	Background

The Social Security Act of 1935 authorized the Social Security  Administration (SSA) to establish a record-keeping system to manage the  Social Security program, which resulted in the creation of the SSN. The widespread disclosure of  SSNs in public records has raised concern because it can put individuals at  increased risk of identity theft. In addition, banks, securities firms,  telecommunication firms, and tax preparers engage in third party  contracting and sometimes share SSNs with their contractors for limited  purposes. Government Entities Are Required by Laws and Regulations to Collect SSNs, and Use Them for Various Purposes

As required by a number of federal laws and regulations, agencies at all  levels of government frequently collect and use SSNs to administer their  programs, to link data for verifying applicants’ eligibility for services and  benefits, and to conduct program evaluations. Private Sector Entities Obtain SSNs from Public and Private Sources and Use Them for Various Purposes

Private sector entities such as information resellers, CRAs, and health care  organizations generally obtain SSNs from various public and private  sources. Finally, health care  organizations also use the SSN to help verify the identity of individuals. No Single Law Governs the Use and Disclosure of SSNs Although Various Laws Have Been Enacted That Help Protect SSNs

Although no single law comprehensively governs the use and disclosure of  SSNs, certain federal laws restrict the use and disclosure of personal  information, including SSNs, by government agencies or private sector  entities. Many states have begun to enact laws to restrict the use and display of  SSNs. Subsequently, other states have enacted laws restricting the use and  display of SSNs. Finally, Congress is currently considering consumer privacy legislation,  which in some cases includes SSN restrictions. More Could Be Done To Protect SSNs

Although laws at both state and federal levels have helped to restrict SSN  display and protect individual’s personal information, clearly gaps remain. In our third party  contractors’ review, we reported that federal regulation and oversight of  SSN sharing varies across four industries we reviewed, revealing gaps in  federal law and agency oversight for different industries that share SSNs  with their contractors. We also found that there are few restrictions placed on certain entities’  abilities such as information resellers to resell SSNs in the course of their  business. Some of these agencies have begun taking action to remove SSNs from  identification cards. GAO Has Proposed Matters for Congressional Consideration and Recommendations

In order to address the issues we found, GAO has proposed matters for  congressional consideration and recommended that a federal agency take  action. To date, OMB has implemented two of our three recommendations,  but Congress is still considering what other actions to take. In our report on the display of SSNs on identification cards and in  public records, we recommended that OMB identify all those federal  activities that require or engage in the display of 9-digit SSNs on health  insurance, identification, or any other cards issued to federal  government personnel or program beneficiaries, and devise a  governmentwide policy to ensure a consistent approach to this type of  display. The lack of a broad, uniform policy  allows for inconsistent, but persistent exposure of the SSN. Conclusions

The use of SSNs by both public and private sector entities is likely to  continue given that it is used as the key identifier by most of these entities  and there is currently no other widely accepted alternative. SSNs are still widely used and publicly available, although becoming less  so. Yet, more could be done to protect  SSNs. Social Security Numbers: Private Sector Entities Routinely Obtain and  Use SSNs, and Laws Limit the Disclosure of This Information. This is a work of the U.S. government and is not subject to copyright protection in the  United States.
Why GAO Did This Study

In 1936, the Social Security Administration established the Social Security number (SSN) to track worker's earnings for Social Security benefit purposes. Since its creation, the SSN has evolved beyond its original purpose and has become the identifier of choice for public and private sector entities. Today, the SSN is a key piece of information often sought by identity thieves. Once the SSN is obtained fraudulently, it can then be used to create false identities for financial misuse or assuming another individual's identity. Congress and some states have recognized the importance of restricting the use and display of SSNs. GAO has issued a number of reports and testimonies about the various aspects of SSN use in both public and private sectors and what could be done to further protect individual's SSNs. Accordingly, this testimony focuses on describing (1) the use of SSNs by government agencies and certain private sector entities, (2) the federal laws that regulate the use and disclosure of SSNs, and (3) the gaps that remain in protecting the SSN and what more could be done.

What GAO Found

SSN use is widespread by both the public and private sectors. Agencies at all levels of government frequently collect and use SSNs to administer their programs, verify applicants' eligibility for services and benefits, and perform research and evaluations of their programs. In addition, SSNs are available in a variety of public records. Certain private sector entities routinely obtain SSNs from various public and private sources, and use SSNs for various purposes, such as to build tools that verify an individual's identity or match existing records. In addition, private sector entities that engage in third party contracting sometimes share SSNs with their contractors for limited purposes. There is no one law that comprehensively regulates SSN use and protections. However, certain federal laws have been enacted to restrict the use and disclosure of consumers' personal information, including SSNs. In addition, certain states have begun to enact their own legislation restricting the use and display of SSNs by public and private sector entities, which has subsequently led other states to start enacting similar legislation. Finally, Congress is currently considering several proposals to restrict SSN use and display, similar to state legislation. Although some action has been taken at the federal and state level to protect SSNs, more could be done. In the course of this work, GAO found that there were gaps in the practices for protecting SSNs within government agencies and across industry sectors, such as a lack of uniformity at all levels of government to assure the security of the SSN; gaps in the federal law and oversight in different industries that share SSNs with their contractors; exposure of SSNs in public records and identification cards under the auspices of the government; and few restrictions on certain entities' abilities to obtain and use SSNs in the course of their business. To address some of these issues, GAO has made recommendations and proposed matters for congressional consideration. To date, OMB has implemented two of these recommendations and some agencies have begun to take steps to eliminate SSNs from their identification cards. Congress is still considering actions to take to address the issues that remain.