50-331; Tex. 
Trans. Sec. 521.044; Va. Code Ann. Sec. 46.2-342; Wash. Rev. Code Ann. Sec. 
26.23.150.
---------------------------------------------------------------------------
    Section 106 would prohibit government entities from allowing 
prisoners to have access to the SSN. We think that this too is a common 
sense protection, in light of the Metromail case, where a company 
employed prisoners to enter personal information from surveys into 
computers. This resulted in a stalking case where a prisoner harassed a 
woman based on information she submitted on a survey. The woman 
received mail from a convicted rapist and burglar who knew everything 
about her--including her preferences for bath soap and magazines. The 
woman sued and as a result of a class-action suit, Metromail may no 
longer use prisoners to process personal information.8 
Nevertheless, a general prohibition on inmate access to SSNs is 
appropriate, and California and Kentucky already have passed 
legislation to keep SSNs out of the hands of prisoners.9
---------------------------------------------------------------------------
    \8\ During litigation, Metromail claimed that they had not violated 
the woman's privacy, that they had no duty to inform individuals that 
prisoners were processing their personal data, and that the data 
processed was not highly intimate or embarrassing. Beverly Dennis, et 
al. v. Metromail, et al., No. 96-04451, Travis County, Texas.
    \9\ Cal Pen Code Sec. 4017.1, Sec. 5071; Cal Wel & Inst Code Sec. 219.5; Ky. 
Rev. Stat. Ann. Sec. 131.191.
---------------------------------------------------------------------------
    Section 108 generally prohibits disclosure of the SSN in the 
private sector, subject to exceptions. We think it important to limit 
exceptions to the general prohibition in order to curb private sector 
use of the SSN. First, the exception for public health purposes should 
be limited to ``emergency public health purposes.'' In its current 
articulation, this exception could allow medical providers and 
insurance companies to continue to rely upon the SSN in normal 
operations. Limiting the exception will encourage the industry to shift 
away from the identifier. We note that Empire Blue Cross is 
transitioning its 4.8 million customers away from the SSN as an 
identifier, demonstrating that it is possible for large health care 
operations to use an alternative identifier.10
---------------------------------------------------------------------------
    \10\ Empire Blue Cross Will End Use Of SSNs, Use Alternate Number 
System, Privacy and Security Law Report (Jun. 7, 2004) at 666.
---------------------------------------------------------------------------
    Section 108 contains an exception for SSNs of the deceased, meaning 
that they could be freely traded on the market. We think there are 
important public policy reasons to place some protections on SSNs of 
the deceased. SSNs of deceased individuals should receive protection 
for the same reasons that justify protections for living individuals; 
those reasons include preventing fraud and identity theft. 
Additionally, criminals are known to assume the identities of deceased 
individuals in order to engage in criminal acts and to avoid law 
enforcement. Some protection for these identifiers is justified.
    Section 109 codifies a much-needed protection for the SSN. Prior to 
the implementation of the Gramm-Leach-Bliley Act, CRAs and other 
entities sold SSNs in credit headers to individuals outside Fair Credit 
Reporting Act regulation. We understand that some businesses are still 
selling SSNs from credit headers that were collected before 
implementation of Gramm-Leach-Bliley. Section 108 would eliminate this 
unregulated sale of SSNs by tying the identifier to the credit report, 
and thus to protections in the Fair Credit Reporting Act.
    Section 110 contains important protections against the practice of 
``coercive disclosure,'' a practice where an entity conditions 
provision of a product or service based on disclosure of the SSN. 
Maine, New Mexico, and Rhode Island have established protections 
against coercive disclosure, and we think it a good idea to federalize 
this important right to enhance privacy of the SSN.11
---------------------------------------------------------------------------
    \11\ 2003 Me. ALS 512; N.M. Stat. Ann. Sec. 57-12B-3; R.I. Gen Laws Sec. 
6-13-17.
---------------------------------------------------------------------------
  ii. states have innovated clever protections for the ssn; congress 
          should consider incorporating them in 108 h.r. 2971
    In recent years, state legislatures have functioned in their 
traditional roles as ``laboratories of democracy,'' creating new 
approaches to enhancing the privacy of SSNs. These privacy protections 
demonstrate that major government and private-sector entities can still 
operate in environments where disclosure and use of the SSN is limited. 
They also provide examples of protections that should be considered at 
the federal level.
Some States Have Placed Broad Prohibitions on Disclosure and Use by 
        Government and Private Entities
    Colorado Governor Bill Owens signed H.B. 1311, legislation that 
creates important new protections for the SSN that took effect this 
summer. The new law will limit the collection of the SSN and its 
incorporation in licenses, permits, passes, or certificates issued by 
the state. The law requires the establishment of policies for safe 
destruction of documents containing the SSN. Insurance companies 
operating in the state must remove the SSN from consumers' 
identification cards. Finally, the legislation creates new penalties 
for individuals who use others' personal information to injure or 
defraud another person.
    A law taking effect in January 2005 in Arizona prohibits the 
disclosure of the SSN to the general public, the printing of the 
identifier on government and private-sector identification cards, and 
establishes technical protection requirements for online transmission 
of SSNs.12 The new law also prohibits printing the SSN on 
materials mailed to residents of Arizona. Exceptions to the new 
protections are limited--companies that wish to continue to use the SSN 
must do so continuously, must disclose the use of the SSN annually to 
consumers, and must afford consumers a right to opt-out of continued 
employment of the SSN. Arizona's new law is based on California Civil 
Code Sec. 1798.85.
---------------------------------------------------------------------------
    \12\ Ariz. Rev. Stat. Sec. 44-1373.
---------------------------------------------------------------------------
Special Protections Have Been Crafted for Students
    A number of states have passed legislation limiting colleges and 
universities from employing the SSN as a student identifier. Limiting 
use of the SSN in this context reduces the risk of identity theft, as 
databases of student information, student identity cards, and even 
posting of grades sometimes contain SSNs.
    In Arizona, major universities can no longer use the SSN as the 
student identifier.13 In Colorado, as of July 2003, public 
and private postsecondary institutions were required to establish 
protections for the SSN and discontinue its use as the primary student 
identifier.14 New York and West Virginia prohibit all public 
and private schools from using the SSN as a primary 
identifier.15 Kentucky law allows students to opt-out of use 
of the SSN as student identifier.16
---------------------------------------------------------------------------
    \13\ Ariz. Rev. Stat. Sec. 15-1823. Rhode Island and Wisconsin have 
similar protections. R.I. Gen. Laws Sec. 16-38-5.1; Wis. Stat. Ann. Sec. 
36.11(35).
    \14\ C.R.S. Sec. 23-5-127.
    \15\ N.Y. Educ. Law Sec. 2-b; W. Va. Code Ann. Sec. 18-2-5f.
    \16\ Ky. Rev. Stat. Ann. 156.160. See also Ky. Rev. Stat. Ann. 
197.120.
---------------------------------------------------------------------------
Protections Crafted for Public, Vital, and Death Records
    Commercial data brokers obtain SSNs from a number of sources, 
including public records that individuals are required to file in order 
to enjoy important rights and privileges offered by society. For 
instance, marriage licenses have been a source for SSNs and a number of 
states, including Arizona, California, Indiana, Iowa, Kentucky, 
Louisiana, Maine, Montana, Ohio, and Michigan, have enacted legislative 
protections to prevent their disclosure.17
---------------------------------------------------------------------------
    \17\ Ariz. Rev. Stat. Sec. 25-121; Cal Fam Code Sec. 2024.5; Burns Ind. 
Code Ann. Sec. 31-11-4-4; Iowa Code Sec. 595.4; Ky. Rev. Stat. Ann. 402.100; 
La. R.S. 9:224; 19-A M.R.S. Sec. 651; MCL Sec. 333.2813; Mont. Code Ann. Sec. 
40-1-107; Ohio Rev. Code Ann. Sec. 3101.05.
---------------------------------------------------------------------------
    Birth and death records are rich in personal information, and 
states have acted to shield SSNs collected in these life events against 
disclosures. Arizona, California, Illinois, Kansas, Maine, Maryland, 
Massachusetts, Minnesota, Mississippi, Missouri, New Hampshire, and 
other states limit the appearance of the parents' SSN on birth 
records.18 Similarly, several states restrict disclosure of 
the SSN in records associated with death.19
---------------------------------------------------------------------------
    \18\ See Ariz. Rev. Stat. Sec. 36-322; Cal Health & Saf Code Sec. 102425; 
410 ILCS 535/11; K.S.A. Sec. 65-2409a; 22 M.R.S. Sec. 2761; Md. Ann. Code Sec. 
4-208; ALM GL ch. 111, Sec. 24B; Minn. Stat. Sec. 144.215; Miss. Code Ann. Sec. 
41-57-14; Mo. Rev. Stat. Sec. 193.075; Mo. Rev. Stat. Sec. 454.440; N.H. Rev. 
Stat. Ann. Sec. 5-C:10.
    \19\ See Ariz. Rev. Stat. Sec. 16-165; Cal Health & Saf Code Sec. 102231; 
Idaho Code Sec. 67-3007; Burns Ind. Code Ann. Sec. 16-37-3-9; La R.S. Sec. 
23:1671; N.D. Cent. Code Sec. 23-02.1-28.
---------------------------------------------------------------------------
Protections Against Pretexting Should Be Considered
    We wish to raise one additional concern here--even legitimate 
collection of the SSN contributes to unauthorized access to the 
identifier. That is, we are increasingly aware of manuals for private 
investigators and other materials suggesting that SSNs can be obtained 
from motor vehicle departments, applications for professional licenses, 
and even tax returns.20 In these cases, the investigator 
probably obtains the identifier through a friend or contact working at 
the institution with a SSN. Alternatively, the manuals suggest the use 
of ``pretexting,'' a practice where an investigator requests personal 
information from an entity while pretending to be another person or 
while pretending to have a legitimate reason for access to the 
information. The Gramm-Leach-Bliley Act prohibits pretexting with 
respect to financial, securities, and insurance companies, but the law 
doesn't apply to pretexting targeted at employers, utility companies, 
or other entities that have SSNs. The Subcommittee should consider 
whether expanding protections against pretexting would enhance the 
privacy of the SSN.
---------------------------------------------------------------------------
    \20\ See e.g. Lee Lapin, How to Get Anything on Anybody 533-543 
(Intelligence Here, 3d ed. 2003) (section titled ``How to Find Anyone's 
Social Security Number'' suggests thirty sources for the SSN, including 
driver's license applications, bankruptcy filings, court records, bank 
files, utility records, professional and recreational licenses, and 
employment files).
---------------------------------------------------------------------------
                               conclusion
    We think that the privacy and integrity of SSNs could be enhanced 
through the passage of federal legislation that limits the collection 
and approved uses of the identifier. We urge the Subcommittee to 
examine state laws that have created new, clever protections for the 
SSN. We look forward to continuing to work with the Subcommittee on 
this and other privacy matters.

    Mr. Stearns. I thank the gentleman.
    I will start with my questions first.
    Mr. Hoofnagle mentioned the possibility of an alternative 
to a Social Security number. Commissioner, do you think there 
is another way to do this instead of having Social Security 
numbers? That would obviate the need to show your Social 
Security number, and should Congress push that idea?
    Mr. Leary. My problem with this, Congressman, is if we were 
writing on a clean slate and starting all over again, I suppose 
you could imagine a system where there might be some other 
identifier. And going down the road, there may be other 
identifiers. I mean, there may be technology having to do with 
your eye, fingerprints or things like this, which will be much, 
much more secure identifiers than what we have today. That is 
down in the future. But we have, unfortunately, a system that 
has been in place for a long time that is very, very hard to 
turn around. Let me give you a purely personal example.
    I first got my Social Security number when I turned 15 and 
had my first summer job. That was almost 60 years ago. In the 
interim, my Social Security number has been out there in 
innumerable employment records, employment applications, and 
records of various kinds. I agree with Mr. Hoofnagle that 
business has gathered these records reflexively for a long 
period of time. We were encouraged to carry our Social Security 
card around with us at all times to use as identification when 
I was young. Now, of course, they advise just the opposite. We 
were encouraged to put the Social Security number on the 
envelope when we mailed in our tax returns. Now, of course, 
they tell us just the opposite. I suspect that someone who 
wanted to get hold of my Social Security number and who knew 
where to look could get it in about 3 minutes today. There is 
not much of anything that Congress can do about that.
    All I am saying is that there is this embedded system, and 
whether there is an incremental value in attempting root and 
branch to change the way businesses do things is a very serious 
question.
    Mr. Stearns. Mr. Hoofnagle, when I have a credit report, my 
Social Security is part of that credit report; and I can get a 
copy of my credit report on the Internet for $35. Do you think 
that consumers should put their Social Security on the 
Internet?
    Mr. Hoofnagle. That is a complex question. It can be 
transferred over the Internet if it is done in encrypted 
fashion.
    Mr. Stearns. If it is not encrypted, then--because you get 
these dialog boxes that say what you are sending is not 
protected.
    Mr. Hoofnagle. If those cases, the consumers should never 
send their Social Security number. They do it over the phone, 
and the credit reporting agencies will make your credit report 
available by mail if you call, but consumers should only enter 
that information if it is encrypted.
    Mr. Stearns. I think it goes without saying, Equifax, 
Experian, TransUnion, these people are not necessarily--they 
have some legitimate arguments that they use this information 
to help the consumers and this bill, might, in fact, hurt the 
marketing or the dissemination of information that is valuable 
to the consumer. So would you understand their point of view? 
Do you think they have a legitimate problem--this is for all 
three of you--that these major data base collectors have some 
reservations about restriction, both application of civil and 
criminal penalties, because they might be liable for something 
they are doing just as a service to the consumer?
    Mr. Hoofnagle. That is a legitimate concern, but I do think 
H.R. 2971 is a nuanced approach, and I think, going forward, 
Congress should have a nuanced approach that allows the use of 
Social Security numbers in some contexts but not in others.
    We got a call from a consumer last week who was going to 
rent a refrigerator for her home. The company wanted her Social 
Security number to check her credit, but then they were going 
to use her Social Security number as her record identifier. So 
she would start receiving mail with her Social Security number 
in it. All the employees of that company would probably have 
her Social Security number. A nuanced approach would allow the 
transfer of the SSN to check the credit but not allow it for 
use as a customer identifier.
    Ms. Bovbjerg. I like to put these things into three groups.
    There are entities who have a legitimate need to use the 
Social Security number. With those, you want them to apply 
better protections; and I think that is something that you are 
looking at in this bill. You want entities who don't need the 
number to stop collecting it, another element of this bill. You 
want to protect sources like, for example, public records in 
the States and counties in particular where people may not know 
that their number is floating around and we have been told by 
the businesses involved are sources for them in getting 
personal information, which includes the Social Security 
number.
    It is a nuanced approach that the entities who have a 
legitimate need, you want to allow them to continue to use it 
but protect it from being transferred to the wrong places, 
protect it from being displayed to people who don't need to see 
it.
    When we have talked with businesses over the years that we 
have been doing this work about what would happen if you 
couldn't use the number, which would be I think a more 
Draconian approach than what we are discussing today, they felt 
that it would be--disruptive was the word they used. They would 
have to consider what they could find to track that would be 
both unique and that the person would keep for their lifetime 
that wouldn't change and something they might be able to 
exchange with other entities but that, ultimately, they would 
adjust.
    Mr. Stearns. Commissioner?
    Mr. Leary. I think we all agree that a nuanced approach is 
necessary. The question is whether or not some of the 
provisions in the bill are not nuanced. Let me pick one for 
example.
    That is the notion that, somehow or other, a consumer can 
refuse to give a Social Security number to a business that 
requires it as a condition of doing business. Now you can 
understand why that right would make sense if, as Mr. Hoofnagle 
points out and I think rightly so, a lot of businesses have 
just gotten in the habit of using it as an identifier. But, it 
seems to me that that right of refusal would make no sense 
whatever if you are asking the business to extend credit to you 
or to give you merchandise on some kind of a payment plan where 
they need that Social Security number to access your credit 
history. If these businesses can't access your credit history 
readily, our financial system as we know it is going to be 
seriously impaired.
    So writing a statute and then subsequently enacting 
regulations that distinguish between the legitimate request for 
Social Security number and one that goes too far is no easy 
task.
    Mr. Stearns. I am going to conclude, and I am going to say 
that the question would be then that the three large data base 
companies, in your opinions, should not fear this bill? Is that 
what the three of you are saying? You all agree with that? That 
Equifax, Experian and TransUnion, there is nothing in this bill 
that would make it difficult for them?
    Mr. Leary. There is some language in the bill that might 
even make it difficult for them, and I would like to submit 
something to the committee. Our written statement doesn't have 
a paragraph by paragraph analysis of the bill; and, with your 
indulgence, I would like to submit that.
    Mr. Stearns. You are saying you think the bill does have 
some reservations and you think it should be improved to better 
allow these people to communicate with consumers?
    Mr. Leary. Yes, sir.
    Mr. Stearns. Ms. Bovbjerg, is your opinion the same? Just 
yes or no. These people are the big players here, and I want to 
see if you think the bill would work for them or not.
    Ms. Bovbjerg. What we have heard out in the business world 
is that it is not impossible to do business without the Social 
Security number. But if use of the Social Security number were 
restructured, there could be a period of disruption, and there 
could be a period where people don't get the services that they 
have become accustomed to.
    Mr. Stearns. You are saying the bill as it stands right now 
in your opinion would not affect these three companies?
    Ms. Bovbjerg. I can't answer that question.
    Mr. Stearns. This is a subjective opinion. The Commissioner 
is saying, yes, I think it could, but some parts of it should 
be changed. Should some of this be changed, you are an expert 
here, so these folks can communicate with the consumers or not?
    Ms. Bovbjerg. I can't say from their perspective. I don't 
have the information to do that. I can say that I think the 
bill would go a long way toward filling in the gaps.
    Mr. Hoofnagle. I wish to echo those comments. I cannot 
evaluate it from the perspective of the credit reporting 
agencies. But I would point out major companies like Blue Cross 
and Blue Shield of New York have switched away from the Social 
Security number. That is a company with 4.8 million 
subscribers.
    Mr. Stearns. Seems you could use the license number on your 
driving permit would be a possibility or just eliminate the 
Social Security except for the last four digits and use that as 
a tool, except in very select cases.
    My time is expired and, with that, the ranking member.
    Ms. Schakowsky. Mr. Hoofnagle, I am--I bank on-line, and my 
password is my Social Security number. Are you saying that 
there is danger in that? And also that there is not any 
particular good reason for that to be my PIN number to log in? 
Actually, they give a PIN number, but my first identifier, 
though, is my Social Security number.
    Mr. Hoofnagle. It is not a good idea to use the Social 
Security number as the main identifier for your account. It is 
not necessary for the company to do so. The general problem is 
that your Social Security number might be available in other 
contexts. It might be in public records. It might be in the 
business records of companies without good security, and access 
to the number could provide someone an opportunity to interfere 
with your accounts.
    Ms. Schakowsky. Does that mean each time I call for help, 
the help line, that the individual who is looking at my account 
is also looking at that screen that has my Social Security 
number and has complete access to that?
    Mr. Hoofnagle. It depends on the company. Some companies 
have layered access to personal information and essentially 
condition access on the need for it. Some companies do not. So 
it is entirely up to whether or not the company has good 
internal security protocols.
    But the risk you are articulating here is the primary 
identity theft risk, and there is very little consumers can do 
about identity theft because so much of the crime that occurs 
is a result of insider access.
    Ms. Schakowsky. This is a financial institution. This isn't 
a small bank. What is the indication of encryption or other 
security? How do I know that the number I give is encrypted?
    Mr. Hoofnagle. Consumers have very little insight into 
security practices. One of the core ideas behind privacy is so-
called fair information practices. It is the idea that you have 
access to your personal information, that you can audit access 
to your information and that there is real security safeguards.
    Ms. Schakowsky. Is there an icon or anything that tells me? 
Normally, I never looked for that, and I have never noticed it. 
Is there something that says it is encrypted in some way?
    Mr. Hoofnagle. In a standard browser, a little lock icon 
should appear at the bottom of the browser. But the consumer, 
in addition to seeing that little lock, should click on the 
lock to make sure that the certificate that is being issued by 
the Web site matches the bank's Web address. That extra step of 
matching the certificate is beyond most consumers.
    Ms. Schakowsky. The issue of restitution for consumers 
seems to be one that has not been particularly addressed. I 
know that, in looking through your testimony, Mr. Leary, that 
you get a lot of complaints and those are shared, I guess, with 
law enforcement. But what we hear in terms of constituent 
complaints is that it is just a hassle beyond tolerance to try 
and get any restitution or relief or even getting it corrected, 
much less even getting--I wonder if any of you could comment on 
that and what kinds of things we could be doing to help once 
the theft has already occurred.
    Mr. Leary. Well, there is an irony here, too, as well. As 
you know, the Federal Trade Commission does administer some 
restitution programs and in a very limited way. And by that, I 
don't mean that our remedies are limited, but our resources are 
limited. So our efforts are necessarily selective, exemplary 
and usually aimed at covering as large a group of consumers as 
we can in a particular complaint against a particular company. 
In other words, we are not equipped to deal with the individual 
constituent complaints that you have and which I know are a 
serious problem.
    One of the great ironies here, in the world we live in 
today, is that Social Security numbers are a very quick and 
ready way to find people who might otherwise not be able to be 
located for the purpose of administering redress programs to 
wide numbers of people who have been injured. I wish I could 
tell you that there is some way that we, the Federal Trade 
Commission, can help you with these individual consumer 
complaints, but I am afraid that we have to deal only with 
things that have a much larger impact.
    I get consumer complaints mailed in to me as well, and one 
of the sad and frustrating things is that we simply don't have 
the resources to deal with these individual things. We can give 
people advice. We have advice in the booklets as to whom you 
can go, steps you can take to repair your credit, at least to 
cutoff the damage. But when it comes to actually getting 
redress from the wrongdoers, that is a real tough job.
    Ms. Bovbjerg. I don't have a lot to say about redress, but 
I did want to say that I think things have been getting a 
little better with regard to law enforcement coordination and 
that does help people. But it is very frustrating and 
disheartening for individuals where the crime doesn't meet a 
threshold that a Federal law enforcement agency will 
investigate. The victims have to go to State and local 
enforcement, and the coordination may or may not be there, 
depending on where the crime occurred, and where the person 
lives. It is terribly frustrating for them, and you can 
understand why they would like restitution, but, even then, I 
don't know that it can compensate for their time, and for the 
damage that such a crime has done to this person's life.
    Mr. Hoofnagle. A number of victims have attempted to sue 
companies that have improperly granted credit to imposters, and 
those lawsuits have generally failed, unfortunately from our 
view. We think a great protection moving forward would be the 
ability of a victim to actually pursue a credit-issuing bank or 
credit-issuing retailer that negligently extends credit to an 
imposter. There are amazing examples of this behavior where an 
imposter applies for credit and only the Social Security number 
matches and nothing else matches and the creditor still issues 
the account, and we think that needs to be reined in.
    Ms. Schakowsky. There are legal impediments to pursuing 
that in the courts.
    Mr. Hoofnagle. There are four cases that have been 
litigated in the Federal Courts on that issue, and all four 
have failed. The most recent was before the Supreme Court of 
South Carolina, where that court said that there was no duty 
between the credit issuer and the victim. So even though the 
credit was granted in the victim's name to an imposter, the 
court still would not recognize a right of action.
    Mr. Stearns. The chairman of the full committee, Chairman 
Barton.
    Chairman Barton. I don't have too many questions. I want to 
thank you for holding the hearing and thank our panelists for 
being here.
    My question goes to the heart of this whole issue. Social 
Security numbers were really not created to be a surrogate for 
a national identification number. They were created to help 
track people who were paying taxes into the Social Security 
Trust Fund, Old Age Survivor and Independent Beneficiary Fund, 
and to pay the benefits out. But they have become a surrogate 
national identity number.
    I took out a loan to buy a new home this past year, and I 
had to give my Social Security number. I opened a bank account 
when I got married. It wasn't an option. You want to take this 
loan out, you give us your Social Security number. You want to 
take this loan out, you give us your Social Security number.
    My first question is, should we just begin to assume that 
the Social Security number is a national identity number and 
proceed forward or should we continue under this charade that 
it is really not a national identification number?
    Mr. Leary. I will start, Mr. Chairman.
    We had a brief discussion of that shortly before you 
arrived, and I agree with you it has evolved in a way that 
probably people didn't foresee 65 years ago. But it has, as a 
practical matter, now become the basis on which credit 
decisions are made. It has been a very important way of 
identifying who someone named John Jones is, and distinguishing 
that person from some other John Jones who has a terrible 
credit history.
    One of the reasons that you and I are able to walk into a 
store in a strange town where nobody knows us and walk away 
with fairly expensive merchandise is because there is a 
recognized identifier. So that is the system we have. Now there 
can be--and I hope someday going down the road, long term, 
there will be--much more highly technical ways of ensuring that 
you are who you say you are, but for the moment this is what we 
are stuck with.
    Mr. Hoofnagle made a very good point, though, and that is 
there are some businesses that are very careless, and they 
assume that if you have the Social Security identifier they can 
take it as a given that you are who you say you are, 
notwithstanding the fact that a lot of other things don't 
match. We are working on ways, by the way, to see if we can't 
make some affirmative suggestions in that regard for more 
positive supplements to that kind of an identifier.
    Ms. Bovbjerg. Chairman Barton, I am Barbara Bovbjerg, From 
GAO, and I do a lot of work with the Social Security 
Administration. I know SSA would be completely horrified at the 
prospect of using the Social Security number as a national 
identifier. They would then be responsible for enumerating 
everyone, not just the people who are born American citizens, 
not just the people who are authorized to work, but everyone. 
And perhaps arguably that might make their task easier, as they 
might not have to sort through people. But it would change the 
whole nature of the Social Security number and its relationship 
to the Social Security program.
    In thinking about that, one can argue that today it is a de 
facto national identifier, but I think that if it is our 
national identifier, we are not really protecting it very well, 
and that if it were to be a national identifier, we would have 
to do things very, very differently than we do now.
    Chairman Barton. We have to go--to quote a poker term, we 
either withdraw or go all in. We are kind of half invested in 
the pot right now, and we haven't committed to it. As we become 
technologically advanced, we need to have a debate and decide, 
either you continue to use this and protect it or back away and 
come up with a real national identification number. That is 
what it is.
    And Mr.--the first gentleman's point--I am a frequent 
flyer. Under this test program, they have my thumbprint and eye 
print. I walk up to National Airport or Reagan Airport, and the 
line is 300 people long. I go up and look in this little thing; 
and it says, that is Joe Barton, and he can go through.
    So, I mean, the technology is there if we wanted to use it. 
And so that is really the question at this hearing, what do we 
want to do.
    Mr. Stearns. Would the gentleman yield?
    Chairman Barton. Sure.
    Mr. Stearns. How do the rest of us get that service?
    Chairman Barton. You just have to sign up for the program.
    Mr. Stearns. Just with the airlines itself?
    Chairman Barton. Yeah. I am sure Mr. Green is signed up.
    Mr. Green. Mr. Chairman, if the gentleman would yield, I 
signed up, but since I use Continental Airlines that service is 
only good for American Airlines out of Reagan. But hopefully we 
will get some type of seamless system.
    Chairman Barton. And that is my point. It took me about 5 
minutes to go through. I don't think they asked for my Social 
Security number when I signed up. They just asked for my 
driver's license, and then they took my thumb print and my eye 
print and that was it.
    Mr. Hoofnagle, do you want to----
    Mr. Hoofnagle. Thank you, Chairman Barton. We are concerned 
about the expanding use of the Social Security number. But I 
did want to remark that people frequently, when thinking about 
privacy, say that the toothpaste is out of the tube and you 
can't put it back in.
    But I don't think that is the case. And the best evidence 
of that is the telemarketing Do Not Call list that the Federal 
Trade Commission created with the Federal Communications 
Commission and by this Congress. And I think that is a 
compelling example of where we can take privacy back and we can 
establish safeguards.
    And the whole history of privacy law has followed the same 
model, where people have said it is too late, the information 
is already out there, but we have passed legislation to protect 
personal information and it protects us from that point 
forward.
    Gramm-Leach-Bliley, too, protects Social Security numbers 
in important ways. And it might not protect you and me, but it 
will protect our children. So I think, going forward, we should 
be optimistic.
    Chairman Barton. I am for that.
    You know, the conservatives--when we come to Congress, the 
conservative mantra is, no national identification number. You 
know, we don't want big brother to know all there is to know 
about us. But, de facto, if you use the modern industrial 
banking and credit system, you are going to have to give your 
Social Security number.
    And you have to have it. I don't think you can refuse to 
have a Social Security number. I think you have to have one. If 
you work, I think you have to have one. I don't think I could 
say, I don't want one, I am not going to pay Social Security 
taxes; or I am going to pay Social Security taxes, but I don't 
want a number. I think whether you get one or not, you get it.
    So I think we ought to have the debate and decide how to 
protect the Social Security number, and then decide what we 
want to do about the national ID number.
    With that, Mr. Chairman, I am going to yield back the 3 
minutes that I have overused.
    Mr. Stearns. I thank the gentleman.
    The gentleman from Texas.
    Mr. Green. Thank you, Mr. Chairman. And I know, as our 
chairman of the full committee mentioned, a lot of us have 
concern about use of our Social Security numbers; and I think 
we do have a de facto ID number.
    Now, I understand when I go and apply for a loan, a home 
loan, they want my Social Security number because sometime 
along the way I am going to deduct that interest on that loan 
and so that mortgage company is going to report that not only 
to myself, but I assume to the IRS. There are reasons that we 
have a Social Security number for tax purposes.
    But I also know when I asked to rent a U-Haul truck, they 
wanted my Social Security number. And I refused. I still got 
the truck. I don't know how often that would happen--simply 
because they want to check your credit rating, and I know that 
is our identifier.
    I guess my concern, and I appreciate our panel and the 
hearing, Mr. Chairman, is because of the three major credit 
bureaus we have; and I know under current law they are required 
to exchange the information. If I, for example, lost my credit 
cards, or I felt they were stolen, I would notify one, and all 
of them would be, the other two would be notified.
    But I do share the concern. In fact, I--being from Texas, I 
have some concern because when I did the American Airlines--
even though I am not a frequent flier with American, it is 
Continental--they did ask for my driver's license number. But I 
always understood that someone can go to my driver's license 
number in Texas, it is on the Web, and find out all my 
information, probably including my Social Security number.
    Is that correct, that States will provide that information, 
and they don't--State governments really don't guard the 
information, particularly a Social Security number?
    Mr. Hoofnagle. Representative Green, since 1998 the 
Driver's Privacy and Protection has set in, opt-in, meaning 
affirmative consent protections for your information at the 
motor vehicle association. The problem is that not all States 
have implemented the Driver's Privacy and Protection Act. 
Florida, for instance, failed to implement it, and they will 
not come into compliance with the law until October 1 of this 
year. And, as a result, there is a lot of information out there 
that is not available in other States. But Federal law should 
protect that data.
    Mr. Green. Well, I would be interested if you could provide 
to the committee other States, other than Florida, that maybe 
are not in compliance with the law from 1998.
    Mr. Hoofnagle. I would be happy to do so.
    Mr. Green. One of the other concerns is, when credit 
bureaus flag reports once there is fraudulent activity, is 
there a specific time by which credit bureaus must respond to 
continue to flag that particular account? Because I know 
oftentimes with stolen identities, it may not happen within 30 
days or 6 months, but can happen later. Is there any kind of 
timeframe that you know of that most of the credit reporting 
agencies have?
    Mr. Leary. I can't answer that question, Congressman. We 
will get an answer for you.
    I will just tell you a personal experience. I lost a 
driver's license about 2 years ago, and reported it, simply out 
of an excess of caution, to the credit agencies. And 2 years 
later, they still have a flag on my accounts, and it is 
extremely difficult to this day for me to get a new line of 
credit or something like that. They ask for all kinds of 
additional information. And I am glad to provide it under the 
circumstances because I feel safer.
    Mr. Green. And I agree. That is why I would rather those 
flags not drop off, because once that number is available on 
that, the folks who want to use it for illegal purposes, it 
could used again 30 days or 6 months or, like you said, maybe 
even a year later.
    Thank you, Mr. Chairman.
    Mr. Stearns. I thank the gentleman.
    As customary, when we have completed the members of the 
subcommittee, we certainly welcome the opportunity for others 
to participate. And we are fortunate to have the author of the 
bill, Congressman Shaw. So he has been kind enough to come 
here, and I welcome his comments and anything he would like to 
put in the record.
    Mr. Shaw. Thank you, Mr. Chairman. And I do have a 
statement that I would ask unanimous consent to be placed in 
the record.
    Mr. Stearns. By unanimous consent, so ordered.
    Mr. Shaw. And just to make a few observations--and I shall 
not take the full 5 minutes--in listening to the questioning 
from the members and, of course, the replies from the panel of 
witnesses, many of whom have appeared before my Social Security 
Subcommittee, I think you are getting the full thrust of what 
we are doing and what we are trying to accomplish.
    Clearly, the Social Security number was never, never 
intended to be an identifier, it never was. We need to do a lot 
to protect this number. This particular portion of the bill 
that this committee has jurisdiction over is of particular 
importance because it stops the widespread use--or requirement 
for the wide spread use--of Social Security numbers just simply 
to open accounts and just simply to do business with particular 
individuals.
    You will find that the utilities ask for it, the phone 
company asks for it. If you go try to open an account at a 
video store, the chances are they are going to want it. Opening 
up credit at a department store, at Burdines Department Store 
in Florida, which is part of the Burdines-Macy's group, they 
had, I recall, a sale where you get 20 percent off, and I was 
buying my wife's Christmas present--20 percent off if I would 
open an account. And I said, Well, that is a good idea, and I 
offered to open the account. And the first thing they wanted to 
know is my Social Security number; and I ended up having to pay 
20 percent more because I wasn't going to give it, and they 
weren't about to give me credit.
    But these are very important things. The use of it as a 
serial number in the military is of great concern. We have had 
testimony before our committee of the tremendous problems that 
people go through and the problems that they have once their 
credit has been stolen, once their identity has been stolen. 
And the Social Security number is the key to it.
    There is actual commerce in Social Security numbers that is 
going on quite legally in this country. I think if you are 
computer literate, you can probably go to a computer and find 
my Social Security number.
    That is not right. We need to stop this practice. We need 
to stop the wide spread use of Social Security numbers for 
things that they were never intended for. That Social Security 
number is the property of the government and the person to whom 
it was issued, period, and it shouldn't be used for any other 
purposes other than governmental purposes.
    We must address the openness of documents, government 
documents, because you can go to court files and find the 
Social Security number.
    These things have to be dealt with. And again, Mr. 
Chairman, I applaud you for moving this legislation forward. I 
am hopeful that we can get this bill. If we can't in the few 
days left in this particular session, maybe we can come back 
and use this as the groundwork necessary to speed this bill 
through. We need this particular portion of it to stop the 
spread of this crime.
    And with that, I yield back, Mr. Chairman.
    [The prepared statement of E. Clay Shaw, Jr. follows:]
   Prepared Statement of Hon. E. Clay Shaw, Jr., a Representative in 
                   Congress from the State of Florida
    Social Security numbers, also known as SSNs, are integral to 
Americans' everyday lives. The government requires us to have an SSN 
for employment, paying taxes, and numerous other transactions. And even 
though it is not required by law, many businesses ask for individual's 
SSNs to provide goods and services.
    Because the SSN is involved in so many transactions and is the key 
to our personal and financial information, it is one of the pieces of 
personal information most desired by identity thieves, and plays a 
pivotal role in identity theft. That is why I applaud the Committee on 
Energy and Commerce, Subcommittee on Commerce, Trade, and Consumer 
Protection for holding this important hearing. Congress must act to 
help consumers protect their SSNs, which is a vital step toward 
identity theft prevention.
    Identity theft is a vast and growing problem. Overall, nearly 10 
million people--or 4.6 percent of the adult population--discovered that 
they were victims of some form of identity theft in the year prior to a 
2003 Federal Trade Commission-sponsored survey. The crime resulted in 
nearly $48 billion in losses to businesses, nearly $5 billion in losses 
to individual victims, and almost 300 million hours spent by victims 
trying to resolve their problems.
    Although Congress has enacted laws in recent years, such as the 
``Gramm-Leach-Bliley Act'' (P.L. 106-102), and the ``Fair and Accurate 
Credit Transactions Act of 2003'' (P.L. 108-159) to help protect 
personal information and prevent identity theft, we do not yet have a 
law that provides broad-based and consistent protection for SSNs, 
especially regarding its collection and use in the private sector.
    To close the gap in SSN privacy protection identified through 
reports by the Government Accountability Office, testimony, and other 
research, I introduced the ``Social Security Number Privacy and 
Identity Theft Prevention Act of 2003'' (H.R. 2971). This bipartisan 
bill, which was unanimously approved by the Committee on Ways and Means 
on July 21, 2004, would restrict the sale and public display of SSNs, 
close an existing credit header loophole that allows widespread 
dissemination of SSNs, tighten procedures for issuing new SSNs, and 
establish penalties for violations. H.R. 2971 has been referred to the 
Committee on Energy and Commerce to consider a provision that makes it 
more difficult for businesses to deny services if a customer refuses to 
provide his or her SSN.
    Providing for uses of SSNs that benefit the public, while 
protecting these numbers from being used by criminals, or even 
terrorists, is a complex balancing act. While there are powerful 
consumer benefits from business use of SSNs as a common identifier, the 
Committee on Ways and Means Subcommittee on Social Security, which I 
chair, has heard testimony on how identity theft rings may use an 
employee of a business to obtain names, SSNs, and other personal 
information in large batches.
    For this reason, the Federal Trade Commission and others advise 
Americans to avoid giving out their SSN unless it is absolutely 
necessary, and my bill puts that advice into law. Consumers should have 
the option to refuse providing their SSNs without being denied goods 
and services, unless the SSN is required by law. While necessary uses 
of SSNs must be, and are preserved in my legislation, widespread 
collection and use of SSNs simply for convenience's sake must stop in 
order stem the growing tide of identity theft.
     Again, I thank the Committee for holding this hearing and look 
forward to working with my colleagues to act quickly to help protect 
SSN privacy and prevent identity theft.

    Mr. Stearns. I thank my colleague, and I appreciate his 
attendance here. I think it has helped our hearing. We have 
finished our questions. I would conclude by saying that, as Mr. 
Shaw mentioned, the Ways and Means Committee had a hearing, 
marked it up. So we try to encourage our committee to look at 
this bill and look at it carefully. And perhaps, Commissioner, 
if you have any changes or suggestions you think should be done 
on the bill, as you alluded to, we would like to see those.
    All of us know that the Fair Credit Reporting Act had an 
amendment so that when I go to a restaurant now, I don't get a 
full MasterCard number back; they truncate it, so I only get 
the last four numbers. And that was a great step forward.
    And so these are the types of things, if you move 
incrementally, you get improvements that will help out to 
protect people's identity.
    So anything we can do--I think, based upon the facts that I 
gave in my opening statement, with as much as $5 billion a year 
lost to individuals and $48 billion a year lost to businesses--
which is really the Federal Trade Commission's statistic--this 
is a formidable problem; and certainly we can't let this 
continue.
    And as also pointed out, I think, by the committee and the 
witnesses, this is on the rise, too, so that this is something 
that we should work for and look for solutions.
    With that, the subcommittee is adjourned.
    [Whereupon, at 3:15 p.m., the subcommittee was adjourned.]
    [Additional material submitted for the record follows:]
                Prepared Statement of ACA International
social security number privacy and identity theft prevention act (h.r. 
                                 2971)
    ACA International (ACA), on behalf of the credit and collection 
industry, strongly opposes the Social Security Number Privacy and 
Identity Theft Prevention Act (H.R. 2971), which would undermine the 
practices voluntarily instituted by private industry, many of which 
have subsequently been required by federal law, to protect the privacy 
of consumers' personal identifying information.
                               rationale
    ACA shares Congress' concern about the increase in the incidence of 
identity theft. We applaud legislative proposals that would serve to 
deter identity thieves and levy harsh punishment against those who 
obtain or use personal identifying information for an unlawful or 
illegal purpose. However, these well-intentioned efforts should not 
pose an unreasonable burden upon businesses which must use Social 
Security numbers (SSNs) to positively identify a particular person. 
Therefore, ACA must oppose H.R. 2971, as currently drafted, as it does 
not specify that the purchase, sale or display of an individual's SSN 
for purposes of enforcing a credit obligation or collecting a debt 
would be legal should H.R. 2971 become law.
    Furthermore, as the legislation would provide broad powers to the 
federal government for access, use and display of an individual's SSN, 
ACA is concerned that H.R. 2971 would not make adequate remedy 
available to an individual whose identity is stolen through the 
negligent actions of a government agency. Unlike other statutes, in 
which a private cause of action can be brought by an individual whose 
identity is stolen, and credit history and consumer credit report 
damaged, the doctrine of governmental immunity would likely prevent 
such recourse to an aggrieved individual under H.R. 2971.
                      protections already in place
    As the nation's premier trade association representing credit and 
collection professionals, ACA places great emphasis upon the education 
of its members, to encourage the highest standards of business ethics 
and full compliance with the myriad of federal and state laws that 
currently govern the industry. Many of these laws mandate specific 
requirements to protect the security and privacy of consumers' personal 
information, including their SSN.
    ACA's creditor and collector members are subject to the Fair Debt 
Collection Practices Act, the Gramm-Leach-Bliley Act, the Federal Trade 
Commission Act, the Truth-in-Lending Act, the Health Insurance 
Portability and Accountability Act and the Fair Credit Reporting Act 
recently reauthorized by the Fair and Accurate Credit Transactions 
(FACT) Act, which all contain provisions related to consumer privacy. 
The FACT Act included several new safeguards to combat identify theft. 
The Federal Trade Commission is currently writing regulations to carry 
out the significant legislative requirements of the FACT Act related to 
new duties for data furnishers and others to prevent and fight identify 
theft.
    Layered with these federal requirements are state laws that govern 
the practices of creditors and third-party collectors and address 
consumer privacy protections. H.R. 2971's sweeping provisions could 
prohibit businesses in the consumer credit and collection industries, 
which are vital to our nation's economy, from obtaining and using SSNs 
to accurately locate consumers and collect owed child support, and 
other important financial obligations.
                    proposed amendment to h.r. 2971
    To be clear, ACA opposes the passage of H.R. 2971. However, if the 
bill does move forward in the legislative process, we respectfully 
submit the following amendment to address the concerns of the credit 
and collection industry. ACA proposes that language similar to that 
which currently exists under the Fair Credit Reporting Act be added to 
H.R. 2971, clarifying that the sale, purchase, or display of an 
individual's Social Security account would be permissible for purposes 
of enforcing a credit obligation.
    Specifically, under the title ``Prohibition of the Sale, Purchase, 
or Display to the General Public of the Social Security Account Number 
in the Private Sector'' in Section 208 (c) Exceptions, ACA would 
propose that another exception be added as follows:
        ``(H) to the extent necessary in the enforcement of a credit 
        obligation or the collection of a debt.''
                               conclusion
    As credit and collection professionals, ACA members take the 
responsibility of safeguarding the security of sensitive consumer data, 
including SSNs very seriously. The member companies of ACA, 
representing over 100,000 credit and collection employees nationwide, 
comply with the existing framework of federal and state laws designed 
to protect consumers. ACA commends Congress for leading the fight 
against identity theft. The FACT Act passed last year and the recently 
passed Identity Theft Penalty Enhancement Act (H.R. 1731) were well-
designed pieces of legislation intended to provide real relief for ID 
theft victims and deter would-be criminals. H.R. 2971, however, is a 
misguided and unnecessary bill that will do more harm than good.
                           aca international
    ACA International, formerly known as the American Collectors 
Association, is the association of credit and collection professionals. 
Founded in 1939, ACA International has approximately 5,300 members, 
including third-party collection agencies, attorneys, credit grantors 
and vendor affiliates. Headquartered in Minneapolis, ACA International 
serves members in the United States, Canada and 58 other countries 
worldwide. For more information on ACA International visit http://
www.acainternational.org.
                                 ______
                                 
     Prepared Statement of Financial Services Coordinating Council
    This Statement for the Record is being submitted on behalf of the 
Financial Services Coordinating Council--or ``FSCC''--whose members are 
the American Bankers Association, American Council of Life Insurers, 
American Insurance Association, and Securities Industry Association. 
The FSCC represents the largest and most diverse group of financial 
institutions in the country, consisting of thousands of large and small 
banks, insurance companies, investment companies, and securities firms. 
Together, these financial institutions provide financial services to 
virtually every household in the United States.
    The FSCC very much appreciates the opportunity to submit this 
statement to the subcommittee on the use and misuse of social security 
numbers (or ``SSNs''). Our comments focus on the integral role of 
social security numbers in United States commerce; the many consumer 
benefits that result from financial institutions' use of these numbers; 
and the potentially negative effects that could occur if undue 
restrictions are imposed on such use. While the FSCC recognizes that 
there have been misuses of social security numbers, we strongly urge 
that any legislation intended to address this problem be carefully 
targeted to specifically-identified abuses, such as measures to stop 
identity theft. We believe it is imperative to avoid restrictions on 
legitimate and beneficial uses of SSNs.
    We would urge the subcommittee to exercise caution in its 
deliberations on any legislation in this area, including consideration 
of H.R. 2971, the ``Social Security Number Privacy and Identity Theft 
Prevention Act of 2004'', given the significant unintended consequences 
that such legislation could engender.
    Our testimony today makes three fundamental points:

 First, following the lead of the U.S. Government for the last 65 
        years, businesses' legitimate use of social security numbers as 
        unique identifiers of individuals is now woven into the fabric 
        of commercial transactions throughout the country. The use of 
        these numbers has produced real benefits for American consumers 
        and taxpayers, and has become critically important for a wide 
        range of government agencies, financial institutions, 
        hospitals, blood banks, and many other businesses, both large 
        and small.
 Second, broad restrictions on the use of social security numbers 
        could have serious unintended consequences, including higher 
        credit costs; increased fraud and identity theft; fundamental 
        and costly changes to internal business operating systems; 
        decreased consumer service; and costly delays in consumer 
        transactions.
 Third, Congress has recently enacted comprehensive privacy 
        protections under the Gramm-Leach-Bliley Act that, among other 
        things, place stringent restrictions on financial institutions' 
        use and transfer of social security numbers. In light of these 
        provisions, the FSCC strongly believes that further legislative 
        restrictions on financial institutions' use and transfer of 
        social security numbers are unnecessary.
    Our statement also discusses the potentially negative impact of 
social security number restrictions on financial institutions' 
legitimate use of public records.
                       fscc position on h.r. 2971
    As a preliminary matter, the FSCC would like to express its serious 
concerns with H.R. 2917 as adopted by the House Ways & Means Committee. 
At its core, the legislation seeks to restrict the availability of 
social security numbers to the general public. It does so by limiting 
the sale, purchase and display of such numbers. It imposes limits on 
the ability of commercial entities to collect these numbers when 
offering a product or service. It also imposes unclear limits on 
disclosures of social security numbers to government agencies and the 
maintenance of social security numbers in ordinary business records. 
Unfortunately, we believe that the bill may have the unintended 
consequence of restricting a wide variety of legitimate business 
activities that pose no danger of the public display of social security 
numbers. Ironically, we remain concerned that H.R. 2971 will have the 
effect of actually limiting our ability to combat identity theft and 
fraud, and to otherwise serve our customers. It is our collective 
associations' view that, with respect to financial institutions, 
existing law already provides consumers with significant protections 
regarding the misuse of social security numbers, making additional 
restrictions unnecessary and potentially counterproductive.
    As the Subcommittee is aware, in 1999 Congress enacted historic 
privacy protections as part of the Gramm-Leach-Bliley Act (GLBA). The 
GLBA subjects the financial services industry to a comprehensive 
privacy framework that requires annual disclosure of the company's 
privacy policies, allows customers to direct the company not to share 
their nonpublic personal information with nonaffiliated third parties, 
contains significant prohibitions on the disclosure of detailed account 
information, and establishes regulatory standards to protect the 
security and confidentiality of nonpublic personal information. 
Importantly, under GLBA, social security numbers are considered 
``nonpublic personal information'' and thus are already subject to 
significant restrictions on the transfer of, and the ability of others 
to reuse, such information. Moreover, Congress just last year enacted 
comprehensive legislation addressing concerns over identity theft as 
part of its passage of the ``Fair and Accurate Credit Transactions Act 
of 2003 (FACT Act)''. Taken together, these two congressional 
initiatives go straight to the heart of congressional concerns over 
identity theft and the efforts of financial institutions to combat this 
growing problem.
    The proposed bill, however, would create an entirely new regulatory 
structure for social security numbers and add it on top of a GLBA 
structure. For example, financial services companies regularly sell, 
for a price, assets between themselves and with secondary market 
institutions (e.g., home mortgages), such assets having social security 
numbers embedded in the files. Technically, these would be ``sales'' 
prohibited under the bill. (These would unlikely be a ``trade or 
business'' sale exempted under the bill). In addition, institutions 
regularly transfer information within their corporate families, either 
through central databases or otherwise, often in exchange for some 
compensation. Again, this could be prohibited under the proposed bill, 
notwithstanding the fact that such transfers of information help 
financial institutions efficiently service customer accounts. Moreover, 
financial institutions regularly use third party databases that 
purchase data from public databases and other sources that institutions 
check against to uncover fraud, identity theft and credit risk. These 
data compilers are not ``consumer reporting agencies'' under the Fair 
Credit Reporting Act (FCRA), and thus would be subject to the bill's 
limitations on purchase and sale. Ironically, each of these legitimate 
transfers of information benefit consumers and often facilitate our 
members' ability to better serve customers needs, combat fraud and root 
out identity theft, yet could be restricted under the bill. These are 
just some examples of legitimate, customer-beneficial activities that 
are called into question. There are undoubtedly others.
    The bill does provide the Attorney General of the United States 
with the ability to exempt other transactions from these prohibitions. 
As a practical matter, the AG is not familiar with the operations of 
financial institutions and would be ill-suited to craft appropriate 
exceptions that protect legitimate business activities. The Justice 
Department would certainly not be able to respond quickly to questions 
that would arise over the implementation of this exception. Moreover, 
delegating that authority to financial services regulators (as the bill 
permits), while potentially helpful, creates a great deal of regulatory 
uncertainty, inserting levels of regulatory bureaucracy in an area 
already adequately dealt with under federal law. As noted before, GLBA 
already establishes broad restrictions on the disclosure of nonpublic 
personal information, while specifically enumerating focused exemptions 
for legitimate business activities. Congress vigorously debated these 
GLBA rules and exemptions, which various State and Federal regulators 
have since implemented after extensive notice and comment periods 
(e.g., Federal Reserve, Office of the Comptroller of the Currency, 
Federal Deposit Insurance Corporation, Office of Thrift Supervision, 
Federal Trade Commission, Securities and Exchange Commission, and state 
insurance commissioners have all engaged in such reviews). Further 
action in this area, as it applies to financial institutions, is not 
necessary.
    As a practical matter, we do not believe that the financial 
services community is really the subject of the concern that this 
legislation is attempting to combat. We use social security numbers, as 
well as other personal financial information, to assist us in making 
sound credit decisions, underwriting applications for insurance 
coverage and performing other ordinary insurance business functions, 
combating fraud, rooting out identity theft, and uncovering financial 
support for terrorism. We do not make these numbers accessible to the 
general public. As a result, we believe that this legislation should be 
targeted at those entities at the heart of the problem, be they 
unregulated information brokers, those engaged in illegal pretext-
calling, or the like.
 integral role of social security numbers in u.s. commercial activities
    To assist the subcommittee in its deliberations, it may be helpful 
to review the important role that social security numbers play in U.S. 
commercial activities.
    As the GAO noted in its February 1999 report,1 the 
Social Security Administration created social security numbers 65 years 
ago as a means to maintain individual earnings records for the purposes 
of that program. But Congress soon realized the tremendous value to 
society of a unique identifier that is common to nearly every American. 
As a result, it began to require federal government use of the SSN as a 
common unique identifier for a broad range of wholly unrelated 
purposes. For example, ``a number of federal laws and regulations 
require the use of the SSN as an individual's identifier to facilitate 
automated exchanges that help administrators enforce compliance with 
federal laws, determine eligibility for benefits, or both.'' 
2 These include federal laws applicable to tax reporting, 
food stamps, Medicaid, Supplemental Security Income, and Child Support 
Enforcement, among others. Moreover, as the GAO acknowledged, it has 
repeatedly recommended in numerous reports that the federal government 
use SSNs as a unique identifier to reduce fraud and abuse in federal 
benefits programs.3
---------------------------------------------------------------------------
    \1\ ``Social Security--Government and Commercial Use of the Social 
Security Number is Widespread,'' February 1999, GAO/HEHS-99-28.
    \2\ Id. at p.4.
    \3\ Id.
---------------------------------------------------------------------------
    Following the federal government's lead, American businesses not 
only complied with federal requirements to use SSNs as identifiers for 
federal laws unrelated to social security, such as income tax 
reporting. They also realized the powerful consumer benefits to be 
derived from comparable business use of SSNs as a common unique 
identifier. Thus, businesses began to use SSNs in a manner similar to 
the federal government, e.g., to match records with other organizations 
to carry out data exchanges for such legitimate business purposes as 
transferring and locating assets, tracking patient care among multiple 
health care providers, and preventing fraud and identity theft. Many 
businesses also use SSNs as an efficient unique identifier for such 
internal activities as identifying income tax filers.
    Similarly, the financial services industry has used the SSN for 
many decades as a unique identifier for a broad range of responsible 
purposes that benefit consumers and the economy. For example, our 
nation's remarkably efficient credit reporting system--which has helped 
make America's affordable and accessible credit the envy of the world--
relies fundamentally on the SSN as a common identifier to compile 
disparate information from many different sources into a single, 
reliable credit report for a given individual. And as set forth in 
considerably more detail in Attachment A to this testimony, the 
banking, insurance, and securities industries each use SSNs as unique 
identifiers for a variety of important regulatory and business 
transactions, primarily to ensure that the person with whom a financial 
institution is dealing really is that person. Set forth below is a very 
incomplete sample of the many financial institution uses of SSNs that 
are listed in Attachment A:

 To combat fraud and identity theft;
 To accurately assess underwriting risk;
 To assist in internal benefits tracking;
 To identify money laundering activities;
 To comply with securities law reporting requirements;
 To transfer assets and accounts to third parties;
 To comply with ``deadbeat dad'' laws;
 To verify appropriate Department of Motor Vehicle records when 
        underwriting auto insurance;
 To obtain verifiable medical information to underwrite life, 
        disability income, and long term care insurance;
 To locate policyholders to pay insurance proceeds;
 To facilitate a multitude of administrative functions.
    As noted in the GAO report, ``[s]imply stated, the uniqueness and 
broad applicability of the SSN have made it the identifier of choice 
for government agencies and private businesses, both for compliance 
with federal requirements and for the agencies' and businesses' own 
purposes.'' 4 Put another way, the use of SSNs as common 
unique identifiers is now woven into the very fabric of both 
governmental and commercial transactions in this country, and has been 
so for decades.
---------------------------------------------------------------------------
    \4\ Id., p.2.
---------------------------------------------------------------------------
    In short, the federal government began the use of SSNs for 
unrelated identification purposes; it required businesses to do the 
same under certain federal laws; and its use served as an example for 
businesses, including financial institutions, for over half a century. 
These uses have produced tremendous efficiencies and benefits for all 
Americans. The FSCC strongly urges members of Congress to keep such 
legitimate uses and benefits, including those financial institution 
uses listed in Attachment A, in the forefront when considering 
proposals to restrict the use of SSNs.
unintended consequences of broad restrictions on use of social security 
                                numbers
    As a result of the widespread use of social security numbers for 
legitimate purposes, the FSCC remains fundamentally concerned about the 
unintended consequences of legislation that is intended to restrict the 
abuse of these numbers. Failure to carefully target legislation to 
avoid these unintended consequences risks serious harm to consumers and 
the smooth operation of the U.S. economy. Let me provide some specific 
examples:

 Potential Harm to Consumers. Financial institutions' use of social 
        security numbers makes it possible for them to provide a level 
        of service to customers that would otherwise not be possible. 
        By using such numbers to verify individual identities, credit 
        bureaus and others can quickly provide financial institutions 
        with accurate credit histories and verification information on 
        people seeking loans, insurance, securities, and other 
        financial products. This in turn permits a financial 
        institution to act swiftly and efficiently on applications or 
        requests related to these products. Use of social security 
        numbers also enables financial institutions to provide more 
        seamless administrative service, e.g., by allowing a life 
        insurer to more easily verify the identity of an individual 
        seeking to change a beneficiary under a life insurance policy. 
        The FSCC's concern is that a broad restriction on the sale or 
        use of social security numbers, however well-intended, could 
        seriously impede the delivery of such important services by 
        driving up processing costs and impairing decision-making.
 Increased Risk of Fraud and Identity Theft. Social security numbers 
        are critical for fraud detection. Banks, insurance companies, 
        and securities firms rely on information available from both 
        public and private sources--with embedded social security 
        numbers to ensure correct identification--to check for 
        ``inconsistencies'' that may suggest the occurrence of fraud or 
        identity theft. The use of these numbers also helps financial 
        institutions verify credit and make sound underwriting 
        decisions that minimize losses. The sophisticated processes 
        used for these purposes rely fundamentally on social security 
        numbers as the common unique identifier to assemble accurate 
        and verifiable information for a given individual. Put another 
        way, without a unique common identifier such as a social 
        security number, we believe it would be easier, not harder, for 
        an individual's identity to be stolen. Thus, to reiterate, we 
        believe that Congress should exercise great caution in 
        restricting the use of social security numbers so as not to 
        risk an increase in consumer fraud or identity theft--a result 
        that would be squarely at odds with the intended purpose of 
        such restrictions.5
---------------------------------------------------------------------------
    \5\ Existing law already includes provisions that prohibit identity 
theft. Stealing someone's identity is punishable by civil and criminal 
penalties under 18 U.S.C. 1028. Moreover, the Gramm-Leach-Bliley Act 
bans pretext calling, which is a basic tool of identity thieves.
---------------------------------------------------------------------------
 Market Disruption. A prohibition on the sale of social security 
        numbers could be construed to restrict such activities as the 
        sale of assets among financial institutions. This is so because 
        financial institution assets (e.g., mortgage servicing 
        accounts, credit card accounts, and traditional bank accounts) 
        often use social security numbers as the basis for account 
        identification. When it sells such an asset, a financial 
        institution could be viewed as technically ``selling'' the 
        embedded social security number as well. Thus, legislative 
        efforts that ``directly or indirectly'' limit the transfer of 
        social security numbers could effectively preclude such plainly 
        legitimate transactions. To address this problem, businesses 
        would need to rework their internal systems completely to 
        eliminate the reliance on such numbers--a massive and needless 
        expense. Accordingly, we believe that any legislative proposal 
        must be crafted to avoid such a significant unintended 
        consequence.
             the protections of the gramm-leach-bliley act
    The FSCC believes there is no need to further restrict the use of 
social security numbers by financial institutions in light of the 
strong social security number restrictions that apply to such 
institutions under the Gramm-Leach-Bliley Act (``GLB Act''). The GLB 
Act and its implementing regulations treat a financial institution 
consumer's social security number as protected ``nonpublic personal 
information.'' 6 As a result, each financial institution 
consumer has the right to block a financial institution from selling or 
transferring his or her social security number to a nonaffiliated third 
party or the general public.
---------------------------------------------------------------------------
    \6\ See, e.g., 12 C.F.R. Sec. 40.3(o), generally defining protected 
``personally identifiable financial information'' to include ``any 
information . . . [t]he bank . . . obtains about a consumer in 
connection with providing a financial product or service to that 
consumers' (emphasis added).
---------------------------------------------------------------------------
    There are exceptions to this general rule for legitimate transfers 
of social security numbers, such as ones that are necessary to carry 
out a transaction requested by the consumer; to protect against fraud; 
to provide necessary identifying information to a credit bureaus, etc. 
However, even with respect to such legitimate transfers of social 
security numbers, the consumer remains protected because the recipient 
of the number is prohibited by law from re-using or re-disclosing the 
number--it may do so only as necessary to carry out the purpose of the 
exception under which the number was received from the financial 
institution. Indeed, this unprecedented restriction on the re-use and 
re-disclosure of consumer information, including social security 
numbers, was recently upheld by the federal district court of the 
District of Columbia.7
---------------------------------------------------------------------------
    \7\ ISRG v. FTC, C.A. No.: 00-1828 (ESH) (Dist. DC, April 30, 
2001).
---------------------------------------------------------------------------
    In short, as the result of the GLB Act's carefully-targeted 
restrictions, a financial institution consumer is fully protected with 
respect to a financial institution's transfer of social security 
numbers, yet legitimate and important uses of these numbers remain 
permissible. In light of these restrictions, no additional restrictions 
on use of SSNs by financial institutions are warranted.
         concerns over restrictions on access to public records
    Finally, some concerns have also been expressed regarding the 
inappropriate use of social security numbers available in the public 
record. The FSCC believes it is important to remember that a wide range 
of private sector enterprises--including banks, insurance companies, 
and securities firms--rely on such records to conduct a broad range of 
legitimate business activities. For example, financial institutions use 
public records to:

 Uncover fraud and identity theft;
 Make sound credit and other financial product determinations;
 Verify identities of the customer at the account opening phase;
 Assist in internal security operations (e.g., employee background 
        checks); and
 Otherwise verify identities in order to conduct a broad range of 
        business transactions.
Business reliance upon such records facilitates the efficient operation 
of the financial and credit markets, limits mistakes, and ensures that 
consumers receive prompt and lower-cost service. It also helps protect 
the customer from fraud.
    More specifically, to achieve the purposes described above, 
financial institutions directly use court bankruptcy records; public 
records involving liens on real estate; criminal records and fraud 
detection databases; and similar types of public records. Financial 
institutions also indirectly use such records for the same purposes by 
relying on databases developed by third parties that themselves rely on 
information from public records. Importantly, SSN identifiers are 
central to ensuring that the information included in these records 
matches the correct individual. This allows banks, for example, to 
verify the identity of a person so that a direction from a customer to 
transfer funds to a third party can be executed without mistake, as 
well as to check important credit-related characteristics of loan 
applicants (such as pending bankruptcies, tax liens, or other credit 
problems).
    Moreover, financial institutions employ sophisticated programs that 
cross-check public information against information supplied by an 
applicant in order to uncover fraud. For example, if the age 
information provided by an applicant posing as another individual were 
inconsistent with other information known about that individual from 
public records made available through SSN identification, a ``red 
flag'' would be raised, which would trigger further checking to uncover 
the identity theft.
    Thus, overly-broad limits on access to public record information 
would compromise a financial institution's ability to make sound 
business decisions and protect its customers. Such limits could also 
greatly slow the decision-making process of U.S. businesses, to the 
detriment of consumers and the economy.
    Finally, even if financial institutions were exempted from 
restrictions on access to public records containing social security 
numbers, such restrictions could still create indirect problems for 
financial institutions and their customers. For example, if a social 
security number were stricken from a public record, it is possible that 
the ability to use that record for legitimate purposes would become 
impossible because of the expense involved in verifying the identity of 
the person covered by that record. The consequences could be delayed 
loan approvals, increased consumer costs for products and services, and 
limits on an institution's ability to discover identity theft on a 
timely basis.
    Even if public entities could still retain social security numbers 
in their internal nonpublic files, the cost and delays in efficiently 
accessing such files would be significant. Ultimately, the cost 
efficiencies and speed of delivery inherent in our current market 
system would be compromised. The effect could be the same as denying 
financial institutions access to such records.
                               conclusion
    The benefits to society from the legitimate and responsible use of 
social security numbers are real and substantial. As a result, the FSCC 
believes that policymakers should look carefully at the unintended 
consequences that could occur with any proposal that would restrict the 
use of these numbers. And, because of the GLB Act's restrictions on 
financial institution disclosure of social security numbers, we believe 
that no new SSN restrictions are required for the financial services 
industry.
                              Attachment A
  activities potentially impaired by restrictions on social security 
                                numbers
    As noted above, a wide range of legitimate activities conducted by 
financial institutions would be affected by broad restrictions on the 
use of social security numbers. Set forth below are examples of such 
activities, grouped by the respective industries represented by the 
FSCC.
I. Banking Industry Uses
A. General Uses of Social Security Numbers
 To assist in account administration and better respond to customer 
        requests. Financial institutions must use shared information to 
        create central databases that then permit institutions to 
        better respond to customer requests or needs (e.g., provide 
        account balances, correct inaccuracies, process loan requests, 
        etc.). To do this, many institutions use social security 
        numbers as a unique identifier to ensure more accurate records.
 To combat fraud and identity theft. Financial institutions rely on 
        third-party databases to investigate claims of fraud and 
        identity theft. These third-party databases in turn rely on 
        social security numbers as the common unique identifier that is 
        used by a variety of data sources. Without such common unique 
        identifiers, there would be no way to ensure that particular 
        information is associated with a particular individual, and not 
        with someone posing as that individual. Thus, SSNs are integral 
        mechanisms for accumulating and processing authentic 
        information for both law enforcement officials and financial 
        institutions.
 To accurately assess risk. Everyday, financial institutions make 
        judgments regarding financial risks. Institutions must rely on 
        information databases to make such judgments, whether they are 
        decisions on loans, insurance products, or other financial 
        services. Social security numbers, when used by internal and 
        third-party data providers as a means of compiling accurate 
        information on an individual, help institutions make prudent 
        decisions on product offerings.
 To verify the identity of the customer--in person, over the phone, by 
        mail, or over the internet--in the account opening stage. A 
        financial institution uses a social security number as the 
        unique individual identifier when verifying information of a 
        person with whom the institution has had no previous contact.
 To identify potential terrorist funding and money laundering 
        activities. Institutions use social security numbers as unique 
        identifiers to comply with various government requirements, 
        such as the U.S.A. Patriot Act, Office of Foreign Assets 
        Control (OFAC) verifications or the processing of certain Bank 
        Secrecy Act-related documents (e.g., cash transaction reports).
 To meet other government safety and soundness requirements. Federal 
        and State bank regulators require banks and savings 
        associations to operate in a safe and sound manner, and require 
        institutions to develop sophisticated internal policies and 
        procedures to that end. To do so, banks often rely on third-
        party databases that themselves rely on social security numbers 
        to promote accuracy. As a result, the use of social security 
        numbers plays a significant role in bank internal risk 
        activities.
 When providing tax reporting information to the Government (e.g., 
        Forms 1098/1099), as well as to the employee (e.g., W-2s).
 To facilitate internet banking operations. Many third-party vendors 
        who provide links to such services rely on social security 
        numbers as account identifiers.
 To assist in internal security operations. Institutions use social 
        security numbers as an employee identifier for purposes of 
        background checks and other activities.
 To assist in internal benefits tracking. For example, to provide 
        reimbursements to employees incurring business expenses, or to 
        track employee participation in employee retirement funds 
        (e.g., 401(k) plans).
 To track external payments to vendors for tax reporting purposes.
 To permit customer access to a wide range of 24-hour banking services 
        via phone or internet. Many banks use social security numbers 
        as the account identifier, both as a convenience to customers 
        and to maintain consistency with other internal processing 
        needs, such as the maintenance of an accurate central database 
        and the subsequent ability to use such numbers when making 
        external credit checks.
B. Type of Institutions that Benefit
 To facilitate financial holding company operations of benefit to the 
        company and its customers. Holding companies share customer 
        information (including social security numbers) within their 
        corporate family (i.e., affiliates) for a variety of purposes, 
        including:
 Providing customers with consolidated statements reflecting the 
        status of all of their financial accounts and investments. To 
        do so, companies need to ensure that customer information 
        matches the correct file--e.g., that the ``John Smith'' on the 
        phone is the John Smith that has two checking accounts, a 
        variable life insurance policy, and holds the securities of 
        four particular companies. Using social security numbers--the 
        only truly common unique identifier--to verify this information 
        greatly enhances company accuracy and increases customer 
        confidence.
 Assisting each affiliate in combating identity theft by giving these 
        affiliates necessary information on the customer so that they 
        may protect the customer's interest. For example, having 
        accurate, up-to-the-minute customer information allows 
        affiliates to quickly identify inconsistencies or irregular 
        activities in a customer's accounts that may reflect that 
        identity theft is occurring. Again, reliance on social security 
        numbers as the ``common'' element that permits institutions to 
        cross-check existing customer information with new information 
        helps institutions help their customers.
 Allowing all aspects of the company to prudently manage risk. When a 
        customer enters a bank, insurance company or securities firm in 
        search of a financial product or service, a financial 
        institution must quickly and accurately gauge its financial 
        risks in providing that product or service. The institution 
        must rely on a variety of credible internal and external 
        databases, such as those provided by credit bureaus, third-
        party vendors and other affiliates, for accurate information on 
        the credit standing and financial health of the applicant. To 
        ensure that these databases are as accurate as possible, such 
        providers must rely upon some form of common identifier that 
        ensures that correct financial history information is 
        associated with the right person. Social security numbers, as 
        the most accurate common identifier available, help ensure the 
        highest available level of accuracy in these databases. Since a 
        financial institution can then rely on the accuracy of this 
        information in assessing its risk, it can make quick, efficient 
        and prudent decisions regarding the new customer.
B. Securities Industry Uses
 Account identification. Many securities firms' systems rely heavily 
        on social security numbers for identification. In general, 
        account relationships are maintained based on SSN as the sole 
        unique identifier for an individual.
 Tax reporting. SSNs appear on account opening documentation, 
        primarily for tax reporting purposes.
 Telephone verification. Firms use SSNs to verify the identity of a 
        client transacting business over the telephone--this enables 
        firms to access an account by keying in the SSN if the customer 
        does not remember his/her account number.
 Account searches. Firms use SSNs for account searches, thus enabling 
        firms to sort all accounts for a customer under the same SSN.
 Court Actions/Judicial Process/Subpoenas. Securities firms are often 
        required to provide documents, which would reveal SSNs of a 
        client in responding to a subpoena, court order, or judicial 
        process. Firms also use SSNs to search for accounts in response 
        to requests from regulators and law enforcement officials.
 Securities law reporting. Many of the reports securities firms are 
        required to file with the SEC and self regulatory organizations 
        are based on SSN searches and identify SSNs. For example, 
        certain reports to stock exchanges are based on total positions 
        by related party (i.e., SSN).
 Institutional risk control/anti-fraud. Firms may use SSNs to perform 
        anti-fraud background checks on potential clients in order to 
        determine whether for example the person has a history of 
        defrauding others.
 Compliance. SSNs are used to identify certain types of activity that 
        firms are required to conduct surveillance for, such as 
        excessive turnover in accounts.
 Communications to shareholders. SSNs are used in connection with 
        mutual fund mailings, including the mailing of proxy statements 
        and prospectuses to proprietary fund shareholders. SSNs are 
        also used in connection with dissemination of a company's 
        annual report, quarterly report, or interim report.
 Escheatment/Abandoned Property. Securities firms are required to 
        provide on an annual basis to individual States the name, last 
        known address, SSN, and other information for purposes of 
        complying with various State escheatment and abandoned property 
        laws, and intangible property tax laws.
 Transfers of accounts to third parties. SSNs are used to facilitate a 
        customer request to transfer an account to another securities 
        firm, or to satisfy a customer request that a physical stock 
        certificate be transferred from street name into his or her 
        name.
 Insurance. SSNs may also be disclosed where a client purchases an 
        insurance policy through the securities firm--the securities 
        firms would then have to disclose (through the client's 
        application) information, including SSN, to the insurance 
        company.
C. Insurance Industry Uses:
  1. Property/Casualty Insurers' Use of Social Security Numbers
 To the extent the p/c insurance industry uses SSNs, that use is 
        confined to legitimate business practices such as underwriting 
        policies, complying with numerous state and federal laws, and 
        verification of identity.
 A proposal to prohibit or limit the disclosure of SSN could restrict 
        p/c insurers from obtaining necessary information for 
        underwriting and verification purposes.
     For example, auto insurers use motor vehicle records to assess 
            insurance risks, reevaluate risks undertaken, conduct 
            claims fraud investigations and pay injured victims. Motor 
            vehicle records, which include social security numbers as 
            identifiers, are an essential source of information needed 
            by insurers to comply with state consumer protection laws 
            and existing contracts.
     Auto insurers may use SSNs obtained from the consumer in order to 
            verify the receipt of proper Department of Motor Vehicle 
            records.
 Undue restrictions on use of SSNs could also impair the ability of p/
        c insurers to comply with reporting requirements under current 
        federal and state laws, such as those described below.
     Federal laws require p/c insurers to report certain payments with 
            the claimant's SSN to the IRS.
     P/C insurers are required under the Federal Welfare Reform Act to 
            report to state welfare agencies certain information, 
            including SSNs, so that the state can seize settlement 
            dollars from non-custodial parents.
     Under state workers compensation laws, p/c insurers are required 
            to file accident claims (which include the claimant's SSN) 
            with various agencies for those agencies' claims 
            administration purposes.
     States laws require p/c insurers to disclose to state-licensed 
            advisory organizations certain information, which may 
            include a SSN. The state-licensed advisory organizations 
            perform a critical function in insurance pricing by using 
            the information to conduct actuarial projections of 
            anticipated losses so that state insurance regulators are 
            able to perform their duties and insurance companies can 
            establish rates in accordance with state-approved rating 
            systems.
  2. Life, Disability Income, and Long Term Care Insurers' Use of 
        Social Security Numbers
    Life, disability income, and long term care insurers are strongly 
committed to the principle that individuals have a legitimate interest 
in the proper collection and handling of their personal information and 
that insurers have an obligation to assure individuals of the 
confidentiality of that information. However, in order for insurers to 
serve their prospective and existing customers, they must use and share 
nonpublic personal information, including social security numbers, in 
connection with the origination, administration, and servicing of 
insurance products and services. These functions are essential to 
insurers' ability to serve and meet their contractual obligations to 
their existing and prospective customers. Life, disability income, and 
long term care insurers also believe that the use and responsible 
sharing of nonpublic personal information, including social security 
numbers, generally increases efficiency, reduces costs, and makes it 
possible to offer economies and innovative products and services to 
consumers that otherwise would not be available.
    a) Underwriting life, disability income, and long-term care 
insurance policies--Insurers must be able to obtain and use nonpublic 
personal information, including SSNs, in order to underwrite 
applications for coverage. SSNs are used in a number of different ways 
in connection with this process:

 To obtain verifiable medical information. Insurers sometimes must use 
        proposed insureds' SSNs in order to obtain medical information 
        about them from doctors and hospitals which use SSNs as 
        identification numbers.
 To obtain drivers' record information. Insurers sometimes use motor 
        vehicle record information in underwriting. In some states, 
        insurers are required to use SSNs to obtain this information 
        from the motor vehicle department.
 To obtain credit report information. Insurers sometimes use 
        information from credit reporting agencies in underwriting, and 
        SSNs are sometimes required to obtain information from consumer 
        reporting agencies.
    b) Performance of Essential Insurance Business Functions--Once 
life, disability income, or long term care insurance policies are 
issued, insurers use their customers' nonpublic personal information, 
including their social security numbers, to perform essential, core 
functions associated with insurance contracts, such as for claims 
evaluations and policy administration. The ability to use this 
information for these purposes is crucial to insurers' ability to meet 
their contractual obligations to their customers and to perform 
important related service and administrative functions. They use SSNs 
to perform a number of these core insurance business functions, which 
include the following:

 To locate policyholders. SSNs are used by insurers to find missing or 
        lost policyholders to inform them that they are entitled to 
        life insurance proceeds.
 For customer service. SSNs are used to identify policies owned by an 
        individual who does not have the account or policy number 
        available when a service request is made.
 For phone call verification. Insurer call centers use SSNs as part of 
        the data requested to authenticate customers who call with 
        requests for service or for product or account information or 
        status.
 To transfer assets to unaffiliated financial institutions. SSNs are 
        often needed to transfer assets from one financial institution 
        to another, for example, for purposes of transfers between 
        mutual funds or annuities and life insurance. (Since one 
        financial institution generally does not know an individual's 
        account number at another financial institution, the SSN is 
        needed to identify the client's identity for the two 
        institutions. This reduces delay, error, and misplaced assets 
        in such transfers.)
 Pension plan administration. Insurers also use SSNs in connection 
        with the administration of pension plans, as identification 
        numbers.
 For online services. Insurers use SSNs as PIN numbers for customers' 
        use of on-line services.
 As identification for group insurance plans. Insurers use SSNs in 
        reporting to employer policyholders under employee group 
        insurance plans and in connection with payroll deductions under 
        these plans.
    c) Disclosures Pursuant to Regulatory/Legal Mandates or to Achieve 
Certain Public Policy Goals--In furtherance of public policy goals 
designed to protect American insurance consumers, life, disability 
income, and long term care insurers share nonpublic personal 
information, including SSNs, to:

 State insurance departments to assist them in their general 
        regulatory oversight of insurers, which includes regular market 
        conduct and financial examinations of insurers;
 Self-regulatory organizations, such as the Insurance Marketplace 
        Standards Association (IMSA), which impose and monitor 
        adherence to requirements with respect to member insurers' 
        conduct in the marketplace; and
 State insurance guaranty funds, which seek to satisfy policyholder 
        claims in the event of impairment or insolvency of an insurer 
        or to facilitate rehabilitations or liquidations which 
        typically require broad access to policyholder information.
Any limitation on these disclosures would seem likely to operate 
counter to the underlying public policy reasons for which they were 
originally mandated--to protect consumers.
    Life, disability income, and long term care insurers are also 
required to make certain disclosures of information by the federal 
government. In addition, they need to (and, in fact, in some states are 
required to) disclose personal information in order to protect against 
or to prevent actual or potential fraud. Such disclosures are made to 
law enforcement agencies and state insurance departments. Their primary 
purpose is to reduce the cost of insurance by helping insurers detect 
(and deter) attempts by insurance applicants to conceal or misrepresent 
facts. Any limitation on insurers' right to make these disclosures 
would seem likely to undermine the public policy goal of reducing 
fraud, the costs of which are ultimately borne by consumers.
    Life, disability income, and long term care are required to use 
SSNs to report to the IRS a variety of payments to insurance consumers, 
including, but not limited to, interest payments, certain dividends, 
and policy withdrawals and surrenders. At least one state, Rhode 
Island, requires that insurers match ``deadbeat'' parents data before 
making payments on claims. SSNs are required for that matching.
    d) Ordinary Business Transactions--In the event of a proposed or 
consummated sale, merger, transfer, or exchange of all or a portion of 
an insurance company, it is often essential that the insurer be able to 
disclose company files. Naturally, these files can contain personal 
information, including customers' SSNs. Such disclosures are often 
necessary to the due diligence process that takes place prior to 
consummation of the deal and are clearly necessary once the deal is 
completed when the newly-created entity often must use policyholder 
files in order to conduct business.
    Insurers also frequently enter into reinsurance contracts in order 
to, among other things, increase the amount and volume of coverage they 
can provide. These arrangements often necessitate the disclosure of 
personal information, which may include SSNs, by the primary insurer to 
the reinsurer.
                                 ______
                                 
 Prepared Statement of Patrick P. O'Carroll, Acting Inspector General, 
                     Social Security Administration
    Good morning, Chairman Stearns, Ranking Member Schakowsky, and 
members of the Subcommittee. Thank you for the opportunity to provide a 
statement for this important hearing to discuss the complex problem of 
protecting private consumers' Social Security number (SSN) from misuse 
and the Committee's proposed legislation, the Social Security Number 
Privacy and Identity Theft Prevention Act of 2004.
The SSN as a National Identifier
    I would like to begin my statement today with a simple declaration: 
The SSN is a national identifier. In past years, many would challenge 
that comment. Today, we live in a changed world, and the SSN's role as 
a national identifier is a recognized fact. Unfortunately, with that 
knowledge, we must also accept that because the SSN is so heavily 
relied upon as an identifier, it is a valuable commodity for 
lawbreakers. Given the importance of this unique, nine-digit number and 
the tremendous risk associated with its misuse, one of the most 
important responsibilities my office undertakes each day is oversight 
of SSN integrity.
    Today I would like to focus my testimony on how the SSN is misused 
to commit crimes, my office's role in addressing homeland security and 
identity theft, and what more needs to be done to ensure the integrity 
of the SSN. The protection of private consumers' SSNs is an important 
concern in fighting identity theft and safeguarding SSN integrity. Over 
the years, we have raised concerns in testimony and reports and have 
called for improved security for all databases--both public and private 
sector--that contain SSNs and other sensitive data, both as a homeland 
security issue and as an identity theft issue.
    The SSN is a widely used identifier, which can be used to tie 
multiple records together about a single individual. While phone 
numbers, addresses, and even names can change, the SSN is constant 
throughout an individual's life. Because of this, many institutions, 
including hospitals and some banks and brokerages, use clients' SSNs as 
an identity confirmation. Other institutions, notably banks, use SSNs 
as secret passwords that only the owner should know.
    While common use of the SSN as an identifier seems reasonable, it 
is an invitation for identity theft. For example, if someone knows the 
name and SSN of another individual, they could use this information to 
access accounts, transfer funds, or make other changes to an account, 
which may have serious repercussions for the true account holder. When 
SSNs appear with their owners' names on driver's licenses, mailing 
labels, and university student ID cards, the owners of these SSNs 
become potential targets. In fact, we are currently reviewing the use 
of the SSN on student IDs in a nationwide audit that will examine such 
policies at approximately 100 schools. Perhaps the most important step 
we can take in preventing SSN misuse is to limit the SSNs easy 
availability on public documents, and even in electronic forums such as 
the Internet.
    Our investigations in this area reveal how widespread the misuse of 
SSNs and other sensitive data from public and private sector databases 
has become. For example, we recently discovered an offer to sell up to 
10,000 SSNs with matching names on the eBay web site. These SSNs were 
used by the University of North Carolina at Pembroke as identifiers for 
its staff, current students, and applicants. The suspect successfully 
stole these SSNs and was ultimately sentenced to 5 months' 
incarceration.
    Our Philadelphia Field Division participated in an investigation 
that found that a former credit card company employee provided several 
co-conspirators personal information of legitimate account holders. The 
co-conspirators then used this information to open and transfer money 
from fraudulent accounts. The former employee was sentenced to 4 years 
probation and ordered to pay the bank restitution of over $132,800.
    In another case, after a year-long identity theft investigation, 
our agents arrested a man who had more than 250 credit cards--along 
with identification documents and fraudulent Social Security cards--for 
aliases he used in an elaborate scheme he began while working as a 
credit manager at a local furniture store. When the company was sold 
and his job was terminated, he took several credit reports with him and 
used those SSNs to get credit cards, bank loans, homes, vehicles, 
computers and cash. He was sentenced to 25 months in prison, ordered to 
pay $383,000 in restitution to numerous credit card companies and 
banking institutions, and ordered to forfeit a home and a recreational 
vehicle.
    The range of sources from which these SSNs and other critical 
personal information were stolen is alarming--legitimate web sites, 
universities, credit card companies, and a furniture store. It is not 
just SSA that has your number--numerous government agencies, companies 
and individual operators such as doctors and insurance agents have them 
as well. In fact, it is quite possible that your number has been given 
without your knowledge to numerous organizations, businesses and 
individuals. We cannot put the genie back in the bottle, but we must do 
more to make those who hold this critical information treat it with the 
same respect they would give to their own bank account numbers.
Misuse of the SSN to Commit Crimes
    For those with an illicit motive, an SSN can be obtained in many 
ways:

 Presenting false documentation to the Social Security Administration 
        (SSA).
 Stealing another person's SSN.
 Purchasing an SSN on the black market.
 Using the SSN of a deceased individual.
 Creating a nine-digit number out of thin air.
    Although SSA may never be able to completely prevent individuals 
from purchasing an SSN on the black market or stealing the SSN of 
another, we are proud that our efforts are making it more difficult to 
do so.
    For example, based on an investigation conducted by our Atlanta 
Field Division, a St. Petersburg, Florida resident was recently 
sentenced to 27 months of incarceration and ordered to make restitution 
to SSA for over $79,000 in survivors benefits she received for herself 
and three nonexistent children. To perpetrate this scheme, the 
individual assumed the identity of a former acquaintance by obtaining a 
North Carolina identification card in her friend's name. With this new 
identity, she used fraudulent birth certificates to apply for SSNs on 
behalf of two fictitious children. She also altered court marriage and 
divorce documents, falsely claiming that a known deceased man was her 
ex-husband and the fictitious children's father. She perpetrated this 
elaborate scheme so that she could apply for and receive Social 
Security survivors benefits for the fictitious children--and, until 
caught, was successful in doing so. Further investigation revealed that 
she had previously committed a similar crime resulting in additional 
survivors benefits for herself and another fictitious child.
    Other Federal agencies such as the Department of Housing and Urban 
Development (HUD) have also experienced a significant increase in the 
number of identity theft occurrences in their programs. Within programs 
administered by HUD, identity thieves are using someone else's SSN to 
obtain and then default on home mortgages--leaving taxpayers to pay 
their bills.
Our Role in Addressing Homeland Security and Identity Theft
    Recognizing the importance of SSNs to terrorists and identity 
thieves, SSA and my office, the Office of the Inspector General (OIG) 
take very seriously our responsibility to ensure that these numbers are 
only issued to those with a legal reason for having one. As such, we 
continuously seek innovative ways to prevent SSN misuse and create 
collaborative partnerships with other Federal, State, and local 
entities to address both homeland security and identity theft concerns.
OIG Homeland Security Activities
    While financial crimes involving SSN misuse are more numerous than 
terrorism-related crimes, the potential threat to homeland security 
nevertheless justifies intense concern. Because SSNs allow individuals 
to assimilate themselves into U.S. society, these numbers can become 
valuable tools for terrorists or others who wish to live in the United 
States and operate under the ``radar screen.'' Once an individual has 
an SSN, he has the ability to work, buy a home, and engage in a wide 
range of financial transactions including the raising and transferring 
of funds.
    Our active involvement in addressing homeland security began on 
September 11, 2001, with our agents assisting in rescue efforts and 
site security at the World Trade Center. We immediately assigned 
supervisors and agents to the FBI Command Centers in New York City and 
New Jersey to process information and investigate leads. The Inspector 
General ordered all Field Divisions to assist in Joint Terrorism Task 
Forces (JTTF) and Anti-Terrorism Task Forces (ATTF) around the 
country--in fact, we are now active participants in 63--Joint Terrorism 
Task Forces and 29 Anti-Terrorism Task Forces, as well as the Foreign 
Terrorist Tracking Task Force.
    In carrying out our homeland security responsibility, we coordinate 
closely with other Federal agencies. For example, we recently met with 
representatives of the Department of Homeland Security (DHS) to discuss 
methods in which we could work together to address the SSN's role in 
homeland security. We welcome this opportunity and believe cooperative 
ventures such as these are imperative to ensure that all of the links 
in the homeland security chain stay connected. Based on our initial 
discussions, we plan to work with DHS to explore possible data matching 
and cross-verification opportunities--those that are currently provided 
for under law and those for which additional legislation may be 
required.
    We are also coordinating with DHS and the Department of State 
(State) to review the effectiveness of the Enumeration at Entry 
initiative, a collaborative effort among the three agencies to 
facilitate the issuance of SSNs to legally admitted aliens whose 
immigration status permits such issuance. This initiative is designed 
to ensure that DHS and State certify the identity and immigration 
status of an alien before an SSN is assigned to that individual. 
Further, we have worked with the Department of Defense to determine 
whether individuals having public responsibilities and positions, 
primarily active duty military personnel, have reported wages with 
names and/or SSNs that do not match SSA's records. We are concerned 
about both unknown individuals working for the military branches and 
potential SSN misuse by military employees.
OIG Identity Theft Activities
    I am also concerned about the escalating occurrences of identity 
theft, which is the fastest-growing form of white-collar crime in the 
United States. In September 2003, the Federal Trade Commission (FTC) 
released a survey showing that 27.3 million Americans were victims of 
identity theft between 1998 and 2003--including 9.9 million people in 
the study's final year. FTC also reported that during the study's final 
year, losses to businesses and financial institutions totaled nearly 
$48--billion and consumer victims reported $5--billion in out-of-pocket 
expenses. Clearly, this is an epidemic that must be brought under 
control.
    Identity theft is an ``enabling'' crime, one that facilitates other 
types of crime, ranging from passing bad checks and defrauding credit 
card companies to committing acts of terrorism. Additionally, criminals 
use identity theft to defraud Federal agencies and programs of millions 
of dollars.
    By law and by mission, our office has a narrow but important role 
in the overall effort to address identity theft. Much of the Federal 
government's responsibility for identity theft issues has been assigned 
by Congress to the FTC. State and local law enforcement agencies and 
financial institutions also have critical roles to play.
    Because our primary mission is to protect the integrity of SSA's 
programs and operations, in the majority of our identity theft 
investigations, we continue to focus investigative efforts on cases 
that affect SSN integrity. For example, our Chicago Field Division took 
part in a 3-day inter-agency undercover operation that resulted in the 
arrest of 12 suspects dealing in fraudulently obtained Social Security 
cards, State driver's licenses, and U.S. passports. Our investigators 
determined that the group's leader and 11 others took part in an 
elaborate document-counterfeiting scheme to obtain valid SSNs for non-
existent children. The names belonged to undocumented noncitizens who 
paid up to $5,000 each for valid documents. Members of the group were 
sentenced to up to 2 years in prison or given immunity from prosecution 
for their cooperation in the undercover sting.
    To maximize our investigative resources, we dedicate agents that 
work on task forces with other law enforcement agencies nationwide to 
investigate identity crimes. We also work closely with prosecutors to 
bundle SSN misuse cases that, when presented separately, may not have 
been accepted for prosecution.
    We are also continuing our efforts to identify opportunities for 
SSA to further strengthen the integrity of the SSN. One of my major 
concerns has been the use of fraudulent documents to obtain SSNs. We 
continue to explore and recommend further controls the Agency can 
implement to strengthen SSA's important responsibility of assigning 
SSNs.
SSA Initiatives to Address SSN Integrity
    SSA has made significant progress in strengthening the defenses of 
the SSN, implementing important suggestions our office has made, and 
working with us to find solutions. In November 2001, the Commissioner 
of Social Security established an Enumeration Response Team (ERT) 
comprised of executives from throughout the Agency, including 
representatives from the OIG. The Commissioner charged this group with 
identifying steps the Agency could take to improve the enumeration 
process and to enhance the integrity of the SSN. Since that time, the 
Commissioner and the ERT have implemented numerous policies and 
procedures designed to better ensure that only individuals authorized 
to do so, receive an SSN. For example, the ERT recommended, and SSA 
adopted, more stringent circumstances under which an individual may 
obtain a non-work SSN. We are proud to serve on workgroups such as 
these and applaud the Commissioner and SSA for their strong commitment 
to improving SSN integrity.
    Prior to the ERT, the Agency implemented other initiatives such as 
the Comprehensive Integrity Review Process (CIRP) and Enumeration at 
Entry process. The CIRP system identifies vulnerabilities in the 
enumeration process and issues alerts to SSA's field offices (FO) to 
develop and certify. The FO reviewer, usually a manager or supervisor, 
performs an enumeration integrity review of each alert. If the reviewer 
determines that there is a possibility of fraud, the alert is forwarded 
to the OIG for development and disposition.
What Actions Still Need to Be Taken to Address SSN Misuse
    Despite the significant progress SSA and Congress have made in 
recent years to address SSN misuse, we believe SSN integrity and 
protection still need improvement at three stages: at issuance, during 
the life of the number-holder, and following the number-holder's death.
    At Stage One (issuance of the SSN), my office is working closely 
with Congress and SSA to strengthen controls over the enumeration 
process, ensure the integrity of identification documents, and make it 
as difficult as possible to fraudulently obtain an SSN from the Federal 
government. Together with Congress and with SSA, we have made important 
strides in reducing enumeration vulnerabilities, and that effort 
continues. Still, to strengthen our defenses even further, we believe 
SSA should implement the following changes.

 Continue to address identified weaknesses within the enumeration 
        process to better safeguard SSNs.
 Work with State Bureaus of Vital Statistics to incorporate additional 
        controls in SSA's Enumeration-at-Birth program, such as 
        periodically reconciling the number of SSNs assigned through 
        the program to the number of births reported by participating 
        hospitals.
    In the last several years, we have focused significant resources to 
address SSN protection within Stages Two (during the life of the number 
holder) and Three (after the number holder's death). Specifically, we 
have conducted numerous audits and made extensive recommendations to 
SSA to improve the SSN misuse problem in the earnings reporting 
process, and most importantly, to improve controls over SSN misuse as 
it pertains specifically to Homeland Security. Nevertheless, to more 
completely address SSN integrity during the life of the number holder 
and following that number holder's death, we believe SSA and lawmakers 
should examine the feasibility of the following initiatives.

 Limiting the SSN's public availability to the greatest extent 
        practicable, without unduly limiting commerce.
 Prohibiting the sale of SSNs, prohibiting their display on public 
        records, and limiting their use to legitimate transactions.
 Enacting strong enforcement mechanisms and stiffer penalties to 
        further discourage SSN misuse.
 Cross-verifying all legitimate databases that use the SSN as a key 
        data element.
 Review the implications of releasing information on deceased 
        individuals.
Limiting the SSN's Public Availability and Sale of the SSN
    Perhaps the most important step we can take in preventing SSN 
misuse is to limit the SSN's easy availability. We believe legislation 
designed to protect the SSN must strictly limit the number's 
availability on public documents. As long as criminals can walk into 
the records room of a courthouse or local government building and walk 
out with names and SSNs culled from public records, it will be 
extremely difficult to reverse the growing trend of SSN misuse. We also 
believe effective legislation should also specifically prohibit the 
sale of SSNs--including one's own SSN--on the open market. In addition, 
as long as criminals can buy a list of names and SSNs through an 
Internet auction, we will continue to be plagued by the consequences.
    To be fully effective, we also believe legislation must limit the 
use of the SSN to appropriate and valid transactions. The financial 
industry relies on the SSN, and no one is suggesting that we change the 
way legitimate business is conducted in the United States. But the use 
of the SSN as a student or patient identification number, as part of a 
car rental contract or to rent a video, must be curtailed.
    Congress enacted the Identity Theft and Assumption Deterrence Act 
of 1998, P.L. 105-318, responding to the growing epidemic of identity 
thefts by imposing criminal sanctions for those who create a false 
identity or misappropriate someone else's. The Internet False 
Identification Prevention Act of 2000, P.L. 106-578, closed a loophole 
left by the earlier legislation, enabling our office and other law 
enforcement organizations to pursue vendors who previously could sell 
counterfeit Social Security cards legally by maintaining the fiction 
that such cards were ``novelties'' rather than counterfeit documents. 
More legislative tools are needed, and we have worked with Congress to 
identify legislation necessary to protect the integrity of the SSN. For 
example, the House is now considering H.R.--2971, the Social Security 
Number Privacy and Identity Theft Prevention Act of 2004, which would 
restrict the use of SSNs in the private and public sector, and 
criminalize the sale of SSNs.
Penalties
    The identity theft legislation I discussed earlier provides 
criminal penalties, but those penalties were designed for identity 
theft crimes involving Social Security cards and/or SSNs, not for SSN 
misuse itself. We believe legislation should not only provide criminal 
penalties for those who misuse SSNs, but should also provide criminal 
penalties for those few SSA employees who betray the public trust and 
assist criminals in improperly obtaining SSNs.
    For example, a former SSA Service Representative was sentenced to 3 
years probation and community service after pleading guilty to a 
bribery charge in connection with issuing 100 to 200 Social Security 
cards to illegal aliens. She received between $50 and $150 for each 
card. We believe it is critically important to send a strong message to 
SSA employees tempted to facilitate crimes against Agency programs by 
pursuing the maximum sentence possible.
    On July 15, 2004, the President signed the Identity Theft Penalty 
Enhancement Act, P.L. 108-275, into law, establishing enhanced 
penalties for aggravated identity theft. While increased criminal 
penalties are a welcomed addition to the arsenal available for use in 
combating identity theft, we also believe legislation should provide an 
administrative safety net in the form of Civil Monetary Penalties to 
allow for some form of relief when criminal prosecution is not 
available for SSN misuse and other Social Security-related crimes.
Cross-verification
    Additionally, we strongly support cross-verification of SSNs 
through both governmental and private sector systems of records to 
identify and address inaccuracies. Our experience has shown that cross-
verification can combat and limit the spread of false identification 
and SSN misuse. Further, we believe all law enforcement agencies should 
be provided the same SSN cross-verification capabilities currently 
granted to employers. In doing so, the law enforcement community would 
use data already available to the Federal, State and local governments 
and the financial sector.
    Potentially, the rewards of cross-verification can be great, and it 
would not require major expenditures of money or the creation of new 
offices or agencies. We believe legislation is needed toexpand cross-
verification of identification data between governmental, financial and 
commercial holders of records and the SSA on a recurring basis. To 
offset SSA's cost for providing such services, the Agency could charge 
a modest fee to commercial and financial entities. The technology to 
accomplish these data matches and verifications exists now. Coupled 
with steps already underway by SSA to strengthen the integrity of its 
enumeration business process, cross-verification, once initiated, would 
be a critical step in combating the spread of identity fraud.
    Let me give you an example of an identity theft case in which 
cross-verification may have prevented a crime against a Federal 
government program, saving taxpayers $62,000. A Salt Lake City 
grandmother learned last year from one of my Denver Field Division 
agents that her SSN was used to purchase a $146,000 HUD home. This 
identity theft went undiscovered until the home went into foreclosure 
because the criminals used this grandmother's SSN, but another name to 
purchase the home. Had HUD been allowed to verify the accuracy of the 
borrower's name and SSN with SSA, HUD would have recognized the 
discrepancy and denied the loan. In this one case alone, the Government 
would have saved the thousands of program dollars HUD had to pay to 
foreclose and resell the property. Additionally, this elderly Salt Lake 
City grandmother would have been spared the time and expense of 
repairing her credit record.
    We believe cross-verification is one of the most important tools 
the Government and private sector can employ to reduce the instances of 
identity theft. We understand the important issue of consumer privacy 
that must be considered by Congress and others before allowing such 
data integrity matches. However, our ability to prevent these egregious 
crimes would be enhanced by additional legislation balancing the need 
for consumer privacy with the need for accurate identifying 
information.
Conclusion
    We appreciate the invitation to provide a statement to this 
Subcommittee and to assist you in the very important work you are doing 
to help protect consumers' SSNs. We are very pleased with the progress 
Congress and SSA have made in addressing the issue of SSN integrity 
over the last several years. However, we reiterate our concern that 
more must be done to ensure that only those individuals authorized to 
have an SSN receive one and that anyone who fraudulently obtains and 
misuses an SSN is adequately penalized. As such, we believe recently 
enacted legislation such as P.L. 108-275, the Identity Theft Penalty 
Enhancement Act, is a significant step toward holding accountable 
individuals who misuse SSNs to commit egregious crimes. In addition, we 
support legislation such as H.R. 2971, the Social Security Number 
Privacy and Identity Theft Prevention Act of 2004, which severely 
limits the sale, purchase and display of SSNs to the general public.
    We also ask that Congress consider other measures such as increased 
cross-verification among Government and private sector entities, Civil 
Monetary Penalties for SSN misuse and other Social Security-related 
crimes when criminal prosecution is not available, and stronger 
penalties for those few SSA employees that betray the public trust by 
selling SSNs. We will certainly continue our vigilance in addressing 
these issues and stand ready to do more to enhance the safety and well-
being of all Americans.
                                 ______
                                 
                                   Federal Trade Commission
                                                   October 20, 2004
The Honorable Cliff Stearns, Chairman
Subcommittee on Commerce, Trade and Consumer Protection
House Committee on Energy and Commerce
2125 Rayburn House Office Building
Washington, DC 20515
    Dear Mr. Chairman: Thank you for the opportunity to present the 
views of the Federal Trade Commission at the September 28, 2004, 
hearing of the Subcommittee on Commerce, Trade, and Consumer Protection 
of the House Committee on Energy and Commerce, on H.R. 2971, the Social 
Security Number Privacy and Identity Theft Prevention Act of 2004. This 
letter responds to the Subcommittee's request for more specific views 
on the bill itself. In addition, the letter addresses Representative 
Green's question at the hearing about the length of time that a fraud 
alert remains on a consumer's credit file.
    As I stated at the hearing, I believe that the goals of H.R. 2971 
are laudable. It seeks to strike the right balance between the 
legitimate and permissible sale and display of Social Security numbers 
(SSNs) and those that should be eliminated. It is extremely difficult, 
however, to find the correct place to draw the lines, by rulemaking or 
otherwise. Some provisions, like restrictions on access by prisoners, 
are clearly justified, but others may have unintended consequences. I 
believe that this bill, if enacted in its current form, would present 
significant challenges to the credit granting system and may ultimately 
harm consumers. The primary concern in this regard is with Sections 109 
and 110. Below, I provide a brief analysis of these provisions and 
their potential negative impact on consumers.
    In my oral presentation, I mentioned that there are many legitimate 
uses of SSNs in commerce that provide substantial benefits to 
consumers. In particular, SSNs are used by consumer reporting agencies 
(e.g., credit bureaus) to organize consumer data files and to match 
individual consumers with the correct consumer file (e.g., credit 
report). In order to ensure accurate and complete results, it is 
important for consumer reporting agencies to obtain a consumer's SSN 
from those that request the consumer's credit report.1 
Similarly, when financial institutions report account information to 
consumer reporting agencies, the SSN is used to match that information 
to the correct consumer file. Without SSNs, consumer reporting agencies 
may be unable to accurately match individual consumers with the proper 
credit reports, and may be unable to match information from financial 
institution records to individual consumer files. This could cause 
inaccurate information to appear in individual consumer files and 
errors in reporting the wrong file to inquiring creditors and other 
permissible users. Thus, undue restrictions on the availability of SSNs 
to businesses could harm consumers by diminishing the accuracy of the 
consumer reporting system.
---------------------------------------------------------------------------
    \1\ The FTC is required, under the Fair and Accurate Credit 
Transactions Act (the FACT Act), to study the processes by which 
consumer reporting agencies ``match'' consumer files to particular 
consumers prior to releasing a consumer report to a user. See Pub. L. 
No. 108-159 Sec. 318. That study will be completed in December 2004. It is 
clear, however, that the current consumer reporting system relies 
heavily on consumers' full SSNs.
---------------------------------------------------------------------------
    In addition, many businesses rely on SSNs to obtain current address 
and other contact information on consumers for a number of legitimate 
purposes. For example, a business may need a consumer's current address 
information in order to administer rebate, recall, or consumer redress 
programs; locate beneficiaries, lost heirs, or the holders of dormant 
accounts; and perform collection activities. In addition, this 
information is often used for law enforcement and public safety 
investigations. Consumer reporting agencies generally possess the most 
up-to-date consumer address and contact information. Because SSNs play 
an important role in the consumer reporting agencies' ability to match 
an individual consumer with the information relating to him, it would 
be more difficult for businesses and law enforcement without SSNs to 
obtain consumers' current address and contact information for a variety 
of legitimate purposes.
    This does not mean that consumer reporting agencies should be able 
to use SSNs without restriction. In my view, however, H.R. 2971 in its 
current form could eliminate or hinder legitimate uses of SSNs, to the 
ultimate detriment of consumers.
Section 109
    Section 109 of H.R. 2971 would restrict consumer reporting agencies 
from disclosing SSNs except as part of a ``full consumer report'' 
(i.e., where there is a permissible purpose under the Fair Credit 
Reporting Act, 15 U.S.C. Sec. 1681 et seq., (FCRA)). Under the FCRA, 
businesses may obtain from consumer reporting agencies identifying 
information about consumers (often referred to as ``above the line'' 
information), including SSNs, without having one of the permissible 
purposes specified in the statute.2 By prohibiting consumer 
reporting agencies from furnishing SSNs except as part of a full 
consumer report, Section 109 would cut off use of SSNs for many 
legitimate uses, such as law enforcement, public safety investigations, 
and insurance or pension benefit distributions,3 which are 
not permissible purposes for full file disclosures under the 
FCRA.4
---------------------------------------------------------------------------
    \2\ This identifying information generally is not covered by the 
FCRA. See FTC v. Trans Union, Dkt. 9255, Op. of the Commission at pp. 
30-31 (Mar. 1, 2000) (holding that consumer name, SSN, address, 
telephone number, and mother's maiden name do not constitute a consumer 
report under the FCRA).
    \3\ For example, assume that a consumer purchases life insurance. 
In current practice, the insurer generally would require the purchaser 
to provide his SSN, as well as those of any beneficiaries. When the 
policy matures and the insurer seeks to locate the beneficiaries, the 
insurer typically would use the SSNs it had collected previously to 
find the current address information for those beneficiaries through a 
consumer reporting agency or other commercial database. Section 110 
would prevent the insurer from requiring the SSNs of the consumer and 
the beneficiaries at the time the policy is purchased. Without the 
SSNs, the insurer could not obtain current address information for the 
beneficiaries from a consumer reporting agency, because the insurer 
likely would not have a permissible purpose to obtain their full 
consumer reports.
    \4\ Apart from the FCRA, the disclosure of SSNs by consumer 
reporting agencies and other financial institutions is limited under 
the Gramm-Leach-Bliley Act (GLBA), which requires financial 
institutions (with certain exceptions) to provide consumers with notice 
and an opt-out opportunity before sharing personal financial 
information with nonaffiliated third parties. See 16 C.F.R. Part 313. 
However, the exceptions to the GLBA notice and opt out requirements 
allow many legitimate business uses and disclosures of this 
information, including for law enforcement and public safety 
investigations. See 16 C.F.R. Sec.Sec.313.14-.15. The permissible purposes 
under the FCRA that would govern disclosure of SSNs under H.R. 2971 are 
significantly narrower than the GLBA exceptions.
---------------------------------------------------------------------------
    At the same time, in those situations where a business does have an 
FCRA permissible purpose for a full file disclosure, this section could 
encourage the overdisclosure of consumer information, because a 
business with a need for SSNs in order to obtain, for example, current 
address information, would be forced to purchase a full consumer report 
containing much more sensitive information than the user needs. In sum, 
this provision could have a negative impact on the availability of 
accurate consumer identifying information for legitimate uses, in 
addition to overdisclosing sensitive consumer information in other 
instances.
Section 110
    Section 110 of H.R. 2971 would make it unlawful for a business to 
require an individual to provide his SSN as a condition of doing 
business, and to do so would violate Section 5 of the FTC Act. The only 
exception to this provision is for circumstances where the business is 
expressly required under federal law to submit the individual's SSN to 
the federal government. As you know, this exception is very limited and 
would not allow businesses to require SSNs for many legitimate uses. 
For example, Section 110 would prevent creditors, insurers, and others 
from requiring a consumer to provide an SSN in connection with an 
application for credit, insurance, or other business transaction 
involving the consumer. As a result, this section would hinder the 
ability of businesses to obtain credit reports for legitimate purposes, 
such as risk analysis, underwriting functions, and security checks.
    In addition, similar to Section 109, this provision would prevent 
businesses with a legitimate need for consumers' current address 
information from obtaining that information, because that information 
is generally only accessible with an SSN.
    Thus, for the reasons described above, I believe that Section 110 
could have a significant negative impact on consumers.5
Fraud Alerts Under the FACT Act
    Finally, during the hearing, Representative Gene Green asked about 
the length of time that a fraud alert--that is, a notation that the 
consumer is a potential victim of identity theft or fraud--remains on a 
consumer's credit file. At present, as a voluntary practice, the 
nationwide consumer reporting agencies have been using a two-step fraud 
alert system, placing initial and extended fraud alerts in consumers' 
files upon request. The first national consumer reporting agency 
contacted notifies the other two of a consumer's request for an initial 
fraud alert. If the consumer later seeks to have an extended alert 
placed in his file, he will have to contact each of the three agencies. 
The duration of the initial fraud alert has varied among the agencies 
from 90 days to twelve months. All three agencies have left the 
extended fraud alert in the consumer's file for seven years.
    The FACT Act codifies and expands upon these voluntary practices. 
The fraud alert provisions go into effect on December 1, 2004, and 
provide for a two-step fraud alert system.6 Upon the initial 
request of a consumer, a nationwide consumer reporting agency must 
include an initial fraud alert in that consumer's file for not less 
than 90 days. If that consumer subsequently requests an extended alert 
and submits an identity theft report,7 a nationwide consumer 
reporting agency must include an extended fraud alert in the consumer's 
file for seven years. A consumer may, however, request to have either 
type of fraud alert removed from his file prior to the expiration of 
the designated period. In addition, the nationwide consumer reporting 
agency receiving the request for the fraud alert, whether initial or 
extended, must refer the fraud alert information to the other 
nationwide consumer reporting agencies.
    Thank you again for this opportunity to provide my views on H.R. 
2971. I look forward to continuing to work with you on these important 
issues.
            Sincerely,
                                            Thomas B. Leary
                                           Federal Trade Commission
------
    5 In addition, it would be valuable in the development 
of any legislation on this subject to have the results of the 
``matching study'' that the FTC is conducting pursuant to the FACT Act. 
This study is intended to learn more about the processes by which 
consumer reporting agencies match consumer files to particular 
consumers prior to releasing a consumer report to a user. See supra 
n.1.
    6 Pub. L. No. 108-159 Sec. 112; FCRA Sec. 605A; 15 U.S.C. Sec. 
1681c-1.
    7 Under the FACT Act, the term ``identity theft report'' 
is to be defined by Commission rulemaking (see Related Identity Theft 
Definitions, Duration of Active Duty Alerts, and Appropriate Proof of 
Identity Under the Fair Credit Reporting Act: Notice of Proposed 
Rulemaking and Request for Comment, 69 Fed. Reg. 23370, 23372 (Apr. 28, 
2004)), and means, ``at a minimum, a report that alleges an identity 
theft, is a copy of an official, valid report filed by the consumer 
with an appropriate Federal, state, or local law enforcement agency . . 
. the filing of which subjects the person filing the report to criminal 
penalties . . .'' Pub. L. No. 108-159 Sec. 112; FCRA Sec. 603(q)(4); 15 
U.S.C. Sec. 1681a(q)(4).

                                 

```