Testimony 

Before the Subcommittee on Social 

Security, Committee on Ways and Means, 

House of Representatives 

United States General Accounting Office 

GAO

For Release on Delivery 

Expected at 10:00 a.m. EDT 

Tuesday, June 15, 2004 SOCIAL SECURITY 

NUMBERS 

Use Is Widespread and 

Protections Vary 

Statement of Barbara D. Bovbjerg, Director 

Education, Workforce, and Income Security Issues 

GAO-04-768T 
www.gao.gov/cgi-bin/getrpt?GAO-04-768T.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Barbara 

Bovbjerg at (202) 512-7215 or 

bovbjergb@gao.gov. 

Highlights of GAO-04-768T, a report to 

Subcommittee on Social Security, 

Committee on Ways and Means, House of 

Representatives 

June 15, 2004

SOCIAL SECURITY NUMBERS 

Use Is Widespread and Protections Vary 

Private sector entities rely extensively on SSNs. We reported early this year 

that entities such as information resellers, consumer reporting agencies , and 

health care organizations routinely obtain SSNs from their business clients 

and public sources, such as government records that can be displayed to the 

public. These entities then use SSNs for various purposes, such as to verify 

individual’s identity or match existing records, and have come to rely on the 

SSN as an identifier, which helps then determine a person’s identity for the 

purpose of providing the services they offer. There is no single federal law 

that regulates the overall use or restricts the disclosure of SSNs by private 

sector entities. However, certain federal laws have helped to place 

restrictions on the disclosures of personal information private sector entities 

are allowed to make to their customers, and certain states have enacted laws 

to restrict the private sector’s use of SSNs. 

Public sector entities also extensively use SSNs. All three levels of 

government use the SSN to comply with certain federal laws and regulations, 

as well as for their own purposes. These agencies rely on the SSN to manage 

records, verify benefit eligibility, collect outstanding debt, and conduct 

research and program evaluations. Despite their widespread reliance on and 

use of SSNs, government agencies are taking steps to safeguard the SSN. For 

example, some agencies are not using the SSN as the primary identification 

number. However, given the open nature of certain government records, 

SSNs appear in records displayed to the public such as documents that 

record financial transactions or court documents. Current GAO work under 

way for this subcommittee is focusing on the storage, display, and protection 

of SSNs in public records. Our preliminary survey data show that the types 

of records most likely to contain SSNs and be made available to the general 

public by state government entities are court records, death records, 

Uniform Commercial Code filings, and professional licensing records. In 

addition, our preliminary data suggest that responding state offices reported 

over 35 instances where they had no specific use for collecting SSNs. In a 

previous report, we proposed that Congress consider developing a unified 

approach to safeguarding SSNs used in all levels of government and 

particularly those displayed in public records, and we continue to believe 

that this approach has merit. 

In 1936, the Social Security 

Administration (SSA) established the 

Social Security number (SSN) to 

track workers’ earnings for social 

security benefit purposes. Today, 

private and public sector entities 

frequently ask individuals for SSNs in 

order to conduct their businesses and 

sometimes to comply with federal 

laws. Although uses of SSNs can be 

beneficial to the public, SSNs are also 

a key piece of information in creating 

false identities either for financial 

misuse or for assuming an 

individual’s identity. The retention of 

SSNs in the public and private sectors

can create opportunities for identity 

theft. In addition, the aggregation of 

personal information, such as SSNs, 

in large corporate databases, as well 

as the public display of SSNs in 

various records accessed by the 

public, may provide criminals the 

opportunity to easily obtain this 

personal information. Given the 

heightened awareness of identity 

crimes, this testimony focuses on 

describing (1) how private sector 

entities obtain, use, and protect SSNs,

and (2) public sector uses and 

protections of SSNs. 
Page 1 GAO-04-768T 

Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here today to discuss private and public sector entities’ 

use of Social Security numbers (SSNs). Although the Social Security 

Administration (SSA) originally created SSNs as a means to track workers’ 

earnings and eligibility for Social Security benefits, over time the SSN has 

come to be used for a myriad of purposes; individuals are frequently asked 

to supply personal information, including their SSNs, to both public and 

private sector entities. In addition, individuals’ SSNs can be found in a 

number of public sources such as records displayed to the public. Given 

the uniqueness and broad applicability of the SSN, many private and 

public sector entities rely extensively on the SSN sometimes as a way to 

accumulate and identify information for their databases, sometimes to 

comply with federal regulations, and other times for various business 

purposes. The potential for misuse of the SSN has raised questions about 

how private and public sector entities obtain, use, and protect SSNs. 

Although Congress has passed a number of laws to protect the security of 

personal information, the continued use of and reliance on SSNs by both 

private and public sector entities underscores the importance of 

determining if appropriate safeguards are in place to protect individuals’ 

private information or if enhanced protection of individuals’ personal 

information is needed. Accordingly, you asked us to talk about how 

certain types of private and public sector entities obtain SSNs and what 

protections, if any, exist to govern their use. My remarks today will focus 

on describing (1) how private sector entities obtain, use, and protect SSNs 

and (2) public sector uses and protections. 

To determine how private sector entities obtain, use, and protect SSNs, we 

relied on our previous work that looked at how private sector entities 

obtain and use SSNs and the laws that limit disclosure of this use. 1 To 

determine how the public sector uses and protects SSNs, we also relied on 

our previous work that looked at the government’s use and protection of 

SSNs.2

 We are currently conducting a survey of state and local agencies to 

 1

U.S. General Accounting Office, Social Security Numbers: Private Sector Entities 

Routinely Obtain and Use SSNs, and Laws Limit the Disclosure of This Information,

GAO-04-11 (Washington D.C.: January 22, 2004). 

2

See U.S. General Accounting Office, Social Security Numbers: Government Benefits from 

SSN Use but Could Provide Better Safeguards, GAO-02-352 (Washington, D.C.: May 31, 

2002). 
Page 2 GAO-04-768T 

determine the extent to which SSNs are displayed in public records, the 

types of records they are displayed in, and how those records are 

maintained. In addition, we are conducting structured interviews of 

federal agencies concerning the display of SSNs. 

In summary, entities such as information resellers, consumer reporting 

agencies (CRAs), and health care organizations routinely obtain SSNs 

from their business clients and from public sources, such as marriage 

licenses, paternity determinations, and professional licenses. Businesses 

use SSNs for various purposes, such as to build databases, verify 

individuals’ identities, or match existing records.3

 Given the various types 

of services these companies offer, we found that all of these entities have 

come to rely on the SSN as an identifier, which they say helps them 

determine a person’s identity for the purpose of providing the services 

they offer. However, certain federal laws have helped to limit the 

disclosures of personal information these private sector entities are 

allowed to make to their customers. Private sector entities are either 

subject to the laws directly, given the nature of their business, or 

indirectly, through their business clients who are subject to these laws. 

Some states have also enacted laws to restrict the private sector’s use of 

SSNs. However, such restrictions vary by state. 

Public sector entities also rely extensively on SSNs. These agencies often 

obtain SSNs for compliance with federal laws and regulations and for their 

own agencies’ purposes. We found that federal, state, and county 

government agencies rely extensively on the SSN to manage records, 

verify benefit eligibility, collect outstanding debt, conduct research and 

program evaluations, and verify information provided to state drivers’ 

licensing agencies.4

 Given that SSNs are often the identifier of choice 

among individuals seeking to create false identities, these agencies are 

taking steps to safeguard SSNs. Yet despite these actions, SSNs appear in 

records displayed to the public such as documents that record financial 

transactions or court documents. In our current work for this 

Subcommittee, we are looking at the storage, display, and protection of 

SSNs in public records. Our preliminary survey data show that the types of 

records mostly likely to contain SSNs and be made available to the general 

public by state government entities are court records, death records, 

Uniform Commercial Code (UCC) filings, and professional licensing 

 3

GAO-04-11 (Washington D.C.: January 2004). 

4

GAO-02-352 (Washington D.C.: May 2002). 
Page 3 GAO-04-768T 

records. In addition, our preliminary results show responding state offices 

reported over 35 instances where they had no specific use for collecting 

SSNs. In a previous report, we proposed that Congress consider 

developing a unified approach to safeguarding SSNs used in all levels of 

government and particularly those displayed in public records, and we 

continue to believe that this approach has merit.5

The Social Security Act of 1935 authorized SSA to establish a recordkeeping system to help manage the Social Security program, and this 

resulted in the creation of the SSN. Through a process known as 

enumeration, unique numbers are created for every person as a work and 

retirement benefit record for the Social Security program. SSA generally 

issues SSNs to most U.S. citizens, and SSNs are also available to 

noncitizens lawfully admitted to the United States with permission to 

work. SSA estimates that approximately 277 million individuals currently 

have SSNs. The SSN has become the identifier of choice for government 

agencies and private businesses, and thus it is used for a myriad of nonSocial Security purposes. 

The growth in the use of SSNs is important to individual SSN holders 

because these numbers, along with names and birth certificates, are 

among the three personal identifiers most often sought by identity thieves.6

In addition, SSNs are used as breeder information to create additional 

false identification documents, such as drivers’ licenses. Recent statistics 

collected by federal agencies and CRAs indicate that the incidence of 

identity theft appears to be growing. 7 The Federal Trade Commission 

(FTC), the agency responsible for tracking identity theft, reported that 

consumer fraud and identity theft complaints grew from 404,000 in 2002 to 

516,740 in 2003. In 2003, consumers also reported losses from fraud of 

more than $437 million, up from $343 million in 2002. In addition, identity 

crime account for over 80 percent of SSN misuse allegations according to 

the SSA. Also, officials from two of the three national CRAs report an 

increase in the number of 7-year fraud alerts placed on consumer credit 

 5

GAO-02-352 (Washington D.C.: May 2002). 

6

United States Sentencing Commission, Identity Theft Final Alert (Washington, D.C.: Dec. 

15, 1999). 

7

U.S. General Accounting Office, Identity Theft: Prevalence and Cost Appear to be 

Growing, GAO-02-363 (Washington, D.C.: Mar. 1, 2002). 

Background 
Page 4 GAO-04-768T 

files, which they consider to be reliable indicators of the incidence of 

identity theft.8

 Law enforcement entities report that identity theft is almost 

always a component of other crimes, such as bank fraud or credit card 

fraud, and may be prosecuted under the statutes covering those crimes. 

Private sector entities such as information resellers, CRAs, and health care 

organizations routinely obtain and use SSNs.9

 Such entities obtain the 

SSNs from various public sources and their business clients wishing to use 

their services. We found that these entities usually use SSNs for various 

purposes, such as to build tools that verify an individual’s identity or 

match existing records. Certain federal laws have limited the disclosures 

private sector entities are allowed to make to their customers, and some 

states have also enacted laws to restrict the private sector’s use of SSNs. 

Private sector entities such as information resellers, CRAs, and health care 

organizations generally obtain SSNs from various public and private 

sources and use SSNs to help identify individuals. Of the various public 

sources available, large information resellers told us they obtain SSNs 

from various records displayed to the public such as records of 

bankruptcies, tax liens, civil judgments, criminal histories, deaths, real 

estate ownership, driving histories, voter registrations, and professional 

licenses. Large information resellers said that they try to obtain SSNs from 

public sources where possible, and to the extent public record information 

is provided on the Internet, they are likely to obtain it from such sources. 

Some of these officials also told us that they have people that go to 

courthouses or other repositories to obtain hard copies of public records. 

 8

A fraud alert is a warning that someone may be using the consumer’s personal information 

to fraudulently obtain credit. When a fraud alert is placed on a consumer’s credit card file, 

it advises credit grantors to conduct additional identity verification before granting credit. 

The three consumer reporting agencies offers fraud alerts that can vary from 2 to 7 years at 

the discretion of the individual. 

9

Information resellers, sometimes referred to as information brokers, are businesses that 

specialize in amassing consumer information that includes SSNs for informational services. 

CRAs, also known as credit bureaus, are agencies that collect and sell information about 

the creditworthiness of individuals. Health care organizations generally deliver their 

services through a coordinated system that includes health care providers and health plans, 

also referred to as health care insurers. 

Private Sector 

Entities Routinely 

Obtain and Use SSNs, 

and Certain Laws 

Affect The Disclosure 

of This Information 

Private Sector Entities 

Obtain SSNs from Public 

and Private Sources and 

Use SSNs for Various 

Purposes 
Page 5 GAO-04-768T 

Additionally, they obtain batch files of electronic copies of all public 

records from some jurisdictions. 

Given the varied nature of SSN data found in public records, some reseller 

officials said they are more likely to rely on receiving SSNs from their 

business clients than they are from obtaining SSNs from public records. 

These entities obtain SSNs from their business clients, who provide SSNs 

in order to obtain a reseller’s services or products, such as background 

checks, employee screening, determining criminal histories, or searching 

for individuals. Large information resellers also obtain SSN information 

from private sources. In many cases such information was obtained 

through review of data where a customer has voluntarily supplied 

information resellers with information about himself or herself. In 

addition, large reseller officials said they also use their clients’ records in 

instances where the client has provided them with information. 

We also found that Internet-based resellers rely extensively on public 

sources and records displayed to the public. These resellers listed on their 

Web sites public information sources, such as newspapers, and various 

kinds of public record sources at the county, state, and national levels. 

During our investigation, we determined that once Internet-based resellers 

obtained an individual’s SSN they relied on information in public records 

to help verify the individual’s identity and amass information around the 

individual’s SSN. 

Like information resellers, CRAs also obtain SSNs from public and private 

sources as well as from their customers or the businesses that furnish data 

to them. CRA officials said that they obtain SSNs from public sources, 

such as bankruptcy records, a fact that is especially important in terms of 

determining that the correct individual has declared bankruptcy. CRA 

officials also told us that they obtain SSNs from other information 

resellers, especially those that specialize in obtaining information from 

public records. However, SSNs are more likely to be obtained from 

businesses that subscribe to their services, such as banks, insurance 

companies, mortgage companies, debt collection agencies, child support 

enforcement agencies, credit grantors, and employment screening 

companies. Individuals provide these businesses with their SSNs for 

reasons such as applying for credit, and these businesses voluntarily 

report consumers’ charge and payment transactions, accompanied by 

SSNs, to CRAs. 

We found that health care organizations were less likely to rely on public 

sources for SSN data. Health care organizations obtain SSNs from 
Page 6 GAO-04-768T 

individuals themselves and from companies that offer health care plans. 

For example, subscribers or policyholders provide health care plans with 

their SSNs through their company or employer group when they enroll in 

health care plans. In addition to health care plans, health care 

organizations include health care providers, such as hospitals. Such 

entities often collect SSNs as part of the process of obtaining information 

on insured people. However, health care officials said that, particularly 

with hospitals, the medical record number rather than the SSN is the 

primary identifier. 

Information resellers, CRAs, and health care organization officials all said 

that they use SSNs to verify an individual’s identity. Most of the officials 

we spoke to said that the SSN is the single most important identifier 

available, mainly because it is truly unique to an individual, unlike an 

individual’s name and address, which can often change over an 

individual’s lifetime. Large information resellers said that they generally 

use the SSN as an identity verification tool. Some of these entities have 

incorporated SSNs into their information technology, while others have 

incorporated SSNs into their clients’ databases used for identity 

verification. For example, one large information reseller that specializes in 

information technology solutions has developed a customer verification 

data model that aids financial institutions in their compliance with some 

federal laws regarding “knowing your customer.” We also found that 

Internet-based information resellers use the SSN as a factor in determining 

an individual’s identity. We found these types of resellers to be more 

dependent on SSNs than the large information resellers, primarily because 

their focus is more related to providing investigative or background-type 

services to anyone willing to pay a fee. Most of the large information 

resellers officials we spoke to said that although they obtain the SSN from 

their business clients, the information they provide back to their 

customers rarely contains the SSN. Almost all of the officials we spoke to 

said that they provide their clients with a truncated SSN, an example of 

which would be xxx-xx-6789. 

CRAs use SSNs as the primary identifier of individuals, which enables 

them to match the information they receive from their business clients 
Page 7 GAO-04-768T 

with the information stored in their databases on individuals.10 Because 

these companies have various commercial, financial, and government 

agencies furnishing data to them, the SSN is the primary factor that 

ensures that incoming data is matched correctly with an individual’s 

information on file. For example, CRA officials said they use several 

factors to match incoming data with existing data, such as name, address, 

and financial account information. If all of the incoming data, except the 

SSN, match with existing data, then the SSN will determine the correct 

person’s credit file. Given that people move, get married, and open new 

financial accounts, these officials said that it is hard to distinguish among 

individuals. Because the SSN is the one piece of information that remains 

constant, they said that it is the primary identifier that they use to match 

data. 

Health care organizations also use the SSN to help verify the identity of 

individuals. These organizations use SSNs, along with other information, 

such as name, address, and date of birth, as a factor in determining a 

member’s identity. Health care officials said that health care plans, in 

particular, use the SSN as the primary identifier of an individual, and it 

often becomes the customer’s insurance number. Health care officials said 

that they use SSNs for identification purposes, such as linking an 

individual’s name to an SSN to determine if premium payments have been 

made. They also use the SSN as an online services identifier, as an 

alternative policy identifier, and for phone-in identity verification. Health 

care organizations also use SSNs to tie family members together where 

family coverage is used,11 to coordinate member benefits, and as a crosscheck for pharmacy transactions. Health care industry association officials 

also said that SSNs are used for claims processing, especially with regard 

to Medicare. According to these officials, under some Medicare programs, 

SSNs are how Medicare identifies benefits provided to an individual. 

 10We found that CRAs and information resellers can sometimes be the same entity, a fact 

that blurs the distinction between the two types of businesses but does not affect the use of 

SSNs by these entities. Five of the six large information resellers we spoke to said they 

were also CRAs. Some CRA officials said that information reselling constituted as much as 

40 percent of CRAs’ business. 

11During the enrollment process, subscribers have a number of options, one of which is 

decided whether they would like single or family coverage. In cases where family coverage 

is chosen, the SSN is the key piece of information generally allowing the family members to 

be linked. 
Page 8 GAO-04-768T 

Certain federal and state laws have placed restrictions on certain private 

sector entities use and disclosure of consumers’ personal information that 

includes SSNs. Such laws include the Fair Credit Reporting Act (FCRA), 

the Gramm-Leach-Bliley Act (GLBA), the Drivers Privacy Protection Act 

(DPPA), and the Health Insurance Portability and Accountability Act 

(HIPAA). As shown in table 1, the laws either restrict the disclosures that 

entities such as information resellers, CRAs, and health care organizations 

are allowed to make to specific purposes or restrict whom they are 

allowed to give the information to. Moreover, as shown in table 1, these 

laws focus on limiting or restricting access to certain personal information 

and are not specifically focused on information resellers. See appendix I 

for more information on these laws. 

Table 1: Aspects of Federal Laws That Affect Private Sector Disclosure of Personal 

Information 

Federal Laws Restrictions 

Fair Credit Reporting Act Limits access to credit data that includes SSNs to 

those who have a permissible purpose under the 

law. 

Gramm-Leach-Bliley Act Creates a new definition of personal information 

that includes SSNs and limits when financial 

institutions may disclose the information to nonaffiliated third parties. 

Drivers Privacy Protection Act Prohibits obtaining and disclosing SSNs and other 

personal information from a motor vehicle record 

except as expressly permitted under the law. 

Health Insurance Portability and 

Accountability Act 

Protects the privacy of health information that 

identifies an individual (including by SSNs) and 

restricts health care organizations from disclosing 

such information to others without the patient’s 

consent. 

Source: GAO analysis. 

We reviewed selected legislative documents of 18 states and found that at 

least 6 states have enacted their own legislation to restrict either the 

display or use of SSNs by the private sector.12 Notably, in 2001, California 

 12On the basis of our interviews with private sector businesses and organizations, contacts 

with some state offices of attorney general, and identified state laws and legislative 

initiatives related to the use of SSNs, we did a legislative review of 18 states that were 

identified as having laws or proposed laws governing SSN use. In the 18 states we 

researched, we reviewed more than 40 legislative documents, including relevant laws, 

proposed laws, legislative summaries, and other related documents, such as state 

regulations, executive orders, and referendums. 

Certain Laws Limit the 

Private Sectors’ Disclosure 

of Personal Information 

That Includes SSNs 
Page 9 GAO-04-768T 

enacted Senate Bill (SB) 168, restricting private sector use of SSNs. 

Specifically, this law generally prohibits companies and persons from 

certain uses such as, posting or publicly displaying SSNs and printing 

SSNs on cards required to access the company’s products or services. 

Furthermore, in 2002, shortly after the enactment of SB 168, California’s 

Office of Privacy Protection published recommended practices for 

protecting the confidentiality of SSNs. These practices were to serve as 

guidelines to assist private and public sector organizations in handling 

SSNs. 

Similar to California’s law, Missouri’s law (2003 Mo. SB 61), which is not 

effective until July 1, 2006, bars companies from requiring individuals to 

transmit SSNs over the Internet without certain safety measures, such as 

encryption and passwords. However, while SB 61 prohibits a person or 

private entity from publicly posting or displaying an individual’s SSN “in 

any manner,” unlike California’s law, it does not specifically prohibit 

printing the SSN on cards required to gain access to products or services. 

In addition, Arizona’s law (2003 Ariz. Sess. Laws 137), effective January 1, 

2005, restricts the use of SSNs in ways very similar to California’s law. 

However, in addition to the private sector restrictions, it adds certain 

restrictions for state agencies and political subdivisions.13 For example, 

state agencies and political subdivisions are prohibited from printing an 

individual’s SSN on cards and certain mailings to the individual. Last, 

Texas prohibits the display of SSNs on all cards, while Georgia and Utah’s 

laws are directed at health insurers and, therefore, pertain primarily to 

insurance identification cards.14 None of these three laws contain the 

provisions mentioned above relating to Internet safety measures and 

mailing restrictions. Table 2 lists states that have enacted legislation and 

related provisions. 

 13Political subdivisions would include counties, cities, and towns. 

14Georgia’s law (O.C.G.A. §33-24-57.1(f)) and Utah’s law (Utah Code Ann. §31-22-634) are 

both effective July 1, 2004. However, Utah’s law provides certain extensions until March 1, 

2005. Texas’ law (2003 Tex. Gen. Laws 341) is effective March 1, 2005. 
Page 10 GAO-04-768T 

Table 2: Provisions Included in Enacted Legislation Reviewed 

Provision 

States Where Provision or Restriction 

Enacted 

Specifically prohibits display on cards AZ, CA, GA, TX, UT 

Requires Internet safety measures AZ, CA, MO 

Restricts mailing of SSNs AZ, CA 

Source: GAO analysis. 

Agencies at all levels of government frequently obtain and use SSNs. A 

number of federal laws require government agencies to obtain SSNs, and 

these agencies use SSNs to administer their programs, verify applicants’ 

eligibility for services and benefits, and do research and evaluation. Given 

the potential for misuse, some government agencies are taking steps to 

limit their use and display of SSNs and prevent the proliferation of false 

identities. However, given the open nature of certain government records, 

SSNs appear in some records displayed to the public. Our ongoing work is 

looking at the storage, display, and protection of SSNs in records 

displayed to the public. 

Government agencies obtain SSNs because a number of federal laws and 

regulations require certain programs and federally funded activities to use 

the SSN for administrative purposes.15 Such laws and regulations require 

the use of the SSN as an individual’s identifier to facilitate automated 

exchanges that help administrators enforce compliance with federal laws, 

determine eligibility for benefits, or both. For example, the Internal 

Revenue Code and regulations, which govern the administration of the 

federal personal income tax program, require that individuals’ SSNs serve 

as taxpayer identification numbers.16 A number of other federal laws 

require program administrators to use SSNs in determining applicants’ 

 15U.S. General Accounting Office, Social Security Numbers: Government and Commercial 

Use of the Social Security Number is Widespread, GAO/HEHS-99-28 (Washington D.C.: 

February 1999). 

16This means that employers and others making payments to individuals must include the 

individuals’ SSNs in reporting to IRS many of these payments. In addition, the Code and 

regulations require individuals filing personal income tax returns to include their SSNs as 

their taxpayer identification number, the SSNs of people whom they claim as dependents, 

and the SSNs of spouses to whom they paid alimony. 

Public Sector Entities 

Also Use SSNs and 

Some Agencies Limit 

Their Use and Display 

Even Though SSNs 

are Displayed in Some 

Public Records 

Public Sector Entities Are 

Required by Laws and 

Regulations to Obtain 

SSNs and Use SSNs for 

Various Purposes 
Page 11 GAO-04-768T 

eligibility for federally funded benefits. The Social Security Act requires 

individuals to provide their SSNs in order to receive benefits under the 

SSI, Food Stamp, Temporary Assistance for Needy Families, and Medicaid 

programs.17 In addition, the Commercial Motor Vehicle Safety Act of 1986 

requires the use of SSNs to identify individuals and established the 

Commercial Driver’s License Information System, a nationwide database 

where states may use individuals’ SSNs to search the database for other 

state-issued licenses commercial drivers may hold.18 Federal law also 

requires the use of SSNs in state child support programs to help states 

locate noncustodial parents, establish and enforce support orders, and 

recoup state welfare payments from parents.19 The law also allows states 

to record SSNs on many other state documents, such as professional, 

occupational, and marriage licenses; divorce decrees; paternity 

determinations; and death certificates, and to make SSNs associated with 

these documents available for state child support agencies to use in 

locating and obtaining child support payments from noncustodial parents. 

Government agencies use SSNs for a variety of reasons. We found that 

most of these agencies use SSNs to administer their programs, such as to 

identify, retrieve, and update their records. In addition, many agencies also 

use SSNs to share information with other entities to bolster the integrity of 

the programs they administer. As unique identifiers, SSNs help ensure that 

the agency is obtaining or matching information on the correct person. 

Government agencies also share information containing SSNs for the 

purpose of verifying an applicant’s eligibility for services or benefits, such 

as matching records with state and local correctional facilities to identify 

individuals for whom the agency should terminate benefit payments. SSNs 

are also used to ensure program integrity. Agencies use SSNs to collect 

delinquent debts and even share information for this purpose. In addition, 

 17Applicants give program administrators information on their income and resources, and 

program administrators use applicants’ SSNs to match records with those of other 

organizations. 

18States may also use SSNs to search another database, the National Driver’s Registry, to 

determine whether an applicant’s license has been cancelled, suspended, or revoked by 

another state. In these situations, the states use SSNs to limit the possibility of 

inappropriately licensing applicants. 

19The law requires states to maintain records that include (1) SSNs for individuals who owe 

or are owed support for cases in which the state has ordered child support payments to be 

made, the state is providing support, or both, and (2) employers’ records of new hires 

identified by SSN. 
Page 12 GAO-04-768T 

SSNs are used for statistics, research, and evaluation. Agencies 

responsible for collecting and maintaining data for statistical programs 

that are required by statute, make use of SSNs. In some cases, these data 

are compiled using information provided for another purpose. For 

example, the Bureau of the Census prepares annual population estimates 

for states and counties using individual income tax return data linked over 

time by SSN to determine immigration rates between localities.20 SSNs also 

provide government agencies and others with an effective mechanism for 

linking data on program participation with data from other sources to help 

evaluate the outcomes or effectiveness of government programs. In some 

cases, records containing SSNs are sometimes matched across multiple 

agency or program databases.21

Finally, government agencies use employees’ SSNs to fulfill some of their 

responsibilities as employers. For example, personnel departments of 

these agencies use SSNs to help them maintain internal records and 

provide employee benefits. In addition, employers are required by law to 

use employees’ SSNs when reporting wages. Wages are reported to SSA, 

and the agency uses this information to update earnings records it 

maintains for each individual. The Internal Revenue Service (IRS) also 

uses SSNs to match the employer wage reports with amounts individuals 

report on personal income tax returns. Federal law also requires that 

states maintain employers’ reports of newly hired employees, identified by 

SSNs. States must forward this information to a national database that is 

used by state child support agencies to locate parents who are delinquent 

in child support payments. 

Despite the widespread use of SSNs at all levels of government, not all 

agencies use SSNs. We found that some agencies do not obtain, receive, or 

use SSNs of program participants, service recipients, or individual embers 

of the public.22 Moreover, not all agencies use the SSN as their primary 

identification number for record-keeping purposes. These agencies 

 20The Bureau of the Census is authorized by statute to collect a variety of information, and 

the Bureau is also prohibited from making it available, except in certain circumstances. 

21The statistical and research communities refer to the process of matching records 

containing SSNs for statistical or research purposes as “record linkage.” See U.S. General 

Accounting Office, Record Linkage and Privacy: Issues in Creating New Federal 

Research and Statistical Information, GAO-01-126SP (Washington, D.C.: Apr. 2001). 

22GAO-02-352 (Washington D.C.: May 2002). 

Government Agencies Are 

Taking Steps to Limit the 

Use and Display of SSNs 
Page 13 GAO-04-768T 

maintain an alternative number that is used in addition to or in lieu of 

SSNs for certain activities. 

Some agencies are also taking steps to limit SSNs displayed on documents 

that may be viewed by others who may not have a need to view this 

personal information. For example, the Social Security Administration has 

truncated individuals’ SSNs that appear on the approximately 120 million 

benefits statements it mails each year. Some states have also passed laws 

prohibiting the use of SSNs as a student identification number. Almost all 

states have modified their policies on placing SSNs on state drivers’ 

licenses. 

At the federal level, SSA has taken steps in its enumeration process and 

verification service to help prevent SSNs from being used to proliferate 

false identities. SSA has formed a task force to address weaknesses in its 

enumeration process and has (1) increased document verifications and 

developed new initiatives to prevent the inappropriate assignment of SSNs 

to noncitizens, and (2) undertaken initiatives to shift the burden of 

processing noncitizen applications from its field offices. 23 SSA also helps 

prevent the proliferation of false identities through its verification service, 

which allows state driver licensing agencies to verify the SSN, name, and 

date of birth of customers with SSA’s master file of Social Security 

records. 24 Finally, SSA has also acted to correct deficiencies in its 

information systems’ internal controls. These changes were made in 

response to the findings of an independent audit that found that SSA’s 

systems were exposed to both internal and external intrusion, increasing 

the possibility that sensitive information such as SSNs could be subject to 

unauthorized access, modification, and disclosure, as well as the risk of 

fraud. 

Given the open nature of certain government records, SSNs appear in 

these records for a number of reasons. For example, SSNs may already be 

a part of a document that is submitted to a recorder for official 

 23See U.S. General Accounting Office, Social Security Administration: Actions Taken to 

Strengthen Procedures for Issuing Social Security Numbers to Noncitizens but Some 

Weakness Remain, GAO-04-12 (Washington D.C.: October 15, 2003). See U.S. General 

Accounting Office, Social Security Numbers: Improved SSN Verification and Exchange of 

States’ Driver Records Would Enhance Identity Verification, GAO-03-920 (Washington 

D.C.: September 15, 2003). 

24GAO-03-920 (Washington D.C.: September 2003). 

Public Records Can Also 

Be a Source of SSNs 
Page 14 GAO-04-768T 

preservation, such as veterans’ discharge papers. Documents that record 

financial transactions, such as tax liens and property settlements, also 

contain SSNs to help identify the correct individual. As previously stated, 

government officials are required by law to collect SSNs in numerous 

instances. Moreover, some state laws allow government entities to collect 

SSNs on voter registries to help avoid duplicate registrations. 

Courts at all three levels of government also collect and maintain records 

that are routinely made available to the public. Court records overall are 

presumed to be public. However, each court may have its own rules or 

practices governing the release of information. SSNs appear in court 

documents for a variety of reasons. In many cases, SSNs are already a part 

of documents that are submitted by attorneys or individuals. These 

documents could be submitted as part of the evidence for a proceeding or 

could be included as part of a petition for an action, such as a judgment or 

a divorce. In other cases, courts include SSNs on documents they and 

other government officials create, such as criminal summonses, arrest 

warrants, and judgments, to increase the likelihood that the correct 

individual is affected (i.e., to avoid arresting the wrong John Smith). Again, 

in some cases, federal law requires that SSNs be placed in certain records 

that courts maintain, such as child support orders. 

In our prior report, we looked at the extent and nature of federal, state, 

and county governments’ use of SSNs when they are contained in public 

records, and the options available to better safeguard SSNs that are found 

in these public records.25 Our findings led us to suggest that Congress 

consider addressing SSN security and display issues in state and local 

government and in public records, including those maintained by the 

judicial branch of government at all levels. We proposed that Congress 

convene a representative group of officials from all levels of government 

to develop a unified approach to safeguard SSNs used in all levels of 

government and particularly those displayed in public records. 

At the request of this subcommittee, GAO was asked what types of public 

records SSNs are stored in, how are those records maintained, and to what 

extent SSNs are displayed inside those records. To do this work, we are 

surveying over 2,500 officials in state and local government agencies, 

including officials in all 50 states and the District of Columbia, and are 

conducting structured interviews of federal agencies. Our preliminary 

 25GAO-02-352 (Washington D.C.: May 2002) 
Page 15 GAO-04-768T 

survey data show that the types of records most likely to contain SSNs and 

be made available to the general public by state government entities are 

court records, death records, UCC filings, and professional licensing 

records. At the local level, court records and land records are those most 

often cited as containing SSNs and being available to the general public. 

Preliminary data analysis indicates that identity verification is the most 

frequently given reason by both state and local respondents for collecting 

or using SSNs that are in records available to the public. Data matching 

and complying with state laws or regulations are also frequently cited as 

reasons for the collection or use of the SSN. However, responding state 

offices reported over 35 instances where they had no specific use for 

collecting SSNs. 

Public and private entities use SSNs for many legitimate and publicly 

beneficial purposes. However, the more frequently SSNs are obtained and 

used, the more likely they are to be misused. As we continue to learn more 

about the entities that obtain SSNs and the purposes for which they obtain 

them, Congress and state legislatures will be able to determine if there are 

ways to limit access to this valuable piece of information and prevent it 

from being misused. However, restrictions on access or use may make it 

more difficult for businesses and government agencies to verify an 

individual’s identity. Accordingly, policy makers will have to balance 

restrictions on the use of SSNs on the one hand with legitimate needs for 

the use of SSNs on the other. 

Although individuals may choose to provide their SSNs to public and 

private sector entities to obtain their services, individuals are often 

required to have their SSNs in records that may ultimately be displayed to 

the public. Such public display of personal information can create 

opportunities for identity crimes. Safeguarding SSNs in records displayed 

to the public offers an additional challenge because of the inherent tension 

between the nature of public records, that is, the need for transparency in 

government activities, and the need to protect individuals’ privacy. For 

this reason, in prior work, we recommended that Congress convene a 

representative group of officials to develop a unified approach to 

safeguard SSNs used in all levels of government and particularly those 

displayed in public records. We continue to believe that this would be a 

useful step toward preventing SSN misuse while acknowledging the needs 

of various levels of government. 

At this subcommittee's request, we are continuing work on SSNs and their 

presence in public records and look forward to supporting continuing 

Conclusions 
Page 16 GAO-04-768T 

congressional consideration of these important policy issues. That 

concludes my testimony, and I would be pleased to respond to any 

questions the subcommittee has. 

For further information regarding this testimony, please contact Barbara 

D. Bovbjerg, Director; Tamara Cross, Assistant Director; or Alicia Cackley, 

Assistant Director of Education, Workforce, and Income Security Issues at 

(202) 512-7215. Individuals making key contributions to this testimony 

include Melinda Bowman, Raun Lazier, Joel Marus, and Caroline Sallee. 

Contacts and 

Acknowledgments 
Page 17 GAO-04-768T 

GLBA requires companies to give consumers privacy notices that explain 

the institutions’ information-sharing practices. In turn, consumers have the 

right to limit some, but not all, sharing of their nonpublic personal 

information. Financial institutions are permitted to disclose consumers’ 

nonpublic personal information without offering them an opt-out right in 

the following circumstances: 

• to effect a transaction requested by the consumer in connection with a 

financial product or service requested by the consumer; maintaining or 

servicing the consumer’s account with the financial institution or another 

entity as part of a private label credit card program or other extension of 

credit; or a proposed or actual securitization, secondary market sale, or 

similar transaction; 

• with the consent or at the direction of the consumer; 

• to protect the confidentiality or security of the consumer’s records; to 

prevent actual or potential fraud, for required institutional risk control or 

for resolving customer disputes or inquiries, to persons holding a legal or 

beneficial interest relating to the consumer, or to the consumer’s fiduciary; 

• to provide information to insurance rate advisory organizations, guaranty 

funds or agencies, rating agencies, industry standards agencies, and the 

institution’s attorneys, accountants, and auditors; 

• to the extent specifically permitted or required under other provisions of 

law and in accordance with the Right to Financial Privacy Act of 1978, to 

law enforcement agencies, self-regulatory organizations, or for an 

investigation on a matter related to public safety; 

• to a consumer reporting agency in accordance with the Fair Credit 

Reporting Act or from a consumer report reported by a consumer 

reporting agency; 

• in connection with a proposed or actual sale, merger, transfer, or 

exchange of all or a portion of a business if the disclosure concerns solely 

consumers of such business; 

• to comply with federal, state, or local laws; an investigation or subpoena; 

or to respond to judicial process or government regulatory authorities. 

Financial institutions are required by GLBA to disclose to consumers at 

the initiation of a customer relationship, and annually thereafter, their 

Appendix I: Federal Laws Affecting 

Information Resellers, CRAs, and Health Care 

Organizations: 

Gramm-Leach-Bliley 

Act (GLBA): 
Page 18 GAO-04-768T 

privacy policies, including their policies with respect to sharing 

information with affiliates and non-affiliated third parties. 

Provisions under GLBA place limitations on financial institutions 

disclosure of customer data, thus affecting some CRAs and information 

resellers. We found that some CRAs consider themselves to be financial 

institutions under GLBA.1

 These entities are therefore directly governed by 

GLBA’s restrictions on disclosing nonpublic personal information to nonaffiliated third parties. We also found that some of the information 

resellers we spoke to did not consider their companies to be financial 

institutions under GLBA. However, because they have financial 

institutions as their business clients, they complied with GLBA’s 

provisions in order to better serve their clients and ensure that their 

clients are in accordance with GLBA. For example, if information resellers 

received information from financial institutions, they could resell the 

information only to the extent that they were consistent with the privacy 

policy of the originating financial institution. 

Information resellers and CRAs also said that they protect the use of nonpublic personal information and do not provide such information to 

individuals or unauthorized third parties. In addition to imposing 

obligations with respect to the disclosures of personal information, GLBA 

also requires federal agencies responsible for financial institutions to 

adopt appropriate standards for financial institutions relating to 

safeguarding customer records and information. Information resellers and 

CRA officials said that they adhere to GLBA’s standards in order to secure 

financial institutions’ information. 

The DPPA specifies a list of exceptions when personal information 

contained in a state motor vehicle record may be obtained and used (18 

U.S.C. § 2721(b)). These permissible uses include: 

• for use by any government agency in carrying out its functions; 

• for use in connection with matters of motor vehicle or driver safety and 

theft; motor vehicle emissions; motor vehicle product alterations, recalls, 

 1

Under GLBA, the term financial institution is defined as “any institution the business of 

which is engaging in financial activities as described in section 4(k) of the Bank Holding 

Company Act of 1956,” which goes into more detail about what are “activities that are 

financial in nature.” These generally include banking, insurance, and investment industries. 

Drivers Privacy 

Protection Act 

(DPPA): 
Page 19 GAO-04-768T 

or advisories; motor vehicle market research activities, including survey 

research; 

• for use in the normal course of business by a legitimate business, but only 

to verify the accuracy of personal information submitted by the individual 

to the business and, if such information is not correct, to obtain the 

correct information but only for purposes of preventing fraud by pursuing 

legal remedies against, or recovering on a debt or security interest against, 

the individual; 

• for use in connection with any civil, criminal, administrative, or arbitral 

proceeding in any federal, state, or local court or agency; 

• for use in research activities; 

• for use by any insurer or insurance support organization in connection 

with claims investigation activities; 

• for use in providing notice to the owners of towed or impounded vehicles; 

• for use by a private investigative agency for any purpose permitted under 

the DPPA; 

• for use by an employer or its agent or insurer to obtain information 

relating to the holder of a commercial driver’s license; 

• for use in connection with the operation of private toll transportation 

facilities; 

• for any other use, if the state has obtained the express consent of the 

person to whom a request for personal information pertains; 

• for bulk distribution of surveys, marketing, or solicitations, if the state has 

obtained the express consent of the person to whom such personal 

information pertains; 

• for use by any requester, if the requester demonstrates that it has obtained 

the written consent of the individual to whom the information pertains; 

• for any other use specifically authorized under a state law, if such use is 

related to the operation of a motor vehicle or public safety. 

As a result of DPPA, information resellers said they were restricted in their 

ability to obtain SSNs and other driver license information from state 
Page 20 GAO-04-768T 

motor vehicle offices unless they were doing so for a permissible purpose 

under the law. These officials also said that information obtained from a 

consumer’s motor vehicle record has to be in compliance with DPPA’s 

permissible purposes, thereby restricting their ability to resell motor 

vehicle information to individuals or entities not allowed to receive such 

information under the law. Furthermore, because DPPA restricts state 

motor vehicle offices’ ability to disclose driver license information, which 

includes SSN data, information resellers said they no longer try to obtain 

SSNs from state motor vehicle offices, except for permissible purposes. 

The HIPAA privacy rule also defines some rights and obligations for both 

covered entities and individual patients and health plan members. Some of 

the highlights are: 

• Individuals must give specific authorization before health care providers 

can use or disclose protected information in most nonroutine 

circumstances, such as releasing information to an employer or for use in 

marketing activities. 

• Covered entities will need to provide individuals with written notice of 

their privacy practices and patients’ privacy rights. The notice will contain 

information that could be useful to individuals choosing a health plan, 

doctor, or other service provided. Patients will be generally asked to sign 

or otherwise acknowledge receipt of the privacy notice. 

Covered entities must obtain an individual’s specific authorization before 

sending them marketing materials. 

Health care organizations, including health care providers and health plan 

insurers, are subject to HIPAA’s requirements. In addition to providing 

individuals with privacy practices and notices, health care organizations 

are also restricted from disclosing a patient’s health information without 

the patient’s consent, except for purposes of treatment, payment, or other 

health care operations. Information resellers and CRAs did not consider 

themselves to be “covered entities” under HIPAA, although some 

information resellers said that their customers are considered to be 

business associates under HIPAA. As a result, they said they are obligated 

to operate under HIPAA’s standards for privacy protection, and therefore 

could not resell medical information without having made sure HIPAA’s 

privacy standards were met. 

Health Insurance 

Portability and 

Accountability Act 

(HIPAA): 
Page 21 GAO-04-768T 

Congress has limited the use of consumer reports to protect consumers’ 

privacy. All users must have a permissible purpose under the FCRA to 

obtain a consumer report (15 USC 1681b). These permissible purposes are: 

• as ordered by a court or a federal grand jury subpoena; 

• as instructed by the consumer in writing; 

• for the extension of credit as a result of an application from a consumer or 

the review or collection of a consumer’s account; 

• for employment purposes, including hiring and promotion decisions, 

where the consumer has given written permission; 

• for the underwriting of insurance as a result of an application from a 

consumer; 

• when there is a legitimate business need, in connection with a business 

transaction that is initiated by the consumer; 

• to review a consumer’s account to determine whether the consumer 

continues to meet the terms of the account; 

• to determine a consumer’s eligibility for a license or other benefit granted 

by a governmental instrumentality required by law to consider an 

applicant’s financial responsibility or status; 

• for use by a potential investor or servicer or current insurer in a valuation 

or assessment of the credit or prepayment risks associated with an 

existing credit obligation; and 

• for use by state and local officials in connection with the determination of 

child support payments, or modifications and enforcement thereof. 

Under FCRA, Congress has limited the use of consumer reports2

 to protect 

consumers’ privacy and limits access to credit data to those who have a 

legally permissible purpose for using the data, such as the extension of 

credit, employment purposes, or underwriting insurance. However, these 

 2

The FTC has determined that certain types of information, including SSNs, do not 

constitute as consumer report under FCRA because they are not factors in determining 

credit eligibility. 

Fair Credit Reporting 

Act (FCRA): 
Page 22 GAO-04-768T 

limits are not specific to SSNs. All of the CRAs that we spoke to said that 

they are considered consumer reporting agencies under FCRA. In addition, 

some of the information resellers we spoke to who handle or maintain 

consumer reports are classified as CRAs under FCRA. Both CRAs and 

information resellers said that as a result of FCRAs restrictions they are 

limited to providing credit data to their customers that have a permissible 

purpose under FCRA. Consequently, they are restricted by law from 

providing such information to the general public. 

(130381) 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
The General Accounting Office, the audit, evaluation and investigative arm of 

Congress, exists to support Congress in meeting its constitutional responsibilities 

and to help improve the performance and accountability of the federal 

government for the American people. GAO examines the use of public funds; 

evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and fulltext files of current reports and testimony and an expanding archive of older 

products. The Web site features a search engine to help you locate documents 

using key words and phrases. You can print these documents in their entirety, 

including charts and other graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 

correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site 

daily. The list contains links to the full-text document files. To have GAO e-mail 

this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail 

alerts” under the “Order GAO Products” heading. 

The first copy of each printed report is free. Additional copies are $2 each. A 

check or money order should be made out to the Superintendent of Documents. 

GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a 

single address are discounted 25 percent. Orders should be sent to: 

U.S. General Accounting Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800 

U.S. General Accounting Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

GAO’s Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Mail or Phone 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Public Affairs