Private Sector Companies We Interviewed Routinely Use Third Party Contractors and Occasionally Share SSNs with Them

Banks, securities firms, telecommunication companies, and tax  preparation companies we interviewed routinely obtain SSNs from their  customers for authentication and identification purposes. All the  companies we interviewed contracted out various services, such as data  processing, administrative, and customer service functions. Although  these companies may share consumer information, such as SSNs, with  contractors that provide services to their customers, company officials  said that they only share such information with their contractors for  limited purposes, generally when it is necessary or unavoidable. Furthermore, we found that some  industry associations have voluntarily developed guidance for their  members regarding the sharing of personal information with third parties. Federal Regulation and Oversight of SSN Sharing Varies Widely Among the Industries We Reviewed

Federal regulation and oversight of SSN sharing varies across the four  industries we reviewed, revealing gaps in the federal law and oversight in  different industries that share SSNs with their contractors. Federal law  and oversight of the sharing of personal information in the financial  services industry is very extensive: Financial services companies must  comply with GLBA requirements for safeguarding customer’s personal  information, and regulators have an examination process in place that  includes determining whether banks and securities firms are safeguarding  this information. IRS has regulations and guidance in place to restrict the  disclosure of SSNs by tax preparers and their contractors, but does not  perform periodic reviews of tax preparers’ compliance. Because it believes  that it lacks statutory authority to do so, FCC has not issued regulations  covering SSNs and also does not periodically review telecommunications  companies to determine whether they are safeguarding such information. State Laws Also Affect the Disclosure and Sharing of SSNs with Third Parties

Company officials informed us of laws in 15 states they believe either  affect how they share sensitive personal information including SSNs with  their contractors or limit both their own and their contractors use and  handling of this information. Closely evaluate all contracts to ensure necessary provisions for  assuring security and confidentiality are included.
Why GAO Did This Study

Recent data breaches highlight how identity theft may occur when businesses share individuals' personal information, including Social Security Numbers (SSNs), with contractors. Because private sector entities are more likely to share consumers' personal information via contractors, members of Congress raised concerns about the protection of this information in contractual relationships. In response, GAO examined (1) how entities within certain industries share SSNs with contractors; (2) the safeguards and notable industry standards in place to ensure the protection of SSNs when shared with contractors; and (3) how federal agencies regulate and monitor the sharing and safeguarding of SSNs between private entities and their contractors.

What GAO Found

Banks, securities firms, telecommunication companies, and tax preparation companies share SSNs with contractors for limited purposes. Firms GAO interviewed routinely obtain SSNs from their customers for authentication and identification purposes, and contract out various services, such as data processing and customer service functions. Although these companies may share consumer information, such as SSNs, with contractors, company officials said that they only share such information with their contractors when it is necessary or unavoidable. Companies in the four business sectors GAO studied primarily relied on accepted industry practices and used the terms of their contracts to protect the personal information shared with contractors. Most company officials stated that their contracts had provisions for auditing and monitoring to assure contract compliance. Some noted that their industry associations have also developed general guidance for their members on sharing personal information with third parties. Federal regulation and oversight of SSN sharing varied across the four industries GAO reviewed, revealing gaps in federal law and agency oversight in the four industries GAO reviewed that share SSNs with contractors. Financial services companies must comply with the Gramm-Leach-Bliley Act (GLBA) for safeguarding customers' personal information and regulators have an examination process in place to determine whether banks and securities firms are safeguarding this information. IRS has regulations and guidance in place to restrict the disclosure of SSNs by tax preparers and their contractors, but does not perform periodic reviews of tax preparers' compliance. Because the Federal Communications Commission (FCC) believes that it lacks statutory authority to do so, it has not issued regulations covering SSNs and also does not periodically review telecommunications companies to determine whether they are safeguarding such information.