In  order to carry out the various missions of the federal government, federal  agencies collect and maintain personal information such as name, date of  birth, address, and SSNs to distinguish among individuals and ensure that  people receive the services or benefits they are entitled to under the law. SSA’s Disclosure Policy Allows Information Sharing with Law Enforcement under Certain Conditions, but is More Restrictive than the Privacy Act

While SSA’s policy permits the sharing of nontax information with law  enforcement, it does so only under certain conditions and is more  restrictive than both the law enforcement exception specified under the  Privacy Act and the disclosure policies of most federal agencies. However,  like SSA’s disclosure policy, the disclosure policies of the IRS and the  Bureau of the Census, which have disclosure requirements prescribed in  their statutes, are more restrictive than the Privacy Act and the disclosure  policies of most federal agencies. SSA  will provide information necessary to investigate or prosecute fraud or  other criminal activity in Social Security programs. Violent and serious crimes. Tax  information is disclosed consistent with IRC 6103. The law enforcement exception of the Privacy Act permits all federal  agencies to disclose personal information to law enforcement agencies  upon written request from the law enforcement agency. SSA Views Restrictions as Integral to Carrying Out Its Mission

SSA maintains that it must have a restrictive disclosure policy to protect  individuals’ personal information, even from law enforcement requests,  because much of the information the agency collects is especially personal  and was initially obtained under the pledge of confidentiality. SSA Has Provided Information to Law Enforcement Officials, but Confusion about the Disclosure Policy May Cause Inconsistent Application

Although SSA’s policy supports sharing limited information with law  enforcement under certain conditions, we found evidence that some SSA  field office staff are confused about the policy that could result in staff  applying it inconsistently. For example, one SSA field  office manager told us that nothing could be disclosed to law enforcement  if the request for information pertained to an individual suspected of  misusing an SSN because the individual had not been indicted or  convicted of this crime. However, SSA’s policy would appear to permit  disclosure in this situation. Most Law Enforcement Officials Found Shared Information Useful but Many Believed More Information Was Needed

Officials from federal, state, and local law enforcement agencies we spoke  with were generally satisfied with the information provided by SSA  although most would like more information on individuals. Law  enforcement officials indicated that, although in most cases SSA only  verified a name and SSN, the information received was useful to their  investigations and, in some cases, was enough to help convict an  individual of a crime. SSA places a high priority on privacy, and its policy for  disclosure to law enforcement agencies goes beyond the requirements of  the Privacy Act. As a possible  consequence of SSA staff and local law enforcement’s confusion about  SSA’s policy, law enforcement may be denied requested information even  though SSA’s policy permits its disclosure or law enforcement may receive  information that SSA’s policy does not permit. As we reported, SSA’s disclosure policy, as well as those  of IRS and the Census Bureau is more restrictive than most federal  agencies.
Why GAO Did This Study

Law enforcement agencies' efforts to investigate the events of September 11th increased awareness that federal agencies collect and maintain personal information on individuals such as name, social security number, and date of birth that could be useful to law enforcement. The Social Security Administration (SSA) is one of the country's primary custodians of personal information. Although the Privacy Act protects much of this information, generally, federal agencies can disclose information to law enforcement. However, determining when the need for disclosure takes priority over an individual's privacy is not clear. GAO was asked to describe (1) SSA's disclosure policy for law enforcement and how it compares with the Privacy Act and those of other federal agencies, (2) SSA's experience sharing information with law enforcement, and (3) law enforcement's experience obtaining information under SSA's policy.

What GAO Found

Although SSA's disclosure policy permits the sharing of information with law enforcement entities, it is more restrictive than the Privacy Act and the disclosure policies of most federal agencies. While the Privacy Act permits disclosures to law enforcement for any type of crime, SSA only allows disclosures under certain conditions. For example, for serious and violent crimes, SSA will disclose information to law enforcement if the individual whose information is sought has been indicted or convicted of that crime. Even when information is disclosed, it might be limited to results obtained from verifying a social security number and name unless the investigation concerns fraud in SSA or other federal benefit programs, then the agency can work with law enforcement officials as part of a task force or joint investigation. However, the disclosure policies for law enforcement of the Internal Revenue Service (IRS) and the Census Bureau, both of which have requirements prescribed in their statutes, are also more restrictive than the Privacy Act and the policies of most federal agencies. SSA officials consider SSA's disclosure policy integral to carrying out the agency's mission. The various restrictions in SSA's disclosure policy create a complex policy that is confusing and could cause inconsistent application across the agency's more than 1,300 field offices. This could result in uneven treatment of law enforcement requests. Because aggregated data were not available, GAO was unable to assess the extent to which SSA does not consistently apply its policy. However, GAO was told of instances in which SSA officials in some field offices did not give law enforcement information that appeared to be permitted under the policy as well as instances in which they gave them more than what appeared to be allowed. Generally, law enforcement officials find the limited information SSA shares useful to their investigation, but many law enforcement officials, particularly state and local law enforcement officials, are not familiar with the policy or the process for requesting information from SSA. Most law enforcement officials expressed a desire for more information than is currently permitted under SSA's policy, but SSA maintains that providing more information would hurt its ability to carry out its primary mission.