II 

111TH CONGRESS 

1ST SESSION S. 1618 

To require the Commissioner of Social Security to issue uniform standards 

for the method for truncation of Social Security account numbers in 

order to protect such numbers from being used in the perpetration 

of fraud or identity theft and to provide for a prohibition on the display 

to the general public on the Internet of Social Security account numbers 

by State and local governments, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

AUGUST 6, 2009 

Mr. SCHUMER introduced the following bill; which was read twice and referred 

to the Committee on the Judiciary 

A BILL 

To require the Commissioner of Social Security to issue 

uniform standards for the method for truncation of Social Security account numbers in order to protect such 

numbers from being used in the perpetration of fraud 

or identity theft and to provide for a prohibition on 

the display to the general public on the Internet of 

Social Security account numbers by State and local governments, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


srobinson on DSKHWCL6B1PROD with BILLS
2 

•S 1618 IS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Safeguarding Social 

3 Security Numbers Act of 2009’’. 

4 SEC. 2. FINDINGS. 

5 Congress makes the following findings: 

6 (1) The Federal Government requires virtually 

7 every individual in the United States to obtain and 

8 maintain a Social Security account number in order 

9 to pay taxes or to qualify for old-age, survivors, and 

10 disability insurance benefits under title II of the So11 cial Security Act. 

12 (2) Many Government agencies and private en13 tities also use Social Security account numbers as 

14 identifiers to track individual records or as informa15 tion that an individual must present to verify his or 

16 her identity. Thus, Social Security account numbers 

17 are routinely collected, recorded, and transferred by 

18 public and private entities. 

19 (3) As an unintended consequence of these 

20 uses, Social Security account numbers have become 

21 1 of the tools that can be used to facilitate crime, 

22 fraud, and invasions of the privacy of the individuals 

23 to whom the numbers are assigned. 

24 (4) According to the Social Security Adminis25 tration’s Inspector General, 16 percent of the 

26 99,000 fraud cases it investigated in the 1-year peVerDate Nov 24 2008 22:54 Aug 07, 2009 Jkt 079200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1618.IS S1618

srobinson on DSKHWCL6B1PROD with BILLS
3 

•S 1618 IS

1 riod ending September 30, 2006, involved the misuse 

2 of Social Security account numbers. 

3 (5) The Social Security account number is also 

4 a key piece of information used in the perpetration 

5 of identity theft. In calendar year 2006, over 

6 240,000 individuals reported to the Federal Trade 

7 Commission that they had been the victims of an 

8 identity theft. Identity theft is a serious crime that 

9 can cause substantial financial losses and force vic10 tims to spend significant time restoring the accuracy 

11 of their credit records. 

12 (6) Social Security account numbers are pub13 licly displayed by some Government entities. In most 

14 jurisdictions throughout the United States, State 

15 and local law requires that certain documentary 

16 records, such as business filings, property records, 

17 and birth and marriage certificates, be made avail18 able to the general public. Some of these records 

19 contain personally identifiable information of individ20 uals, including Social Security account numbers. In21 creasingly, State and local record keepers are dis22 playing public records on the Internet, where these 

23 records are widely accessible at no cost or for a 

24 minimal fee. There are known instances of criminals 


srobinson on DSKHWCL6B1PROD with BILLS
4 

•S 1618 IS

1 using personally identifiable information from online 

2 public records to commit identity theft. 

3 (7) Private information resellers also routinely 

4 record and transfer individuals’ Social Security ac5 count numbers and other personally identifiable in6 formation. In a 2006 study, the Government Ac7 countability Office (GAO) was able to purchase 

8 truncated or full Social Security account numbers 

9 from 5 of 21 Internet information resellers that were 

10 surveyed. 

11 (8) The GAO has concluded, based on available 

12 evidence, that unauthorized access to personal data 

13 such as Social Security account numbers is a fre14 quent occurrence. A survey of 17 Federal agencies 

15 by the Committee on Oversight and Government Re16 form of the House of Representatives found that 

17 these agencies suffered more than 788 data breaches 

18 from January 2003 through July 2006. 

19 (9) In many instances, public and private enti20 ties seek to protect Social Security account numbers 

21 from abuse by truncating a portion of each number. 

22 However, because truncation methods are not uni23 form, it is possible to obtain a full Social Security 

24 account number by reconstructing the number based 


srobinson on DSKHWCL6B1PROD with BILLS
5 

•S 1618 IS

1 on partial information obtained from different 

2 sources. 

3 (10) In a report issued in June 2007, the GAO 

4 found that truncated Social Security account num5 bers in Federal documents stored as public records 

6 remain vulnerable to misuse, in part because dif7 ferent truncation methods used by the public and 

8 private sectors permit the reconstruction of full So9 cial Security account numbers. Federal entities such 

10 as the Department of Justice, the Internal Revenue 

11 Service, and the Judicial Conference of the United 

12 States truncate by displaying the last 4 digits of the 

13 Social Security account number. In contrast, the 

14 GAO found that information resellers sometimes sell 

15 records containing Social Security account numbers 

16 that are truncated to display the first 5 digits. 

17 (11) The first 5 digits of an individual’s Social 

18 Security account number are assigned based on the 

19 location in which the account number was issued 

20 and the order in which the account number was 

21 issued. The last 4 digits of an individual’s Social Se22 curity account number are randomly generated, cre23 ating a unique account number for each individual. 

24 Many public and private entities ask consumers to 

25 supply the last 4 digits of Social Security account 


srobinson on DSKHWCL6B1PROD with BILLS
6 

•S 1618 IS

1 numbers as a way to verify consumers’ identities, 

2 providing an additional reason for identity thieves to 

3 seek to acquire these digits. 

4 (12) The GAO reported in 2006 that it had 

5 been unable to identify any industry standards or 

6 guidelines for truncating Social Security account 

7 numbers. Moreover, the GAO could not identify any 

8 consensus among Government officials about which 

9 method for truncation better protects Social Security 

10 account numbers from abuse. 

11 (13) The GAO has stated that standardizing 

12 the truncation of Social Security account numbers 

13 would better protect these numbers from misuse. 

14 Since 2005, the GAO has on multiple occasions rec15 ommended the establishment of uniform standards 

16 for truncation of Social Security account numbers. 

17 (14) Given the Social Security Administration’s 

18 role in assigning Social Security account numbers, 

19 the Commissioner of Social Security may be in the 

20 best position to determine whether and how trunca21 tion should be standardized. 

22 (15) The truncation of Social Security account 

23 numbers, even by Federal Government agencies, is 

24 not comprehensively required or regulated. Cur25 rently, the Social Security Administration does not 


srobinson on DSKHWCL6B1PROD with BILLS
7 

•S 1618 IS

1 have the legal authority to regulate the use of Social 

2 Security account numbers by other entities. 

3 (16) Because the Federal Government created 

4 and maintains the system of required Social Security 

5 account numbers, and because the Federal Govern6 ment does not permit individuals to exempt them7 selves from those requirements, it is appropriate for 

8 the Federal Government to take steps to curb the 

9 abuse of Social Security account numbers. 

10 SEC. 3. DEFINITION. 

11 In this Act, the term ‘‘Social Security account num12 ber’’ means the account number assigned to an individual 

13 by the Commissioner of Social Security in the exercise of 

14 the Commissioner’s authority under section 205(c)(2) of 

15 the Social Security Act (42 U.S.C. 405(c)(2)) and includes 

16 any derivative of such number. 

17 SEC. 4. REQUIREMENT TO ISSUE UNIFORM STANDARDS 

18 FOR THE METHOD FOR TRUNCATION OF SO19 CIAL SECURITY ACCOUNT NUMBERS. 

20 (a) ESTABLISHMENT OF UNIFORM STANDARDS.— 

21 (1) IN GENERAL.—The Commissioner of Social 

22 Security shall issue uniform standards for the meth23 od for truncation of Social Security account numbers 

24 in order to facilitate the protection of such numbers 

25 from being used in the perpetration of fraud or idenVerDate Nov 24 2008 22:54 Aug 07, 2009 Jkt 079200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1618.IS S1618

srobinson on DSKHWCL6B1PROD with BILLS
8 

•S 1618 IS

1 tity theft. Such uniform standards shall not apply 

2 with respect to a Social Security account number of 

3 a deceased individual. 

4 (2) APPLICATION.— 

5 (A) FEDERAL GOVERNMENT.—On and 

6 after the date that the Commissioner of Social 

7 Security determines in regulations established 

8 pursuant to subsection (b), the uniform stand9 ards issued under paragraph (1) shall apply to 

10 the Federal Government— 

11 (i) whenever the Federal Government 

12 displays a Social Security account number; 

13 and 

14 (ii) to the extent practicable, whenever 

15 the Federal Government transfers, records, 

16 or otherwise utilizes a Social Security ac17 count number. 

18 (B) STATE AND LOCAL GOVERNMENTS

19 AND PRIVATE ENTITIES.—If a State, local gov20 ernment, or private entity truncates Social Se21 curity account numbers, the State, local govern22 ment, or private entity shall comply with the 

23 uniform standards issued under paragraph (1) 

24 to the same extent that the Federal GovernVerDate Nov 24 2008 22:54 Aug 07, 2009 Jkt 079200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1618.IS S1618

srobinson on DSKHWCL6B1PROD with BILLS
9 

•S 1618 IS

1 ment is required to comply with such standards 

2 under subparagraph (A). 

3 (3) REQUIREMENTS.— 

4 (A) IN GENERAL.—In establishing the uni5 form standards required under paragraph (1), 

6 the Commissioner of Social Security shall con7 sider the matters described in subparagraph 

8 (B) and consult with, at a minimum, the heads 

9 of the following Federal agencies: 

10 (i) The Department of Justice. 

11 (ii) The Federal Trade Commission. 

12 (iii) The Department of the Treasury. 

13 (B) SPECIFIC CONSIDERATIONS.—For pur14 poses of subparagraph (A), the matters de15 scribed in this subparagraph are the following: 

16 (i) The extent to which various meth17 ods for truncation of Social Security ac18 count numbers will assist in the prevention 

19 of fraud and identity theft, taking into ac20 count the following: 

21 (I) The risk that a truncated So22 cial Security account number can be 

23 combined with other personally identi24 fiable information to derive or acquire 


srobinson on DSKHWCL6B1PROD with BILLS
10 

•S 1618 IS

1 a complete Social Security account 

2 number. 

3 (II) The risk that the numerical 

4 digits not masked in the truncation 

5 process will reveal personally identifi6 able information about an individual. 

7 (III) The risk that a truncated 

8 Social Security account number can 

9 be used to derive or acquire from 

10 other sources a full Social Security ac11 count number. 

12 (ii) The methods in use for the trun13 cation of Social Security account numbers 

14 by the Federal Government, State and 

15 local governments, and private entities and 

16 the extent of use of each method by the 

17 Federal Government, State and local gov18 ernments, and private entities. 

19 (iii) The reasons why Social Security 

20 account numbers are collected and re21 corded by the Federal Government, State 

22 and local governments, and private enti23 ties. 

24 (iv) The effect of each proposed meth25 od for truncation on the uses for Social SeVerDate Nov 24 2008 22:54 Aug 07, 2009 Jkt 079200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S1618.IS S1618

srobinson on DSKHWCL6B1PROD with BILLS
11 

•S 1618 IS

1 curity account numbers by the Federal 

2 Government, State and local governments, 

3 and private entities. 

4 (v) Any comments regarding proposed 

5 methods for truncation submitted to the 

6 Commissioner from— 

7 (I) experts on privacy and data 

8 security, consumer advocacy groups, 

9 and identity theft assistance organiza10 tions; 

11 (II) the Federal Government or 

12 State or local governments, including 

13 State Attorneys General; 

14 (III) representatives of private 

15 entities that transfer, display, record, 

16 or otherwise utilize Social Security ac17 count numbers on a regular basis; 

18 (IV) the Comptroller General of 

19 the United States; and 

20 (V) any other appropriate enti21 ties. 

22 (b) REGULATIONS.—Not later than the date that is 

23 24 months after the date of enactment of this Act, the 

24 Commissioner of Social Security shall promulgate regula25 tions to carry out this section. 


srobinson on DSKHWCL6B1PROD with BILLS
12 

•S 1618 IS

1 (c) GAO REPORT.—Not later than 18 months after 

2 the effective date of the regulations promulgated by the 

3 Commissioner of Social Security under subsection (b) (or, 

4 if more than 1 effective date applies to such regulations, 

5 the latest such date), the Comptroller General of the 

6 United States shall report to Congress on the extent to 

7 which the uniform standards required under subsection 

8 (a)(1) have resulted in the adoption of such standards by 

9 private entities, and whether these standards are likely to 

10 provide greater protection against fraud and identity theft 

11 than the practices adhered to prior to such date. The re12 port shall include— 

13 (1) a recommendation regarding— 

14 (A) whether such standards should be 

15 mandatory for State and local governments and 

16 private entities, and if so, under what cir17 cumstances; and 

18 (B) whether making such standards man19 datory for such entities (with respect to each 

20 circumstance identified under subparagraph 

21 (A)) would help prevent fraud, identity theft, 

22 and unauthorized access to consumers’ person23 ally identifiable information; and 

24 (2) recommendations for such additional legisla25 tion or administrative action as the Comptroller 


srobinson on DSKHWCL6B1PROD with BILLS
13 

•S 1618 IS

1 General determines appropriate to further reduce 

2 the risks of fraud, identity theft, and unauthorized 

3 access resulting from the transfer, sale, display, re4 cording, or other utilization of Social Security ac5 count numbers. 

6 SEC. 5. PROHIBITION ON THE DISPLAY TO THE GENERAL 

7 PUBLIC ON THE INTERNET OF SOCIAL SECU8 RITY ACCOUNT NUMBERS BY STATE AND 

9 LOCAL GOVERNMENTS. 

10 (a) IN GENERAL.—Chapter 88 of title 18, United 

11 States Code, is amended by inserting at the end the fol12 lowing: 

13 ‘‘§ 1802. Prohibition on the display to the general 

14 public on the Internet of Social Security 

15 account numbers by State and local gov16 ernments 

17 ‘‘(a) PROHIBITION.— 

18 ‘‘(1) IN GENERAL.—Subject to paragraph (2), a 

19 State, a political subdivision of a State, or any offi20 cer, employee, or contractor of a State or a political 

21 subdivision of a State, shall not display to the gen22 eral public on the Internet all or any portion of any 

23 Social Security account number. 

24 ‘‘(2) EXCEPTION IF DISPLAY COMPLIES WITH

25 UNIFORM STANDARDS.—A State, a political subdiviVerDate Nov 24 2008 22:54 Aug 07, 2009 Jkt 079200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S1618.IS S1618

srobinson on DSKHWCL6B1PROD with BILLS
14 

•S 1618 IS

1 sion of a State, or any officer, employee, or con2 tractor of a State or a political subdivision of a 

3 State, may display to the general public on the 

4 Internet a portion of a Social Security account num5 ber if such display complies with the uniform stand6 ards for the method for truncation of such numbers 

7 issued by the Commissioner of Social Security under 

8 section 4 of the Safeguarding Social Security Num9 bers Act of 2009. 

10 ‘‘(b) RULES OF CONSTRUCTION; DEEMED COMPLI11 ANCE.— 

12 ‘‘(1) RULES OF CONSTRUCTION.—Nothing in 

13 this section shall be construed to supersede, alter, or 

14 affect any statute, regulation, or order of the Fed15 eral Government, a State, or a political subdivision 

16 of a State relating to the submission of a Social Se17 curity account number to a State or a political sub18 division of a State. 

19 ‘‘(2) DEEMED COMPLIANCE.—A State, a polit20 ical subdivision of a State, or any officer, employee, 

21 or contractor of a State or a political subdivision of 

22 a State, shall be deemed to be in compliance with 

23 the requirements of subsection (a) if the State or po24 litical subdivision— 


srobinson on DSKHWCL6B1PROD with BILLS
15 

•S 1618 IS

1 ‘‘(A) permits an individual to submit, in 

2 addition to original material required to be sub3 mitted to the State or political subdivision that 

4 contains all or any portion of the individual’s 

5 Social Security account number, a duplicate of 

6 the material that has all of the individual’s So7 cial Security account number redacted or trun8 cated in accordance with the uniform standards 

9 for the method of truncation issued under sec10 tion 4 of the Safeguarding Social Security 

11 Numbers Act of 2009; 

12 ‘‘(B) displays such duplicate on the Inter13 net in place of the original material that con14 tains all or any portion of the individual’s So15 cial Security account number; and 

16 ‘‘(C) prior to any display of such duplicate 

17 on the Internet, obtains the individual’s in18 formed written consent to such display. 

19 ‘‘(c) PENALTIES.—A State or a political subdivision 

20 of a State that has a policy or practice of substantial non21 compliance with this section shall be subject to a civil pen22 alty imposed by the Attorney General of not more than 

23 $5,000 a day for each day of substantial noncompliance. 

24 ‘‘(d) ENFORCEMENT.—The Attorney General may 

25 bring a civil action against a State, a political subdivision 


srobinson on DSKHWCL6B1PROD with BILLS
16 

•S 1618 IS

1 of a State, or any officer, employee, or contractor of a 

2 State or a political subdivision of a State, in any appro3 priate United States district court for appropriate relief 

4 with respect to a display to the general public on the Inter5 net of all or any portion of any Social Security account 

6 number in violation of this section. 

7 ‘‘(e) DEFINITIONS.—In this section: 

8 ‘‘(1) DISPLAY TO THE GENERAL PUBLIC ON

9 THE INTERNET.— 

10 ‘‘(A) IN GENERAL.—The term ‘display to 

11 the general public on the Internet’ means, in 

12 connection with all or any portion of a Social 

13 Security account number, to place such number 

14 or any portion of such number in violation of 

15 this section, in a viewable manner on an Inter16 net site that is available to the general public, 

17 including any Internet site that requires a fee 

18 for access to information accessible on or 

19 through the site. 

20 ‘‘(B) INCLUSION OF CERTAIN UNPRO21 TECTED TRANSMISSIONS.—In any case in which 

22 a State, a political subdivision of a State, or 

23 any officer, employee, or contractor of a State 

24 or a political subdivision of a State, requires as 

25 a condition of doing business transmittal of all, 


srobinson on DSKHWCL6B1PROD with BILLS
17 

•S 1618 IS

1 or any part of, an individual’s Social Security 

2 account number by means of the Internet with3 out ensuring that such number is encrypted or 

4 otherwise secured from disclosure, any such 

5 transmittal of such number shall be treated as 

6 a ‘display to the general public on the Internet’ 

7 for purposes of this section. 

8 ‘‘(C) NONAPPLICATION.—Such term does 

9 not apply to a Social Security account number 

10 of a deceased individual. 

11 ‘‘(2) SOCIAL SECURITY ACCOUNT NUMBER.— 

12 The term ‘Social Security account number’ means 

13 the account number assigned to an individual by the 

14 Commissioner of Social Security in the exercise of 

15 the Commissioner’s authority under section 

16 205(c)(2) of the Social Security Act and includes 

17 any derivative of such number.’’. 

18 (b) CLERICAL AMENDMENT.—The chapter analysis 

19 for chapter 88 of title 18, United States Code, is amended 

20 by adding at the end the following: 

‘‘1802. Prohibition on the display to the general public on the Internet of Social 

Security account numbers by State and local governments.’’. 

21 (c) EFFECTIVE DATE.—The amendments made by 

22 subsections (a) and (b) shall take effect on the date that 

23 is 1 year after the date on which final regulations are 


srobinson on DSKHWCL6B1PROD with BILLS
18 

•S 1618 IS

1 issued under section 4(b) and shall apply to violations oc2 curring on or after that date. 

3 (d) NO RETROACTIVE APPLICATION.—Nothing in 

4 section 1802 of title 18, United States Code, as added by 

5 the amendments made by subsections (a) and (b), shall 

6 be construed as applying to the placement of all or any 

7 portion of a Social Security account number in a viewable 

8 manner on an Internet site that is available to the general 

9 public, including any Internet site that requires a fee for 

10 access to information accessible on or through the site, 

11 by a State, a political subdivision of a State, or any officer, 

12 employee, or contractor of a State or a political subdivision 

13 of a State, that is done prior to the effective date of such 

14 amendments. 

15 (e) GRANTS TO STATE AND LOCAL GOVERNMENTS

16 TO COME INTO COMPLIANCE WITH THE PROHIBITION ON

17 THE DISPLAY TO THE GENERAL PUBLIC ON THE INTER18 NET OF SOCIAL SECURITY ACCOUNT NUMBERS.— 

19 (1) IN GENERAL.—The Attorney General shall 

20 award grants to States and political subdivisions of 

21 States to carry out activities to remove, redact, or 

22 truncate, in accordance with the uniform standards 

23 for the method of truncation issued under section 4, 

24 all Social Security account numbers on forms and 

25 records of executive, legislative, and judicial agencies 


srobinson on DSKHWCL6B1PROD with BILLS
19 

•S 1618 IS

1 of States and political subdivisions of States that, as 

2 of the date of enactment of this Act, have been dis3 played to the general public on the Internet and 

4 would be a violation of section 1802 of title 18, 

5 United States Code (as added by the amendments 

6 made by subsections (a) and (b)), if that section had 

7 been in effect at the time such numbers were first 

8 displayed. 

9 (2) APPLICATION.—A State or political subdivi10 sion of a State desiring a grant under this sub11 section shall submit an application to the Attorney 

12 General at such time, in such manner, and con13 taining such information as the Attorney General 

14 shall require. 

15 (3) AUTHORIZATION OF APPROPRIATIONS.— 

16 There is authorized to be appropriated to the Attor17 ney General to carry out this subsection, 

18 $10,000,000 for each of fiscal years 2010 and 2011. 

19 (4) DEFINITION OF STATE.—In this subsection, 

20 the term ‘‘State’’ means each of the 50 States, the 

21 District of Columbia, the Commonwealth of Puerto 

22 Rico, the United States Virgin Islands, Guam, and 

23 the Commonwealth of the Northern Mariana Is24 lands. 


srobinson on DSKHWCL6B1PROD with BILLS
20 

•S 1618 IS

1 SEC. 6. PREEMPTION OF STATE LAW. 

2 This Act and the amendments made by this Act shall 

3 supersede a provision of State law only if, and only to the 

4 extent that, such provision conflicts with a requirement 

5 of this Act or an amendment made by this Act. 

Æ 


srobinson on DSKHWCL6B1PROD with BILLS