Social Security Numbers: Stronger Protections Needed When Contractors Have Access to SSNs
Released: 2006-01-23T00:00:00

Letter

Background

In recent years, companies have increasingly relied on the use of contractors to perform certain activities and functions related to their business operations. This trend has often been referred to as outsourcing. However, no commonly recognized definition of outsourcing exists, and there has been confusion over whether it encompasses only activities a company originally performed in-house or includes any activity a company may contract out. According to outsourcing experts, approximately 90 percent of businesses contract out some activity because they find either it is more economical to do so or other companies are better able to perform these activities. Some of the activities companies outsource will require that contractors be provided personal information about the companies’ customers in order to perform those activities; in some cases, this information includes SSNs.

Originally, the Social Security Administration (SSA) created the SSN as part of a recordkeeping system to help manage the Social Security program. SSA uses the SSN as a means to track workers’ earnings and eligibility for Social Security benefits and assigns a unique number to every person as a work and retirement benefit record. Today, SSA generally issues SSNs to all U.S. citizens, but they are also available to non-citizens lawfully admitted to the United States as permanent residents.

However, because of the number’s unique nature and broad applicability, the SSN has become the identifier of choice for government agencies and private businesses and is used for numerous non Social Security purposes, such as opening a bank account and receiving health insurance.

As shown in table 1, certain federal laws have been enacted that place restrictions on some private sector entities’ use and disclosure of consumers’ personal information, including SSNs.

Limits access to credit data that includes SSNs to those who have a permissible purpose under the law.

Amends FCRA to allow, among other things, consumers who request a copy of their credit report to also request that the first 5 digits of their SSN (or similar identification number) not be included in the file; requires consumer reporting agencies and any business that uses a consumer report to adopt procedures for proper disposal.

Creates a new definition of nonpublic personal information that includes SSNs and limits when financial institutions may disclose the information to nonaffiliated third parties. It also requires that financial services regulatory agencies establish standards for the entities under their agencies’ jurisdiction relating to administrative, technical, and physical safeguards to: insure the security and confidentiality of customer records and information; protect against any anticipated threats or hazards to the security or integrity of such protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer.

To ensure compliance with these federal laws, some federal regulators conduct examinations of their respective institutions’ operations. For example, in the financial industry, federal agencies, such as the Office of the Comptroller of the Currency (OCC), the Federal Reserve Board (FRB), the Federal Deposit Insurance Corporation (FDIC) and the Securities and Exchange Commission (SEC) regulate banking or securities firms. OCC charters, regulates, and supervises all national banks, while FRB regulates bank holding companies and state-chartered banks that are members of the Federal Reserve System. FDIC regulates banks that are state-chartered banks that are not members of the Federal Reserve System. These banking regulators examine banking institutions for safety and soundness and compliance with applicable laws, including the Fair and Accurate Credit Transaction Act (FACTA), and GLBA. SEC regulates and examines investment advisers registered with the Commission and investment companies, including mutual funds, that engage primarily in investing, reinvesting, and trading in securities and that offer their own securities to the investing public. SEC also regulates and examines other market participants, including broker-dealers and self-regulatory organizations (SRO). As part of its examinations, SEC reviews these firms for compliance with GLBA’s safeguard provisions. In addition, SRO’s such as the New York Stock Exchange (NYSE) and National Association of Securities Dealers (NASD) examine their member broker-dealers to ensure compliance with applicable laws, self-regulatory rules, and SEC regulations, including GLBA’s safeguard provision.

In 1978, the Federal Financial Institutions Examination Council (FFIEC) was created as a formal interagency body authorized to prescribe uniform principles, standards, and report forms for the federal examination of financial institutions. The council’s membership is composed of the federal bank regulators—FDIC, FRB, OCC—plus the regulators for credit unions and thrift institutions—the National Credit Union Administration (NCUA) and the Office of Thrift Supervision (OTS), respectively. The FFIEC has issued guidance related to outsourcing services that provides a framework for the FFIEC agencies to examine their banks’ contractor management programs and exercise enforcement options if financial institutions do not establish and maintain adequate information security programs. The FFIEC also coordinates examinations of banks’ information technology service providers and separate guidance has been issued for conducting these examinations.

Along with OTS, the three bank regulators have jointly issued regulations that generally require each financial institution to develop, implement, and maintain, as part of its existing information security program, appropriate measures to properly dispose of consumer information derived from consumer reports. Together, these agencies have also issued interpretive guidance requiring every financial institution to develop and implement a response program, including customer notice provisions, designed to address incidents of unauthorized access to customer information maintained by the institution or its service provider. Under the Bank Service Company Act, as amended, the federal banking agencies have authority to regulate and examine certain services provided to banks by third parties—including contractors—to the same extent as if those services were performed directly by the bank.

IRS is responsible for ensuring that tax preparers are complying with certain confidentiality provisions in the IRC, primarily Section 7216. IRC § 7216 prohibits the unauthorized use or disclosure of tax return information by tax return preparers. Tax return preparers are also subject to GLBA. However, those provisions do not supersede, alter, or affect the preexisting requirements of IRC § 7216, although FTC has oversight and enforcement authority over tax preparers’ compliance with GLBA.

FCC is responsible for regulating interstate and international communications by radio, television, wire, satellite, and cable, and enforcing the provisions of the Telecommunications Act of 1996, which restricts the use of customer proprietary network information (CPNI). CPNI is the data collected by telecommunications corporations on a consumer’s telephone calls. It includes the time, date, duration, and destination number of each call, the type of network a consumer subscribes to, and any other information that appears on the consumer’s telephone bill. SSNs are not part of CPNI.

FTC is an independent agency whose mission is, in part, to prevent business practices that are anticompetitive, deceptive, or unfair to consumers. As part of its responsibilities, FTC enforces consumer privacy provisions and safeguards of FCRA, FACTA, and GLBA not enforced by other federal agencies. FTC is also required to collect identity theft complaints.

FTC statistics currently indicate that identity theft is growing. For 2004, FTC reported that it received about 247,000 complaints from individuals stating that they were victims of identity fraud, which was up from just over 86,000 complaints reported in 2001. While the reported number of victims and likely identity crimes has increased, the extent to which these statistics represent company security breaches is not well documented. However, various news reports and identity crime experts have attributed some identity thefts and credit card fraud to security breaches involving third party companies.

Private Sector Companies We Interviewed Routinely Use Third Party Contractors and Occasionally Share SSNs with Them

Banks, securities firms, telecommunication companies, and tax preparation companies we interviewed routinely obtain SSNs from their customers for authentication and identification purposes. All the companies we interviewed contracted out various services, such as data processing, administrative, and customer service functions. Although these companies may share consumer information, such as SSNs, with contractors that provide services to their customers, company officials said that they only share such information with their contractors for limited purposes, generally when it is necessary or unavoidable.

Private Sector Companies We Interviewed Obtain and Use SSNs Primarily for Identification Purposes

Officials from selected banking, securities, telecommunications, and tax preparation companies told us that they obtain and use SSNs primarily for authentication and identification purposes related to fraud prevention, credit verification, and complying with federal law. However, these officials told us that SSNs were not distinguished from other types of customers’ personally identifiable information. Company officials also told us that the same safeguards applied to SSNs as all other pieces of their customers’ personal information.

Officials from banks and securities firms we interviewed said that their companies obtained SSNs directly from their customers to comply with federal law when the customer opened a new account or conducted certain financial transactions. For example, the Bank Secrecy Act, as amended by the USA Patriot Act mandates that, among other things, financial institutions must verify each new account holder’s identity when opening an account, in an effort to curtail money laundering and terrorist financing. According to company officials we interviewed, other federal laws and regulations require both banks and securities firms to use SSNs for tax-reporting and customer-identity-verification purposes. In addition, some bank and securities firm officials said that due to its uniqueness, their companies also incorporated the SSN into their fraud prevention and authentication programs.

Telecommunication company officials we interviewed said that their companies are not required by federal law to collect or use the SSN, but that potential customers are asked to provide their SSN before establishing an account. These officials explained that their companies primarily use the SSN to query credit reporting agencies’ records in order to verify a potential customer’s creditworthiness, without which their companies would not be able to extend services to an individual quickly. In those instances where an individual did not have an SSN or refused to provide it, company officials said that their companies offered customers the option of using a pre paid service or providing a monetary deposit. Telecommunication companies we interviewed also used the SSN for customer account authentication and verification as well as fraud prevention. For example, officials from one company told us that they used the SSN as a key piece of information to ensure that a person inquiring about their account was the actual account holder.

Unlike the telecommunication companies, tax preparation companies are required by federal law to collect and use SSNs. IRC requires that individuals who have been assigned a number include their SSNs on their tax returns as a taxpayer identification number and that such information be kept confidential by these companies. Tax preparation officials and tax industry representatives we interviewed said that they also used the SSN as the identification number for refund payments to customers and other internal purposes. For example, officials from one tax preparation company told us that they used the SSN as the identification number for tracking any additional taxes owed in the event of an error by the preparer.

Private Sector Companies We Interviewed Contract Various Services

Banks, securities firms, telecommunication companies, and tax preparation entities we interviewed all contracted out services, such as administrative, information technology, and customer service functions. We found that every company we interviewed used contractors for a variety of services, ranging from maintenance functions to software development. We found the following examples: Officials from one bank told us that they contracted administrative functions such as financial statement processing and shipping services.

Some banks contract out services, such as Internet banking, check imaging, telephone banking, and debit and ATM processing services.

Officials from a securities firm told us that they contracted with software data vendors for the development and maintenance of specific data products.

Tax preparation representatives told us that some individual tax preparers may contract with or use electronic return originators (ERO’s).

Some financial sector regulators and industry representatives had conducted surveys to determine the types of services being contracted by the financial services industry. In 2004, economists from the Federal Reserve Bank of Kansas City, Missouri, found that certain types of banks relied on third-party vendors to provide an array of services, such as electronic banking and payment processing. In addition, NYSE and NASD conducted a joint survey in 2004 of a select number of their members. The survey revealed that some of their member firms routinely contracted out accounting, finance, administrative, and information technology functions. NASD has specific restrictions that prohibit its members from contracting certain functions, such as supervisory and compliance activities.

Private Sector Companies We Interviewed Only Share SSNs with Contractors for Limited Purposes

Banking, investment, telecommunication, and tax preparation officials we interviewed said that they share SSNs with their contractors only for limited purposes and even then, only when it is necessary or unavoidable. In general, most of the financial services companies we spoke to said they shared SSNs with contractors to assist with services involving employee background checks, debt collections, fraud prevention, accessing credit reports, and information technology, such as data management.

Officials from one securities firm said that they shared SSNs with their contractors who assisted them in complying with federal customer identification requirements. For example, some financial services company officials told us that they used service providers to cross- reference potential customers against a government-provided “watch list” of known terrorists, suspected terrorists, and individuals being investigated for possible suspicious activity. Some large financial service provider officials also told us that in most cases their client only granted them access to SSNs in those instances where they believed SSNs were needed, such as when servicing their clients’ accounts or storing data.

Telecommunication and tax preparation companies we interviewed also shared SSNs for limited purposes. Telecommunication companies generally shared SSNs with contractors for services, such as customer/client contact centers, debt collection, and data storage functions. For example, officials from one telecommunication company told us that they shared SSNs and other personally identifiable information with their contracted customer contact center. The company shared their customers’ account information, including SSNs, with contact center employees so that the contracted employees could authenticate, identify, and service their customers’ accounts. However, company officials said that these employees could only access account holder information needed to fulfill specific requests and SSNs were not needed for some types of requests. According to tax industry representatives, tax preparation companies shared SSNs with their contractors primarily for administrative and data management functions. For example, one tax preparation company told us that their contractors had access to their customers’ SSNs for services involving data analysis and preparation of reports for internal company use, tracking, and processing of customer services and archiving and storage of tax return data.

Company officials we spoke to from all industries told us that they are cautious about providing third party contractors access to their customers’ personal information, including SSNs. In many cases, company officials cited multiple risk factors that could result if their customer’s sensitive data were exposed by their service providers, such as compliance and reputation risks. For example, in the last year, several large banks experienced data security breaches in which their customers’ personally identifiable information, including SSNs, was compromised, exposing individuals’ information to potential misuse. Many company officials said that in order to reduce such risks, they consider multiple financial and operational factors before sharing sensitive data, such as SSNs, with their contractors. For example, bank officials from one bank told us that they request the financial statements of their prospective service providers to ensure that each service provider is financially sound.

Private Sector Companies We Interviewed Have Established Safeguards to Protect SSNs

The private sector companies we contacted provided us with standard contract forms they use in contracting with service providers to safeguard customers’ personal information, such as SSNs, from misuse. In general, the types of provisions these companies included in their standard contract forms included electronic and physical data protections, audit rights, data breach notifications, subcontractor restrictions, and data handling and disposal requirements. We found that most of the companies we interviewed had established some type of due diligence or credentialing process to verify the reliability of potential contractors prior to and during contract negotiations. Furthermore, we found that some industry associations have voluntarily developed guidance for their members regarding the sharing of personal information with third parties.

Provisions in Selected Service Provider Contracts Help Safeguard SSNs from Misuse

Private sector companies we contacted often included provisions in their service provider standard contract forms to safeguard customers’ personal information, such as SSNs, from misuse. In general, these contract provisions included but were not limited to electronic and physical data protections, audit rights, subcontractor restrictions, data breach notifications, and data-handling and disposal requirements.

While company officials told us that the extent to which they included safeguard provisions varied with the type of service being contracted, most said that they included the above safeguard provisions when sharing personally identifiable information, including SSNs, with their contractors. To verify these claims, we asked each company to provide us with copies of their standard information security contract provisions and any other policies and procedures associated with such agreements. Our review of the standard contract forms and the associated documentation for 10 companies found that they included most of the above safeguard provisions, but the level of specificity of the safeguard provisions varied across company contracts. For example, each standard contract form we reviewed included provisions requiring contractors to establish both electronic and physical information security safeguards. However, in many cases, the standard contract form did not require the contractor to implement a specific type of electronic or physical safeguard, but only made reference to employing overall administrative, technical, and physical safeguards to prevent the unauthorized use or disclosure of their customers’ personal information, such as the SSN. Some company officials told us that the information security safeguard provisions were intentionally vague to provide the contractor with flexibility in instituting such electronic and physical safeguards. However, we found that one large service provider included specific security controls in its standard contract form, which ranged from physical seals and alarms on their data centers’ exterior windows to the prohibition of printers on computer terminals with access to sensitive data.

Almost all of the 10 standard contract forms we reviewed also granted companies the right to audit their service providers with notice, which is consistent with industry standards. For example, one tax preparation company’s standard contract provisions stated that the company had the right to audit or independently evaluate any security processes or controls, but would only exercise such rights in a manner that limited unnecessary interference in the contractor’s operations. In addition, most company standard contract forms required service providers to obtain written consent from the client company before employing a subcontractor to conduct any service on the company’s behalf. Some industry sector officials told us that their standard contract forms contain provisions that explicitly require subcontractors to comply with the same safeguard requirements that the original contractor was required to follow. However, some company officials in the securities industry stated that their subcontractors are rarely granted access to consumer information, such as SSNs.

Most of the standard contract forms we reviewed also included security breach notification provisions, which typically required the contractor to notify the company in the event of any information security breach. Also, the contract language varied on the type of information that would prompt a notification and the degree to which a contractor should be involved in rectifying such a breach across industries. For example, officials from one of the banks we spoke to told us that their company required their contractors to notify them within 24 hours of any security breach or suspicious behavior, and they provided their contractors with a 24 hour telephone hotline. We were also told by most industry officials that any action taken against the contractor would depend on the extent of the breach, although in most cases, these companies had established some form of initial response program to address such breaches. However, we only found that the financial services companies had included provisions in their standard contract forms specifically outlining their response program.

Finally, we also identified companies that included data-handling and disposal requirements provisions in their standard contract forms. In these cases, the companies included general language restricting the use and disclosure of personal information to only those parties involved in executing the contracted service. For example, one large bank’s standard contract form stated that the contractor had no legal right to access, receive, accept, transmit, or store any of its confidential information for any purpose not related to fulfilling the contract unless it was granted such rights by the bank.

Selected Companies Follow a Common Process in Selecting Contractors but Monitoring of Contractors Varies

The private sector companies we contacted spoke of similar processes for acquiring and negotiating services with potential contractors. Some company officials said that before services were contracted, they conducted some form of due diligence that is part of the overall contracting process and may include on-site visits and reviews of security policies. In addition, the due diligence phase may also include reviewing financial and independent audit statements or reports, in an effort to shed light on how contractors handle consumer data.

We found that the most sophisticated due diligence among the four industries, was the multi-tiered, risk-based process used by the companies in both the banking and securities industries. Officials from two banks told us that their due diligence practices include administering questionnaires to ascertain the amount of consumer data needed by the contractor to perform their duties. After reviewing the contractor’s responses, these banks used their risk based classification system to assign a priority rating to indicate the level of information to which a contractor will have access—the higher the priority rating, the more personal information the contractor is cleared to use. Officials from one bank said they were in the process of developing a system to share the information obtained through the due diligence process with other banks. Bank officials said this collaboration effort is designed to minimize the disruption contractors’ face when their potential clients review them.

Unlike the common process for selecting contractors, we found that performance review and monitoring practices for contractors varied across companies. Two companies, from the banking and tax preparation sectors, stated that they use risk-based audit systems. This means that “high risk” contractors—which include contractors that have access to SSNs—are audited more frequently than those that are lower risk. However, a few other companies stated that they periodically audit contractors, although the impetus for the audit is not based on degree of access the contractors have to SSNs, but on other factors such as the size of the contractor. One company in particular told us that it frequently engages in spontaneous audits of its contractors when they sense something is awry with the data-sharing relationship.

Some Industry Associations Provide Outsourcing Guidance, and Safeguards Used Are Generally Consistent with Established Practices for Safeguarding Information

The banking and securities firms we met with relied on established industry practices and international standards in developing contract terms and safeguards. According to officials in this sector, one of the foremost sources of guidance is from an industry-led consortium consisting of 100 of the largest financial institutions known as BITS. Among other things, this consortium has developed a framework for developing and managing outsourced relationships. The framework consists of nine sections and addresses topics such as: (1) governing the practice of outsourcing consumer information through information technology, (2) developing due diligence considerations and, (3) contractual, service level and insurance considerations.

Financial companies also mentioned an international standard for information security—ISO 17799—that identifies 10 security controls used in a range of situations when exchanging consumer information through information systems. For example, this standard handles scenarios such as allowing access for traveling data users, as well as those users in remote locations, to authenticating users and passwords. Additionally, the banking sector has established a financial services roundtable which discusses a range of topics including privacy issues related to protecting consumer information. Bank officials told us that two of their specific efforts are to develop identity theft assistance and establish shared assessment centers in conjunction with BITS. The shared assessment center provides members with information about contractors based on their practices for security and privacy.

The telecommunications and tax preparation industries have not developed guidance similar to that developed by BITS. According to officials at a large telecommunications company, though, their contractors are expected to abide by accepted industry practices. However, these practices were not specified in the standard contract form for this company. An official with the National Association of Tax Preparers (NATP) said that, given the many types of tax preparers, such as certified public accountants, enrolled agents, individual practitioners, attorneys and financial planners, establishing specific guidance on sharing consumer data would not be worthwhile.

However, in 2004, the American Institute of Certified Public Accountants (AICPA) issued a ruling for its members clarifying their responsibilities to their clients when using third party contractors, including offshore providers. This action was prompted by congressional and regulatory concerns about the outsourcing of tax preparation work and maintaining the confidentiality of personal financial information that is provided to contractors, especially those in other countries. The ruling applies to all client services in addition to tax preparation and requires members to take the following steps: Inform clients, preferably in writing, that the tax preparer may use an outside contractor in providing services to the client and share client information with that contractor. Members are not required to provide this notification if a contractor is only used for administrative support services such as record storage or authorized e-file tax transmittal services.

Provide adequate oversight of all services performed by the contractor and adequately plan and supervise the services provided by the contractor. The ruling does not elaborate on what is adequate as it may vary depending on the nature of the service provided.

Enter into a contractual agreement requiring the contractor to maintain the confidentiality of clients’ information and be reasonably assured the contractor has appropriate procedures in place to prevent the unauthorized release of confidential client information. This provision applies to contractors that provide administrative support and professional services and does not require the member to obtain specific consent from the client to share information with the contractor.

In our review, we found that information security policies and procedures of the companies we contacted were generally consistent with established industry practices for maintaining the confidentiality of personal information. For example, 12 of the companies we interviewed had incorporated or told us that they had provisions in their contracts restricting their subcontractor’s access and use of consumer information, such as SSNs. In addition company documents included other types of safeguards that are consistent with considered established practices we identified such as confidentiality provisions, information disposal requirements, audit rights, data security breach procedures, and physical safeguards. In addition, several company officials from the financial sector said that they also relied on these established industry standards when developing their internal policies and procedures, although we could not determine the extent to which the companies had actually incorporated these established practices.

Federal Regulation and Oversight of SSN Sharing Varies Widely Among the Industries We Reviewed

Federal regulation and oversight of SSN sharing varies across the four industries we reviewed, revealing gaps in the federal law and oversight in different industries that share SSNs with their contractors. Federal law and oversight of the sharing of personal information in the financial services industry is very extensive: Financial services companies must comply with GLBA requirements for safeguarding customer’s personal information, and regulators have an examination process in place that includes determining whether banks and securities firms are safeguarding this information. Oversight in the tax preparation and telecommunications industries’ sharing of SSNs is not as comprehensive as it is in the financial services industry. IRS has regulations and guidance in place to restrict the disclosure of SSNs by tax preparers and their contractors, but does not perform periodic reviews of tax preparers’ compliance. Because it believes that it lacks statutory authority to do so, FCC has not issued regulations covering SSNs and also does not periodically review telecommunications companies to determine whether they are safeguarding such information.

Federal Oversight in the Financial Services Sector Is Extensive

In the financial services sector, banks and securities firms, among others, must comply with the provisions of GLBA to establish safeguards that protect the confidentiality of nonpublic personal information about their customers or clients. GLBA generally permits banks to share customers’ personal information with contractors without the customers’ permission, provided that the bank fully discloses it is doing so and enters into a contract requiring the contractor to maintain the confidentiality of the information. Through periodic bank and securities firm examinations, the federal agencies with oversight responsibility for these entities review their compliance with the agencies’ GLBA and other regulations.

Bank Regulatory Agencies Monitor Compliance with GLBA through Regulations and Examinations for Compliance

The federal bank supervisory agencies jointly issued guidelines to implement the GLBA safeguarding requirements. These guidelines require banks to establish information security programs that include using due diligence in selecting contractors, requiring contractors to take steps to meet the safeguard standards, and, in certain situations, monitoring contractors to confirm that they are meeting the safeguard requirements. The three agencies base portions of their examinations and supervisory practices on these guidelines. The FFIEC has also issued guidance outlining the following four steps banks should follow in establishing contractual relationships with technology service providers: Conduct appropriate risk assessments. Maintain adequate due diligence procedures. Closely evaluate all contracts to ensure necessary provisions for assuring security and confidentiality are included.

Establish ongoing monitoring and oversight procedures.

These steps are also incorporated into FFIEC’s examination procedures manual for reviewing technology service providers. Appendix II describes these steps in more detail.

The bank regulatory agencies conduct periodic examinations in which compliance with GLBA and the guidance for sharing information with contractors are assessed. The frequency of examinations at a particular bank depends on a series of risk assessments. For example, OCC examiners we met with said that, in general, the more a bank shares nonpublic personal information (as defined by GLBA) with contractors, the greater its risk potential is, and therefore, the more scrutiny information security will receive.

OCC performs targeted examinations that focus on specific subjects along with ongoing supervision activities to assess the banks’ overall operations and performance. Information security, contractor management, and compliance with GLBA and other privacy laws are among the targeted examinations that have been conducted or planned at the three banks we met with. The targeted examinations can also include reviews of offshore contractors. One such examination was aimed exclusively at reviewing risk management practices and controls of the banks’ contractor management unit in India. FDIC and FRB also conduct examinations of state-chartered banks and bank holding companies in which two regulators also assess information security, contractor management, and GLBA compliance. We reviewed examination reports and related workpapers for three large national banks supervised by OCC that we met with. Our review of the examination reports found that they draw overall conclusions on whether the bank is satisfactorily meeting both OCC’s requirements for complying with GLBA and its guidance for sharing sensitive information with contractors and then the reports discuss any areas of weakness in detail. When there are findings that require corrective action by bank management, the examiners will report these as matters requiring attention. In some instances, concerns were raised about banks consistently implementing their information security policies among all their business units; however, the reports indicate that the banks’ management is addressing these issues.

Certain bank contractors are also examined periodically under the purview of the FFIEC, using examiners from all FFIEC member agencies. These bank service contractors—referred to as technology service providers—often have access to sensitive personal information. We reviewed 66 bank contractor examination reports and found the examinations addressed information security issues including GLBA compliance, the sufficiency of both internal and independent IT audits, the adequacy of system controls and written policies and procedures, and the use of or need for risk and vulnerability assessments. About two thirds of the examination reports concluded that the service providers’ overall information security is satisfactory but make recommendations for specific improvements. Some of the examinations focused on GLBA compliance, and examiners recommended improvements that contractors could make to their internal processes to better ensure they are complying with GLBA.

SEC and Self-Regulatory Agencies Also Use Examinations to Oversee Requirements for Safeguarding Sensitive Customer Information

Securities firms are also required to meet the GLBA standards for safeguarding customer’s personal information. To implement GLBA, SEC issued regulation S-P, which applies to the financial institutions subject to SEC’s jurisdiction under GLBA—investment advisors registered with SEC, investment companies and broker-dealers. Regulation S-P directs these securities firms to adopt policies and procedures that are reasonably designed to insure the security and confidentiality of customer records and information, protect against anticipated threats or hazards to the security and integrity to customer records and information, and protect against unauthorized access to or use of customer records and information that could bring substantial harm or inconvenience to any customer.

Under Regulation S-P, securities firms, similar to banks, generally may share customers’ personal information with contractors without customers’ permission, provided that the firms notify customers they are doing so, and prohibit contractors, through the terms of the contract, from disclosing or using the information for any purposes other than those for which the information was provided.

SEC’s Office of Compliance, Inspections, and Examinations (OCIE) conducts periodic exams of securities firms that include compliance with Regulation S-P. OCIE uses a risk assessment framework to target firms for examination. Any known concerns or questions about a firm’s practices for protecting customer information are among the components factored into the risk assessment. OCIE’s examination process covers such steps in the contract management process as due diligence in selecting contractors, contract provisions for protecting information privacy, and monitoring compliance with the contract terms including the use of audits or other reviews of contractors’ procedures and performance. Examiners are also expected to obtain and review certain documents in addition to the contracts, such as any relating to specific security controls. Although the bank regulatory agencies have authority to examine contractors, SEC officials told us that they cannot examine contractors unless they happen to be another securities firm.

In addition to its ongoing examinations, OCIE initiated two examination sweeps focused solely on firms’ protection of personal information. The first—performed during 2002 and 2003—focused on large securities firms policies and procedures for preventing identity theft. The examinations reviewed how well they complied with the safeguarding requirements and also scrutinized the firms’ vendor management processes to see if they were designed to ensure compliance with the safeguarding requirements. These examinations found that, while the firms were generally in compliance, some were confused about specific things they needed to do to meet the requirements. In the fall of 2005, OCIE began the second sweep—examining the outsourcing practices of securities firms. OCIE plans to conduct these examinations with NYSE at a small number of firms selected to be as representative of the industry as possible. According to the procedures developed by OCIE, the examinations will be very detailed and explore what specific measures have been taken by firms in the areas of: Due diligence in selecting contractors; Adequacy of privacy and security provisions in the contracts; Contractors’ policies and procedures for safeguarding customer Oversight and monitoring for compliance with the contract terms, including offshore contractors’ ability to comply with applicable U.S. information privacy laws.

After completing this program, OCIE plans to incorporate the procedures for examining outsourcing activities into its regular examinations.

NASD and NYSE have issued their own guidance on safeguarding customer information. NASD has issued guidance outlining procedures and safeguards for sharing customer information with contractors, and overseeing compliance with any applicable securities laws and NASD rules. In response to concerns about the growing use of contractors in the securities industry, NYSE has proposed a similar rule governing its members’ use of contractors, which will require member firms to follow certain steps in selecting and overseeing contractors.

NASD and NYSE also examine member firms to ensure compliance with Regulation S-P. However, similar to SEC, neither SRO has the authority to examine or review contractors that are not member firms. NASD officials said a Regulation S-P review will be included in an examination if their examiners believe there is a Regulation S-P compliance or information security issue at a member firm. They added that the examiners review the firm’s procedures and internal controls for monitoring contractors and review each contract to ensure it includes clauses protecting the confidentiality of customer information and barring the contractor from using it for purposes not related to the contracted service. NYSE examinations review third-party contracts to ensure that they contain confidentiality clauses prohibiting the contractor from using or disclosing customer information for any use other than the purposes the contractor was provided the information. We reviewed 10 NYSE examination reports, documenting each instance of noncompliance with Regulation S-P found by NYSE examiners since January 2003. We found several cases where the examiners found that third party contracts did not contain the necessary confidentiality clauses.

Tax Preparers Must Follow IRS and FTC Information Nondisclosure Requirements, but IRS Has No Process for Routinely Monitoring Compliance

Tax return preparers are required to protect the confidentiality of taxpayer information under IRS provisions and FTC’s GLBA regulations. Under Sections 6713 and 7216 of IRC and IRS regulations, tax return preparers may, under certain circumstances, disclose tax information to other tax preparers, including contractors, or to other employees of the tax preparers’ firm. Tax return preparers and contractors who provide certain services in connection with the preparation of tax returns—including contractors used in preparing and processing electronic tax returns-—are required to protect the confidentiality of taxpayer information, and they may be subject to civil and criminal penalties for the unauthorized use or disclosure of tax return information, including SSNs.

Tax return preparers must also follow FTC’s GLBA regulations for maintaining the security and confidentiality of customer information. Among other protective measures, FTC’s GLBA regulations state that entities such as tax return preparers may use contractors and provide customers’ information to those contractors, but only if certain conditions are fulfilled. Thus, in the case of tax return preparers, the preparer must provide its customers with initial notice of its privacy policies and practices before it shares sensitive information with contractors, and contracts the tax return preparer enters into with its contractors must prohibit the contractors from disclosing or using customers’ tax return information for any purposes other than those for which the information was provided. FTC’s GLBA regulations also specify that entities such as tax return preparers oversee their contractors by (1) taking reasonable steps to select and retain service providers that can maintain appropriate safeguards for the customer information being shared and (2) requiring provisions in the contracts to implement and maintain these safeguards.

Unlike the bank regulatory agencies and SEC, IRS does not conduct periodic examinations of tax preparers. IRS monitors and oversees tax preparers, including how well they safeguard taxpayer information, by investigating complaints, which may come from clients or referrals from local IRS offices. IRS officials said the agency has plans to start conducting more self-initiated reviews of a sample of tax preparers but the agency has limited resources for this effort. IRS also performs background checks of applicants who provide electronic return services and plans to review a sample of Electronic Return Originators each year.

During the course of our work we found that some IRS and professional association officials were concerned that IRS regulations did not adequately cover tax return preparers who submit taxpayer returns electronically. For example, officials from a professional association for tax return preparers said there were no explicit provisions restricting what various third party providers participating in electronic filing could do with taxpayer information once they possess it. In response to this concern, however, IRS officials stated that any participant in its e-file program performing any role that handles tax return data is covered by IRC 7216. IRS has also recently issued proposed regulations intended to, among other things, clarify that the rules also apply to tax return preparers who submit taxpayer returns electronically. The proposed regulations also clarify that a tax return preparer may disclose tax return information to another tax return preparer located in the United States, including a contractor, without the taxpayer’s consent under certain conditions. They also provide that contractors, under certain circumstances, are subject to criminal penalties for unauthorized use or disclosure of tax return information. In addition, the proposed regulations contain a new provision that states that disclosure of tax information may be made to certain types of contractors, but only if the tax return preparer ensures that all individuals who are to receive tax information receive written notice that criminal penalties for improper disclosure apply to them.

No Federal Law Requires Safeguards for SSNs Collected or Shared by the Telecommunications Industry

FCC officials told us that they know of no federal law that restricts the sharing of SSNs by telecommunications firms with their contractors and that they do not regulate or oversee the privacy of customer information maintained or shared by telecommunications firms unless the information is included in customer proprietary network information (CPNI). The Telecommunications Act of 1996 restricts the use and disclosure of CPNI, which is defined as information relating to the quantity, technical configuration, type, destinations, location and amount of use of a telecommunications service subscribed to, and information contained in the bills pertaining to telephone service received by a customer. Currently, the act does not include SSNs in its definition of CPNI. Agency officials also stated that FCC has enacted regulations governing disclosure of CPNI (but not SSNs) to certain types of third parties.

Although FCC has authority to take enforcement action against telecommunications companies for inappropriate use and disclosure of CPNI, the limited definition of CPNI precludes FCC from taking enforcement action when SSNs are used or disclosed. It also has no authority to oversee the use of contractors by telecommunications firms other than its authority to oversee compliance with its regulations affecting the sharing of CPNI. Agency officials told us FCC is considering a request by the Federal Bureau of Investigation to regulate foreign storage of CPNI and foreign-based access to CPNI based on national security and law enforcement concerns.

Despite FCC’s lack of authority with regard to SSNs being shared by telecommunications companies, under certain circumstances, FTC may be able to take action against telecommunications companies for improperly sharing SSNs. An FTC staff member and representatives from the telecommunications companies we met with said that under Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive business practices, FTC may be able to take action against companies that fail to meet the terms of their own privacy policies in certain circumstances. For example, if a telecommunications company stated in its privacy policy that it would only share a consumer’s personal information with contractors for certain purposes and a contractor used the SSNs for a purpose not covered by the privacy policy, FTC could consider this a deceptive business practice. However, according to FTC, no actions have been taken against telecommunications carriers under Section 5 because of a failure to comply with statements made in their privacy policies about information shared with contractors.

State Laws Also Affect the Disclosure and Sharing of SSNs with Third Parties

Company officials informed us of laws in 15 states they believe either affect how they share sensitive personal information including SSNs with their contractors or limit both their own and their contractors use and handling of this information. The laws cover areas such as limiting the use and display of SSNs, specifying record disposal requirements, prohibiting requiring SSNs to complete a business transaction, privacy policy provisions, and security breach notification requirements.

A few of the company officials we spoke to said that California’s privacy laws were particularly significant to the development of their information confidentiality and security policies. As a result, many told us that their companies have adapted the requirements of the California laws for companywide application. The California law that most directly affects how businesses can share personal information with their contractors was enacted in September 2004 and requires that businesses incorporate provisions to implement and maintain reasonable security procedures and practices to protect personal information from unauthorized access, disclosure, use, modification, or destruction into their contracts with third party service providers. This law identifies SSNs, when used in conjunction with customer names, as one of several forms of personal information covered. Some company officials also said California’s security breach notification statute significantly affected their information security and confidentiality procedures. These officials also told us this statute was the impetus for formulating their own breach notification requirements and procedures.

Company officials in each of the industry sectors said that they will incorporate the requirements of state laws they believe affect how they share sensitive personal information into their company’s security and confidentiality policies or operations, effectively applying them to all states they do business in. For example, officials from one company told us it is more efficient to apply these state requirements nationwide than to design systems for specific states.

Conclusions

With millions of Americans at risk of identity theft, it is vital that any entity with access to personal information, especially to SSNs, take every precaution to protect this information from misuse. Inadequate database security and improper handling, disposal, and sharing of such personal information creates vulnerability to identity theft, with its attendant costs to individuals and businesses.

Officials from each of the industries we met with clearly felt that safeguarding SSNs and other personal information was very important and had taken steps to do so. However, as we found in the telecommunications sector, companies are not always required to include in their service- provider contracts provisions that would safeguard SSNs. Gaps in existing federal law or agency oversight, such as what we found in the industries we looked at, do not provide incentives for companies to commit to protecting personal information. Each industry is subject to different federal oversight and is often left to decide what established practices for safeguarding SSNs and other consumer information it wishes to follow. Federal action to strengthen safeguards for SSNs that companies in non- financial service industries collect could avert disclosures of this important personal information and better protect Americans from the cost and inconvenience of identity theft.

Matter for Congressional Consideration

We recommend that Congress consider possible options for addressing the gaps in existing federal requirements for safeguarding SSNs shared with contractors. One approach would be to require industry-specific protections for the sharing of SSNs with contractors where such measures are not already in place. For example, Congress could consider whether the Telecommunications Act of 1996 should be amended to address how that industry shares SSNs with contractors.

Alternatively, Congress could take a broader approach. For example, in considering proposed legislation that would generally restrict the use and display of SSNs, Congress could also include a provision that would explicitly apply this restriction to third party contractors. With either approach, Congress will also want to establish a mechanism for overseeing compliance by contractors and enforcement.

Agency Comments

We requested comments on a draft of this report from FCC, FDIC, the Federal Reserve Board, FTC, IRS, OCC, and SEC. None of the agencies provided formal, written comments. With the exception of FDIC, all provided technical, editorial, and other clarifying comments which we incorporated in the report as appropriate.

We are sending copies of this report to the Secretary of the Treasury, the Chairmen of the Federal Reserve Board, FDIC, FTC, FCC, SEC, the Office of the Comptroller of the Currency, the Commissioner of the IRS, and other interested parties. Copies will also be made available at no charge on GAO’s Web site at http://www.gao.gov. If you have questions concerning this report, please call me on (202) 512-7215. Key contributors to this report are listed in appendix VI.

Appendix I: Scope and Methodology

In this report, we focused on the uses and protections of SSNs when they are shared with contractors and subcontractors within the financial services, telecommunications, and tax preparation industries. To describe the types of services that companies in these industry sectors contract, we identified and interviewed company officials in the banking, securities, telecommunication, and tax preparation industries. We selected these industries because they collect large volumes of personal information including SSNs and experts in the fields of outsourcing and information security we interviewed believed these industries were among the most likely to share SSNs with contractors. We contacted 17 of the largest companies, based on asset size, from each of the industry sectors. We also contacted seven large service providers—companies whose sole business is to provide services to other businesses under contract. Based on the response to our request, we conducted structured interviews with a total of 17 of these companies—3 banks, 4 securities firms, 4 telecommunication companies, 1 tax preparation company, and 5 service providers—regarding the types of services they contracted and whether SSNs were shared between the companies and contractors. The remaining seven companies did not respond to our request. Furthermore, we conducted structured interviews with six industry associations. These included three associations that represented enrolled agents and tax professionals within the tax preparation industry. We contacted these to obtain more perspectives from the tax preparation industry since only one tax preparation firm agreed to meet with us. However, we were unable to determine the extent to which some of the member’s responses were representative of associations with similar membership. Our interviews with the companies and industry associations are not statistically representative of either their industries or the business sector as a whole, and therefore should not be considered to represent the views of the sectors as a whole. In addition, we also reviewed academic and consultant’s studies, a professional trade associations’ outsourcing survey, self-regulatory organizations’ research, and bank examinations to determine the types of services that companies from the different industry sectors commonly contracted.

To identify company safeguards to protect SSNs during the contracting process, we conducted structured interviews with company officials from each industry to gain a better understanding of their safeguards and the stages of the contracting process. We requested copies of standard contract forms from each of the companies. Ten companies provided copies to us. We reviewed the forms to identify specific provisions that addressed the security and confidentiality of personal information. We also obtained and reviewed internal security policies and procedures from companies willing to provide them and compared these security measures across the different industry sectors. We did not verify the extent to which these businesses complied with their own policies, procedures, and safeguards. Finally, we contacted these industries’ trade associations to identify any best practices or notable industry practices for the safeguarding of customer’s personally identifiable information. Because of the sensitive nature of the information we were obtaining, we agreed not to identify the companies in our report and to treat any information they provided, including their standard contract forms, as proprietary.

To identify how federal agencies regulate and monitor the sharing and safeguarding of SSNs and other personal information between entities they oversee and their contractors, we interviewed agency officials and reviewed documents from the following agencies with jurisdiction over the four industry sectors in our review Federal Deposit Insurance Corporation, Federal Reserve System, Office of the Comptroller of the Currency, Federal Financial Institutions Examination Council, Federal Trade Commission, Federal Communications Commission, Internal Revenue Service, and Securities and Exchange Commission.

We also met with officials from self-regulatory agencies-—the New York Stock Exchange and the National Association of Securities Dealers—and reviewed documents they prepared.

Documents we obtained and reviewed included applicable statutes, regulations, guidance to regulated entities, examination manuals and related materials, examination reports and related workpapers, survey reports, and any other related materials. We limited our review to identifying steps and procedures the agencies follow in overseeing compliance with federal requirements for safeguarding personal information. We did not assess the adequacy or effectiveness of their oversight and enforcement measures.

For bank examination reports, we limited our analysis to reviewing those for the three banks we met with. Our purpose was to, in general, identify what the examinations covered, if they followed OCC’s examination procedures, and the types of issues they found. We reviewed only those reports relating to GLBA, information security, or contractor management that were issued since 2002. In addition, we reviewed the most recent examination report for 66 contractors. Most of the reports are maintained in the regional or field offices of the bank regulatory agency that had lead responsibility for the exam. Examination reports for 16 multi-regional service providers—which FFIEC classifies separately—are maintained in FFIEC headquarters. Because of this dispersion, we requested the reports for the 16 multi-regional service providers and any other reports that were available electronically—which were the remaining 50. As a result, our sample of both the bank and contractor examination reports is not representative, and our findings from them cannot be generalized.

In order to ensure we obtained complete information from the federal agencies, we also asked the companies we interviewed to tell us the federal requirements for protecting personal information they were responsible for complying with and compared their responses with what we obtained from the agencies.

Appendix II: Summary of Federal Bank Supervisory Agency Guidance on Contracting with Technology Service Providers

Conduct appropriate risk assessments. When considering contracting out a particular activity, banks should evaluate factors such as the strategic goals, objectives, and business needs of the financial institution; the ability to evaluate and oversee contractual relationships; the importance and criticality of the services to the bank; defined requirements for the contracted activity; necessary controls and reporting processes; contractual obligations and requirements for the contractor; contingency plans, including availability of alternative contractors, costs and resources required to switch contractors; ongoing assessment of contractual arrangements to evaluate consistency with strategic objectives and contractor performance; and regulatory requirements and guidance for the business lines affected and technologies used.

Maintain adequate due diligence procedures. Banks should evaluate prospective contractors to determine their ability, both operationally and financially, to meet the bank’s needs, and should convey the bank’s needs, objectives, and necessary controls to the prospective contractor. Some of the specific factors banks should consider in selecting contractors include their technology and industry expertise, financial condition, and operations and controls including the adequacy of their standards, policies and procedures relating to internal controls, security, privacy protections, and maintenance of records and also determining if contractors provide sufficient security precautions such as encryption and customer identity authentication.

Closely evaluate all contracts to ensure necessary provisions for assuring security and confidentiality are included. Consideration should be given to including contract provisions that address control over operations. Contracts should address, among other matters, the scope of service, performance standards, security and confidentiality of the bank’s information and other resources, controls, audit rights, frequency and type of reporting to the bank, and sub-contracting. Security and confidentiality provisions should include prohibiting the contractor and its agents or subcontractors from using or disclosing the bank’s information except as needed to or be consistent with providing the contracted service, protecting against unauthorized use, and requiring the contractor to fully disclose security breaches that result in unauthorized intrusions that may materially affect the bank or its customers and report corrective actions taken.

Establish ongoing monitoring and oversight procedures. Banks should implement an oversight program to monitor each contractor’s financial conditions and operations, the quality of service and support in fulfilling the contract, contract compliance and revision needs, and maintenance of business resumption contingency plans.

Appendix III: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

The following team members made key contributions to this report: Margaret Armen, Pat Bernard, Richard Burkard, Tamara Cross, Amber Edwards, Michele Fejfar, Jason Holsclaw, Joel Marus, Sheila McCoy, Jonathan McMurray, and Amanda Miller.