I 

113TH CONGRESS 

1ST SESSION H. R. 2229 

To require the Commissioner of Social Security to issue uniform standards 

for the method for truncation of Social Security account numbers in 

order to protect such numbers from being used in the perpetration 

of fraud or identity theft and to provide for a prohibition on the display 

to the general public on the Internet of Social Security account numbers 

by State and local governments and private entities, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 3, 2013 

Mr. ROSS (for himself and Ms. CASTOR of Florida) introduced the following 

bill; which was referred to the Committee on Ways and Means 

A BILL 

To require the Commissioner of Social Security to issue 

uniform standards for the method for truncation of Social Security account numbers in order to protect such 

numbers from being used in the perpetration of fraud 

or identity theft and to provide for a prohibition on 

the display to the general public on the Internet of 

Social Security account numbers by State and local governments and private entities, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


tjames on DSK6SPTVN1PROD with BILLS
2 

•HR 2229 IH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Safeguarding Social 

3 Security Numbers Act of 2013’’. 

4 SEC. 2. FINDINGS. 

5 Congress makes the following findings: 

6 (1) The Federal Government requires virtually 

7 every individual in the United States to obtain and 

8 maintain a Social Security account number in order 

9 to pay taxes or to qualify for old-age, survivors, and 

10 disability insurance benefits under title II of the So11 cial Security Act. 

12 (2) Many Government agencies and private en13 tities also use Social Security account numbers as 

14 identifiers to track individual records or as informa15 tion that an individual must present to verify his or 

16 her identity. Thus, Social Security account numbers 

17 are routinely collected, recorded, and transferred by 

18 public and private entities. 

19 (3) As an unintended consequence of these 

20 uses, Social Security account numbers have become 

21 one of the tools that can be used to facilitate crime, 

22 fraud, and invasions of the privacy of the individuals 

23 to whom the numbers are assigned. 

24 (4) According to the Social Security Adminis25 tration’s Inspector General, 16 percent of the 

26 99,000 fraud cases it investigated in the 1-year peVerDate Mar 15 2010 03:14 Jun 04, 2013 Jkt 029200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H2229.IH H2229

tjames on DSK6SPTVN1PROD with BILLS
3 

•HR 2229 IH

1 riod ending September 30, 2006, involved the misuse 

2 of Social Security account numbers. 

3 (5) The Social Security account number is also 

4 a key piece of information used in the perpetration 

5 of identity theft. In calendar year 2006, over 

6 240,000 individuals reported to the Federal Trade 

7 Commission that they had been the victims of an 

8 identity theft. Identity theft is a serious crime that 

9 can cause substantial financial losses and force vic10 tims to spend significant time restoring the accuracy 

11 of their credit records. 

12 (6) Social Security account numbers are pub13 licly displayed by some Government entities. In most 

14 jurisdictions throughout the United States, State 

15 and local law requires that certain documentary 

16 records, such as business filings, property records, 

17 and birth and marriage certificates, be made avail18 able to the general public. Some of these records 

19 contain personally identifiable information of individ20 uals, including Social Security account numbers. In21 creasingly, State and local recordkeepers are dis22 playing public records on the Internet, where these 

23 records are widely accessible at no cost or for a 

24 minimal fee. There are known instances of criminals 


tjames on DSK6SPTVN1PROD with BILLS
4 

•HR 2229 IH

1 using personally identifiable information from online 

2 public records to commit identity theft. 

3 (7) Private information resellers also routinely 

4 record and transfer individuals’ Social Security ac5 count numbers and other personally identifiable in6 formation. In a 2006 study, the Government Ac7 countability Office (GAO) was able to purchase 

8 truncated or full Social Security account numbers 

9 from 5 of 21 Internet information resellers that were 

10 surveyed. 

11 (8) The GAO has concluded, based on available 

12 evidence, that unauthorized access to personal data 

13 such as Social Security account numbers is a fre14 quent occurrence. A survey of 17 Federal agencies 

15 by the Committee on Oversight and Government Re16 form of the House of Representatives found that 

17 these agencies suffered more than 788 data breaches 

18 from January 2003 through July 2006. 

19 (9) In many instances, public and private enti20 ties seek to protect Social Security account numbers 

21 from abuse by truncating a portion of each number. 

22 However, because truncation methods are not uni23 form, it is possible to obtain a full Social Security 

24 account number by reconstructing the number based 


tjames on DSK6SPTVN1PROD with BILLS
5 

•HR 2229 IH

1 on partial information obtained from different 

2 sources. 

3 (10) In a report issued in June 2007, the GAO 

4 found that truncated Social Security account num5 bers in Federal documents stored as public records 

6 remain vulnerable to misuse, in part because dif7 ferent truncation methods used by the public and 

8 private sectors permit the reconstruction of full So9 cial Security account numbers. Federal entities such 

10 as the Department of Justice, the Internal Revenue 

11 Service, and the Judicial Conference of the United 

12 States truncate by displaying the last 4 digits of the 

13 Social Security account number. In contrast, the 

14 GAO found that information resellers sometimes sell 

15 records containing Social Security account numbers 

16 that are truncated to display the first 5 digits. 

17 (11) The first 5 digits of an individual’s Social 

18 Security account number are assigned based on the 

19 location in which the account number was issued 

20 and the order in which the account number was 

21 issued. The last 4 digits of an individual’s Social Se22 curity account number are randomly generated, cre23 ating a unique account number for each individual. 

24 Many public and private entities ask consumers to 

25 supply the last 4 digits of Social Security account 


tjames on DSK6SPTVN1PROD with BILLS
6 

•HR 2229 IH

1 numbers as a way to verify consumers’ identities, 

2 providing an additional reason for identity thieves to 

3 seek to acquire these digits. 

4 (12) The GAO reported in 2006 that it had 

5 been unable to identify any industry standards or 

6 guidelines for truncating Social Security account 

7 numbers. Moreover, the GAO could not identify any 

8 consensus among Government officials about which 

9 method for truncation better protects Social Security 

10 account numbers from abuse. 

11 (13) The GAO has stated that standardizing 

12 the truncation of Social Security account numbers 

13 would better protect these numbers from misuse. 

14 Since 2005, the GAO has on multiple occasions rec15 ommended the establishment of uniform standards 

16 for truncation of Social Security account numbers. 

17 (14) Given the Social Security Administration’s 

18 role in assigning Social Security account numbers, 

19 the Commissioner of Social Security may be in the 

20 best position to determine whether and how trunca21 tion should be standardized. 

22 (15) The truncation of Social Security account 

23 numbers, even by Federal Government agencies, is 

24 not comprehensively required or regulated. Cur25 rently, the Social Security Administration does not 


tjames on DSK6SPTVN1PROD with BILLS
7 

•HR 2229 IH

1 have the legal authority to regulate the use of Social 

2 Security account numbers by other entities. 

3 (16) Because the Federal Government created 

4 and maintains the system of required Social Security 

5 account numbers, and because the Federal Govern6 ment does not permit individuals to exempt them7 selves from those requirements, it is appropriate for 

8 the Federal Government to take steps to curb the 

9 abuse of Social Security account numbers. 

10 SEC. 3. REQUIREMENT TO ISSUE UNIFORM STANDARDS 

11 FOR THE METHOD FOR TRUNCATION OF SO12 CIAL SECURITY ACCOUNT NUMBERS. 

13 (a) IN GENERAL.—The Commissioner of Social Secu14 rity shall issue uniform standards— 

15 (1) for the method for truncation of Social Se16 curity account numbers in order to facilitate the pro17 tection of such numbers from being used in the per18 petration of fraud or identity theft; and 

19 (2) for the method for encryption (or other 

20 method of securing from disclosure) of Social Secu21 rity account numbers transmitted by means of the 

22 Internet. 

23 Such uniform standards shall not apply with respect to 

24 a Social Security account number of a deceased individual. 

25 (b) REQUIREMENTS.— 


tjames on DSK6SPTVN1PROD with BILLS
8 

•HR 2229 IH

1 (1) IN GENERAL.—In establishing the uniform 

2 standards required under subsection (a), the Com3 missioner of Social Security shall consider the mat4 ters described in paragraph (2) and consult with, at 

5 a minimum, the heads of the following Federal agen6 cies: 

7 (A) The Department of Justice. 

8 (B) The Federal Trade Commission. 

9 (C) The Department of the Treasury. 

10 (2) SPECIFIC CONSIDERATIONS.—For purposes 

11 of paragraph (1), the matters described in this para12 graph are the following: 

13 (A) The extent to which various methods 

14 for truncation of Social Security account num15 bers will assist in the prevention of fraud and 

16 identity theft, taking into account the following: 

17 (i) The risk that a truncated Social 

18 Security account number can be combined 

19 with other personally identifiable informa20 tion to derive or acquire a complete Social 

21 Security account number. 

22 (ii) The risk that the numerical digits 

23 not masked in the truncation process will 

24 reveal personally identifiable information 

25 about an individual. 


tjames on DSK6SPTVN1PROD with BILLS
9 

•HR 2229 IH

1 (iii) The risk that a truncated Social 

2 Security account number can be used to 

3 derive or acquire from other sources a full 

4 Social Security account number. 

5 (B) The methods in use for the truncation 

6 of Social Security account numbers by the Fed7 eral Government, State and local governments, 

8 and private entities and the extent of use of 

9 each method by the Federal Government, State 

10 and local governments, and private entities. 

11 (C) The reasons why Social Security ac12 count numbers are collected and recorded by 

13 the Federal Government, State and local gov14 ernments, and private entities. 

15 (D) The effect of each proposed method 

16 for truncation on the uses for Social Security 

17 account numbers by the Federal Government, 

18 State and local governments, and private enti19 ties. 

20 (E) Any comments regarding proposed 

21 methods for truncation submitted to the Com22 missioner from— 

23 (i) experts on privacy and data secu24 rity, consumer advocacy groups, and iden25 tity theft assistance organizations; 


tjames on DSK6SPTVN1PROD with BILLS
10 

•HR 2229 IH

1 (ii) the Federal Government or State 

2 or local governments, including State At3 torneys General; 

4 (iii) representatives of private entities 

5 that transfer, display, record, or otherwise 

6 utilize Social Security account numbers on 

7 a regular basis; 

8 (iv) the Comptroller General of the 

9 United States; and 

10 (v) any other appropriate entities. 

11 SEC. 4. APPLICATION OF UNIFORM STANDARDS. 

12 (a) FEDERAL GOVERNMENT.—On and after the date 

13 that the Commissioner of Social Security determines in 

14 regulations issued pursuant to section 6, the uniform 

15 standards issued under section 3(1) shall apply to the 

16 Federal Government— 

17 (1) whenever the Federal Government displays 

18 a Social Security account number; and 

19 (2) to the extent practicable, whenever the Fed20 eral Government transfers, records, or otherwise uti21 lizes a Social Security account number. 

22 (b) STATE AND LOCAL GOVERNMENTS; PRIVATE EN23 TITIES.— 


tjames on DSK6SPTVN1PROD with BILLS
11 

•HR 2229 IH

1 (1) DISPLAY OR TRANSMISSION BY A STATE OR

2 LOCAL GOVERNMENT BY MEANS OF THE INTER3 NET.— 

4 (A) PROHIBITION.— 

5 (i) IN GENERAL.—Subject to clause 

6 (ii), a State, a political subdivision of a 

7 State, or any officer, employee, or con8 tractor of a State or a political subdivision 

9 of a State, shall not display to the general 

10 public on the Internet all or any portion of 

11 any Social Security account number. 

12 (ii) EXCEPTIONS.—A State, a political 

13 subdivision of a State, or any officer, em14 ployee, or contractor of a State or a polit15 ical subdivision of a State may display to 

16 the general public on the Internet— 

17 (I) a portion of a Social Security 

18 account number if such display com19 plies with the uniform standards for 

20 the method for truncation and en21 cryption of such numbers issued by 

22 the Commissioner of Social Security 

23 under section 3; and 


tjames on DSK6SPTVN1PROD with BILLS
12 

•HR 2229 IH

1 (II) all or any portion of a Social 

2 Security account number of a de3 ceased individual. 

4 (B) PENALTIES.—A State, a political sub5 division of a State, or any officer, employee, or 

6 contractor of a State or a political subdivision 

7 of a State that violates subparagraph (A) shall 

8 be subject to a civil penalty of not more than 

9 $5,000 per day for each day that the State or 

10 political subdivision violated such subsection. 

11 (C) ENFORCEMENT.—The Attorney Gen12 eral may bring a civil action against a State, a 

13 political subdivision of a State, or any officer, 

14 employee, or contractor of a State or a political 

15 subdivision of a State, in any appropriate 

16 United States District Court for a violation of 

17 subparagraph (A). 

18 (D) EFFECTIVE DATE.—Subparagraphs 

19 (A) through (C) shall take effect on the date 

20 that is 1 year after the date on which regula21 tions are issued under section 6 and shall apply 

22 to violations occurring on or after that date. 

23 (2) DISPLAY BY OTHER MEANS.—It is the sense 

24 of Congress that if a State, local government, or pri25 vate entity displays a Social Security account numVerDate Mar 15 2010 03:14 Jun 04, 2013 Jkt 029200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H2229.IH H2229

tjames on DSK6SPTVN1PROD with BILLS
13 

•HR 2229 IH

1 ber in a manner other than that described in para2 graph (1), the State, local government, or private 

3 entity should comply with the uniform standards 

4 issued under section 3 to the same extent that the 

5 Federal Government or a State or local government 

6 is required to comply with such standards under 

7 subsection (a) and paragraph (1) of this subsection. 

8 SEC. 5. GRANTS TO STATE AND LOCAL GOVERNMENTS TO 

9 COME INTO COMPLIANCE WITH THE PROHI10 BITION ON THE DISPLAY TO THE GENERAL 

11 PUBLIC ON THE INTERNET OF SOCIAL SECU12 RITY ACCOUNT NUMBERS. 

13 (a) IN GENERAL.—The Attorney General shall award 

14 grants to States and political subdivisions of States to 

15 carry out activities to remove, redact, or truncate, in ac16 cordance with the uniform standards for the method of 

17 truncation issued under section 3, all Social Security ac18 count numbers on forms and records of executive, legisla19 tive, and judicial agencies of States and political subdivi20 sions of States that, as of the date that is 1 year after 

21 the date on which regulations are issued under section 6, 

22 would be displayed to the general public on the Internet 

23 in violation of section 4(b)(1). 

24 (b) APPLICATION.—A State or political subdivision of 

25 a State desiring a grant under this subsection shall submit 


tjames on DSK6SPTVN1PROD with BILLS
14 

•HR 2229 IH

1 an application to the Attorney General at such time, in 

2 such manner, and containing such information as the At3 torney General may reasonably require. 

4 (c) AUTHORIZATION OF APPROPRIATIONS.—There is 

5 authorized to be appropriated to the Attorney General to 

6 carry out this subsection, $10,000,000 for each of fiscal 

7 years 2014 and 2015. 

8 SEC. 6. REGULATIONS. 

9 Not later than the date that is 6 months after the 

10 date of the enactment of this Act, the Commissioner of 

11 Social Security shall issue regulations to carry out this 

12 Act. 

13 SEC. 7. GAO REPORT. 

14 Not later than 18 months after the effective date of 

15 the regulations issued by the Commissioner of Social Secu16 rity under section 6, the Comptroller General of the 

17 United States shall report to Congress on the extent to 

18 which the uniform standards required under section 3 

19 have resulted in the adoption of such standards by private 

20 entities, and whether these standards are likely to provide 

21 greater protection against fraud and identity theft than 

22 the practices adhered to prior to such date. The report 

23 shall include— 

24 (1) a recommendation regarding— 


tjames on DSK6SPTVN1PROD with BILLS
15 

•HR 2229 IH

1 (A) whether such standards should be 

2 mandatory for State and local governments and 

3 private entities, and if so, under what cir4 cumstances; and 

5 (B) whether making such standards man6 datory for such entities (with respect to each 

7 circumstance identified under subparagraph 

8 (A)) would help prevent fraud, identity theft, 

9 and unauthorized access to consumers’ person10 ally identifiable information; and 

11 (2) recommendations for such additional legisla12 tion or administrative action as the Comptroller 

13 General determines appropriate to further reduce 

14 the risks of fraud, identity theft, and unauthorized 

15 access resulting from the transfer, sale, display, re16 cording, or other utilization of Social Security ac17 count numbers. 

18 SEC. 8. PREEMPTION OF STATE LAW. 

19 This Act and the amendments made by this Act shall 

20 supersede a provision of State law only if, and only to the 

21 extent that, such provision conflicts with a requirement 

22 of this Act or an amendment made by this Act. 

23 SEC. 9. DEFINITIONS. 

24 In this Act— 


tjames on DSK6SPTVN1PROD with BILLS
16 

•HR 2229 IH

1 (1) the term ‘‘display to the general public on 

2 the Internet’’ means, in connection with all or any 

3 portion of a Social Security account number, to post 

4 or to permit the continued presence of such number, 

5 or any portion of such number in a viewable manner 

6 on an Internet site that is available to the general 

7 public, including any Internet site that requires a fee 

8 for access to information accessible on or through 

9 the site; 

10 (2) the term ‘‘Social Security account number’’ 

11 means the account number assigned to an individual 

12 by the Commissioner of Social Security in the exer13 cise of the Commissioner’s authority under section 

14 205(c)(2) of the Social Security Act (42 U.S.C. 

15 405(c)(2)) and includes any derivative of such num16 ber; and 

17 (3) the term ‘‘State’’ means each of the 50 

18 States, the District of Columbia, the Commonwealth 

19 of Puerto Rico, the United States Virgin Islands, 

20 Guam, and the Commonwealth of the Northern Mar21 iana Islands. 

Æ 


tjames on DSK6SPTVN1PROD with BILLS