Government Agencies Collect and Use SSNs for a Variety of Purposes

A number of federal laws and regulations require agencies at all levels of  government to frequently collect and use SSNs for various purposes. Private Sector Entities Collect SSNs from Various Sources for Identity Verification Purposes

Certain private sector entities, such as information resellers, consumer  reporting agencies (CRAs), and healthcare organizations collect SSNs  from public and private sources, as well as their customers, and primarily  use SSNs for identity verification purposes. In addition, banks, securities  firms, telecommunication firms, and tax preparers engage in third party  contracting and sometimes share SSNs with their contractors for limited  purposes, generally when it is necessary and unavoidable. Vulnerabilities Persist in Federal Laws Addressing SSN Collection and Use by Private Sector Entities

In our reviews of private sector entities’ collection and use of SSNs, we  found variation in how different industries are covered by federal laws  protecting individuals’ personal information. For example, although  federal laws place restrictions on reselling some personal information,  these laws only apply to certain types of private sector entities, such as  financial institutions. Consequently, information resellers are not covered  by these laws, and there are few restrictions placed on these entities’  ability to obtain, use, and resell SSNs. Vulnerabilities also exist in federal law and agency oversight for different  industries that share SSNs with their contractors. For example, while  federal law and oversight of the sharing of personal information in the  financial services industry is very extensive, federal law and oversight of  the sharing of personal information in the tax preparation and  telecommunications industries is somewhat lacking. Specifically, in our  Internet resellers report, several resellers provided us with truncated SSNs  showing the first five digits, though other entities truncate SSNs by  showing the last four digits. Therefore, because of the lack of SSN  truncation standards, even truncated SSNs remain vulnerable to potential  misuse by identity thieves and others. While we suggested that the  Congress consider enacting standards for truncating SSNs or delegating  authority to SSA or some other governmental entity to do so, SSN  truncation standards have yet to be addressed at the federal level. However, because of this widespread use of SSNs, and the  vulnerabilities that remain to protecting this identifier in both sectors,  SSNs continue to be accessible to misuse by identity thieves and others. Social Security Numbers: Use Is Widespread and Protections Vary in  Private and Public Sectors. Social Security Numbers: Private Sector Entities Routinely Obtain and  Use SSNs, and Laws Limit the Disclosure of This Information. Social Security Numbers: Ensuring the Integrity of the SSN.
Why GAO Did This Study

Since its creation, the Social Security number (SSN) has evolved beyond its intended purpose to become the identifier of choice for public and private sector entities, and it is now used for myriad non-Social Security purposes. This is significant because a person's SSN, along with name and date of birth, are the key pieces of personal information used to perpetrate identity theft. Consequently, the potential for misuse of the SSN has raised questions about how private and public sector entities obtain, use, and protect SSNs. Accordingly, this testimony focuses on describing the (1) use of SSNs by government agencies, (2) use of SSNs by the private sector, and (3) vulnerabilities that remain to protecting SSNs. For this testimony, we primarily relied on information from our prior reports and testimonies that address public and private sector use and protection of SSNs. These products were issued between 2002 and 2006 and are listed in the Related GAO Products section at the end of this statement. We conducted our reviews in accordance with generally accepted government auditing standards.

What GAO Found

A number of federal laws and regulations require agencies at all levels of government to frequently collect and use SSNs for various purposes. For example, agencies frequently collect and use SSNs to administer their programs, link data for verifying applicants' eligibility for services and benefits, and conduct program evaluations. In the private sector, certain entities, such as information resellers, collect SSNs from public sources, private sources, and their customers and use this information for identity verification purposes. In addition, banks, securities firms, telecommunication firms, and tax preparers engage in third party contracting, and consequently sometimes share SSNs with their contractors for limited purposes. Vulnerabilities persist in federal laws addressing SSN collection and use by private sector entities. In particular, we found variation in how different industries are covered by federal laws protecting individuals' personal information. For example, although federal laws place restrictions on reselling some personal information, these laws apply only to certain types of private sector entities, such as financial institutions. Consequently, information resellers are not covered by these laws, and there are few restrictions placed on these entities' ability to obtain, use, and resell SSNs for their businesses. Vulnerabilities also exist in federal law and agency oversight for different industries that share SSNs with their contractors. For example, while federal law and oversight of the sharing of personal information in the financial services industry are very extensive, federal law and oversight of the sharing of personal information in the tax preparation and telecommunications industries are somewhat lacking. Moreover, in our Internet resellers report, several resellers provided us with truncated SSNs showing the first five digits, though other information resellers and consumer reporting agencies truncate SSNs to show the last four digits. Therefore, because of the lack of SSN truncation standards, even truncated SSNs remain vulnerable to potential misuse by identity thieves and others. While we suggested that the Congress consider enacting standards for truncating SSNs or delegating authority to the Social Security Administration or some other governmental entity to do so, SSN truncation standards have yet to be addressed at the federal level.