In addition, SSNs are used as breeder information to create additional  false identification documents, such as drivers’ licenses. Private Sector Entities Routinely Obtain and Use SSNs, and Certain Laws Affect The Disclosure of This Information

Private sector entities such as information resellers, CRAs, and health care  organizations routinely obtain and use SSNs. We found that these entities usually use SSNs for various  purposes, such as to build tools that verify an individual’s identity or  match existing records. Certain federal laws have limited the disclosures  private sector entities are allowed to make to their customers, and some  states have also enacted laws to restrict the private sector’s use of SSNs. Private Sector Entities Obtain SSNs from Public and Private Sources and Use SSNs for Various Purposes

Private sector entities such as information resellers, CRAs, and health care  organizations generally obtain SSNs from various public and private  sources and use SSNs to help identify individuals. We also found that Internet-based resellers rely extensively on public  sources and records displayed to the public. Large information resellers said that they generally  use the SSN as an identity verification tool. In  addition, given the open nature of certain government records, SSNs  appear in some records displayed to the public. Given the potential for  misuse, some government agencies are taking steps to limit their use and  display of SSNs and prevent the proliferation of false identities. Public Sector Entities Are Required by Laws and Regulations to Obtain SSNs and Use SSNs for Various Purposes

Government agencies obtain SSNs because a number of federal laws and  regulations require certain programs and federally funded activities to use  the SSN for administrative purposes. For example, personnel departments of  these agencies use SSNs to help them maintain internal records and  provide employee benefits. Documents that record financial transactions, such as  tax liens and property settlements, also contain SSNs to help identify the  correct individual. Moreover, not all agencies use the SSN as their  primary identification number for record-keeping purposes. We proposed that Congress  convene a representative group of officials from all levels of government  to develop a unified approach to safeguard SSNs used in all levels of  government and particularly those displayed in public records. However, the more frequently SSNs are obtained and  used, the more likely they are to be misused. Accordingly, policy makers will  have to balance the potential benefits of restrictions on the use of SSNs on  the one hand with the impact on legitimate needs for the use of SSNs on  the other. These permissible uses include:  for use by any government agency in carrying out its functions; for use in connection with matters of motor vehicle or driver safety and  theft; motor vehicle emissions; motor vehicle product alterations, recalls,  or advisories; motor vehicle market research activities, including survey  research; for use in the normal course of business by a legitimate business, but only  to verify the accuracy of personal information submitted by the individual  to the business and, if such information is not correct, to obtain the  correct information but only for purposes of preventing fraud by pursuing  legal remedies against, or recovering on a debt or security interest against,  the individual; for use in connection with any civil, criminal, administrative, or arbitral  proceeding in any federal, state, or local court or agency; for use in research activities; for use by any insurer or insurance support organization in connection  with claims investigation activities; for use in providing notice to the owners of towed or impounded vehicles; for use by a private investigative agency for any purpose permitted under  the DPPA; for use by an employer or its agent or insurer to obtain information  relating to the holder of a commercial driver’s license; for use in connection with the operation of private toll transportation  facilities; for any other use, if the state has obtained the express consent of the  person to whom a request for personal information pertains; for bulk distribution of surveys, marketing, or solicitations, if the state has  obtained the express consent of the person to whom such personal  information pertains; for use by any requester, if the requester demonstrates that it has obtained  the written consent of the individual to whom the information pertains; for any other use specifically authorized under a state law, if such use is  related to the operation of a motor vehicle or public safety.
Why GAO Did This Study

In 1936, the Social Security Administration (SSA) established the Social Security number (SSN) to track workers' earnings for social security benefit purposes. Today, private and public sector entities frequently ask individuals for SSNs in order to conduct their businesses and sometimes to comply with federal laws. Although uses of SSNs can be beneficial to the public, SSNs are also a key piece of information in creating false identities either for financial misuse or for assuming an individual's identity. The retention of SSNs in the public and private sectors can create opportunities for identity theft. In addition, the aggregation of personal information, such as SSNs, in large corporate databases, as well as the public display of SSNs in various records accessed by the public, may provide criminals the opportunity to easily obtain this personal information. Given the heightened awareness of identity crimes, this testimony focuses on describing (1) how private sector entities obtain, use, and protect SSNs, and (2) public sector uses and protections of SSNs.

What GAO Found

Private sector entities rely extensively on SSNs. We reported early this year that entities such as information resellers, consumer reporting agencies, and health care organizations routinely obtain SSNs from their business clients and public sources, such as government records that can be displayed to the public. These entities then use SSNs for various purposes, such as to verify an individual's identity or to match existing records, and have come to rely on the SSN as an identifier, which helps them determine a person's identity for the purpose of providing the services they offer. There is no single federal law that regulates the overall use or restricts the disclosure of SSNs by private sector entities. However, certain federal laws have helped to place restrictions on the disclosures of personal information private sector entities are allowed to make to their customers, and certain states have enacted laws to restrict the private sector's use of SSNs. Public sector entities also extensively use SSNs. All three levels of government use the SSN to comply with certain federal laws and regulations, as well as for their own purposes. These agencies rely on the SSN to manage records, verify benefit eligibility, collect outstanding debt, and conduct research and program evaluations. In addition, given the open nature of certain government records, SSNs appear in records displayed to the public such as documents that record financial transactions or court documents. Despite the widespread reliance on and use of SSNs, government agencies are taking steps to safeguard the SSN. For example, some agencies are not using the SSN as the primary identification number. In a previous report, we proposed that Congress consider developing a unified approach to safeguarding SSNs used in all levels of government and particularly those displayed in public records, and we continue to believe that this approach has merit. The use of SSNs by both private and public sector entities is likely to continue, but the more frequently SSNs are used, the more likely they are to be misused given the continued rise in identity crimes. In considering restrictions to SSN use, policy makers will have to balance the protections that could occur from such restrictions with legitimate business needs for the use of SSNs.