In recent years, companies have increasingly relied on the use of contractors to perform certain activities and functions related to their business operations. This trend has often been referred to as outsourcing. However, no commonly recognized definition of outsourcing exists, and there has been confusion over whether it encompasses only activities a company originally performed in-house or includes any activity a company may contract out. According to outsourcing experts, approximately 90 percent of businesses contract out some activity because they find either it is more economical to do so or other companies are better able to perform these activities. Some of the activities companies outsource will require that contractors be provided personal information about the companies’ customers in order to perform those activities; in some cases, this information includes SSNs. Originally, the Social Security Administration (SSA) created the SSN as part of a recordkeeping system to help manage the Social Security program. SSA uses the SSN as a means to track workers’ earnings and eligibility for Social Security benefits and assigns a unique number to every person as a work and retirement benefit record. Today, SSA generally issues SSNs to all U.S. citizens, but they are also available to non-citizens lawfully admitted to the United States as permanent residents. However, because of the number’s unique nature and broad applicability, the SSN has become the identifier of choice for government agencies and private businesses and is used for numerous non Social Security purposes, such as opening a bank account and receiving health insurance. As shown in table 1, certain federal laws have been enacted that place restrictions on some private sector entities’ use and disclosure of consumers’ personal information, including SSNs. Limits access to credit data that includes SSNs to those who have a permissible purpose under the law. Amends FCRA to allow, among other things, consumers who request a copy of their credit report to also request that the first 5 digits of their SSN (or similar identification number) not be included in the file; requires consumer reporting agencies and any business that uses a consumer report to adopt procedures for proper disposal. Creates a new definition of nonpublic personal information that includes SSNs and limits when financial institutions may disclose the information to nonaffiliated third parties. It also requires that financial services regulatory agencies establish standards for the entities under their agencies’ jurisdiction relating to administrative, technical, and physical safeguards to: insure the security and confidentiality of customer records and information; protect against any anticipated threats or hazards to the security or integrity of such protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer. To ensure compliance with these federal laws, some federal regulators conduct examinations of their respective institutions’ operations. For example, in the financial industry, federal agencies, such as the Office of the Comptroller of the Currency (OCC), the Federal Reserve Board (FRB), the Federal Deposit Insurance Corporation (FDIC) and the Securities and Exchange Commission (SEC) regulate banking or securities firms. OCC charters, regulates, and supervises all national banks, while FRB regulates bank holding companies and state-chartered banks that are members of the Federal Reserve System. FDIC regulates banks that are state-chartered banks that are not members of the Federal Reserve System. These banking regulators examine banking institutions for safety and soundness and compliance with applicable laws, including the Fair and Accurate Credit Transaction Act (FACTA), and GLBA. SEC regulates and examines investment advisers registered with the Commission and investment companies, including mutual funds, that engage primarily in investing, reinvesting, and trading in securities and that offer their own securities to the investing public. SEC also regulates and examines other market participants, including broker-dealers and self-regulatory organizations (SRO). As part of its examinations, SEC reviews these firms for compliance with GLBA’s safeguard provisions. In addition, SRO’s such as the New York Stock Exchange (NYSE) and National Association of Securities Dealers (NASD) examine their member broker-dealers to ensure compliance with applicable laws, self-regulatory rules, and SEC regulations, including GLBA’s safeguard provision. In 1978, the Federal Financial Institutions Examination Council (FFIEC) was created as a formal interagency body authorized to prescribe uniform principles, standards, and report forms for the federal examination of financial institutions. The council’s membership is composed of the federal bank regulators—FDIC, FRB, OCC—plus the regulators for credit unions and thrift institutions—the National Credit Union Administration (NCUA) and the Office of Thrift Supervision (OTS), respectively. The FFIEC has issued guidance related to outsourcing services that provides a framework for the FFIEC agencies to examine their banks’ contractor management programs and exercise enforcement options if financial institutions do not establish and maintain adequate information security programs. The FFIEC also coordinates examinations of banks’ information technology service providers and separate guidance has been issued for conducting these examinations. Along with OTS, the three bank regulators have jointly issued regulations that generally require each financial institution to develop, implement, and maintain, as part of its existing information security program, appropriate measures to properly dispose of consumer information derived from consumer reports. Together, these agencies have also issued interpretive guidance requiring every financial institution to develop and implement a response program, including customer notice provisions, designed to address incidents of unauthorized access to customer information maintained by the institution or its service provider. Under the Bank Service Company Act, as amended, the federal banking agencies have authority to regulate and examine certain services provided to banks by third parties—including contractors—to the same extent as if those services were performed directly by the bank. IRS is responsible for ensuring that tax preparers are complying with certain confidentiality provisions in the IRC, primarily Section 7216. IRC § 7216 prohibits the unauthorized use or disclosure of tax return information by tax return preparers. Tax return preparers are also subject to GLBA. However, those provisions do not supersede, alter, or affect the preexisting requirements of IRC § 7216, although FTC has oversight and enforcement authority over tax preparers’ compliance with GLBA. FCC is responsible for regulating interstate and international communications by radio, television, wire, satellite, and cable, and enforcing the provisions of the Telecommunications Act of 1996, which restricts the use of customer proprietary network information (CPNI). CPNI is the data collected by telecommunications corporations on a consumer’s telephone calls. It includes the time, date, duration, and destination number of each call, the type of network a consumer subscribes to, and any other information that appears on the consumer’s telephone bill. SSNs are not part of CPNI. FTC is an independent agency whose mission is, in part, to prevent business practices that are anticompetitive, deceptive, or unfair to consumers. As part of its responsibilities, FTC enforces consumer privacy provisions and safeguards of FCRA, FACTA, and GLBA not enforced by other federal agencies. FTC is also required to collect identity theft complaints. FTC statistics currently indicate that identity theft is growing. For 2004, FTC reported that it received about 247,000 complaints from individuals stating that they were victims of identity fraud, which was up from just over 86,000 complaints reported in 2001. While the reported number of victims and likely identity crimes has increased, the extent to which these statistics represent company security breaches is not well documented. However, various news reports and identity crime experts have attributed some identity thefts and credit card fraud to security breaches involving third party companies. Banks, securities firms, telecommunication companies, and tax preparation companies we interviewed routinely obtain SSNs from their customers for authentication and identification purposes. All the companies we interviewed contracted out various services, such as data processing, administrative, and customer service functions. Although these companies may share consumer information, such as SSNs, with contractors that provide services to their customers, company officials said that they only share such information with their contractors for limited purposes, generally when it is necessary or unavoidable. Officials from selected banking, securities, telecommunications, and tax preparation companies told us that they obtain and use SSNs primarily for authentication and identification purposes related to fraud prevention, credit verification, and complying with federal law. However, these officials told us that SSNs were not distinguished from other types of customers’ personally identifiable information. Company officials also told us that the same safeguards applied to SSNs as all other pieces of their customers’ personal information. Officials from banks and securities firms we interviewed said that their companies obtained SSNs directly from their customers to comply with federal law when the customer opened a new account or conducted certain financial transactions. For example, the Bank Secrecy Act, as amended by the USA Patriot Act mandates that, among other things, financial institutions must verify each new account holder’s identity when opening an account, in an effort to curtail money laundering and terrorist financing. According to company officials we interviewed, other federal laws and regulations require both banks and securities firms to use SSNs for tax-reporting and customer-identity-verification purposes. In addition, some bank and securities firm officials said that due to its uniqueness, their companies also incorporated the SSN into their fraud prevention and authentication programs. Telecommunication company officials we interviewed said that their companies are not required by federal law to collect or use the SSN, but that potential customers are asked to provide their SSN before establishing an account. These officials explained that their companies primarily use the SSN to query credit reporting agencies’ records in order to verify a potential customer’s creditworthiness, without which their companies would not be able to extend services to an individual quickly. In those instances where an individual did not have an SSN or refused to provide it, company officials said that their companies offered customers the option of using a pre paid service or providing a monetary deposit.