	Background

The Social Security Act of 1935 authorized the Social Security  Administration (SSA) to establish a record-keeping system to manage the  Social Security program, which resulted in the creation of the SSN. In 1998, Congress made identity theft a federal crime when it enacted the  Identity Theft and Assumption Deterrence Act (Identity Theft Act). Public Sector Entities Use SSNs, and Some Agencies Limit Their Display

As required by a number of federal laws and regulations, agencies at all  levels of government frequently collect and use SSNs to administer their  programs, to link data for verifying applicants’ eligibility for services and  benefits, and to conduct program evaluations. Government agencies use SSNs for a variety of reasons. In addition, SSNs are sometimes used for  statistics, research, and evaluation. SSNs Are Widely Available in Public Records Held by States, Local Jurisdictions, and Courts, but Many of These Agencies Are Taking Steps to Limit Display

SSNs are publicly available throughout the United States, primarily at the  state and local levels of government. Certain Private Sector Entities Routinely Obtain and Use SSNs

Private sector entities such as information resellers, credit reporting  agencies, and health care organizations routinely obtain and use SSNs. Because the SSN is a unique  identifier, we found that these entities use SSNs for various purposes, such  as building tools to aid in verifying an individual’s identity or matching  existing data. Private Sector Entities Obtain SSNs from Public and Private Sources

Private sector entities such as information resellers, CRAs, and health care  organizations generally obtain SSNs from various public and private  sources. In addition to these  federal laws, many states have enacted their own legislation to restrict the  use and display of SSNs, focusing on public display restrictions, such as  the display of SSNs on identification cards, SSN solicitation, and customer  notifications when SSNs are compromised. In the last year, Congress has  also introduced consumer privacy legislation similar to enacted state  legislation, which in some cases includes SSN restrictions. Federal and State Laws Limit the Use and Disclosure of Personal Information, Including SSNs

Certain federal and state laws have placed restrictions on entities’ use and  disclosure of consumers’ personal information, including SSNs. Notably, in 2001, California enacted a law to restrict the use and display of  SSNs. For example, New York law makes identity theft a crime. Furthermore, some states have also included identity theft victim  assistance provisions in their laws. The increased availability and aggregation of personal information in  public and private sector databases and via the Internet has provided new  opportunities for individuals to engage in fraudulent activities. State legislatures have also placed restrictions on SSNs by enacting laws  that restrict the use and display of SSNs and prohibit the theft of  individuals' personal information. Financial institutions are permitted to disclose consumers’  nonpublic personal information without offering them an opt-out right in  some of the following circumstances:  to effect a transaction requested by the consumer in connection with a  financial product or service requested by the consumer; maintaining or  servicing the consumer’s account with the financial institution or  another entity as part of a private label credit card program or other  extension of credit; or a proposed or actual securitization, secondary  market sale, or similar transaction;  to protect the confidentiality or security of the consumer’s records; to  prevent actual or potential fraud, for required institutional risk control  or for resolving customer disputes or inquiries, to persons holding a  legal or beneficial interest relating to the consumer, or to the  consumer’s fiduciary;  to the extent specifically permitted or required under other provisions  of law and in accordance with the Right to Financial Privacy Act of  1978, to law enforcement agencies, self-regulatory organizations, or for  an investigation on a matter related to public safety;  to a consumer reporting agency in accordance with the Fair Credit  Reporting Act or from a consumer report reported by a consumer  reporting agency;   to comply with federal, state, or local laws; an investigation or  subpoena; or to respond to judicial process or government regulatory  authorities.
Why GAO Did This Study

In 1936, the Social Security Administration established the Social Security number (SSN) to track worker's earnings for Social Security benefit purposes. Despite its narrowly intended purpose, the SSN is now used for a myriad of non-Social Security purposes. Today, SSNs are used, in part, as identity verification tools for services such as child support collections, law enforcement enhancements, and issuing credit to individuals. Although these uses can be beneficial to the public, the SSN is now a key piece of information in creating false identities. The aggregation of personal information, such as SSNs, in large corporate databases and the increased availability of information via the Internet may provide criminals the opportunities to commit identity theft. Although Congress and the states have enacted a number of laws to protect consumers' privacy, the public and private sectors' continued use of and reliance on SSNs, and the potential for misuse, underscore the importance of strengthening protections where possible. Accordingly, this testimony focuses on describing (1) the public use of SSNs, (2) the use of SSNs by certain private sector entities, and (3) certain federal and state laws regulating the use of SSNs and identity theft.

What GAO Found

The public and private sector use of SSNs is widespread. Agencies at all levels of government frequently collect and use SSNs to administer their programs, verify applicants' eligibility for services and benefits, and conduct research and evaluations of their programs. Although some government agencies are taking steps to limit the use and display of SSNs, these numbers are still widely available in a variety of public records held by states, local jurisdictions, and courts. In addition, certain private sector entities that we have reviewed, such as information resellers, credit reporting agencies (CRAs), and health care organizations, also routinely obtain and use SSNs. These entities often obtain SSNs from various public sources or their clients and use SSNs for various purposes, such as building tools that aid in verifying an individual's identity or matching records from various sources. Given the extent to which government and private sector entities use SSNs, Congress has enacted federal laws to restrict the use and disclosure of consumers' personal information, including SSNs. Many states have also enacted their own legislation to restrict the use and display of SSNs, focusing on public display restrictions, SSN solicitation, and customer notifications when SSNs are compromised. Furthermore, Congress has recently introduced consumer privacy legislation similar to enacted state legislation, which in some cases includes SSN restrictions. Although there is some consistency in the various proposed and enacted federal and state laws, gaps remain in protecting individuals' personal information from fraud and identity theft. Some federal agencies are beginning to collect statistics on identity theft crime, which appears to be growing. For example, recent statistics show that identity theft is increasing in New York. In 2004, Federal Trade Commission (FTC) statistics indicated that over 17,600 New Yorkers reported being a victim of identity theft, which is up from roughly 7,000 in 2001.