59–006 

110TH CONGRESS REPT. 110–191 " ! HOUSE OF REPRESENTATIVES 1st Session Part 1 

SOCIAL SECURITY NUMBER PROTECTION ACT OF 2007 

JUNE 13, 2007.—Ordered to be printed 

Mr. DINGELL, from the Committee on Energy and Commerce, 

submitted the following 

R E P O R T 

[To accompany H.R. 948] 

[Including cost estimate of the Congressional Budget Office] 

The Committee on Energy and Commerce, to whom was referred 

the bill (H.R. 948) to strengthen the authority of the Federal Government to protect individuals from certain acts and practices in 

the sale and purchase of Social Security numbers and Social Security account numbers, and for other purposes, having considered 

the same, report favorably thereon with an amendment and recommend that the bill as amended do pass. 

CONTENTS 

Page 

Amendment .............................................................................................................. 2 

Purpose and Summary ............................................................................................ 5 

Background and Need for Legislation .................................................................... 5 

Hearings ................................................................................................................... 7 

Committee Consideration ........................................................................................ 8 

Committee Votes ...................................................................................................... 8 

Committee Oversight Findings ............................................................................... 8 

Statement of General Performance Goals and Objectives .................................... 8 

New Budget Authority, Entitlement Authority, and Tax Expenditures ............. 8 

Earmarks and Tax and Tariff Benefits .................................................................. 8 

Committee Cost Estimate ....................................................................................... 8 

Congressional Budget Office Estimate ................................................................... 8 

Federal Mandates Statement ................................................................................. 11 

Advisory Committee Statement .............................................................................. 11 

Constitutional Authority Statement ...................................................................... 11 

Applicability to Legislative Branch ........................................................................ 11 

Section-by-Section Analysis of the Legislation ...................................................... 11 

Changes in Existing Law Made by the Bill, as Reported ..................................... 14 


hmoore on PRODPC68 with HMRPT
2 

AMENDMENT

The amendment is as follows: 

Strike all after the enacting clause and insert the following: 

SECTION 1. SHORT TITLE. 

This Act may be cited as the ‘‘Social Security Number Protection Act of 2007’’. 

SEC. 2. DEFINITIONS. 

In this Act: 

(1) COMMISSION.—The term ‘‘Commission’’ means the Federal Trade Commission. 

(2) PERSON.—The term ‘‘person’’ means any individual, partnership, corporation, trust, estate, cooperative, association, or any other entity. 

(3) SALE.—The term ‘‘sale’’ means obtaining, directly or indirectly, anything 

of value in exchange for a Social Security number. Such term does not include 

the submission of such numbers as part of the process for applying for any type 

of Government benefit or programs (such as grant or loan applications or welfare or other public assistance programs). Such term also does not include 

transfers of such numbers as part of a data matching program under the Computer Matching and Privacy Protection Act. 

(4) PURCHASE.—The term ‘‘purchase’’ means providing directly or indirectly, 

anything of value in exchange for a Social Security number. Such term does not 

include the submission of such numbers as part of the process for applying for 

any type of Government benefit or programs (such as grant or loan applications 

or welfare or other public assistance programs). Such term also does not include 

transfers of such numbers as part of a data matching program under the Computer Matching and Privacy Protection Act. 

(5) SOCIAL SECURITY NUMBER.—The term ‘‘Social Security number’’ means the 

social security account number assigned to an individual under section 

205(c)(2)(B) of the Social Security Act (42 U.S.C. 405(c)(2)(B)). 

(6) STATE.—The term ‘‘State’’ means any State of the United States, the District of Columbia, Puerto Rico, the Northern Mariana Islands, the United States 

Virgin Islands, Guam, American Samoa, and any territory or possession of the 

United States. 

SEC. 3. PROHIBITION ON CERTAIN USES OF SOCIAL SECURITY NUMBERS. 

(a) PROHIBITION.—Except as provided under regulations issued by the Commission 

under subsection (c), it shall be unlawful for any person to—

(1) intentionally display the Social Security number of another individual on 

a website that is generally accessible to the public or provide an individual with 

access to the Social Security number of another individual through the Internet; 

(2) require an individual who is customer of or member associated with such 

person to use that individual’s Social Security number as a password for access 

to any good or service, including access to any account of that individual or any 

protected access website; or 

(3) display the Social Security number of any individual on any membership 

or identity card issued by such person. 

(b) ENFORCEMENT.—A violation of subsection (a) shall be treated as an unfair and 

deceptive act or practice in violation of a regulation under section 18(a)(1)(B) of the 

Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices. The Commission shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as 

though all applicable terms and provisions of the Federal Trade Commission Act (15 

U.S.C. 41 et seq.) were incorporated into and made a part of this section. Any person who violates subsection (a) shall be subject to the penalties and entitled to the 

privileges and immunities provided in that Act. 

(c) EXCEPTIONS.—Not later than 9 months after the date of enactment of this Act, 

the Commission shall promulgate rules providing for any exceptions to the prohibition in subsection (a) for circumstances which the Commission considers appropriate 

and consistent with the public interest, the protection of consumers, and the purposes of this Act. 

SEC. 4. REGULATION OF THE SALE AND PURCHASE OF SOCIAL SECURITY NUMBERS. 

(a) PROHIBITION.—It shall be unlawful for any person to sell or purchase a Social 

Security number in a manner that violates a regulation promulgated by the Commission under subsection (b) of this section. 

(b) REGULATIONS.—


hmoore on PRODPC68 with HMRPT
3 

(1) RESTRICTIONS AUTHORIZED.—The Commission, after consultation with the 

Commissioner of Social Security, the Attorney General, and other agencies as 

the Commission deems appropriate, shall promulgate regulations restricting the 

sale and purchase of Social Security numbers and any unfair or deceptive acts 

or practices in connection with the sale and purchase of Social Security numbers. 

(2) LIMITATIONS ON RESTRICTIONS.—In promulgating such regulations, the 

Commission shall impose restrictions and conditions on the sale and purchase 

of Social Security numbers that are no broader than necessary— (A) to provide reasonable assurance that Social Security numbers will not 

be used to commit or facilitate fraud, deception, or crime; and 

(B) to prevent an undue risk of bodily, emotional, or financial harm to 

individuals. 

For purposes of subparagraph (B), the Commission shall consider the nature, 

likelihood, and severity of the anticipated harm; the nature, likelihood, and extent of any benefits that could be realized from the sale or purchase of the numbers; and any other relevant factors. 

(3) EXCEPTIONS.—The regulations promulgated pursuant to paragraph (1) 

shall include exceptions which permit the sale and purchase of Social Security 

numbers—(A) to the extent necessary for law enforcement or national security purposes; 

(B) to the extent necessary for public health purposes; 

(C) to the extent necessary in emergency situations to protect the health 

or safety of 1 or more individuals; 

(D) to the extent necessary for research conducted for the purpose of advancing public knowledge, on the condition that the researcher provides 

adequate assurances that—

(i) the Social Security numbers will not be used to harass, target, or 

publicly reveal information concerning any identifiable individuals; 

(ii) information about identifiable individuals obtained from the research will not be used to make decisions that directly affect the rights, 

benefits, or privileges of specific individuals; and 

(iii) the researcher has in place appropriate safeguards to protect the 

privacy and confidentiality of any information about identifiable individuals; 

(E) to the extent consistent with an individual’s voluntary and affirmative 

written consent to the sale or purchase of a Social Security number that 

has been assigned to that individual; 

(F) to the extent necessary for legitimate consumer credit verification, if 

the Social Security numbers used for such verification are redacted in accordance with uniform redaction standards established by the Commission 

in such regulations; and 

(G) under other appropriate circumstances as the Commission may determine and as are consistent with the principles in paragraph (2). 

(c) RULEMAKING.—

(1) DEADLINE FOR ACTION.—Not later than 1 year after the date of enactment 

of this Act, the Commission shall promulgate the regulations under subsection 

(b) of this section, in accordance with section 553 of title 5, United States Code. 

(2) EFFECTIVE DATES.—Subsection (a) and the regulations promulgated under 

subsection (b) shall take effect 30 days after the date on which the final regulations issued under this section are published in the Federal Register. 

(d) ENFORCEMENT.—Any violation of a regulation promulgated under subsection 

(b) of this section shall be treated as a violation of a regulation under section 

18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding 

unfair or deceptive acts or practices. 

(e) ADMINISTRATION AND ENFORCEMENT.—

(1) THE COMMISSION.—The Commission shall prevent any person from violating this section, and any regulation promulgated thereunder, in the same 

manner, by the same means, and with the same jurisdiction, powers, and duties 

as though all applicable terms and provisions of the Federal Trade Commission 

Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. 

Any person who violates such regulation shall be subject to the penalties and 

entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.) as though all applicable terms and provisions 

of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated 

into and made a part of this Act. Nothing contained in this Act shall be construed to limit the authority of the Commission under any other provision of 

law. 


hmoore on PRODPC68 with HMRPT
4 

(2) ACTIONS BY STATES.—

(A) CIVIL ACTIONS.—In any case in which the attorney general of a State 

has reason to believe that an interest of the residents of that State has 

been or is threatened or adversely affected by an act or practice that violates any regulation of the Commission promulgated under subsection (b), 

the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction, to—

(i) enjoin that act or practice; 

(ii) enforce compliance with the regulation; 

(iii) obtain civil penalties in an amount of $11,000 per violation not 

to exceed a total of $5,000,000; or 

(iv) obtain such other legal and equitable relief as the district court 

may consider to be appropriate. 

Before filing an action under this subsection, the attorney general of the 

State involved shall provide to the Commission and to the Attorney General 

a written notice of that action and a copy of the complaint for that action. 

If the State attorney general determines that it is not feasible to provide 

the notice described in this subparagraph before the filing of the action, the 

State attorney general shall provide the written notice and the copy of the 

complaint to the Commission and to the Attorney General as soon after the 

filing of the complaint as practicable. 

(B) COMMISSION AND ATTORNEY GENERAL AUTHORITY.—On receiving notice under subparagraph (A), the Commission and the Attorney General 

each shall have the right—

(i) to move to stay the action, pending the final disposition of a pending Federal matter as described in subparagraph (c); 

(ii) to intervene in an action under clause (I); 

(iii) upon so intervening, to be heard on all matters arising therein; 

and 

(iv) to file petitions for appeal. 

(C) PENDING CRIMINAL PROCEEDINGS.—If the Attorney General has instituted a criminal proceeding or the Commission has instituted a civil action 

for a violation of this Act or any regulations thereunder, no State may, during the pendency of such proceeding or action, bring an action under this 

section against any defendant named in the criminal proceeding or civil action for any violation of this section that is alleged in that proceeding or 

action. 

(D) RULE OF CONSTRUCTION.—For purposes of bringing any civil action 

under subparagraph (A), nothing in this Act shall be construed to prevent 

an attorney general of a State from exercising the powers conferred on the 

attorney general by the laws of that State to conduct investigations, administer oaths and affirmations, or compel the attendance of witnesses or the 

production of documentary and other evidence. 

(E) VENUE; SERVICE OF PROCESS.—Any action brought under this section 

may be brought in any district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United 

States Code. In an action brought under this section, process may be served 

in any district in which the defendant is an inhabitant or may be found. 

SEC. 5. STUDY ON FEASIBILITY OF BANNING SOCIAL SECURITY AS AN AUTHENTICATOR. 

(a) STUDY.—The Commission shall conduct a study to determine—

(1) the extent of the use of Social Security numbers as a primary means of 

authenticating identity; 

(2) the extent of the use of Social Security numbers for verification in commercial transactions; and 

(3) the feasibility of a prohibition on such use. 

The study shall also examine possible alternatives to Social Security numbers for 

verification purposes and uses in authenticating identity. 

(b) REPORT.—The Commission shall transmit to Congress a report of the study, 

including any recommendations, not later than 1 year after the date of the enactment of this Act. 

SEC. 6. EFFECT ON OTHER LAWS. 

This Act supersedes any provision of a statute, regulation, or rule of a State or 

political subdivision of a State that expressly—

(1) prohibits the uses of Social Security numbers described in section 3(a); or 

(2) restricts or prohibits the sale or purchase of Social Security numbers in 

a manner similar to the regulations promulgated under section 4(b). 


hmoore on PRODPC68 with HMRPT
5 

PURPOSE AND SUMMARY

The purpose of H.R. 948, the Social Security Number Protection 

Act of 2007, is to prohibit the public display and the purchase and 

sale of citizens’ Social Security numbers in interstate commerce in 

violation of rules to be promulgated by the Federal Trade Commission (FTC). H.R. 948 makes it unlawful to intentionally display Social Security numbers on a Web site or to provide access thereto 

through the Internet, to display Social Security numbers on membership or identity cards, or to require customers to use Social Security numbers as passwords for access to any goods or services, 

account, or protected access Web site. H.R. 948 also requires the 

FTC to promulgate rules within one year, after consultation with 

the Attorney General and Commissioner of Social Security, restricting the sale and purchase of Social Security numbers. The regulations should be broad enough to prevent Social Security numbers 

from being used to commit fraud, deception, or crime, and prevent 

risk of bodily, emotional, or financial harm to individuals. H.R. 948 

requires, however, certain exemptions from the prohibition for legitimate purposes including emergencies, public health, and law 

enforcement. 

BACKGROUND AND NEED FOR LEGISLATION

Consumer transactions account for more than two-thirds of the 

U.S. gross domestic product at this time, and information sharing 

is of particular importance to the U.S. economy. The exchange of 

information among businesses is linked to broad economic benefits, 

including the widespread availability and low cost of consumer 

credit, based in part upon real time authentication and verification. 

Notwithstanding the benefits of information sharing, however, consumers, businesses, and governmental entities have begun to focus 

on the privacy implications of information practices. The same 

technological advances in information networks that benefit consumers are increasingly misused for purposes that can harm consumers when information is accessible to unauthorized parties. 

Adopting fair information practices became more common among 

businesses in the mid 1990s. The common elements of fair information practices are: notice, choice, access, security, and enforcement. 

There is wide variance in the extent to which businesses adhere to 

these information practices. Even among the entities that have embraced these fair information practices, there is disagreement 

about the right mix of self-regulation, legislation, and technology in 

protecting privacy. 

Historically, Congress has taken a sector-by-sector approach to 

privacy and has mandated discrete protections for certain personal 

information used for commercial purposes, upon a showing that a 

particular use harmed or threatened to harm the American consumer. This industry-by-industry approach differs from the comprehensive approach attempted by other nations, such as the European Union’s Data Protection Directive. Together those sector specific statutes encompass a significant portion of U.S. commercial 

activity, though they are significantly different in the protections 

afforded to consumers. The following is a small sample of Federal 

statutes addressing the issue of information privacy: the Children’s 

Online Privacy Protection Act, the Cable Communications Policy 


hmoore on PRODPC68 with HMRPT
6 

Act, the Telecommunications Act of 1996, the Telephone Consumer 

Protection Act, the Electronic Communications Privacy Act, the 

Health Insurance Portability Protection Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Family Educational 

Rights and Privacy Act, the Video Privacy Protection Act, the Driver’s Privacy Protection Act, and wiretap statutes. 

The need to address privacy concerns has grown exponentially 

with the prevalence of digitized personal information that can be 

stored, transferred, and theoretically accessed by limitless parties 

depending on the data safeguards or protections. Such information 

sharing may require the authentication and validation of individuals’ identities. In many cases, individuals’ Social Security numbers have become the default identifier. 

Originally created by the Federal Government to administer the 

Social Security program, the numbers were intended only to track 

employee contributions to the system and administer benefits but 

were prohibited from any other use. Congress later authorized the 

use of Social Security numbers as taxpayer identification numbers 

for the IRS. Over time, however, the numbers have become default 

identification and verification for many other purposes. The Federal Government requires virtually every individual in the United 

States to obtain and maintain a Social Security number in order 

to pay taxes, to qualify for Social Security benefits, or to seek employment. An unintended consequence of these requirements is 

that Social Security numbers have become tools that can be used 

to facilitate crime, fraud, and invasions of the privacy of the individuals to whom the numbers are assigned. Because the Federal 

Government created and maintains this system, and because the 

Federal Government does not permit persons to exempt themselves 

from those requirements, the Committee finds it is appropriate for 

the Government to take steps to stem the abuse of this system. 

The Committee notes that Congress attempted to limit the use 

of Social Security numbers with the passage of the Privacy Act of 

1974. This law applied only to government agencies, however, and 

did not restrict the private sector. As a result of the lack of restrictions, Social Security numbers have become synonymous with an 

individual’s identity as the number is tied directly to nearly all financial accounts, as well as patient records of health-care providers 

and other business entities. While there are clear benefits associated with the ability to authenticate and verify an individual—including the provision of instantaneous credit, combating fraudulent 

transactions, and accurately identifying or locating individuals 

whose name has changed and is otherwise unable to be located—

the Social Security number has become the singularly most important means of identifying and authenticating an individual, increasing its value in the eyes of identity thieves and fraudsters. 

The Committee finds that the inappropriate sale or purchase of 

Social Security numbers is a significant factor in a growing range 

of illegal activities, including fraud, identity theft, and, in some 

cases, stalking and other violent crimes. It is the identifying information associated with a Social Security number that presents the 

largest potential threats to individuals. Because an individual’s information is linked to the Social Security number, access to the Social Security number opens the individuals’ identity and related information to the possibility of the information being available to 


hmoore on PRODPC68 with HMRPT
7 

unauthorized parties or for unauthorized purposes. The Committee 

found that this can facilitate the commission of criminal activities 

and also can result in serious invasions of individual privacy. 

The Committee seeks to stop the unauthorized access to and use 

of an individual’s Social Security number as a result of a commercial transaction to purchase or sell the numbers. For example, identity theft crimes have risen substantially over the past decade in 

part because Social Security numbers and other information necessary to perpetrate the crime are often easily available for purchase by potential criminals. The Committee’s related investigation 

into the practice of pretexting—fraudulently impersonating someone else to acquire detailed information (usually over the phone) 

about another person—demonstrated that access to an individual’s 

personal information is often only limited to the provision of a Social Security number. Once a Social Security number is obtained, 

access to detailed personal information associated with the Social 

Security number is readily accessible. With this information in 

hand, a criminal can commit identity theft in numerous ways, including opening new accounts in the name of the individual attached to the Social Security number. 

Although account fraud is one of the most common crimes perpetrated by criminals, the Committee is aware of other harm, including violent crimes, that can occur when Social Security numbers are easily available for purchase. The Committee is concerned 

the range of harms and crimes that can be perpetrated will only 

increase if prohibitions are not enacted to restrict the proliferation 

of the commercial availability of individuals’ Social Security numbers. No one should seek to profit from the sale of Social Security 

numbers. Consequently, there is a need for enactment of legislation 

that will offer individuals assigned such numbers necessary protections from the public display or the sale and purchase of Social Security numbers in circumstances that might facilitate unlawful conduct or that might otherwise likely result in unfair or deceptive 

practices. The Committee observes that the Office of Management 

and Budget recently released a memorandum advising Federal departments and agencies to review their use of Social Security numbers and come up with a plan in 120 days to eliminate their unnecessary collection and use within 18 months. Action on the Committee’s bipartisan legislation is critical and timely. 

HEARINGS

No hearings were held on H.R. 948 this year. However, in the 

109th Congress, the Subcommittee on Commerce, Trade, and Consumer Protection held a hearing on Thursday, May 11, 2006 entitled ‘‘Social Security Numbers in Commerce: Reconciling Beneficial 

Uses with Threats to Privacy’’ which examined H.R. 1078, substantially similar legislation considered in the 109th Congress, as well 

as other legislative proposals to increase privacy protections for Social Security numbers. Testimony was received from the following: 

The Honorable Jon Leibowitz, Commissioner, Federal Trade Commission; Mr. Oliver I. Ireland, Partner, Morrison & Foerster, testifying on behalf of the Financial Services Industry Association; Ms. 

Susan McDonald, President, Pension Benefit Information; Ms. 

Lauren Steinfeld, Former Associate Chief Counsel, Office of Management and the Budget, Mr. H. Randy Lively Jr., President and 


hmoore on PRODPC68 with HMRPT
8 

CEO, American Financial Services Association; and Mr. Marc 

Rotenberg, Executive Director, Electronic Privacy Information Center. 

COMMITTEE CONSIDERATION

On Wednesday, May 10, 2007, the Committee on Energy and 

Commerce met in open markup session and ordered H.R. 948 favorably reported to the House, amended, by a voice vote, a quorum 

being present. 

COMMITTEE VOTES

Clause 3(b) of rule XIII of the Rules of the House of Representatives requires the Committee to list the record votes on the motion 

to report legislation and amendments thereto. There were no 

record votes taken in connection with ordering H.R. 948 reported. 

A motion by Mr. Dingell to order H.R. 948 reported to the House, 

amended, was agreed to by a voice vote. 

COMMITTEE OVERSIGHT FINDINGS

Pursuant to clause 3(c)(1) of rule XIII of the Rules of the House 

of Representatives, the oversight findings of the Committee are reflected in the preceding portions of this report. 

STATEMENT OF GENERAL PERFORMANCE GOALS AND OBJECTIVES

The purpose of the legislation is to reduce harm to individuals 

that results from the public display or the purchase or sale of their 

Social Security number. 

NEW BUDGET AUTHORITY, ENTITLEMENT AUTHORITY, AND TAX

EXPENDITURES

Regarding compliance with clause 3(c)(2) of rule XIII of the Rules 

of the House of Representatives, the Committee finds that H.R. 

948, the Social Security Number Protection Act of 2007, would result in no new or increased budget authority, entitlement authority, or tax expenditures or revenues. 

EARMARKS AND TAX AND TARIFF BENEFITS

Regarding compliance with clause 9 of rule XXI of the Rules of 

the House of Representatives, H.R. 948 does not contain any Congressional earmarks, limited tax benefits, or limited tariff benefits 

as defined in clause 9(d), 9(e), or 9(f) of rule XXI. 

COMMITTEE COST ESTIMATE

The Committee adopts as its own the cost estimate prepared by 

the Director of the Congressional Budget Office pursuant to section 

402 of the Congressional Budget Act of 1974. 

CONGRESSIONAL BUDGET OFFICE ESTIMATE

Pursuant to clause 3(c)(3) of rule XIII of the Rules of the House 

of Representatives, the following is the cost estimate provided by 

the Congressional Budget Office pursuant to section 402 of the 

Congressional Budget Act of 1974: 


hmoore on PRODPC68 with HMRPT
9 

MAY 25, 2007. 

Hon. JOHN D. DINGELL, 

Chairman, Committee on Energy and Commerce, 

House of Representatives, Washington, DC. 

DEAR MR. CHAIRMAN: The Congressional Budget Office has prepared the enclosed cost estimate for H.R. 948, the Social Security 

Number Protection Act of 2007. 

If you wish further details on this estimate, we will be pleased 

to provide them. The CBO staff contact is Susan Willie. 

Sincerely, 

PETER R. ORSZAG. 

Enclosure. 

H.R. 948—Social Security Number Protection Act of 2007 

Summary: H.R. 948 would prohibit the sale or purchase of Social 

Security numbers (SSNs) as well as certain other activities related 

to their display or use. The Federal Trade Commission (FTC) 

would be required to develop regulations to enforce the new prohibitions. CBO estimates that promulgating and enforcing those regulations would not have a significant effect on federal spending. 

Enacting the bill could increase federal revenues from civil penalties assessed for violations of the new regulations, but CBO estimates that any such increase would not be significant in any year. 

Enacting the bill would not affect direct spending. 

H.R. 948 contains intergovernmental mandates as defined in the 

Unfunded Mandates Reform Act (UMRA). The bill would preempt 

state and local laws that restrict the use, sale, or purchase of Social 

Security numbers, but CBO estimates that the costs of those mandates would be small and would not exceed the threshold established in UMRA ($66 million in 2007, adjusted annually for inflation). 

H.R. 948 would impose private-sector mandates as defined in the 

UMRA. It would prohibit any entity in the private sector from selling or purchasing a Social Security number in violation of the regulations that the Federal Trade Commission would issue. The bill 

also would prohibit certain uses of Social Security numbers. The 

cost to the private sector of complying with those mandates is uncertain because it would depend on regulations that have not yet 

been promulgated. Therefore, CBO cannot determine whether the 

aggregate cost of mandates in the bill would exceed the annual 

threshold established by UMRA for private sector mandates ($131 

million in 2007, adjusted annually for inflation). 

Estimated cost to the Federal Government: H.R. 948 would make 

it illegal to display an individual’s SSN on a public Web site or on 

a membership or identity card, to require the use of a SSN as a 

password for access to services, or to sell or purchase SSNs. The 

bill would require the FTC to develop and enforce those new prohibitions. 

Based on information from the FTC, CBO estimates that the cost 

to develop regulations limiting the display and use of SSNs as well 

as their sale and purchase would be less than $500,000 per year. 

Such costs would be subject to the availability of appropriated 

funds. The costs of this legislation would fall within budget function 370 (commerce and housing credit). 


hmoore on PRODPC68 with HMRPT
10 

Enacting H.R. 948 could increase federal revenues from civil penalties assessed for violations of the new regulations. CBO estimates, however, that any additional revenues that would result 

from enacting the bill would not be significant because of the relatively small number of cases likely to be involved. 

Estimated impact on state, local, and tribal governments: H.R. 

948 contains intergovernmental mandates as defined in UMRA. In 

particular, the bill would require state attorneys general to notify 

the FTC of any action taken under the bill, allow the FTC to intervene in those actions, and limit the actions that attorneys general 

may take in certain circumstances. Also, provisions regarding the 

use, sale, or purchase of Social Security numbers would preempt 

state laws. CBO estimates that the aggregate costs, if any, to state, 

local, and tribal governments of complying with the mandates in 

the bill would be small and would not exceed the threshold established in UMRA ($66 million in 2007, adjusted annually for inflation). 

CBO believes that the bill would grant no new authority to the 

FTC to regulate the activities of state and local governments. 

Under current law, the courts have ruled that the FTC does not 

have jurisdiction over those governments or over public universities. Furthermore, the bill’s provisions apply to ‘‘persons,’’ a term 

that does not include sovereigns such as state, local, or tribal governments. We expect, therefore, that the provisions of the bill regarding the use, sale, and purchase of Social Security numbers 

would not apply to such entities. 

Estimated impact on the private sector: H.R. 948 contains private-sector mandates as defined in UMRA. It would prohibit any 

entity from selling or purchasing a Social Security number (SSN) 

in violation of regulations that the FTC would issue to implement 

this legislation. The bill also would prohibit the display of Social 

Security numbers on any Web site that is generally accessible to 

the public or on any membership or identity cards. In addition, the 

bill would prohibit anyone from requiring that a consumer use a 

Social Security number as a password. The FTC would be required 

to ensure that the restrictions and conditions on the sale or purchase of SSNs are no broader than necessary to provide reasonable 

assurance that SSNs will not be used to commit or facilitate fraud, 

deception, or crime, and to prevent an undue risk of bodily, emotional, or financial harm to individuals. 

H.R. 948 is aimed at prohibiting activities that have no legitimate purpose; however, despite the exemptions in the bill, some 

entities engaging in legitimate activities might be forced to change 

their business practices as a result of the legislation. The cost to 

the private sector of complying with the mandates in the bill is uncertain because it would depend on regulations that have not yet 

been promulgated. Consequently, CBO cannot determine whether 

the aggregate cost of mandates in H.R. 948 would exceed the annual threshold established by UMRA for private-sector mandates 

($131 million in 2007, adjusted annually for inflation). 

Estimate prepared by: Federal Costs: Susan Willie; Impact on 

state, local, and tribal governments: Elizabeth Cove; Impact on the 

private sector: Fatimot Ladipo. 

Estimate approved by: Robert A. Sunshine, Assistant Director for 

Budget Analysis. 


hmoore on PRODPC68 with HMRPT
11 

FEDERAL MANDATES STATEMENT

The Committee adopts as its own the estimate of Federal mandates prepared by the Director of the Congressional Budget Office 

pursuant to section 423 of the Unfunded Mandates Reform Act. 

ADVISORY COMMITTEE STATEMENT

No advisory committees within the meaning of section 5(b) of the 

Federal Advisory Committee Act were created by this legislation. 

CONSTITUTIONAL AUTHORITY STATEMENT

Pursuant to clause 3(d)(1) of rule XIII of the Rules of the House 

of Representatives, the Committee finds that the Constitutional authority for this legislation is provided in Article I, section 8, clause 

3, which grants Congress the power to regulate commerce with foreign nations, among the several States, and with the Indian Tribes. 

APPLICABILITY TO LEGISLATIVE BRANCH

The Committee finds that the legislation does not relate to the 

terms and conditions of employment or access to public services or 

accommodations within the meaning of section 102(b)(3) of the Congressional Accountability Act. 

SECTION-BY-SECTION ANALYSIS OF THE LEGISLATION

Section 1. Short title 

Section 1 defines this Act as the ‘‘Social Security Protection Act 

of 2007’’. 

Section 2. Definitions 

Section 2 defines terms to be used in this Act: including, ‘‘Commission,’’ ‘‘person,’’ ‘‘sale,’’ ‘‘purchase,’’ ‘‘Social Security number,’’

and ‘‘State.’’

The terms ‘‘sale’’ and ‘‘purchase’’ are broadly defined to include, 

respectively, obtaining or providing, directly or indirectly, anything 

of value in exchange for a Social Security number. Both of the latter terms, ‘‘sale’’ and ‘‘purchase,’’ are specifically defined to exclude 

two sets of circumstances: (1) the submission of such numbers as 

part of the process for applying for any type of government benefit 

or program (e.g., grant or loan applications or welfare or other public assistance programs); and (2) the transfers of such numbers as 

part of a data matching program under the Computer Matching 

and Privacy Protection Act of 1988. The term ‘‘State’’ is defined 

broadly to include both States of the United States and other political subdivisions of the United States, such as its territories and 

possessions. 

Section 3. Prohibition on certain uses of social security numbers 

Section 3 prohibits the use of Social Security numbers in specific 

circumstances, except as provided under regulations promulgated 

by the FTC. Subsection 3(a)(1) would make it unlawful for any person to intentionally display the Social Security number of another 

individual on a Web site that is generally accessible to the public 

or provide an individual with access to the Social Security number 

of another individual through the Internet. Subsection 3(a)(2) 


hmoore on PRODPC68 with HMRPT
12 

would make it unlawful to require an individual who is a customer 

of or member associated with such person to use that individual’s 

Social Security number as a password for access to any good or 

service, including access to any account of that individual or any 

protected access website. Subsection 3(a)(3) would make it unlawful 

to display the Social Security number of any individual on any 

membership or identity card issued by such person. Subsection 3(b) 

stipulates that a violation of subsection (a) shall be treated as an 

unfair and deceptive act or practice under section 18(a)(1)(B) of the 

Federal Trade Commission Act. Any person who violates subsection 

(a) shall be subject to the penalties and entitled to the privileges 

and immunities provided in the Federal Trade Commission Act. 

Subsection 3(c) directs the FTC to promulgate rules that provide 

for any exceptions to the prohibitions in subsection (a) for circumstances that the FTC considers appropriate and consistent with 

the public interest, the protection of consumers, and the purposes 

of this Act. The Committee understands that access to Social Security numbers is essential to many vital government and commercial 

operations, such as database accuracy and fraud prevention. The 

Committee believes, however, that there is no legitimate reason 

why, for example, Web site operators should be displaying, providing access to, or selling Social Security numbers to the general 

public. The intent of this section is to stop the public display of Social Security numbers. The Committee believes that such activity 

poses a substantial threat to consumers of identity theft and financial account fraud. 

Section 4. Regulation of the sale and purchase of social security 

numbers 

Section 4 provides for the prohibition of the sale or purchase of 

Social Security numbers in violation of regulations promulgated by 

the FTC. The FTC shall promulgate regulations within one year of 

enactment restricting the sale and purchase and defining unfair 

and deceptive acts related to the sale and purchase of Social Security numbers. The FTC regulations shall also include exceptions for 

certain enumerated purposes consistent with the intent of the legislation. 

Subsection 4(a) would establish the general prohibition of the 

sale and purchase of a Social Security number in a manner that 

violates a regulation promulgated by the FTC under subsection (b). 

Subsection 4(b)(1) would direct the FTC, after consultation with the 

Commissioner of Social Security, the Attorney General, and other 

agencies as the FTC deems appropriate, to promulgate regulations 

restricting the sale and purchase of Social Security numbers and 

any unfair and deceptive acts and practices in connection with the 

sale and purchase of those numbers. Subsection 4(b)(2) would require the FTC to impose restrictions and conditions on the sale and 

purchase of Social Security numbers and Social Security account 

numbers that are no broader than necessary (A) to provide reasonable assurance that such numbers will not be used to commit or 

facilitate fraud, deception, or crime; and (B) to prevent an undue 

risk of bodily, emotional, or financial harm to individuals (taking 

into account the nature, likelihood, and severity of the anticipated 

harm and the extent of any benefits that might be realized from 


hmoore on PRODPC68 with HMRPT
13 

the sale or purchase of the numbers and any other relevant factors). 

Subsection 4(b)(3) would require the FTC to establish in those 

regulations exceptions for seven categories of situations in which 

the sale and purchase of Social Security numbers would be permitted: (1) to the extent necessary for law enforcement or national 

security purposes; (2) to the extent necessary for public health purposes; (3) to the extent necessary in emergency situations to protect 

the health and safety of one or more individuals; (4) to the extent 

necessary for research to advance public knowledge (including, but 

not limited to, scientific, epidemiological, and social scientific research) conducted for the purpose of advancing public knowledge, 

on the condition that for such research the researcher provides adequate assurances that (i) the Social Security numbers will not be 

used to harass, target, or publicly reveal information concerning 

any identifiable individual(s); (ii) information about identifiable individuals obtained from the research will not be used to make decisions that directly affect the rights, benefits, or privileges of specific individuals; and (iii) the researcher has in place appropriate 

safeguards to protect the privacy and confidentiality of any information about identifiable individuals; (5) to the extent consistent 

with an individual’s voluntary and affirmative written consent to 

the sale or purchase of a particular Social Security number that 

has been assigned to that individual; (6) to the extent necessary for 

legitimate consumer credit verification, if the Social Security numbers used for such verification are redacted in accordance with uniform redaction standards issued by the FTC in such regulations, 

and (7) under other appropriate circumstances as the FTC may determine and as are consistent with the paragraph (2). Under any 

of these seven exceptions, when Federal departments and agencies 

have Social Security numbers in systems of records, the legal protections of the Privacy Act, 5 U.S.C. § 552a, will apply. 

The Committee intends that the FTC’s regulations will address, 

among other things, growing concerns about the ability of companies to demand that consumers provide them with a full Social Security number as a condition of doing business. The Committee intends that the FTC, in crafting uniform redaction standards pursuant to 4(b)(3)(F), shall protect against the threat that a persons’

full Social Security number could be uncovered. For example, such 

standards shall protect against the threat that a person’s full Social Security number could be identified by combining the redacted 

number with other data which might otherwise reasonably be 

available about the individual and which could facilitate replication 

of the full number, such as the individual’s date of birth or place 

of birth. 

Subsection 4(c)(1) would direct the FTC to promulgate the regulations under subsection 4(b) not later than one year after the date 

of enactment of the bill. Subsection 4(a), and regulations promulgated under subsection 4(b), shall take effect thirty days after the 

date on which the final regulations issued under subsection 4(b) 

are published in the Federal Register. Subsection 4(d) would direct 

that any violation of a regulation promulgated under subsection 

4(b) shall be treated as a violation of a regulation under section 

18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 

§ 57a(a)(1)(B)) regarding unfair or deceptive acts or practices. 


hmoore on PRODPC68 with HMRPT
14 

Subsection 4(e)(1) would set forth the FTC’s authority to prevent 

violations of Section 3 and the regulations promulgated under Section 4, and provide that violators of such rules shall be subject to 

the penalties, and entitled to the privileges and immunities provided in the Federal Trade Commission Act as though all applicable terms and provisions of that Act were incorporated into and 

made a part of this bill. Subsection 4(e)(2) would authorize any 

State attorney general to bring a parens patriae action in a United 

States district court, in any case in which that attorney general has 

reason to believe that an interest of the residents of that State has 

been or is threatened or adversely affected by an act or practice 

that violates any regulation under Section 4(b) of the Act. The relief that the State attorney general may seek would include injunctive relief, enforcement of compliance with the regulation, obtaining damages, restitution, and other compensation on behalf of the 

State’s residents (including civil penalties up to $11,000 per violation, not to exceed a maximum of $5,000,000) and any other legal 

or equitable relief as the district court may consider to be appropriate. This subsection also contains provisions for notice to the 

FTC and the Department of Justice when such actions are brought; 

litigation-related rights that the FTC and the Department each 

would have in such actions; a provision precluding States from filing such parens patriae actions if the Department has instituted a 

prosecution for criminal violations or the FTC has instituted civil 

litigation for civil violations of the Act; a provision clarifying the 

ability of a State attorney general to use investigatory powers 

under the laws of that State; and procedural provisions for venue 

and service of process. 

Section 5. Study of feasibility of banning social security as an authenticator 

Section 5 directs the FTC to conduct a study to determine: (1) the 

extent of the use of Social Security numbers as a primary means 

of authenticating identity; (2) the extent of the use of Social Security numbers for verification in commercial transactions; (3) the 

feasibility of a prohibition on such use; and (4) possible alternatives 

to Social Security numbers for verification purposes and uses in authenticating identity. The FTC shall transmit to Congress a report 

of the study, including recommendations, no later than one year 

after the date of enactment of this Act. 

Section 6. Effect on other laws 

Section 6 preempts any State laws that expressly: (1) prohibits 

the uses of Social Security numbers described in Section 3(a); or (2) 

restricts or prohibits the sale or purchase of Social Security numbers in a manner similar to the regulations promulgated under 

Section 4(b). 

CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

H.R. 948 does not amend any existing Federal statute. 

Æ 


hmoore on PRODPC68 with HMRPT