Because of the number’s  uniqueness and broad applicability, the SSN has become the identifier of  choice for government agencies and private businesses, and thus it is used  for a myriad of non–Social Security purposes. They may provide their services to a  variety of customers, either to specific business clients or through the  Internet to anyone willing to pay a fee. We testified  before the Subcommittee on Social Security, House Committee on Ways  and Means, about SSA’s enumeration and verification processes, and  reported that the aggregation of personal information, such as SSNs, in  large corporate databases, as well as the public display of SSNs in various  public records, may provide criminals the opportunity to commit identity  crimes. Private Sector Entities Routinely Obtain SSNS from Their Business Clients and Use Them Largely as a Tool to Identify Individuals

Information resellers, CRAs, and health care organizations routinely  obtain SSNs from their business clients and use SSNs for various  purposes, such as to build tools that verify an individual’s identity or  match existing records. Like information resellers, CRAs also obtain SSNs from their customers or  the businesses that furnish data to them, as well as from private and public  sources. Finally, health care organization officials said that they obtain SSNs from  individuals themselves and companies that offer health care plans. CRAs Use SSNs as Identifiers and to Match Incoming Data with Their Existing Databases

CRAs use SSNs as the primary identifier of individuals that enables them  to match the information they receive from their business clients with the  information stored in their databases on individuals. Federal and State Laws Affect the Disclosure of Personal Information, and Businesses Say They Have a Proprietary Interest in Safeguarding SSNs

Information resellers, CRAs, and health care organization officials said  that certain federal laws have helped to limit the disclosures they are  allowed to make to their customers. Finally, at least six states have enacted laws to restrict the  private sector’s use of SSNs, and California’s SSN law has had some effect  nationwide. In addition, our review of state legislation and interviews of  state and industry officials show several state laws are very similar to  California’s law. Some State Laws and Regulations Extend beyond Similar Federal Restrictions

We found that regulations and laws in 2 of the 18 states we reviewed do  not address SSNs specifically but do extend beyond federal restrictions  regarding the sharing of “personal information,” which may include SSNs. Private sector officials we spoke to agreed that, given the continued rise in  identity crimes, removing SSNs from public display is a step in the right  direction. Appendix I: Scope and Methodology

To describe how information resellers, CRAs, and health care  organizations obtain and use SSNs, we expanded on previous GAO work  in this area and we interviewed officials from large information resellers,  CRAs, health care organizations, the Consumer Data Industry Association  (an international trade association that represents consumer information  companies), and the Social Security Administration. We also had our  investigators access six Internet-based information resellers’ Web sites. Each  association asked some of its members to determine how they obtained  and used SSNs. To determine the laws and practices relevant to safeguarding SSNs, we  determined what federal laws were helping to protect SSNs through our  discussions with information resellers, CRAs, health care organizations,  and the Federal Trade Commission. These permissible uses include:  for use by any government agency in carrying out its functions; for use in connection with matters of motor vehicle or driver safety and  theft; motor vehicle emissions; motor vehicle product alterations, recalls,  or advisories; motor vehicle market research activities, including survey  research; for use in the normal course of business by a legitimate business, but only  to verify the accuracy of personal information submitted by the individual  to the business and, if such information is not correct, to obtain the  correct information but only for purposes of preventing fraud by pursuing  legal remedies against, or recovering on a debt or security interest against,  the individual; for use in connection with any civil, criminal, administrative, or arbitral  proceeding in any federal, state, or local court or agency; for use in research activities; for use by any insurer or insurance support organization in connection  with claims investigation activities; for use in providing notice to the owners of towed or impounded vehicles; for use by a private investigative agency for any purpose permitted under  the DPPA; for use by an employer or its agent or insurer to obtain information  relating to the holder of a commercial driver’s license;  for use in connection with the operation of private toll transportation  facilities; for any other use, if the state has obtained the express consent of the  person to whom a request for personal information pertains; for bulk distribution of surveys, marketing, or solicitations, if the state has  obtained the express consent of the person to whom such personal  information pertains; for use by any requester, if the requester demonstrates that it has obtained  the written consent of the individual to whom the information pertains; for any other use specifically authorized under a state law, if such use is  related to the operation of a motor vehicle or public safety. Congress has limited the use of consumer reports to protect consumers’  privacy.
Why GAO Did This Study

In 1936, the Social Security Administration (SSA) established the Social Security number (SSN) to track workers' earnings for Social Security benefit purposes. However, the SSN is also used for a myriad of non-Social Security purposes. Today, public and private sector entities view the SSN as a key piece of information that enables them to conduct their business and deliver services. However, given the apparent rise in identity crimes as well as the rapidly increasing availability of information over the Internet, Congress has raised concern over how certain private sector entities obtain, use, and safeguard SSN data. In previous reports, we discussed the benefits of government and commercial entities using SSNs. We also examined how certain private sector entities and the government obtain, use, and safeguard SSNs. This report provides additional information on private sector uses of SSNs. The Chairman, Subcommittee on Social Security, House Committee on Ways and Means, asked that GAO examine the private sector use of SSNs by businesses most likely to obtain and use them including information resellers, consumer reporting agencies (CRAs), and health care organizations. Specifically, our objectives were to (1) describe how information resellers, CRAs, and some health care organizations obtain and use SSNs and (2) discuss the laws and practices relevant to safeguarding SSNs and consumers' privacy. GAO makes no recommendations.

What GAO Found

Information resellers, consumer reporting agencies, and some health care organizations routinely obtain SSNs from their customers and have come to rely on SSNs as identifiers that help them determine an individual's identity and accumulate information about individuals. Larger information resellers usually obtain SSNs from their customers and use them to determine the identity of an individual for purposes such as employment screening, credit information, and criminal history. Other Internet-based information resellers whose Web sites we accessed also obtain SSNs from their customers and scour public records and other publicly available information to provide the information to persons willing to pay a fee. CRAs, too, are large users of SSNs. They obtain SSNs from businesses that furnish individuals' data to them and use SSNs to determine consumers' identities and match the information they receive from businesses with information stored in consumers' credit files. Finally, health care organizations obtain SSNs from individuals themselves and companies that offer health care plans and use them as identifiers. Some health care organizations use SSNs as member identification numbers. Certain federal laws help to safeguard consumers' personal information, including SSNs, by restricting the disclosure of and access to such information, and private sector officials we spoke with said that they indeed take steps to safeguard the SSN information they collect. Information resellers, CRAs, and health care organizations told us they take steps to safeguard SSN data in part for business purposes but also because of federal and state laws that require such safeguards. Finally, some states are taking steps, legislatively, to address consumer concerns regarding SSN use and privacy of their personal information. Of the 18 states we examined, at least 6 had enacted laws specifically restricting private sector use and display of SSNs. California's law, in particular, has had some nationwide effect on business practices in places where some businesses have discontinued the display of SSNs in all of their locations. Also, our review shows that several state laws are similar to California's. In addition, while some state laws and regulations we reviewed did not restrict or prohibit SSN use or display specifically, they did extend beyond federal restrictions regarding the sharing of personal information.