Monday, 6 September 1999
Arizona Dialy Star
http://www.azstarnet.com/public/dnews/0906N5.html
By Pila Martínez
The Arizona Daily Star
Government is required by law to keep your Social Security number safe, but it
doesn't always follow the rules.
Big business, on the other hand, has few if any rules to follow.
When Social Security numbers were created in 1935, they were meant to keep track
of Americans' income and the money they contributed to the Social Security system.
They didn't appear on driver's licenses, weren't casually dictated over the phone
and weren't traded around.
It was a protected number, held in the same confidence as credit data is today, said
Lauren Weinstein, moderator for the Privacy Forum, a World Wide Web site that addresses
privacy and technology issues.
``But because of some court decisions some years back, it became unprotected, and
then it became pretty much free game,'' Weinstein said.
Under a 1993 agreement, the Federal Trade Commission allowed TRW, a major credit
bureau, to sell certain consumer information - including name, address, phone number,
year of birth and Social Security number - to third-party marketers so they can target
goods or services directly to consumers through mail or by telephone.
Before the decision, nothing had been specified about how credit bureaus could use
Social Security numbers. ``A lot of people think that there's something special
about the Social Security number, that it has some kind of legal protection, where
in most cases it really doesn't,'' Weinstein said. ``It's pretty much free and clear
for people to trade and use and treat it like a commodity.''
The simple rule is that anyone but the government can ask for it - even require it
before rendering services - and then do whatever he or she wants with it. In the
government's case, agencies can require it only if authorized by law, and they must
protect the number.
``There are many more regulations concerning government use of this kind of information,''
Weinstein said. ``It's Big Brother Incorporated that you have to worry about, because
that's where it's like the Wild West.''
But that doesn't mean government always treats Social Security numbers properly.
In fact, violations of the federal Privacy Act of 1974 can be found throughout state
and local government.
Until recently, the University of Arizona used Social Security numbers as a common
identifier for students. That practice started more than a decade ago, said university
attorney Mike Proctor.
``It was based on convenience as opposed to thinking about it,'' Proctor said.
That changed in the spring of 1998 when UA officials issued a series of public apologies
for illegally releasing thousands of Social Security numbers to two companies as
part of CatCard, its campus identification system.
While Social Security numbers no longer are on the identification cards, they are
still stored in computers to comply with federal reporting requirements. Students
now are given randomly generated numbers.
Tucsonan Willy Bils is looking for the 9th Circuit U.S. Court of Appeals to take
up his case against the Tucson Police Department, in which he contends police wrongly
asked him for his Social Security number during a traffic stop.
A few months after Bils filed his original lawsuit in August 1997, the department
altered its policy. Officers now are supposed to explain to detainees that they can
refuse to tell them their Social Security numbers.
The Privacy Act requires governments to tell people whether providing their Social
Security number is voluntary or mandatory. If the number is mandatory, the agency
involved must state the law under which the information is required.
But that law often is ignored, Bils said, pointing, for instance, to Tucson City
Court records-request forms that include spaces for Social Security numbers. Even
the Arizona Attorney General's Office, which wrote several opinions in the 1970s
and '80s in keeping with the Privacy Act, has without explanation required people
filing claims against the state to provide their Social Security numbers.
If a government agency requests the number as a condition of providing its service,
but doesn't have the authorization to do so, the holder can follow that particular
agency's appeal process to remedy the situation, said Lowell Kepke, a Social Security
spokesman for the San Francisco region.
But ``private organizations have no particular federal right to ask for Social Security
numbers, but neither are they prohibited,'' he said.
``What we tell people to do is, if an organization asks for their Social Security
number, they should then ask why is it that the number's needed and how will it be
used,'' Kepke said.
``Many people look for the Social Security (Administration) to protect them from
having to give their number out, and there's no law that helps us do that.''
Weinstein said you should be prepared to go without a private organization's services
if you aren't willing to provide your number.
``In purely commercial transactions, you have to make a decision.
Do I want this service enough? Is there a reason for this? If there isn't, you can
either take your business elsewhere or you can say, `Look, I want a different number.'
''
Privacy activist Robert Ellis Smith says commercial enterprises don't need Social
Security numbers.
They could use a combination of names, addresses and birthdates to verify a person's
identity, said Smith, publisher of the Privacy Journal, a monthly newsletter reporting
on technology and its impact on personal privacy.
``In some ways, it's more accurate,'' he said, pointing out that only one digit needs
to be off for a Social Security number to be useless.
YOU AND THE PRIVACY ACT
Section 7 of the federal Privacy Act of 1974 provides that:
``It shall be unlawful for any federal, state or local government agency to deny
to any individual any right, benefit, or privilege provided by law because of such
individual's refusal to disclose his Social Security account number.''
Although this provision applies beyond federal agencies, it does not apply to: (1)
any disclosure that is required by federal statute; or (2) any disclosure of a Social
Security number to any federal, state or local agency maintaining a system of records
in existence and operating before Jan. 1, 1975, if such disclosure was required under
statute or regulation adopted prior to such date to verify the identity of an individual.
The Tax Reform Act of 1976 expressly exempts state agencies from this restriction
to the extent that Social Security numbers are used ``in the administration of any
tax, general public assistance, driver's license, or motor vehicle registration law
within its jurisdiction.'' Other allowed state uses include birth certificates and
child support orders.
The Privacy Act also states, ``Any federal, state or local government agency which
requests an individual to disclose his Social Security account number shall inform
that individual whether that disclosure is mandatory or voluntary, by what statutory
or other authority such number is solicited, and what uses will be made of it.''
Source: U.S. Department of Justice
------------------------------------------------------------------------
Check out The Privacy Journal online.
------------------------------------------------------------------------