Statement of Stuart Pratt, President, Consumer Data Industry Association

Testimony Before the Subcommittee on Social Security
of the House Committee on Ways and Means

June 21, 2007

Chairman McNulty, Ranking Member Johnson and members of the subcommittee, thank you for this opportunity to appear before you today to discuss the importance of Social Security Numbers. For the record, my name is Stuart Pratt and I am president and CEO of the Consumer Data Industry Association.[1]

Our members applaud this committee for the thoughtful and open dialogue that you have fostered regarding how Social Security Numbers are used, to identify risks associated with such use, and to address these risks in a reasonable, targeted fashion.

As a preliminary matter, CDIA supports efforts to limit the sale and public display of Social Security Numbers.  CDIA’s members do not publicly sell or display Social Security Numbers to the general public, and we oppose such activity. However, as will be discussed below, such restrictions have to be carefully considered, balanced and bounded so that restrictions on use do not interfere with legitimate business uses of SSNs to detect and prevent ID theft and financial fraud and for other beneficial purposes.

SSNs are important to the smooth operation of today’s economy because there is no other single identifier that serves the same purpose as effectively as the SSN.

Although there are other identifiers that may serve similar purposes in some contexts, there are no other identifiers that serve this role across all individuals and circumstances.

For instance, name and address can’t be used because they are too common, change due to marriage and divorce, and, according to the U.S. Census Bureau, 42 million consumers move every year. Even for consumers who’s address and name are constant, they do not always use their identifiers inconsistently (i.e. in some instances they will use a nickname, and may inconsistently use their generational designations (e.g., III, or Sr.).)  There are also times where consumers themselves make mistakes when completing applications. Thus, a consumer’s identifiers may be presented in different ways in different databases and, in some cases, the data may be partially incorrect.  Further, personal identifiers such as name and birthday, are generally not as unique as we may believe they are.

Further, the use of other alternatives that could possibly serve as a substitute for an SSN, such as a cell phone number or driver’s license number, is often restricted by law. 

Thus, the SSN is a truly unique identifier.

As the only unique identifier, the use of the SSN has migrated beyond simply keeping track of social security payments, even within the federal government itself.  For example, it is used for tax purposes, Selective Service registration, employment verification, the provision of government benefits and a host of other uses. In addition, the use of the SSN is often mandated by the federal government.  For instance, the Treasury Department regulations regarding PATRIOT Act compliance for financial institutions' in many instances requires financial institutions to use the consumers full SSN, as obtained from “trusted [private] sources,” such as credit bureaus.

Additionally, many State laws require the use of the SSN for a wide range of important purposes dependent on accurate identification. For instance, to meet requirements of the law, government data often must be cross-checked or enhanced with data from private sector databases.

For the private sector, the role of the SSN is that it serves as a unique identifier that is permanent, so a consumer cannot voluntarily relinquish it in bad times, and it is consistent across various systems.  For example, a financial institution, a wireless communications company and a hospital can all rely on the same identifier for widely divergent purposes, all to help ensure that the individual before them is the person they believe is before them.  Said differently, after having verified that a consumer is legitimate, a bank, for example, can then create a unique identifier such as a customer or PIN number.  But as long as the bank is dependent on third-party sources to cross check applicant data, unique identifiers must cut across external data sources.

• CURRENT LAW PROTECTS THE PUBLIC FROM INAPPROPRIATE USE

There are several federal and state laws and regulations that restrict the use or disclosure of SSNs, including: the Gramm-Leach-Bliley Act (15 U.S.C. 6826(b)) and its implementing regulations (“Privacy Rule”); the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); Section 5 of the FTC Act (15 U.S.C. 41-51); the Fair Debt Collection Practices Act (15 U.S.C. 1601 et seq.); the Health Insurance Portability and Accountability Act (Pub. L. 104-191); and the Drivers Privacy Protection Act (18 U.S.C. 2721 et seq.). Together, these laws restrict the use and display of SSNs, how they can be used, who they can (and can’t) be shared with, and under what circumstances. 

The use of the SSN by Credit Reporting Agencies, (CRAs), for instance, is governed by both the FCRA and, in most instances, GLB, as well.  These statutes limit how and when CRAs can disclose SSNs, to whom, and under what circumstances.  

For instance, many CDIA-member products are focused on helping consumers to gain access to the goods and services for which they apply –assisting a lender or other service provider in determining a consumer’s eligibility. These products are regulated under the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.) as “consumer reports.” Eligibility determinations include applications for any type of credit including unsecured credit, home purchases, auto financing, home equity loans, as well as for insurance of all types, employment, government benefits, apartment rentals, and for other business transactions initiated by the consumer.

The FCRA, enacted in 1970, has been the focus of careful oversight by the Congress resulting in significant changes in both 1996 and again in 2003. There is no other law that is so current in ensuring consumer rights and protections are adequate.

Similarly, some fraud detection tools are regulated under GLBA, and the use of data regarding those products is similarly circumscribed.

• Beneficial Uses of the SSN

Because the SSN allows for consistency across various systems and data bases, there are a number of ways that the SSN is used that benefits consumers.  Further, without the availability of the SSN, many of the products and services that consumers take for granted today could become more scarce.

For instance, CDIA’s members produce a range of critical consumer data products which bring great value to individual consumers, to society, and to the nation’s economy. Our members design products used for determinations of a consumer’s eligibility for a product or service, to prevent identity theft and fraud and to aid in the location of consumers for a variety of reasons.

1)      Proper File matching: Ensuring that data goes to the right file, and is reported about the right individual

Lydia Parnes, Director of the Bureau of Consumer Protection at the Federal Trade Commission, recently testified about the importance of Social Security Numbers before the Senate Judiciary Subcommittee on Terrorism, Technology and Homeland Security:

“SSNs play a vital role in our economy, enabling businesses, government, and others to match information to the proper individual. For example, consumer reporting agencies use SSNs to ensure that the data furnished to them is placed in the correct file, and that they are providing the right credit report for the right consumer. SSNs also are used in locator databases to find lost beneficiaries, witnesses, and law violators and to collect child support and other judgments. Employers must collect SSNs for tax reporting purposes, and health care providers may need them to facilitate Medicare reimbursement.” She went on to say that “the SSN is valuable in enabling entities to match information to consumers. With 300 million Americans, many of whom share the same name, the SSN presents significant advantages as a means  of identification because of its uniqueness and permanence.”

Financial institutions and others rely on full and complete information from credit bureaus.  Complete information is necessary if the appropriate information is to be placed in the proper consumer account.  As an example, a financial institution may obtain information from a credit bureau on its customer named Tom Jones.  As you can imagine, there are thousands of Tom Joneses in the country.  In fact, it is likely that many Tom Joneses share the same last four digits of their SSN.  Therefore, a report with information pertaining to Tom Jones with the last four digits of 1234 may not provide the financial institution with sufficient information to determine to WHICH Tom Jones the report refers. 

SSNs, therefore, help to ensure that our members are more likely to load data to the correct file with a high degree of precision.  This is particularly true where a new account has been opened and is being added to the consumer's file for the first time.  Consumer reporting agencies of all types have, under the Fair Credit Reporting Act, a duty to maintain reasonable procedures to ensure the maximum possible accuracy of the file;  SSNs help them meet this requirement.  

SSNs also help to ensure that the proper consumer’s file is produced when a consumer applies for a benefit under the FCRA. If a consumer reporting agency cannot, with precision, identify the proper file of the consumer, it returns a message to the creditor indicating that no record was found.  This result would likely lead to far higher credit denials for consumers due to the inability of the creditor to review the consumer's credit history.  Said differently, the Fair Credit Reporting Act certainly does not contemplate the consumer reporting agency "taking a guess" as to which consumer's file must be accessed and thus this current liability coupled with the absence of the SSN would seriously impinge on the way in which credit is granted in this country today.

2)      Identity Verification to Prevent Identity Theft and Fraud

A number of CIDA members produce products that are used by financial institutions, insurance companies and others to verify the identity of an individual and ensure that the person they are interacting with is who they say they are.  These products are very effective in detecting and preventing identity theft and financial fraud before it happens.

The SSN helps businesses to prevent fraud by cross-checking applicant data against various other data sources in order to authenticate the consumers’ identity.  Absent the use of an SSN, these systems will be far less likely to trigger security protocols, which prevent the crime of identity theft.

In 2004, the GAO conducted a study on Social Security Numbers, and concluded that “information resellers, credit reporting agencies and health care organizations use social security numbers to build tools that verify an individual’s identity or match existing records since there is no widely accepted alternative.” The report further states that “restricting business access to social security numbers would hurt customers and possibly aide identify thieves since it would be more difficult for business to verify an individual’s identity.”

3)      Other specific products and services are enabled and enhanced through the availability of the SSN:

Access to home ownership: Every homeowner benefits from a credit reporting system that reduces the costs of all mortgage loans by a full two percentage points, thus putting literally thousands of dollars in disposable income into their pockets. Homeownership is no longer a luxury of the well-to-do, but is a truly democratized American dream enjoyed by nearly seventy percent of the population.[2] The SSN helps to facilitate the efficient operation of this system, as described above.

Child support payment enforcement: Access to SSNs dramatically increases the ability of child support enforcement agencies to locate non-custodial, delinquent parents (often reported in the news with the moniker “deadbeat dads”).  For example, the Financial Institution Data Match program required by the Personal Responsibility and Work Opportunity Reconciliation Act of 1996 (PL 104-193) led to the location of 700,000 delinquent individuals being linked to accounts worth nearly $2.5 billion.  Child support enforcement agencies report that their efforts are far more effective when they have access to the parent’s SSN. One agency reports that they are able to locate fully 80% more delinquent non-custodial parents when the SSN is available,  and the Association for Children for Enforcement of Support (ACES), a private child support recovery organization, has stated that social security numbers are the most important tool for locating parents who have failed to pay child support. 

Locator Services - SSNs are used routinely by law enforcement to locate missing children, fugitives and witnesses to crimes.  The ability to conduct an information search using an SSN is essential.  Restrictions on access to SSNs in government records would hamper the ability of law enforcement to obtain this vital information.  Further a number of states report that use of SSNs to match across data bases has greatly reduced entitlement fraud. For example, Pension Benefit Information (PBI), a private company that locates former employees that are due pension benefits, has indicated that in many cases the SSN becomes the only link between an employer and their former employees with vested benefits.  Employees move, marry and change their name, but the one thing that remains constant is their SSN.

Locating sex offenders—SSNs are used to locate registered and unregistered sex offenders.  There are over 560,000 sex offenders in the U.S.  Approximately twenty-four percent of these individuals fail to comply with address registration requirements mandated by law.  Access to SSNs allows law enforcement to locate sex offenders even when the registration address has not been kept current. 

Employment/security screening: As discussed above, SSNs serve as vital links among disparate records that help businesses verify prospective employees’ identities and conduct thorough, accurate background checks to ensure workplace safety and business security.

Small business B-to-B transactions: An SSN is the key business entity identifier to virtually all sole proprietorships or partnerships; as a result, SSNs are necessary to facilitate business-to-business transactions between small businesses.

Securitized credit markets: Confidence in the U.S. securities market is made possible by accurate financial histories compiled using the SSN as a key identifier. Restricting use of the SSN could undermine confidence in these securities, resulting in substantially higher consumer costs for credit, including mortgages and auto loans.

Insurance fraud prevention—Insurance companies use public record information compiled using social SSNs to detect fraudulent insurance claims.  According to the National Fraud Center, the average American household pays $200 to $400 a year in additional insurance premiums to offset the cost of fraud.  This cost would likely increase if companies do not have the information they need to detect and prevent fraud.

4) Additionally, without the use of the SSN, consumers would suffer harm:

Incomplete data harms consumers: There would likely be an decrease in the ability of consumer reporting agencies to properly match incoming information to the correct consumer about whom the information relates. Think about the consequence to consumers of having a consumer credit report that does not contain all of the accounts that they pay on time and which makes them eligible for the lowest cost loans.

Incomplete data harms our banking system: The absence of the SSN would also put at risk the safety and soundness of lending decisions due to less information being included in consumer credit reports due to data matching problems.

Incomplete data prevents consumer access to goods and services: Think about the consequence for consumers when a consumer reporting agency cannot locate the proper file on a consumer and thus a lender, insurer or other service provider wanting to do business with the consumer has to deny the application, or the consumer has to pay higher rates.

• INFORMATION SECURITY AND THE SSN

As discussed above, the use of data like the SSN actually helps to prevent fraud and identity theft, by enabling better authentication of consumers, so that a lender knows that a loan applicant is you, and not an identity thief. 

However, concerns have been raised that the SSN is a “key,” and all a potential identity thief needs to “unlock” a consumer’s credit – that simply is not true. 

There are 2 basic types of financial fraud that may be perpetrated against an individual.  The first is fraud against a person’s existing accounts, such as credit card fraud, where a thief obtains your account number or credit card, and charges items to that card or drains your existing bank account.  While those instances are problematic, and may cause a consumer some stress while getting those problems rectified, they do not cause any long-term harm to the consumer; they suffer no financial liability, and such fraud does not impact their credit in any way.  More than 2/3rds of all “identity theft,” as identified by the FTC, falls into this category. 

The second, and more serious type of financial fraud is what we term “real name” fraud, where a fraudster obtains a person’s sensitive personal information, such as their SSN and other information, and somehow fools a lender into thinking that they are that person.  This may enable the thief to open new credit accounts in a victim’s name without the knowledge of the victim.  While the victim is ultimately not responsible for the financial harm, this type of fraud can have serious repercussions for the victim.

As discussed, while obtaining a person’s SSN may potentially make them susceptible to identity theft, it takes a lot more information, and the ability to use it in a way that thwarts the fraud detection tools in place, to commit “real” identity theft. Further, the SSN plays a major role in helping to stop such fraud, as well. 

The availability of MORE information, rather than less, is the key to reducing reliance on the SSN. Database matching is often like finger-print matching – the more unique data points there are, the more ability there is to identify and authenticate an individual. Further, each piece of data reduces the reliance on every other piece. However, Congress has limited the use of alternatives, increasing the reliance on SSNs.

For instance, there are other unique identifiers that could help reduce the reliance on SSNs, such as Driver’s License numbers, that do exist. However, the Driver’s Privacy Protection Act (DPPA) has limited the ability of data base companies to utilize those to supplement, or even supplant, the use of SSNs.

Wireless cell phone numbers also have the potential to serve that purpose. However, while those numbers are not used for telemarketing, Congress has, in other contexts, considered limiting the utility of these numbers for identification and fraud detection purposes, as well.

• PUBLIC RECORDS AND THE SSN

Public records play a vital in our society and bring value to the consumer. Bankruptcy records, tax liens and judgments are part of consumer “credit” reports used by lenders to make decisions that implicate safety and soundness. Records of eviction are critical to landlords who must themselves pay the bills and attempt to lease properties to consumers who will do the same. Validating professional licenses for employment screening agencies is yet another use of public records, as is accessing criminal histories.

Through the development of nationwide databases of public record information, our members have solved the problems inherent in having to search through tens of thousands of federal and state court houses and agency databases. In this way, the SSN is as important an identifier in a public document as it is in a private-sector database. It is a critical identifier for all of the data management reasons we discuss above. Without an SSN, a consumer can simply alter a few items of information, such as moving to a new address, or even changing a name and thus separate himself/herself from a bankruptcy record, a tax lien, a record of eviction and even a criminal history, in some cases. Clearly this is not a positive outcome for consumers or for American businesses which are on the front lines of making, for example, fair and accurate risk based lending and employment decisions, while at the same time fighting identity theft and fraud.

Some federal proposals have suggested that state agencies must limit access to the SSN. The concern of the CDIA’s members is that this apparent unfunded mandate will drive under-funded state agencies to either stop requesting the SSN when processing vital records, or to simply deny all access to public records containing SSNs.  

It is important that public records, including those records containing SSNs, continue to be made available.  The open public records system is the cornerstone of the U.S. democracy and economy.

The debate about the presence of the SSN in public records has suggested a possible binary solution, where SSNs could be made available electronically for certain entities, but could possibly be redacted for publicly available electronic documents, though costs associated with such an unfunded mandate will have to be addressed.  It is encouraging to hear state court organizations discussing strategies for protecting SSNs, and CDIA will continue to engage in these dialogues.

However, while CDIA believes that disclosure of the SSN to the general public must be addressed, we also believe that public records must be made available, including SSNs, to those with an appropriate need. Ultimately, dialogue with state and federal agencies coupled with the advancement of technologies will address concerns about public records which contain SSNs. An unfunded mandate will destabilize the system of public records which is so important to our democracy.

• Some Additional Notes on Other Important Issues:

Finally, there are a few additional issues I would like to highlight before I conclude:

• Legitimate business uses:

It is important that any restrictions imposed on the sale or display of SSNs contain exceptions for legitimate business uses such as identity verification; detecting, preventing and investigating ID theft and fraud; locating individuals; collecting child support and other lawful debts; and for any purposes permitted under the Fair Credit Reporting Act and Gramm-Leach-Bliley Act.

• Preemption:

Ensuring that the Social Security number issue is addressed in a uniform fashion, so that all consumers are protected, is a vital component of this debate.  Any legislation that would restrict the sale or display of SSNs must contain federal preemption so that businesses are subject to a single, national law rather than having to comply with various state laws all with differing and potentially conflicting requirements.   

• Exempt Current Law

As discussed previously, SSNs are broadly covered by a whole host of current statutes.  Instead of adding an additional compliance burden on top of those laws, we would urge the Committee to exempt practices already covered under existing laws.

• Minimize Rulemaking Authority

Because so many business practices rely on stable laws, CDIA would urge the Committee to codify any changes to current law, to the extent possible, rather than granting broad authority to the regulatory agencies. 

• Further Assisting Identity Theft Victims: Provide the Ability to “Ping” the SSN Database

CRAs utilize very sophisticated tools to ensure the accuracy of their systems.  However, in rare cases of identity theft, it would be useful for us to have the ability to cross-check our databases to determine if a particular SSN is associated with a particular person.  This would be very useful in further helping ensure the accuracy of our databases, and could help contribute to the accuracy of our databases and the ability to help correct the records of Identity Theft victims.

CONCLUSION

In conclusion, you can see that the underlying theme in the discussion of SSN uses is that of balance and ultimately ensuring the security of the number. Law that that imposes national uniform information security regulations on all who possesses the SSN in combination with a person’s name and address, is the most responsible and constructive focus for Congress. In contrast, law that overreaches in attempting to limit use of the SSN is likely to merely take fraud prevention tools out of the hands of legitimate businesses at the expense of consumers.

Ironically, to prevent fraud you must be able to crosscheck information. To maintain accurate databases, you must be able to maintain a range of identifying elements. Absent the availability of the SSN, we will be less able to build accurate data bases, to accurately identify records and to help prevent identity theft through the development of fraud prevention and authentication tools.

Ultimately consumers expect us all to accomplish the goals of protecting and securing the SSN, and also ensuring the accuracy and effectiveness of databases which contain information about them.

Thank you for this opportunity to testify.

[1] CDIA, as we are commonly known, is the international trade association representing over 300 consumer data companies that provide fraud prevention and risk management products, credit and mortgage reports, tenant and employment screening services, check fraud and verification services, systems for insurance underwriting and also collection services. As we will discuss below, the secure and protected use of the social security number (SSN) is an important key to the effectiveness of these systems and services

[2]  Kitchenman, Walter., U.S. Credit Reporting: Perceived Benefits Outweigh Privacy Concerns., Pp. 5 (1998).