State laws restricting private use of Social Security numbers

Social Security Number Protection Legislation for States

Text of the CU/U.S. PIRG
model state bill to reduce solicitation
of Social Security numbers and get SSNs
out of the mail and off of ID cards

SUMMARY

• Reducing the collection, printing, mailing, and display of Social Security numbers (SSNs) is a key element in reducing identity theft.
• Companies put individuals at heightened risk of identity theft when they ask for SSNs they do not need, places the SSN on identification cards and cards used to access goods or services, print the SSN on documents such as pay stubs, mail documents containing the SSN, or require individuals to transmit an SSN over the Internet.
• A thief who gets a consumer’s name and SSN can open new accounts unless the consumer has placed a security freeze to bar access to his or her credit reporting files.  The Social Security number has been called the “magic key” for identity thieves, by George Washington University law school professor Daniel Solove.  He also said: “Anyone can easily find it [the Social Security number] out…It’s used everywhere, and it’s really hard to change if it falls in the wrong hands. How could you come up with a worse system?” (1)
• It is time for a change in the use of SSNs.  Part of that change is reducing the private collection, display, and mailing of SSNs.

The SSN has evolved beyond its intended purpose to become a near-universal identifier used by private and public sector entities.(2) The widespread use of the SSN has made it a valuable target for identity thieves. According to a U.S. Government Accountability Office report released June 2007, “SSNs are a key piece of information used to create false identities for financial misuse or to assume another individual’s identity.”(3) A 2007 Federal Trade Commission report found that approximately 8.3 million Americans were victims of some form of ID theft in the year 2005.(4)  Consumers Union estimates that this is over 22,000 new U.S. victims of identity theft every day.(5)

WHAT HAS ALREADY BEEN DONE?

States across the country have enacted laws to restrict the printing and display of SSNs on identification cards, the mailing of SSNs, and requirements to send SSNs on the Internet.  Four states have gone further, restricting businesses from collecting or insisting on an SSN as a condition of the purchase or lease of goods or services.

Many states have enacted laws to restrict the printing on cards, mailing, display and Internet use of SSNs. For example, California enacted legislation in 2001 that generally prohibited businesses from engaging in certain activities with SSNs, such as posting or publicly displaying SSNs, mailing documents that display SSNs before the document is opened, printing SSNs on cards necessary for accessing products or services, or requiring people to transmit an SSN over the Internet unless the connection is secure or the number is encrypted.(6) Over twenty states have passed laws similar to California’s—Alaska, Arizona, Arkansas, Colorado, Connecticut, Georgia, Hawaii, Illinois, Maryland, Michigan, Minnesota, Missouri, New Jersey, New Mexico, New York, North Carolina, Oklahoma, Pennsylvania, Rhode Island, South Carolina, Texas, Utah, and Virginia.(7)  Five states have placed significant restrictions on the private solicitation of or insistence on collecting SSNs – Alaska, Kansas, Rhode Island, Maine and New Mexico.(8)

In 2008, one state passed a bill that provides more comprehensive SSN protections than those offered in other states, accompanied by well-crafted, limited exceptions.  Alaska’s HB 65 restricts the request, collection, sale, and sharing of SSNs by both private parties and government agencies.  This law contains limited exceptions such for specific purposes such as for insurance, medical services, fraud prevention, or law enforcement, and such as when required by law. (9)   By limiting the circulation of SSNs in multiple areas, Alaska’s new law will reduce the risk of SSN misuse and prevent identity theft
The following states have passed these meaningful SSN protections:

• States that either restrict the solicitation of SSNs or prohibit denying goods and services to an individual who declines to give an SSN:

Alaska

Kansas

Maine

New Mexico

Rhode Island

• States that restrict the printing of SSNs on ID cards required to access products or services:

Alaska	New Jersey
Arizona	New York
Arkansas	North Carolina
California	Pennsylvania
Colorado	Rhode Island
Connecticut	South Carolina
Hawaii	Texas
Illinois	Vermont
Michigan (10)	Virginia
Minnesota

States that restrict intentionally communicating SSNs to the public and/or intentional public posting and display:

Alaska	Missouri
Arizona	New Jersey (11)
Arkansas	New Mexico
California	New York
Colorado	North Carolina
Connecticut	Pennsylvania
Georgia	Rhode Island
Hawaii	South Carolina
Illinois	Texas
Michigan	Vermont
Minnesota	Virginia

States restrict mailing of SSNs within the mailing envelope:(12)

Alaska	New Mexico
Arizona	New York
California	North Carolina
Colorado	Pennsylvania
Hawaii	Rhode Island
Illinois	South Carolina
Michigan	Texas
Minnesota	Vermont
New Jersey

WHAT MORE CAN BE DONE?

The remaining states can act to get the SSN out of the wallet, out of the mailbox, off the Internet, and to stop the solicitation of SSNs when they are not required by law or required for certain specific purposes.  States can start to clean up the SSN mess by following the 18 states that restrict the printing of the SSN on identification cards, the 22 states that restrict the intentional communicating/ public posting/ display of SSNs, and the 17 states that restrict the mailing of documents containing an SSN.  States can also enact legislation prohibiting the private collection of SSNs except where required by law or for the specific purpose of credit, taxes, employment, or investment.

The Consumers Union Model State SSN Protection Law will:

• Stops most requests for, collection of, and mailing of the SSN.  Stops collection of the SSN by private businesses for purposes beyond credit, taxes, employment, investment, new bank accounts, child support and criminal record checks unless the SSN is required by law.
• Stops these practices unless required by law:
• Placing SSNs on identification and membership cards
• Posting, displaying, or making SSNs available to the general public
• Using the SSN as a password or access code for goods and services.
• Inviting input of the SSN on the web for unencrypted transmission.
• Tailors exceptions for true need.  Some of the early state laws restricting SSN use included a variety of exceptions.  Too many exceptions will undermine the usefulness of a state law restricting SSN collection and use.

The model law focuses on a going-forward basis on reducing the risk of identity theft from stolen SSNs by reducing the instances in which SSNs can be requested, collected, mailed, printed on wallet cards, used as passwords, and solicited over the Internet without encryption. 

There are also additional areas for further work on SSNs.  These additional areas include reducing the appearance of SSNs in public records, reducing government agency use of SSNs, requiring all types of companies holding SSNs to safeguard that data, restricting the practices of database companies that sell information about individuals including or using SSNs, and restricting the internal uses and sharing of SSNs by private companies.  Consumers Union is ready to work with states who wish to tackle these additional issues.

_______________________________

(1) Krim, Jonathan. “Net Aids Access to Sensitive ID Data.” Washington Post. April 4, 2005. Accessed June 21, 2007: www.washingtonpost.com/ac2/wp-dyn/A23686-2005Apr3?language=printer

(2) United States Government Accountability Office, GAO-07-1023T, Social Security Numbers: Use is Widespread and Protection Could Be Improved (June 2007), available at http://www.gao.gov/new.items/d07752.pdf

(3) Ibid.

(4) Federal Trade Commission 2006 Identity Theft Survey Report, Prepared by Synovate, issued November 2007.

(5) www.consumersunion.org/campaigns/financialprivacynow/2007/04/fact_sheet_about_id_theft_1.html

(6) Cal. Civil Code § 1798.85 (West 2001).

(7) See Alaska (A.S. 45.48.400); Arkansas (Ark. Code Ann. § 4-86-107 (2005)); Arizona (Ariz. Rev. Stat. § 44-1373 (2004)); Colorado (Colo. Rev. Stat. § 6-1-715(2006)); Connecticut (Conn. Gen. Stat. § 42-470 (2003)); Georgia (Ga. Code Ann. § 10-1-393.8 (2006)); Hawaii (Haw. Rev. Stat. § 487J-2 (2006)); (Illinois (815 Ill. Comp. Stat. 505/2QQ (2004)); Maryland (Md. Code Ann., Com. Law § 14-3301 et seq. (2005)); Michigan (Mich. Comp. Laws § 445.81 et seq. (2004)); Minnesota (Minn. Stat. § 325E.59 (2005)); Missouri (Mo. Rev. Stat. § 407.1355 (2003)); New Jersey (NJ Stat. Ann. § 56:8-164 (West 2005)); New Mexico (NM Stat. Ann. § 57-12B-4 (2005)); New York (N.Y. Gen. Bus. Law § 399-dd (2006)); North Carolina (N.C. Gen. Stat. § 75-62 (2005)); (Oklahoma (Okla. Stat. tit. 40, § 173.1 (2004)); Pennsylvania (74 Pa. Stat. Ann. § 201 (West 2006); Rhode Island (R.I. Gen. Laws § 6-48-8 (2006)); South Carolina (S.C. Code § 37-20-180 (2008)); Texas (Tex. Bus. & Com. Code Ann. 35.58 (2003)); Utah (Utah Code Ann. § 31A-21-110 (2004)); and Virginia (Va. Code Ann. § 59.1-443.2 (2005)).

(8) Alaska’s law states that a person, business or government entity “may not request or collect” an individual’s social security number unless authorized by law, with limited exceptions. A.S. § 44.48.400 (2008). Under the Kansas law, a business shall not “solicit, require or use for commercial purposes an individual’s social security number unless such number is necessary for such person’s normal course of business and there is a specific use for such number for which no other identifying number may be used.” Kan. Stat. Ann § 75-3520 (2006).    Maine’s law prohibits the denial of goods or services because an individual refuses to provide an SSN, with limited exceptions.  Me. Ann. Stat. Title 10 § 1272-B (2003).  Rhode Island’s statute also prohibits the denial of goods or services for refusal to provide an SSN, with three exceptions.  R.I. Gen Laws §6-13-1.  New Mexico also limits the collection of SSNs: “No business shall require a consumer’s social security number as a condition for the consumer to lease or purchase products, goods or services from the business.”  NM Stat. Ann. § 57-12B-3.  This law permits businesses to require SSNs, however, “if the number will be used in a manner consistent with state or federal law or as part of an application for credit or in connection with annuity or insurance transactions” or “if the consumer consents to the acquisition or use.”  NM Stat. Ann. § 57-12B-3.

(9) A.S. § 44.45.400 (2008).

(10) The Michigan prohibition applies to the printing of all or more than 4 sequential digits of an SSN on any ID badge or card, membership card, or permit or license. The statute does not refer specifically to cards required to access products or services, but these should be covered as membership cards.

(11) The New Jersey prohibition applies regardless of whether the posting/display is intentional.

(12) States have a variety of exemptions to this prohibition.  There are also other states that restrict the mailing of materials in such a way that the SSN is visible on the outside of the mailed material.

Prepared by:
Gail Hillebrand
Financial Services Campaign Manager
1535 Mission Street
San Francisco, CA 94103
Ghillebrand@consumer.org
415-431-6747

Last updated: June 2008