Prohibition of the sale, purchase, and display to the general public of the social security account number

(a)

In general

Title II of the Social Security Act is amended by inserting after section 208 (42 U.S.C. 408) the following new section:

208A.

Prohibition of the sale, purchase, and display to the general public of the social security account number

(a)

Definitions

For purposes of this section: (1)

Person

(A)

In general

Subject to subparagraph (B), the term person means any individual, partnership, corporation, trust, estate, cooperative, association, or any other entity. (B)

Governmental entities

Such term does not include a governmental entity. Nothing in this subparagraph shall be construed to authorize, in connection with a governmental entity, an act or practice otherwise prohibited under this section or section 205(c)(2)(C). (2)

Selling and purchasing

(A)

In general

Subject to subparagraph (B)— (i)

Sell

The term sell in connection with a social security account number means to obtain, directly or indirectly, anything of value in exchange for such number. (ii)

Purchase

The term purchase in connection with a social security account number means to provide, directly or indirectly, anything of value in exchange for such number. (B)

Exceptions

The terms sell and purchase in connection with a social security account number do not include the submission of such number as part of— (i)the process for applying for any type of Government benefits or programs (such as grants or loans or welfare or other public assistance programs), (ii)the administration of, or provision of benefits under, an employee benefit plan, or (iii)the sale, lease, merger, transfer, or exchange of a trade or business. (3)

Display to the general public

(A)

In general

The term display to the general public means, in connection with a social security account number, to intentionally place such number in a viewable manner on an Internet site that is available to the general public or to make such number available in any other manner intended to provide access to such number by the general public. (B)

Internet transmissions

In any case in which a person requires, as a condition of doing business with such person, transmittal to such person of an individual’s social security account number by means of the Internet without reasonable provisions to ensure that such number is encrypted or otherwise secured from disclosure, any such transmittal of such number as so required shall be treated as a display to the general public of such number by such person. (4)

Social Security account number

The term social security account number has the meaning given such term in section 208(c), except that such term includes any derivative of such number. Notwithstanding the preceding sentence, any expression, contained in or on any item sold or displayed to the general public, shall not be treated as a social security account number solely because such expression sets forth not more than the last 4 digits of such number, if the remainder of such number cannot be determined based solely on such expression or any other matter presented in or on such item. (b)

Prohibition of sale, purchase, and display to the general public

(1)Except as provided in paragraph (2), it shall be unlawful for any person to— (A)sell or purchase a social security account number or display to the general public a social security account number, or (B)obtain or use any individual’s social security account number for the purpose of locating or identifying such individual with the intent to physically injure or harm such individual or using the identity of such individual for any illegal purpose. (2)Notwithstanding paragraph (1), and subject to paragraph (3), a social security account number may be sold or purchased by any person to the extent provided in this subsection (and for no other purpose) as follows: (A)to the extent necessary for law enforcement, including (but not limited to) the enforcement of a child support obligation, as determined under regulations issued as provided in subsection (j); (B)to the extent necessary for national security purposes, as determined under regulations issued as provided in subsection (j); (C)to the extent necessary for public health purposes; (D)to the extent necessary in emergency situations to protect the health or safety of 1 or more individuals; (E)to the extent that the sale or purchase is required to comply with a tax law of the United States or of any State (or political subdivision thereof); (F)to the extent that the sale or purchase is to or by a consumer reporting agency (as defined in section 603(f) of the Fair Credit Reporting Act (15 U.S.C. 1681a(f))) for use or disclosure solely for permissible purposes described in section 604(a) of such Act (15 U.S.C. 1681b(a)); and (G)to the extent necessary for research (other than market research) conducted by an agency or instrumentality of the United States or of a State or political subdivision thereof (or an agent of such an agency or instrumentality) for the purpose of advancing the public good, on the condition that the researcher provides adequate assurances that— (i)the social security account numbers will not be used to harass, target, or publicly reveal information concerning any identifiable individuals; (ii)information about identifiable individuals obtained from the research will not be used to make decisions that directly affect the rights, benefits, or privileges of specific individuals; and (iii)the researcher has in place appropriate safeguards to protect the privacy and confidentiality of any information about identifiable individuals, including procedures to ensure that the social security account numbers will be encrypted or otherwise appropriately secured from unauthorized disclosure. (3)Notwithstanding paragraph (1), a social security account number assigned to an individual may be sold, purchased, or displayed to the general public by any person— (A)to the extent consistent with such individual’s voluntary and affirmative written consent to the sale, purchase, or display of the social security account number, but only if— (i)the terms of the consent and the right to refuse consent are presented to the individual in a clear, conspicuous, and understandable manner, (ii)the individual is placed under no obligation to provide consent to any such sale, purchase, or display, and (iii)the terms of the consent authorize the individual to limit the sale, purchase, or display to purposes directly associated with the transaction with respect to which the consent is sought, and (B)under such circumstances as may be deemed appropriate in regulations issued as provided under subsection (j). (4)In the case of social security account numbers which constitute personally identifiable medical information, the Commissioner of Social Security, with respect to medical research which is referred to in paragraph (3)(A) or which is treated in regulations of the Commissioner issued pursuant to paragraph (3)(B), shall maintain ongoing consultation with the Office for Civil Rights of the Department of Health and Human Services to ensure that the sale or purchase of such social security account numbers is permitted only in compliance with existing Federal rules and regulations prescribed by the Secretary of Health and Human Services pursuant to section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (110 Stat. 2033). (c)

Prohibition of unauthorized disclosure to government agencies or instrumentalities

(1)It shall be unlawful for any person to communicate by any means to any agency or instrumentality of the United States or of any State or political subdivision thereof the social security account number of any individual other than such person without the written permission of such individual, unless the number was requested by the agency or instrumentality. In the case of an individual who is legally incompetent, permission provided by the individual’s legal representatives shall be deemed to be permission provided by such individual. (2)Paragraph (1) shall not apply to the extent necessary— (A)for law enforcement, including (but not limited to) the enforcement of a child support obligation, or (B)for national security purposes,

as determined under regulations issued as provided under subsection (j).

(d)

Prohibition of the displays on cards or tags required for access to goods, services, or benefits

No person may display a social security account number on any card or tag issued to any other person for the purpose of providing such other person access to any goods, services, or benefits or include on such card or tag a magnetic strip, bar code, or other means of communication which conveys such number. (e)

Prohibition of the displays on employee identification cards or tags

No person that is an employer, and no other person offering benefits in connection with an employee benefit plan maintained by such employer or acting as an agent of such employer, may display a social security account number on any card or tag that is commonly provided to employees of such employer (or to their family members) for purposes of identification or include on such card or tag a magnetic strip, bar code, or other means of communication which conveys such number. (f)

Measures To preclude unauthorized disclosure of social security account numbers and protect the confidentiality of such numbers

Subject to the preceding provisions of this section, any person having in such person’s records the social security account number of any individual other than such person shall, to the extent that such records are maintained for the conduct of such person’s trade or business— (1)ensure that no officer or employee thereof has access to such number for any purpose other than as necessary for the conduct of such person’s trade or business, (2)restrict, in accordance with regulations of the Commissioner, access to social security account numbers obtained thereby to officers and employees thereof whose duties or responsibilities require access for the conduct of such person’s trade or business, and (3)provide such safeguards as may be specified, in regulations of the Commissioner, to be necessary or appropriate to preclude unauthorized access to the social security account number and to otherwise protect the confidentiality of such number. (g)

Deceased individuals

This section does not apply with respect to the social security account number of a deceased individual. (h)

Criminal penalty

Any person who violates this section shall be guilty of a felony and upon conviction thereof shall be fined under title 18, United States Code, or imprisoned for not more than 5 years, or both. (i)

Applicability of other protections

Nothing in this section shall be construed to supersede, alter, or affect any restriction or limitation on the sale, purchase, display to the general public, or other disclosure of social security account numbers, provided in any Federal statute, regulation, order, or interpretation, if the restriction or limitation is greater than that provided under this section, as determined under applicable regulations issued by the Commissioner of Social Security or by another agency or instrumentality of the United States as provided in subsection (j). (j)

Regulations

(1)In issuing regulations to carry out the provisions of subparagraphs (A) and (B) of subsection (b)(2), subsection (b)(3)(B), and subsection (c)(2), the Commissioner of Social Security shall consult with the Attorney General of the United States, the Secretary of Health and Human Services, the Secretary of Homeland Security, the Secretary of the Treasury, the Federal Trade Commission, the Federal banking agencies (as defined in section 3 of the Federal Deposit Insurance Act), the National Credit Union Administration, the Securities and Exchange Commission, State attorneys general, and such representatives of the State insurance commissioners as may be designated by the National Association of Insurance Commissioners. Any agency or instrumentality of the United States may exercise the authority of the Commissioner to issue such regulations, with respect to matters otherwise subject to regulation by such agency or instrumentality, to the extent determined appropriate in regulations of the Commissioner. (2)In issuing the regulations described in paragraph (1) pursuant to the provisions of subparagraph (A) or (B) of (b)(2) or subsection (c)(2) (relating to law enforcement and national security), the Commissioner may authorize the sale or purchase of social security account numbers only if the Commissioner determines that— (A)such sale or purchase would serve a compelling public interest that cannot reasonably be served through alternative measures, and (B)such sale or purchase will not pose an unreasonable risk of identity theft, or bodily, emotional, or financial harm to an individual (taking into account any restrictions and conditions that the Commissioner imposes on the sale, purchase, or disclosure). (3)In issuing the regulations described in paragraph (1) pursuant to the provisions of subsection (b)(3)(B), the Commissioner may authorize the sale, purchase, or display to the general public of social security account numbers only after considering, among other relevant factors— (A)the associated cost or burden to the general public, businesses, commercial enterprises, non-profit organizations, and Federal, State, and local governments; and (B)the associated benefit to the general public, businesses, commercial enterprises, non-profit associations, and Federal, State, and local governments. (4)If, after considering the factors in paragraph (3), the Commissioner authorizes, in regulations referred to in paragraph (3), the sale, purchase, or display to the general public of social security account numbers, the Commissioner shall impose restrictions and conditions on the sale, purchase, or display to the general public to the extent necessary— (A)to provide reasonable assurances that social security account numbers will not be used to commit or facilitate fraud, deceptions, or crime, and (B)to prevent an unreasonable risk of identity theft or bodily, emotional, or financial harm to any individual, considering the nature, likelihood, and severity of the anticipated harm that could result from the sale, purchase, or display to the general public of social security account numbers, together with the nature, likelihood, and extent of any benefits that could be realized. (5)In the issuance of regulations described in paragraph (1), notice shall be provided as described in paragraphs (1), (2), and (3) of section 553(b) of title 5, United States Code, and opportunity to participate in the rule making shall be provided in accordance with section 553(c) of such title. (6)Each agency and instrumentality exercising authority to issue regulations under this subsection shall consult and coordinate with the other such agencies and instrumentalities for the purposes of assuring, to the extent possible, that the regulations prescribed by each such agency or instrumentality are consistent and comparable, as appropriate, with the regulations prescribed by the other such agencies and instrumentalities. The Commissioner shall undertake to facilitate such consultation and coordination.

(b)

Effective date

Initial final regulations prescribed to carry out the provisions of section 208A of the Social Security Act (added by this section) shall be issued not later than the last date of the 18th calendar month following the date of the enactment of this Act. Such provisions shall take effect 1 year after the date of the issuance of such regulations. Section 208A(b) of such Act shall apply in the case of displays to the general public (as defined in section 208A(a)(3) of such Act) to such displays to the general public originally occurring after such 1-year period. Such provisions shall not apply with respect to any such display to the general public of a record (containing a social security account number (or any derivative thereof)) generated prior to the close of such 1-year period.