GAO/HEHS/AIMD-00-253R SSN Use Questions

United States General Accounting Office

Washington, DC 20548

Health, Education, and

Human Services Division

B-285802

July 7, 2000

The Honorable E. Clay Shaw, Jr.

Chairman, Subcommittee on Social Security

Committee on Ways and Means

House of Representatives

Subject: Social Security Numbers: Subcommittee Questions Concerning the Use of

the Number for Purposes Not Related to Social Security

Dear Mr. Chairman:

This letter responds to your request that we provide answers to questions relating to our

May 9, 2000 testimony.1 In that testimony we discussed the usage of the Social Security

number (SSN) for purposes not related to social security and the implication of

restricting such usage. Your questions, along with our responses, follow.

1. The term “national identifier” has a very bad connotation to many people. In your

opinion, has the Social Security number become a national identifier?

The SSN is widely used by governments and businesses to maintain and exchange

information. The Office of the Inspector General of the Social Security Administration

(SSA) has noted that, over time, the SSN has become a “de facto” identifier used by

federal and state governments. Banks, credit bureaus, insurance companies, and health

care providers also use the SSN for identification purposes. This widespread use of the

SSN beyond its original purpose has raised privacy concerns. While privacy concerns

should not be discounted, it is important to note that the use of SSNs to link individuals

to information about them enhances the administration of federal and state programs,

makes credit more accessible to consumers, and allows medical care to be integrated

across providers and insurers.

1

Social Security: Use of the Social Security Number is Widespread (GAO/T-HEHS-00-111, May 9, 2000).
B-285802

2 GAO/HEHS/AIMD-00-253R SSN Use Questions

2. In your testimony, you indicated that there is no federal law that regulates the

overall use of SSNs. In your view, is such a law needed? Is it feasible to enact,

administer, and enforce such a law?

Whether a law regulating the overall use of SSNs is needed depends on a number of

factors. The first of these is the extent to which such a law could effectively curb

identity theft and address privacy concerns. Secondly, these potential benefits would

have to be weighed against how additional restrictions on the use of SSNs might hamper

government and businesses’ ability to conduct routine business. The feasibility of

administering and enforcing such a law would depend on how restrictive it was and its

scope—whether it was intended to change existing practices or limit uses of the SSN

beyond those currently practiced. In addition, it would be necessary to decide what

agency or agencies would be responsible for administration and enforcement and the

resources those agencies would have to carry out those duties.

3. As you pointed out in your testimony, the Social Security number was created as a

means of tracking workers’ earnings and eligibility for Social Security benefits. It

was never intended to serve as a personal identification document. Only certain

information is maintained by SSA as a part of its Social Security number database.

What information is available? What proof is required to obtain a Social Security

number? How have the proof requirements changed over time?

SSA collects only certain information about applicants for SSNs, and the documentation

required as proof of this information has changed over time. Originally, SSA assigned an

SSN to applicants based solely on individuals’ unverified statements regarding age,

identity, and place of birth. However, since 1978, applicants for new SSNs must provide

proof of age, identity, and U.S. citizenship or proof that they are lawfully residing in the

U.S. In addition, applicants must provide other information such as their place of birth,

mother’s maiden name, and father’s name. Those applicants who are not U.S. citizens

must also provide Immigration and Naturalization Service documentation showing

whether they are allowed to work or provide a valid non-work reason for needing an

SSN.

4. Despite public concerns about sharing personal information in today’s electronic

world, does the public benefit from the widespread use of SSNs and the sharing of

personal information? Can you provide some examples?

When consumers want to be uniquely identified, particularly in the health care and

consumer credit service industries, the use of SSNs to share personal information

accomplishes this purpose with one uniform number. Using SSNs to link individuals to

their medical records allows doctors, hospitals, and HMO’s to coordinate a person’s

health care among health providers and with insurers. Similarly, because up-to-date

consumer payment histories linked to SSNs are available through national credit

bureaus, the use of SSNs helps individuals instantly demonstrate their credit worthiness

anywhere in the country when requesting credit.
B-285802

3 GAO/HEHS/AIMD-00-253R SSN Use Questions

5. If someone refused to disclose his or her SSN to a private business, can the

business, by law, decline to provide the service? For example, if someone refuses

to provide his or her SSN on a loan application, can the bank deny the loan?

No federal law imposes broad restrictions on businesses’ use of SSNs; consequently,

businesses that request SSNs as a condition for receiving services may deny such

services to individuals who refuse. However, practices vary by industry. Health care

providers generally request patients’ SSNs, but we were told that they do not require

them as a condition for treatment. In contrast, most credit card companies request

clients’ SSNs as a condition for extending credit and may refuse service to those who do

not comply. States vary in whether they require an SSN as part of the application for

non-commercial driver licenses. Some require it for inclusion in a database, some do

not, and in some states it is optional.

6. What are the possible effects on businesses of restricting their use of SSNs?

Federal restrictions on using SSNs could hamper businesses’ ability to conduct routine

internal activities and their ability to exchange data. Correctly matching a specific

individual to a corresponding record of information is an important concern for health

care providers, information brokers, and credit agencies. Limits on the use of SSNs

could make it harder for health care service providers to track patients’ medical

histories, make it less easy for employers to do background checks, and lessen the

certainty with which credit information could be matched to specific individuals.

7. You mentioned in your testimony that many businesses and agencies are

voluntarily restricting the use of SSNs to help protect their customers’ privacy and

reduce SSN misuse. Can you please elaborate on some of these self-regulatory

policies?

In 1997, 13 of the self-identified leaders in the information brokerage industry agreed to

limit their disclosure of the SSNs they obtain from nonpublic sources to those customers

who have legitimate uses for this information, such as law enforcement officials. In

addition, they agreed to annual compliance reviews by an independent contractor. The

Federal Trade Commission can cite them for unfair and deceptive business practices if

they do not do as they have agreed. While recent reports indicate that the companies

have generally complied with the agreement to limit their sale of SSNs that they obtain

from nonpublic sources, it should be noted that the SSNs contained in the records they

acquire are more likely to come from public sources, according to an information broker.

Some states have taken steps to protect individuals’ privacy by changing whether they

display SSNs on driver licenses. For example, according to driver license officials in

Georgia and Massachusetts, these states no longer automatically use SSNs as driver

license numbers. They give drivers the option of using a state generated license number,

instead of their SSN. Similarly, driver license officials in Ohio told us that the state

previously printed SSNs along with state-assigned numbers on driver licenses, but now

allows drivers the option of not having SSNs printed on their licenses. According to an
B-285802

4 GAO/HEHS/AIMD-00-253R SSN Use Questions

American Association of Motor Vehicle Administrators official, only Hawaii still requires

that SSNs be used as a driver’s license number, but the state plans to discontinue this

requirement next year.

8. One area not discussed in your written testimony is e-commerce. How has the

high-tech economy affected SSN use? In general, can people conduct business on

the Internet without providing their SSNs? How would restricting the use of SSNs

affect e-commerce?

Our work to date has not included assessing the uses of SSNs within the high-tech

economy or the effects of their restricted usage on e-commerce. However, in visits to

two of the existing e-commerce sites, we found that certain consumer purchases can

currently be made via the Internet without requiring the use of an SSN. Instead, these

sites typically required new and repeat customers to register for on-line services by

providing an identifier such as the user’s name, and by selecting a password.

Additionally, they require a credit card number to cover purchases of goods or services.

Certain other e-commerce sites that we observed, however, such as those that sell

securities or insurance policies, did require SSNs for tax or identification purposes.

9. You indicated that “information brokers” collect SSNs for the sole purpose of

selling them. What exactly is an information broker? How are consumers served

by this industry? What is the downside of limiting their activities? Why do

information brokers need people’s SSNs?

Information brokers buy personal information, amass it in databases, and then resell it to

clients. Brokers buy some of this information from private sources. However, some of

the information they buy is already available to the public. Brokers offer customers

convenient one-stop shopping for information that might otherwise by widely dispersed.

For example, an employer can obtain information about a person’s driving history and

criminal history from an information broker, rather than attempt to locate and access

public records containing the same information. Information brokers serve a variety of

clients—a lawyer may request information needed for a civil proceeding; a pension plan

administrator may request information to locate pension beneficiaries; or an individual

may ask for information to help locate a birth parent. Information brokers may use SSNs

to search databases. Limiting information brokers’ use of SSNs might make it more

difficult for them to conduct searches that produce records unique to a given individual.

10. According to your testimony, the Social Security Act declares that SSNs obtained

by authorized individuals after October 1, 1990 are confidential and cannot be

disclosed. If the Social Security Act prohibits the disclosure of SSNs why is their

use so widespread and why are businesses allowed to ask for the SSN?

The Social Security Act provision to which you refer, section 205(c), protects against

unauthorized disclosure of SSNs, but does not restrict the many legally authorized uses
B-285802

5 GAO/HEHS/AIMD-00-253R SSN Use Questions

of the SSN. Businesses are allowed to ask for and use SSNs because section 205(c)

generally only applies to governmental use of SSNs.

Section 205(c) generally does not apply to business transactions. It prohibits disclosure

by "authorized persons," and it defines that term in part to mean those who gain access

to SSNs "pursuant to any provision of law....” Someone who comes into possession of an

SSN as part of a business relationship—for example, the bank that requires it as part of a

credit card application—has not gained access to it pursuant to a provision of law, and is

therefore not subject to the section 205(c) restriction on disclosure.

11. If the use of the SSN were restricted by federal law, is it likely that another

personal identifier would take its place?

Although privacy concerns should not be discounted, exchanges of computerized data

are important to the functioning of governments and businesses, and these exchanges

can benefit the public. Given the large amount of such data available, in general,

accuracy in linking the correct individual with information about him or her is desirable

in the administration of some programs and in cases where people want to be uniquely

identified. The SSN provides a convenient and effective method for doing this. If the

SSN were not available for this purpose, in all likelihood, some other mechanism for

doing the same would eventually take its place.

-----

We are sending copies of this letter to other interested parties. If you have any questions

on matters discussed in this letter, please contact Kay Brown or me on 512-7215. Key

contributors to this assignment were Jacquelyn Stewart, Patrick di Battista, Valerie

Melvin and Roger Thomas.

Sincerely,

Barbara Bovbjerg,

Associate Director, Education,

Workforce, and Income Security Issues

(207101)