Testimony of Barry Steinhardt
Associate Director,
American Civil Liberties Union 

before the
Subcommittee on Government Management,
Information and Technology
of the
House Committee on Government Reform 

May 18, 2000
(Submitted June 13, 2000)

"Demand for Data" 

First, let me thank Chairman Horn, Ranking Member Turner and the Members of the Subcommittee for allowing the American Civil Liberties Union (ACLU) to submit this written testimony in support of H.R. 220, the Freedom and Privacy Restoration Act. The ACLU is a nationwide, non-profit organization consisting of nearly 300,000 members dedicated to protecting the principles of freedom and liberty set forth in the Bill of Rights. The privacy of Social Security Numbers is an important issue and we applaud the Committee's attention to the problem.  

This testimony will address a phenomenon that has been occurring for decades: the ever-increasing use and misuse of Social Security Numbers (SSNs) in our society. This treatment of SSNs as a unique identifier creates grave risks for individual privacy and the security of our identity. To counter these risks, my testimony will recommend that Congress should:  

1. Enact an amended version of H.R. 220, the Freedom and Privacy Restoration Act to phase out governmental uses of Social Security Numbers not directly related to the Social Security system and the collection of taxes;     
2. Ban the sale of Social Security Numbers; and     
3. Limit the demand by private individuals and corporations for Social Security Numbers and their use for purposes unrelated to the Social Security System. 

Background

The Social Security Number was not intended as a universal identifier. Indeed, when the Federal Government created the Social Security system in 1936, many observers feared that it would develop into a nation-wide identification program, by which every man, woman and child in America could be tagged and tracked, using a nine-number combination. The creators of the Social Security Number brushed aside these concerns, assuring Americans that SSNs would be used for no purpose other than to administer the new pension program.

Those proved to be hollow promises. The number of Federal agencies using Social Security Numbers has mushroomed in response to mounting requests for Social Security information from both public and private entities. In the public sector, after the Social Security system was created, the Internal Revenue Service began using Social Security Numbers as taxpayer ID numbers. Other government departments followed suit. Like the IRS, they wanted to use those numbers for identification purposes. The list of agencies that use Social Security Numbers includes such disparate bodies as the Selective Service system, Department of Agriculture, the Department of Health and Human Services, and even the Passport Office. 

This heavy use of Social Security Numbers is not limited to the Federal government. Many state agencies, including welfare offices and motor vehicles services, followed the lead of their Federal counterparts by making use of Social Security Numbers. Innumerable schools (particularly private institutions) demand the SSN for student identification purposes.

As an example of the widespread State use of Social Security Numbers, attached is a chart prepared by the ACLU of Wisconsin, which shows that 33 Wisconsin State agencies ranging from the Natural Resources Department to the Department of Tourism routinely use Social Security Numbers.

Financial services companies, health care providers, private employers, insurers, blood banks, information brokers, and mailing list companies are just a sampling of the many entities that also use Social Security Numbers to identify and track millions of Americans. As a result, throughout the public and private sectors, Social Security Numbers are becoming de facto national ID numbers.

Widespread use of Social Security Numbers Has Created an Epidemic of Identity Theft

Identity theft has become an epidemic in this country and the promiscuous use of the Social Security Number is a primary cause. Criminals use Social Security Numbers to open phony bank accounts and get credit cards, then run up massive bills. Sometimes, these crooks can access existing accounts and bankrupt the legitimate owners. These tactics have ruined many lives. Identity theft destroys credit ratings and prevents people from obtaining the opportunities that they rightfully deserve, including job opportunities, loans, and new homes. What is more, the victims of identity fraud rarely can resolve the problems caused by the theft of their identity, even after years of effort.

Worse still, identity fraud is on the increase. According to a 1998 report by the General Accounting Office (GAO), [U.S. Government Accounting Office, www.gao.gov, "Identity Fraud," 1998, p. 40, Report No. GGD-98-100BR],the number of identity theft cases increased 16-fold between 1992 and 1997. Many of the institutions that use Social Security Numbers, including major credit bureaus like TransUnion, say that they are now receiving approximately 1900 phone calls a day from identity theft victims. Recent news reports suggest that millions of Americans have been affected by this wave of criminal behavior. Experts believe that these difficulties are being exacerbated by the widespread availability of Social Security Numbers, as well as the computerization of the files that contain those nine-digit combinations.

Social Security Numbers are a Crucial Ingredient in Tracking and Profiling Americans

Social Security Numbers allow "cradle to grave" tracking of individuals. Time and again, the public has rejected the idea of a universal identifier. Yet despite public concern, Social Security Numbers are now given to Americans from the moment they are born. The extensive use of these numbers allows interested parties to trace private individuals as they conduct many basic, everyday transactions. Social Security Numbers allow a multitude of unrelated databases to be tied together. Because Social Security Numbers can be found on so many documents, slips of paper, and even computers files, it is all too simple to discover a startling quantity of personal information about an individual when armed with only their name and Social Security Number. 

Compounding these problems are various proposals to create a National ID card using Social Security Numbers. These plans would not only exacerbate the problem of identity fraud mentioned earlier, but lead to the creation of a surveillance society, where virtually any activity would require individuals to produce their papers. 

Congress recently responded to these concerns by repealing the portion of the 1996 Illegal Immigration Reform and Immigrant Responsibility Act that would have required state motor vehicle agencies to follow stringent Federal specifications when issuing driver licenses (such as putting a driver's Social Security Number on the license). 

Congress should take additional steps to return the use of Social Security Numbers to their original purpose and to lessen the dangers posed by their wide spread use. We make three specific proposals. 

Amend and Enact H.R. 220 To Sunset Non-Social Security Use of SSNs

Given the proliferation of the uses of Social Security Numbers by agencies of the federal government, it would be difficult to immediately prohibit their use by Federal agencies even if exceptions are made for administration of the Social Security system and the collection of taxes. But the Congress can begin phasing out their unrelated use and compel government agencies to justify their use.

Toward this end, H.R. 220 generally bans government agencies from using SSNs "or any derivative of such a number as the means of identifying any individual." (See H.R. 220, 106^th Cong. § 2 (1999).) This ban targets non-Social Security and Federal tax uses of SSNs by Federal and state governments only. The measure creates exceptions allowing the Social Security Administration and the Internal Revenue Service to continue using SSNs. (See H.R. 220 at § 2.) Moreover, as currently written, H.R. 220 would have virtually no impact on the private use of Social Security Numbers. 

In addition, the bill would prevent any two Federal agencies or instrumentalities from using the same identifying number with respect to any individual. (See Id. at § 4.) The measure would also bar the Federal government from creating a mandatory national "standard for identification of an individual." (See Id. at § 5.) The proposal would also amend the Privacy Act of 1974 and generally deter government agencies from requesting Social Security Numbers from individuals, on either a mandatory or voluntary basis. (See Id. at § 3; see also 5 U.S.C. § 552a (1999).) All of these restrictions would take effect January 1, 2001. (See Id. at § 6.)

Unfortunately, portions of the bill may present serious difficulties in their implementation. Section 4 would essentially force Federal agencies to check with one another as to whether the identifying numbers they use are the same, then create new numbers where necessary. (See H.R. 220 at § 4.) Section 5 might negate numerous statutes (and therefore the procedures to carry out those mandates) that could be construed as creating a mandatory national "standard for identification of an individual." (See Id. at § 5.) All of these things must be accomplished by January 1, 2001. (See Id. at § 6.) Because so many Federal agencies use Social Security Numbers, it may impossible for these entities to comply with H.R. 220's requirements within a few months.

As an alternative, we recommend that H.R. 220 be adopted with the following amendments:

• Give federal and state governmental agencies more time to adjust by sunsetting non-Social Security, non-federal income tax governmental use of the SSN by January 1, 2004, instead of January 1, 2001 as is currently provided in the bill;     
• Include provisions allowing Congress to step in to preserve any particular existing use of SSNs by federal and state agencies; and     
• Substitute for Sections 4 and 5 of the bill a study of the standards and numbers federal agencies use for identification purposes.

Outlaw the Sale of Social Security Numbers

The restrictions in H.R. 220 on Federal and state agencies only address part of the problem. Congress should act to curb the use of Social Security Numbers in the private sector by prohibiting the sale of SSNs. This regulation should apply to corporations as well as private individuals. This will curb tracking of ordinary citizens and make it harder for identity thieves to commit fraud. 

Congress should place severe restrictions on the ability of the private sector to demand the disclosure of Social Security Numbers and should require the private sector to phase out their use for purposes other than administering the Social Security and tax systems.

As a start, Congress should except Social Security Numbers from the "credit header" loophole. This loophole came from a 1994 consent decree with the credit bureau TRW (now known as Experian). The decree exempted many types of sensitive personal information contained in credit reports from the definition of "credit report" and from the protection of the Fair Credit Reporting Act. As a result, credit bureaus continue to give out Social Security Numbers under "credit headers." Excepting Social Security Numbers from credit headers would only partially close this loophole because these headers may also include individuals' names, addresses, dates of birth, previous addresses, and telephone numbers. 

Efforts to close this loophole without the help of Congress have run into fierce resistance. The Federal Trade Commission (FTC) made the most recent attempt at regulation several weeks ago. (See Privacy of Consumer Financial Information, 65 Fed. Reg. 33646 (2000) (to be codified at 16 C.F.R. pt. 313).) Unfortunately, this initiative has already run into great difficulty, partly because opponents have charged that the FTC lacks the Congressional authority to issue these new standards. Meanwhile, self-regulatory schemes have similarly failed to stem the tide. Congress should step forward and provide for stronger privacy protection of this information.

Control Unauthorized Use of Social Security Numbers

Last year, the General Accounting Office reported to the House Committee on Ways and Means about the growing use of the Social Security Number by governmental and private entities. (See U.S. GAO, "Social Security: Government and Commercial Use of the Social Security Number is Widespread," (No. HEHS-99-28, February 1999).) The GAO report noted that few Federal laws apply to state and local government disclosure and use of Social Security Numbers, while virtually no laws govern corporate use of Social Security Numbers. Congress should act to restrict businesses' and state and local governments' use of Social Security Numbers, particularly "when that use is unrelated to a specific federal requirement." (See Id. at 2.)

Furthermore, these standards must have some teeth. Congress should allow regulatory agencies to prosecute offenders. For example, the Federal Trade Commission should have the power to take action against companies that engage in unfair or deceptive trade practices related to their use of Social Security Numbers. In addition, Congress should provide individuals with a private right of action against individuals and corporations who do not abide by restrictions on the sale, use and disclosure of Social Security Numbers. Such a right of action would be consistent with other legislation Congress has enacted to protect the privacy of driver's license records and video rental records.