In addition,  Internet resellers also offered to sell information in various ways, from  packaged information, such as various information that would be  collected through a background check or a search of a person’s criminal  records to single types of information, such as a credit score. As shown  in table 3, individuals, businesses, and attorneys were the most frequently  identified clients. For the financial institution clients, resellers  mostly identified banks. Most of these resellers obtained their  information from public or nonpublic sources or a combination of both  sources. However, in one case we received unexpected and unrequested  information. We received one full nine-digit SSN  and four truncated SSNs. We also found a wide range of the costs for information services when we  tried to purchase SSNs. All resellers that provided truncated SSNs showed the first five digits and  masked the last four digits. One consumer reporting agency we spoke to told us that it  truncates the SSN by masking the first five digits on reports it provides  directly to consumers, by displaying only the last four digits. According to SSA officials, the law does not address the  use of the number by private and public sector entities. Therefore, we could not  determine if FCRA, GLBA, and DPPA were applicable to the majority of  resellers we reviewed. We also found 5 out of the 154 Internet resellers referenced state laws on  their Web sites. Matter for Congressional Consideration

Since there is no consistently practiced method for truncating SSNs, and  no federal agency has the authority to regulate how SSNs should be  truncated, Congress may wish to consider enacting standards for  truncating SSNs or delegating authority to SSA or some other  governmental entity to issue standards for truncating SSNs. To describe the types of readily identifiable Internet resellers that have  SSN-related services and characteristics of their businesses, we developed  a Web-based data collection instrument (DCI) for GAO analysts to  document selected information contained on the Internet resellers’ Web  sites. Our analyses found   154 Internet resellers with SSN-related services. The criteria we used to select the  resellers for our attempted purchases included the following (1) the Web  site advertised the sale of an SSN without the customer’s having to provide  the SSN of the subject of our inquiry, (2) the Web site advertised the sale  of an SSN to the general public, and (3) the transaction could be made  online through the Internet reseller’s Web site using a credit card. To determine the applicability of federal privacy laws to Internet resellers,  we reviewed federal laws and the resellers’ Web sites for information  about the resellers’ type of entity and sources of information. Although  Internet resellers generally did not provide information about the entity  and sources of information, they generally cited, and we recorded,  whether they stated adherence to any federal privacy laws.
Why GAO Did This Study

GAO previously reported on how large information resellers like consumer reporting agencies obtain and use Social Security numbers (SSNs). Less is known about information resellers that offer services to the general public over the Internet. Because these resellers provide access to personal information, SSNs could be obtained over the Internet. GAO was asked to examine (1) the types of readily identifiable Internet resellers that have SSN-related services and characteristics of their businesses, (2) the extent to which these resellers sell SSNs, and (3) the applicability of federal privacy laws to Internet resellers.

What GAO Found

We found 154 Internet information resellers with SSN-related services. Most of these resellers offered a range of personal information, such as dates of birth, drivers' license information, and telephone records. Many offered this information in packages, such as background checks and criminal checks. Most resellers also frequently identified individuals, businesses, attorneys, and financial institutions as their typical clients, and public or nonpublic sources, or both as their sources of information. In attempting to purchase SSNs from 21 of the 53 resellers advertising the sale of such information, we received 1 full SSN, 4 truncated SSNs displaying only the first five digits, and no SSNs from the remaining 16. In one case, we also received additional unrequested personal information including truncated SSNs of the search subject's neighbors. We also found that some other entities truncate SSNs by displaying the last four digits. According to experts we spoke to, there are few federal laws and no specific industry standards on whether to display the first five or last four digits of the SSN, and SSA officials told us the agency does not have the authority to regulate how other public or private entities use SSNs, including how they are truncated. We could not determine if federal privacy laws were applicable to the Internet resellers because such laws depend on the type of entity and the source of information, and most of the resellers' Web sites did not include this information. However, these laws could apply to resellers; 4 of the resellers we examined had Web sites identifying the type of entity they were. About one-half of the resellers cited adherence to one or more federal privacy laws and a few referenced state laws.