1.Short title and table of
contents
(a)This Act may be cited as the Social Security Number Privacy and Identity Theft
Prevention Act of 2009
.
(b)The table of contents is as follows:
Sec. 1. Short title and table of contents.
Sec. 2. Restrictions on the sale or display to the general
public of social security account numbers by governmental entities.
Sec. 3. Prohibition of display of social security account
numbers on checks issued for payment by governmental entities.
Sec. 4. Prohibition of the display of social security account
numbers on certain government identification cards or tags.
Sec. 5. Prohibition of inmate access to social security account
numbers.
Sec. 6. Measures to preclude unauthorized disclosure by
governmental entities of social security account numbers and protect the
confidentiality of such numbers.
Sec. 7. Uniform standards for truncation of the social security
account number.
Sec. 8. Prohibition of the sale, purchase, and display to the
general public of the social security account number in the private
sector.
Sec. 9. New criminal penalties for misuse of social security
account numbers.
Sec. 10. Extension of civil monetary penalty
authority.
Sec. 11. Criminal penalties for employees of the Social
Security Administration who knowingly and fraudulently issue social security
cards or social security account numbers.
Sec. 12. Enhanced penalties in cases of terrorism, drug
trafficking, crimes of violence, or prior offenses.
Sec. 13. Regulatory and enforcement authority with respect to
misuse of the social security account number.
Sec. 14. Study on feasibility of banning social security
account number as an authenticator.
2.Restrictions on
the sale or display to the general public of social security account numbers by
governmental entities
(a)Section 205(c)(2)(C) of the Social Security Act (42 U.S.C. 405(c)(2)(C)) is
amended by adding at the end the following new clause:
(x)(I)A governmental entity (as defined in
subclause (X)) may not sell or display to the general public any social
security account number if such number has been disclosed to such governmental
entity pursuant to the assertion by such governmental entity to any person that
disclosure of such number is a statutory or regulatory requirement.
Notwithstanding the preceding sentence, such number may be sold or displayed to
the general public in accordance with the exceptions specified in subclauses
(II), (III), (IV), (V), (VI), (VII), and (VIII) (and for no other
purpose).
(II)Notwithstanding subclause (I), a
social security account number may be sold by a governmental entity to the
extent that such sale is specifically authorized by this Act or the Privacy Act
of 1974.
(III)Notwithstanding subclause (I), a
social security account number may be sold by a governmental entity to the
extent that is necessary or appropriate for law enforcement or national
security purposes, as determined under regulations which shall be issued as
provided in section 1129C.
(IV)Notwithstanding subclause (I), a
social security account number may be sold by a governmental entity to the
extent that such sale is required to comply with a tax law of the United States
or of any State (or political subdivision thereof).
(V)Notwithstanding subclause (I), a
social security account number may be sold by a State department of motor
vehicles as authorized under subsection (b) of section 2721 of title 18, United
States Code, if such number is to be used pursuant to such sale solely for
purposes permitted under paragraph (1), (6), or (9) of such subsection.
(VI)Notwithstanding subclause (I), a
social security account number may be sold or otherwise made available by a
governmental entity to a consumer reporting agency (as defined in section
603(f) of the Fair Credit Reporting
Act (15 U.S.C. 1681a(f))) for use or disclosure solely for
permissible purposes described in section 604(a) of such Act (15 U.S.C.
1681b(a)).
(VII)Notwithstanding subclause (I), a
social security account number may be sold by a governmental entity to the
extent necessary for research (other than market research) conducted by any
governmental entity for the purpose of advancing the public good, on the
condition that the researcher provides adequate assurances that the social
security account numbers will not be used to harass, target, or publicly reveal
information concerning any identifiable individuals, that information about
identifiable individuals obtained from the research will not be used to make
decisions that directly affect the rights, benefits, or privileges of specific
individuals, and that the researcher has in place appropriate safeguards to
protect the privacy and confidentiality of any information about identifiable
individuals, including procedures to ensure that the social security account
numbers will be encrypted or otherwise appropriately secured from unauthorized
disclosure. In the case of medical research, the Commissioner of Social
Security shall maintain ongoing consultation with the Office for Civil Rights
of the Department of Health and Human Services to ensure that the sale or
purchase of social security account numbers which constitute personally
identifiable medical information is permitted only in compliance with existing
Federal rules and regulations prescribed by the Secretary of Health and Human
Services pursuant to section 264(c) of the Health Insurance Portability and
Accountability Act of 1996 (110 Stat. 2033).
(VIII)Notwithstanding subclause (I), a
social security account number may be sold or displayed to the general public
by a governmental entity under such other circumstances as may be specified in
regulations issued as provided in section 1129C.
(IX)This clause does not apply with
respect to a social security account number of a deceased individual.
(X)For purposes of this clause, the term
governmental entity
means an executive, legislative, or judicial
agency or instrumentality of the Federal Government or of a State or political
subdivision thereof, a federally recognized Indian tribe, or a trustee
appointed in a case under title 11, United States Code. Such term includes a
person acting as an agent of such an agency or instrumentality, Indian tribe,
or trustee. For purposes of this subclause, the term State
has
the meaning provided in subparagraph (D)(iii)(II).
(XI)For purposes of this clause, the term
sell means, in connection with a social security account, to
obtain, directly or indirectly, anything of value in exchange for such number.
Such term does not include the submission of such number as part of the process
for applying for any type of Government benefits or programs (such as grants,
loans, or welfare or other public assistance programs) or as part of the
administration of, or provision of benefits under, an employee benefit
plan.
(XII)For purposes of this clause, the
term display to the general public shall have the meaning provided
such term in section 208A(a)(3)(A). In any case in which a governmental entity
requires transmittal to such governmental entity of an individual’s social
security account number by means of the Internet without ensuring that such
number is encrypted or otherwise appropriately secured from disclosure, any
such transmittal of such number as so required shall be treated, for purposes
of this clause, as a display to the general public
of such
number by such governmental entity for purposes of this clause.
(XIII)For purposes of this clause, the
term social security account number
includes any derivative of
such number. Notwithstanding the preceding sentence, any expression, contained
in or on any item sold or displayed to the general public, shall not be treated
as a social security account number solely because such expression sets forth
not more than the last 4 digits of such number, if the remainder of such number
cannot be determined based solely on such expression or any other matter
presented in or on such item.
(XIV)Nothing in the preceding subclauses
of this clause shall be construed as superseding, altering, or affecting any
statute, regulation, order, or interpretation in effect under any other Federal
or State law, except to the extent that such statute, regulation, order, or
interpretation is inconsistent with such subclauses, and then only to the
extent of the inconsistency. For purposes of this subclause, a statue,
regulation, order, or interpretation is not inconsistent with the preceding
subclauses of this clause if the protection such statute, regulation, order, or
interpretation affords any person is greater than the protection provided under
such
subclauses.
.
(b)Effective date
and related rules
(1)Initial final regulations prescribed to carry out the
provisions of section 205(c)(2)(C)(x) of the Social Security Act (added by this
section) shall be issued not later than the last date of the 18th calendar
month following the date of the enactment of this Act. Such provisions shall
take effect, with respect to matters governed by such regulations issued by the
Commissioner of Social Security or any other agency or instrumentality of the
United States, 1 year after the date of the issuance of such regulations by the
Commissioner or such other agency or instrumentality, respectively. Such
provisions shall apply in the case of displays to the general public, as
defined in section 208A(a)(3) of such Act (added by section 8 of this Act), to
such displays originally occurring after such 1-year period. Such provisions
shall not apply with respect to any display of a record (containing a social
security account number (or any derivative thereof)) generated prior to the
close of such 1-year period.
(2)The last sentence
of subclause (XIII) of section 205(c)(2)(C)(x) of the Social Security Act
(added by this section) shall cease to be effective with respect to sales or
displays to the general public occurring after 2 years after the effective date
of the initial final regulations prescribed to carry out the provisions of such
section 205(c)(2)(C)(x).
3.Prohibition of
display of social security account numbers on checks issued for payment by
governmental entities
(a)Section 205(c)(2)(C) of the Social Security Act (42 U.S.C. 405(c)(2)(C)) (as
amended by section 2 of this Act) is amended further by adding at the end the
following new clause:
(xi)No governmental entity (as defined in
clause (x)(X)) may include the social security account number of any individual
(or any derivative of such number) on any check issued for any payment by such
governmental entity or on any document attached to or accompanying such a
check.
.
(b)The amendment made by this section shall apply with respect
to checks (and documents attached to or accompanying such checks) issued after
1 year after the date of the enactment of this Act.
4.Prohibition of
the display of social security account numbers on certain government
identification cards or tags
(a)Section 205(c)(2)(C) of the Social Security Act (42 U.S.C. 405(c)(2)(C)) (as
amended by the preceding provisions of this Act) is amended further by adding
at the end the following new clause:
(xii)No governmental entity (as defined in
clause (x)(X)), and no other person offering benefits in connection with an
employee benefit plan maintained by such governmental entity, may display a
social security account number (or any derivative thereof) on any card or tag
that is commonly provided—
(I)to employees of such governmental
entity,
(II)in the case of a governmental entity
which is an educational institution, to its students, or
(III)in the case of a governmental entity
which is a medical institution, to its patients,
(or to their
family members) for purposes of identification or include on such card or tag a
magnetic strip, bar code, or other means of communication which conveys such
number (or derivative thereof). The requirements of this clause shall also
apply to the Medicare card issued by the Department of Health and Human
Services..
(b)The amendment made by this section shall apply with respect
to cards or tags issued after 1 year after the date of the enactment of this
Act, except that the last sentence of section 205(c)(2)(C)(xii) (as added by
this section) shall take effect 2 and one-half years after the date of the
enactment of this Act.
5.Prohibition of
inmate access to social security account numbers
(a)Section 205(c)(2)(C) of the Social Security Act (42 U.S.C. 405(c)(2)(C)) (as
amended by the preceding provisions of this Act) is amended further by adding
at the end the following new clause:
(xiii)No governmental entity (as defined
in clause (x)(X)) may employ, or enter into a contract for the use or
employment of, prisoners in any capacity that would allow such prisoners access
to the social security account numbers of other individuals (or any derivatives
of such numbers). For purposes of this clause, the term prisoner
means an individual confined in a jail, prison, or other penal institution or
correctional
facility.
.
(b)
(1)Except as provided in paragraph (2), the amendment made
by this section shall apply with respect to employment of prisoners, or entry
into contract for the use or employment of prisoners, on or after the date of
the enactment of this Act.
(2)Treatment of
current arrangementsIn the case of—
(A)prisoners employed
as described in clause (xiii) of section 205(c)(2)(C) of the
Social Security Act (as added by this
section) on the date of the enactment of this Act, and
(B)contracts
described in such clause in effect on such date,
the
amendment made by this section shall take effect 90 days after the date of the
enactment of this Act.6.Measures to preclude
unauthorized disclosure by governmental entities of social security account
numbers and protect the confidentiality of such numbers
(a)Section 205(c)(2)(C) of the Social Security Act (42
U.S.C. 405(c)(2)(C)) (as amended by the preceding provisions of this Act) is
amended further by adding at the end the following new clause:
(xiv)Except as otherwise provided in this
paragraph, in the case of any governmental entity (as defined in clause (x)(X))
having access to an individual’s social security account number—
(I)no officer or employee thereof shall
have access to such number for any purpose other than the effective
administration of the statutory provisions governing its functions,
(II)such governmental entity shall
restrict, to the satisfaction of the Commissioner of Social Security, access to
social security account numbers obtained thereby to officers and employees
thereof whose duties or responsibilities require access for the administration
or enforcement of such provisions, and
(III)such governmental entity shall
provide such other safeguards as the Commissioner determines to be necessary or
appropriate to preclude unauthorized access to the social security account
number and to otherwise protect the confidentiality of such number.
For purposes
of this clause the term social security account number
includes
any derivative
thereof..
(b)The amendment made by this section shall take effect 1 year
after the date of the enactment of this Act.
7.Uniform standards
for truncation of the social security account number
(a)Section 205(c)(2)(C) of the Social Security Act (42
U.S.C. 405(c)(2)(C)) (as amended by the preceding provisions of this Act) is
amended further by adding at the end the following new clause:
(xv)The truncation by any governmental
entity (as defined in clause (x)(X)) or by any person in the private sector of
an individual’s social security account number which is used by such
governmental entity or person otherwise in accordance with the requirements of
this Act shall be in accordance with a uniform truncation standard which shall
be specified in regulations prescribed by the Commissioner of Social Security.
Under such standard, the number as truncated shall set forth not more than the
last 4 digits of the number. Nothing in this clause shall be construed to
authorize any use of the social security account number which is not otherwise
authorized by this title or regulations prescribed
thereunder.
.
(b)Initial final
regulations prescribed to carry out the provisions of section 205(c)(2)(C)(xv)
of the Social Security Act (added by this section) shall be issued not later
than the last date of the 18th calendar month following the date of the
enactment of this Act. Such provisions shall take effect, with respect to
matters governed by such regulations issued by the Commissioner or any other
agency or instrumentality of the United States, 1 year after the date of the
issuance of such regulations by the Commissioner or such other agency or
instrumentality, respectively.
8.Prohibition of the
sale, purchase, and display to the general public of the social security
account number in the private sector
(a)Title II of the Social
Security Act is amended by inserting after section 208 (42 U.S.C.
408) the following new section:
208A.Prohibition of the sale, purchase, and
display to the general public of the social security account number in the
private sector(a)For
purposes of this section:
(1)
(A)Subject to subparagraph (B), the term person
means any individual, partnership, corporation, trust, estate, cooperative,
association, or any other entity.
(B)Exclusion of
governmental entitiesSuch term does not include a governmental
entity. Nothing in this subparagraph shall be construed to authorize, in
connection with a governmental entity, an act or practice otherwise prohibited
under this section or section 205(c)(2)(C).
(2)
(A)Subject to subparagraph (B)—
(i)The
term sell in connection with a social security account number
means to obtain, directly or indirectly, anything of value in exchange for such
number.
(ii)The
term purchase in connection with a social security account number
means to provide, directly or indirectly, anything of value in exchange for
such number.
(B)The
terms sell
and purchase
in connection with a
social security account number do not include the submission of such number as
part of—
(i)the process for
applying for any type of Government benefits or programs (such as grants or
loans or welfare or other public assistance programs),
(ii)the
administration of, or provision of benefits under, an employee benefit plan,
or
(iii)the sale, lease,
merger, transfer, or exchange of a trade or business.
(3)Display to the
general public
(A)The term display to the general public
means, in connection with a social security account number, to intentionally
place such number in a viewable manner on an Internet site that is available to
the general public or to make such number available in any other manner
intended to provide access to such number by the general public.
(B)In any case in
which a person requires transmittal to such person of an individual’s social
security account number by means of the Internet without ensuring that such
number is encrypted or otherwise well-secured from disclosure, any such
transmittal of such number as so required shall be treated as a display
to the general public
of such number by such person.
(4)Social security
account number
(A)The term social
security account number has the meaning given such term in section
208(e), except that such term includes any derivative of such number.
(B)Notwithstanding the preceding sentence, for purposes
of subsection (b)(1)(A), any expression, contained in or on any item sold or
displayed to the general public, shall not be treated as a social security
account number solely because such expression sets forth not more than the last
4 digits of such number, if the remainder of such number cannot be determined
based solely on such expression or any other matter presented in or on such
item.
(5)
(A)The term governmental entity
means an
executive, legislative, or judicial agency or instrumentality of the Federal
Government, a State or political subdivision thereof, a federally recognized
Indian tribe, or a trustee appointed in a case under title 11, United States
Code. Such term includes a person acting as an agent of such an agency or
instrumentality, Indian tribe, or trustee.
(B)The
term State
includes the District of Columbia, the Commonwealth
of Puerto Rico, the Virgin Islands, Guam, the Commonwealth of the Northern
Marianas, and the Trust Territory of the Pacific Islands.
(b)Prohibition of
sale, purchase, and display to the general public
(1)Except as provided in paragraph (2), it shall be unlawful
for any person to—
(A)sell or purchase a
social security account number or display to the general public a social
security account number, or
(B)obtain or use any
individual’s social security account number for the purpose of locating or
identifying such individual with the intent to harass, harm, or physically
injure such individual or using the identity of such individual for any illegal
purpose.
(2)
(A)Notwithstanding paragraph (1), and subject to paragraph
(3), a social security account number may be sold or purchased by any person to
the extent provided in this subsection (and for no other purpose) as
follows:
(i)to the extent necessary for law
enforcement, including (but not limited to) the enforcement of a child support
obligation, as determined under regulations issued as provided in section
1129C;
(ii)to the extent necessary for national
security purposes, as determined under regulations issued as provided in
section 1129C;
(iii)to the extent
necessary for public health purposes;
(iv)to the extent necessary in emergency
situations to protect the health or safety of 1 or more individuals;
(v)to
the extent that the sale or purchase is required to comply with a tax law of
the United States or of any State (or political subdivision thereof);
(vi)to the extent that the sale or purchase is
to or by a consumer reporting agency (as defined in section 603(f) of the
Fair Credit Reporting Act (15 U.S.C.
1681a(f))) for use or disclosure solely for permissible purposes described in
section 604(a) of such Act (15 U.S.C. 1681b(a)); and
(vii)to the extent
necessary for research (other than market research) conducted by an agency or
instrumentality of the United States or of a State or political subdivision
thereof (or a person acting as an agent of such an agency or instrumentality)
for the purpose of advancing the public good, on the condition that the
researcher provides adequate assurances that—
(I)the social
security account numbers will not be used to harass, target, or publicly reveal
information concerning any identifiable individuals;
(II)information about
identifiable individuals obtained from the research will not be used to make
decisions that directly affect the rights, benefits, or privileges of specific
individuals; and
(III)the researcher has in place appropriate
safeguards to protect the privacy and confidentiality of any information about
identifiable individuals, including procedures to ensure that the social
security account numbers will be encrypted or otherwise appropriately secured
from unauthorized disclosure.
(B)In the case of
research referred to in subparagraph (A)(vii) consisting of medical research,
the Commissioner of Social Security shall maintain ongoing consultation with
the Office for Civil Rights of the Department of Health and Human Services to
ensure that the sale or purchase of social security account numbers which
constitute personally identifiable medical information is permitted only in
compliance with existing Federal rules and regulations prescribed by the
Secretary of Health and Human Services pursuant to section 264(c) of the Health
Insurance Portability and Accountability Act of 1996 (110 Stat. 2033).
(3)Consent and
other circumstances determined by regulationNotwithstanding
paragraph (1), a social security account number assigned to an individual may
be sold or purchased by any person—
(A)to the extent
consistent with such individual’s voluntary and affirmative written consent to
the sale or purchase, but only if—
(i)the terms of the
consent and the right to refuse consent are presented to the individual in a
clear, conspicuous, and understandable manner,
(ii)the individual is
placed under no obligation to provide consent to any such sale or purchase,
and
(iii)the terms of the
consent authorize the individual to limit the sale or purchase to purposes
directly associated with the transaction with respect to which the consent is
sought, and
(B)under such circumstances as may be deemed
appropriate in regulations issued as provided under section 1129C.
(c)Prohibition of
display on checksIt shall be unlawful for any person to include
the social security account number of any other individual on any check issued
for any payment by such person or on any document attached to or accompanying
such a check.
(d)Prohibition of
unauthorized disclosure to government agencies or instrumentalities
(1)It shall be unlawful for any person to communicate by any
means to any agency or instrumentality of the United States or of any State or
political subdivision thereof the social security account number of any
individual other than such person without the written permission of such
individual, unless the number was requested by the agency or instrumentality.
In the case of an individual who is legally incompetent, permission provided by
the individual’s legal representatives shall be deemed to be permission
provided by such individual.
(2)Paragraph
(1) shall not apply to the extent necessary—
(A)for law
enforcement, including (but not limited to) the enforcement of a child support
obligation, or
(B)for national
security purposes,
as
determined under regulations issued as provided under section 1129C.(e)Prohibition of
the displays on cards or tags required for access to goods, services, or
benefitsNo person may display a social security account number
on any card or tag issued to any other person for the purpose of providing such
other person access to any goods, services, or benefits or include on such card
or tag a magnetic strip, bar code, or other means of communication which
conveys such number.
(f)Prohibition of
the displays on employee identification cards or tagsNo person
that is an employer, and no other person offering benefits in connection with
an employee benefit plan maintained by such employer or acting as an agent of
such employer, may display a social security account number on any card or tag
that is commonly provided to employees of such employer (or to their family
members) for purposes of identification or include on such card or tag a
magnetic strip, bar code, or other means of communication which conveys such
number.
(g)Measures To
preclude unauthorized disclosure of social security account numbers and protect
the confidentiality of such numbersSubject to the preceding provisions of this
section, any person having access to the social security account number of any
individual other than such person shall, to the extent that such access is
maintained for the conduct of such person’s trade or business—
(1)ensure that no
officer or employee thereof has access to such number for any purpose other
than as necessary for the conduct of such person’s trade or business,
(2)restrict, in
accordance with regulations of the Commissioner of Social Security, access to
social security account numbers obtained thereby to officers and employees
thereof whose duties or responsibilities require access for the conduct of such
person’s trade or business, and
(3)provide such
safeguards as may be specified, in regulations of the Commissioner of Social
Security, to be necessary or appropriate to preclude unauthorized access to the
social security account number and to otherwise protect the confidentiality of
such number.
(h)This section does not apply with respect to the
social security account number of a deceased individual.
(i)Applicability of
other protectionsNothing in
the preceding subsections of this section shall be construed as superseding,
altering, or affecting any statutory provision, regulation, order, or
interpretation in effect under any other Federal or State law, except to the
extent that such statutory provision, regulation, order, or interpretation is
inconsistent with such subsections, and then only to the extent of the
inconsistency. For purposes of this subclause, a statutory provision,
regulation, order, or interpretation is not inconsistent with the preceding
subsections of this section if the protection such statutory provision,
regulation, order, or interpretation affords any person is greater than the
protection provided under such
subsections.
.
(b)Effective date
and related rules
(1)Initial final regulations prescribed to carry out the
provisions of section 208A of the Social Security Act (added by this section)
shall be issued not later than the last date of the 18th calendar month
following the date of the enactment of this Act. Such provisions shall take
effect, with respect to matters governed by such regulations issued by the
Commissioner of Social Security or any other agency or instrumentality of the
United States, 1 year after the date of the issuance of such regulations by the
Commissioner of Social Security or such other agency or instrumentality,
respectively. Section 208A(b) of such Act shall apply in the case of displays
to the general public (as defined in section 208A(a)(3) of such Act) to such
displays to the general public originally occurring after such 1-year period.
Such provisions shall not apply with respect to any such display to the general
public of a record (containing a social security account number (or any
derivative thereof)) generated prior to the close of such 1-year period.
(2)Section
208A(a)(4)(B) of the Social Security Act (added by this section) shall cease to
be effective with respect to sales, purchases, or displays to the general
public occurring after 2 years after the effective date of the initial final
regulations prescribed to carry out the provisions of section 208A of such
Act.
9.New criminal
penalties for misuse of social security account numbers
(a)Section 208 of the Social Security Act (42 U.S.C. 408) is
amended—
(1)in subsection (a),
by inserting or
at the end of paragraph (8) and by inserting
after paragraph (8) the following new paragraph:
(9)willfully acts or fails to act so as to
cause a violation of section
208A(b)(1)(B);
.
(2)by redesignating
subsections (b) through (e) as subsections (c) through (f),
respectively;
(3)in subsection
(c)(1) (as so redesignated), by inserting or (b)
after
subsection (a)
; and
(4)by inserting after
subsection (a) the following new subsection:
(b)(1)Whoever—
(A)knowingly, and with intent to commit,
or to aid or abet, any activity that constitutes a violation of Federal law, or
a violation of any applicable law of a State or political subdivision thereof
if the maximum penalty of such applicable law includes imprisonment for 5 years
or more—
(i)possesses the social security
account number of another person without lawful authority, or
(ii)possesses a social security card,
knowing that the social security account number or other identifying
information displayed on the card has been altered, counterfeited, or forged or
that the card was falsely made, stolen, or obtained from the Social Security
Administration by use of false information;
if such
activity is committed, or aided or abetted, with intent to use such social
security account number, social security card, or other identifying information
displayed on such card in furtherance of such violation;(B)being—
(i)an officer or employee of any
governmental entity (as defined in section 205(c)(2)(C)(x)(X)), or
(ii)a person acting as an agent of a
governmental entity (as so defined),
willfully acts or fails to act so
as to cause a violation of clause (vi)(II), (xi), (xii), or (xv) of section
205(c)(2)(C);(C)being a trustee appointed in a case under
title 11, United States Code (or an officer or employee thereof or a person
acting as an agent thereof), willfully acts or fails to act so as to cause a
violation of clause (xi) or (xv) of section 205(c)(2)(C); or
(D)willfully acts or fails to act so as
to cause a violation of subsection (c), (d), (e), or (f) of section 208A or, as
a person in the private sector, willfully acts or fails to act so as to cause a
violation of section 205(c)(2)(C)(xv);
shall be
guilty of a misdemeanor and upon conviction thereof shall be fined under title
18, United States Code, or imprisoned for not more than 1 year, or both.(2)(A)Whoever—
(i)with intent to deceive, discloses, sells,
or transfers his own social security account number, assigned to him by the
Commissioner of Social Security (in the exercise of the Commissioner’s
authority under section 205(c)(2) to establish and maintain records), to any
person;
(ii)without lawful authority, offers, for a
fee, to acquire for any individual, or to assist in acquiring for any
individual, an additional social security account number or a number that is
purported to be a social security account number;
(iii)being—
(I)an officer or employee of any
governmental entity (as defined in section 205(c)(2)(C)(x)(X)), or
(II)a person acting as an agent of a
governmental entity (as so defined),
willfully
acts or fails to act so as to cause a violation of clause (x), (xiii), or (xiv)
of section 205(c)(2)(C);(iv)being a trustee appointed in a case under
title 11, United States Code (or an officer or employee thereof or a person
acting as an agent thereof), willfully acts or fails to act so as to cause a
violation of clause (x) or (xiv) of section 205(c)(2)(C); or
(v)willfully acts or fails to act so as
to cause a violation of subsection (b)(1)(A) or (g) of section 208A;
shall
be fined, imprisoned, or both, as provided in subparagraph (B).(B)A person convicted of a violation
described in subparagraph (A) shall—
(i)be fined under title 18, United States
Code, imprisoned not more than 1 year, or both; and
(ii)if the offense is committed under
false pretenses or for commercial advantage, personal gain, or malicious harm,
be fined under title 18, United States Code, imprisoned not more than 5 years,
or
both.
.
(b)The amendments made by this section shall apply with
respect to each violation occurring after the date of the enactment of this
Act, except that subparagraphs (B), (C), and (D) of section 208(b)(1) of such
Act and clauses (iii), (iv), and (v) of section 208(b)(2)(A) of such Act (added
by subsection (a)(3)) shall apply, in connection with violations of clause (x),
(xi), (xii), (xiii), (xiv), or (xv) of section 205(c)(2)(C) or section 208A,
with respect to each violation occurring on or after the effective date
applicable with respect to such violation under section 2, 3, 4, 5, 6, 7, or
8.
10.Extension of
civil monetary penalty authority
(a)Application of
civil money penalties to elements of criminal violationsSection
1129(a) of the Social Security Act (42
U.S.C. 1320a–8(a)) is amended—
(1)by redesignating
paragraphs (2) and (3) as paragraphs (4) and (5), respectively;
(2)by designating the
last sentence of paragraph (1) as a new paragraph (2), appearing after and
below paragraph (1); and
(3)by inserting after
paragraph (2) (as designated under paragraph (2) of this subsection) the
following:
(3)Any person (including an
organization, agency, or other entity) who—
(A)uses a social security account number
that such person knows or should know has been assigned by the Commissioner of
Social Security (in an exercise of authority under section 205(c)(2) to
establish and maintain records) on the basis of false information furnished to
the Commissioner by any person;
(B)falsely represents a number to be the
social security account number assigned by the Commissioner of Social Security
to any individual, when such person knows or should know that such number is
not the social security account number assigned by the Commissioner to such
individual;
(C)with intent to deceive, alters a
social security card that the person knows or should know was issued by the
Commissioner of Social Security, or possesses such a card with intent to alter
it;
(D)buys or sells a card that such person
knows or should know is, or is purported to be, a card issued by the
Commissioner of Social Security, or possesses such a card with intent to buy or
sell it;
(E)counterfeits a social security card,
or possesses a counterfeit social security card with intent to buy or sell
it;
(F)discloses, uses, compels the
disclosure of, or knowingly sells or purchases the social security account
number of any person in violation of the laws of the United States;
(G)with intent to deceive the
Commissioner of Social Security as to such person’s true identity (or the true
identity of any other person), furnishes or causes to be furnished false
information to the Commissioner with respect to any information required by the
Commissioner in connection with the establishment and maintenance of the
records provided for in section 205(c)(2);
(H)without lawful authority, offers, for
a fee, to acquire for any individual, or to assist in acquiring for any
individual, an additional social security account number or a number which is
purported to be a social security account number;
(I)with intent to deceive, discloses,
sells, or transfers his own social security account number, assigned to him by
the Commissioner of Social Security under section 205(c)(2)(B), to any
person;
(J)knowingly, and with intent to commit,
or to aid or abet, any activity that constitutes a violation of Federal law, or
a violation of any applicable law of a State or political subdivision thereof
if the maximum penalty of such applicable law includes imprisonment for 5 years
or more—
(i)possesses a social security account
number of another individual without lawful authority, or
(ii)possesses a social security card,
knowing that the social security account number or other identifying
information displayed on the card has been altered, counterfeited, or forged or
that the card was falsely made, stolen, or obtained from the Social Security
Administration by use of false information,
if such
activity is committed, or aided or abetted, with intent to use such social
security account number, social security card, or other identifying information
displayed on such card in furtherance of such violation;(K)being—
(i)an officer or employee of a
governmental entity (as defined in section 205(c)(2)(C)(x)(X)), or
(ii)a person acting as an agent of a
governmental entity (as so defined),
willfully acts or fails to act so
as to cause a violation of clause (vi)(II), (x), (xi), (xii), (xiii), (xiv), or
(xv) of section 205(c)(2)(C);(L)being a trustee appointed in a case
under title 11, United States Code (or an officer or employee thereof or a
person acting as an agent thereof), willfully acts or fails to act so as to
cause a violation of clause (x), (xi), (xiv), or (xv) of section
205(c)(2)(C);
(M)violates section 208A (relating to
prohibition of the sale, purchase, or display of the social security account
number in the private sector) or, as a person in the private sector, violates
section 205(c)(2)(C)(xv); or
(N)violates section 208(g) (relating to
fraud by social security administration employees);
shall be
subject to, in addition to any other penalties that may be prescribed by law, a
civil money penalty of not more than $5,000 for each violation. Such person
shall also be subject to an assessment, in lieu of damages sustained by the
United States resulting from such violation, of not more than twice the amount
of any benefits or payments paid as a result of such
violation..
(b)The amendments made by this section shall apply with
respect to violations committed after the date of the enactment of this Act,
except that subparagraphs (J), (K), (L), and (M) of section 1129(a)(3) of the
Social Security Act (added by
subsection (a)) shall apply with respect to violations of the provisions of
clause (x), (xi), (xii), (xiii), (xiv), or (xv) of section 205(c)(2)(C) or
section 208A occurring on or after the applicable effective date provided in
connection with such provisions under section 2, 3, 4, 5, 6, 7, or 8 of this
Act.
11.Criminal
penalties for employees of the Social Security Administration who knowingly and
fraudulently issue social security cards or social security account
numbers
(a)Section 208 of the Social
Security Act (as amended by section 9) is amended further by adding
at the end the following new subsection:
(g)(1)Whoever is an employee
of the Social Security Administration and knowingly and fraudulently sells or
transfers one or more social security account numbers or social security cards
shall, upon conviction, be guilty of a felony and fined under title 18, United
States Code, imprisoned as provided in paragraph (2), or both.
(2)Imprisonment for a violation
described in paragraph (1) shall be for—
(A)not more than 5 years, in the case of
an employee of the Social Security Administration who has fraudulently sold or
transferred not more than 50 social security account numbers or social security
cards,
(B)not more than 10 years, in the case of
an employee of the Social Security Administration who has fraudulently sold or
transferred more than 50, but not more than 100, social security account
numbers or social security cards, or
(C)not more than 20 years, in the case of
an employee of the Social Security Administration who has fraudulently sold or
transferred more than 100 social security account numbers or social security
cards.
(3)For purposes of this
subsection—
(A)The term social security
employee means any State employee of a State disability determination
service, any officer, employee, or contractor of the Social Security
Administration, any employee of such a contractor, or any volunteer providing
services or assistance in any facility of the Social Security
Administration.
(B)The term social security account
number means a social security account number assigned by the
Commissioner of Social Security under section 205(c)(2)(B) or another number
that has not been so assigned but is purported to have been so assigned.
(C)The term social security
card means a card issued by the Commissioner of Social Security under
section 205(c)(2)(G), another card which has not been so issued but is
purported to have been so issued, and banknote paper of the type described in
section 205(c)(2)(G) prepared for the entry of social security account numbers,
whether fully completed or
not.
.
(b)The amendment made by this section shall apply with respect
to violations occurring on or after the date of the enactment of this
Act.
12.Enhanced
penalties in cases of terrorism, drug trafficking, crimes of violence, or prior
offenses
(a)Section 208 of the Social
Security Act (as amended by the preceding provisions of this Act) is
amended further—
(1)in subsection (a),
by striking shall be fined
and all that follows and inserting
the following: shall be fined, imprisoned, or both, as provided in
subsection (c).
;
(2)in subsection (b)(2)(B)(ii) (as added by
section 9), by striking be fined
and all that follows and
inserting the following: be fined, imprisoned, or both, as provided in
subsection (c).
;
(3)by striking
subsection (d);
(4)by redesignating
subsection (c) as subsection (d); and
(5)by inserting after
subsection (b) the following new subsection:
(c)A person convicted
of a violation described in subsection (a) or a violation described in
subsection (b)(2)(A) which is subject to subsection (b)(2)(B)(ii) shall
be—
(1)fined under title
18, United States Code, or imprisoned for not more than 5 years, or both, in
the case of an initial violation, subject to paragraphs (3) and (4),
(2)fined under title
18, United States Code, or imprisoned for not more than 10 years, or both, in
the case of a violation which occurs after a prior conviction for another
offense under subsection (a) becomes final, subject to paragraphs (3) and
(4),
(3)fined under title
18, United States Code, or imprisoned for not more than 20 years, in the case
of a violation which is committed to facilitate a drug trafficking crime (as
defined in section 929(a)(2) of title 18, United States Code) or in connection
with a crime of violence (as defined in section 924(c)(3) of title 18, United
States Code) involving force against the person of another, subject to
paragraph (4), and
(4)fined under title
18, United States Code, or imprisoned for not more than 25 years, in the case
of a violation which is committed to facilitate an act of international or
domestic terrorism (as defined in paragraphs (1) and (5), respectively, of
section 2331 of title 18, United States
Code).
.
(b)Section 811 of such Act (42 U.S.C. 1011) is
amended—
(1)in subsection (a),
by striking shall be fined
and all that follows and inserting
shall be fined, imprisoned, or both, as provided in subsection
(b).
;
(2)by redesignating
subsection (b) as subsection (c); and
(3)by inserting after
subsection (a) the following new subsection:
(b)A
person convicted of a violation described in subsection (a) shall be—
(1)fined under title
18, United States Code, or imprisoned for not more than 5 years, or both, in
the case of an initial violation, subject to paragraphs (3) and (4),
(2)fined under title
18, United States Code, or imprisoned for not more than 10 years, or both, in
the case of a violation which occurs after a prior conviction for another
offense under subsection (a) becomes final, subject to paragraphs (3) and
(4),
(3)fined under title
18, United States Code, or imprisoned for not more than 20 years, in the case
of a violation which is committed to facilitate a drug trafficking crime (as
defined in section 929(a)(2) of title 18, United States Code) or in connection
with a crime of violence (as defined in section 924(c)(3) of title 18, United
States Code) involving force against the person of another, subject to
paragraph (4), and
(4)fined under title
18, United States Code, or imprisoned for not more than 25 years, in the case
of a violation which is committed to facilitate an act of international or
domestic terrorism (as defined in paragraphs (1) and (5), respectively, of
section 2331 of title 18, United States
Code).
.
(c)Section 1632 of such Act (42 U.S.C. 1383a) is
amended—
(1)in subsection (a),
by striking shall be fined
and all that follows and inserting
shall be fined, imprisoned, or both, as provided in subsection
(b).
;
(2)by redesignating
subsections (b) and (c) as subsections (c) and (d), respectively; and
(3)by inserting after
subsection (a) the following new subsection:
(b)A person convicted
of a violation described in subsection (a) shall be—
(1)fined under title
18, United States Code, or imprisoned for not more than 5 years, or both, in
the case of an initial violation, subject to paragraphs (3) and (4),
(2)fined under title
18, United States Code, or imprisoned for not more than 10 years, or both, in
the case of a violation which occurs after a prior conviction for another
offense under subsection (a) becomes final, subject to paragraphs (3) and
(4),
(3)fined under title
18, United States Code, or imprisoned for not more than 20 years, in the case
of a violation which is committed to facilitate a drug trafficking crime (as
defined in section 929(a)(2) of title 18, United States Code) or in connection
with a crime of violence (as defined in section 924(c)(3) of title 18, United
States Code) involving force against the person of another, subject to
paragraph (4), and
(4)fined under title
18, United States Code, or imprisoned for not more than 25 years, in the case
of a violation which is committed to facilitate an act of international or
domestic terrorism (as defined in paragraphs (1) and (5), respectively, of
section 2331 of title 18, United States
Code).
.
(d)The amendments made by this section shall apply with respect
to violations occurring after the date of the enactment of this Act.
13.Regulatory and
enforcement authority with respect to misuse of the social security account
numberTitle XI of the Social
Security Act is amended by inserting after section 1129B (42 U.S.C. 1320a–7b)
the following new section:
1129C.Regulatory and enforcement authority with respect to misuse
of the social security account number(a)
(1)The Commissioner of Social Security shall prescribe
regulations to carry out the provisions of clauses (vi)(II), (x), (xi), (xii),
(xiii), (xiv), and (xv) of section 205(c)(2)(C) and section 208A. Such
regulations shall be issued in consultation with the Federal Trade Commission,
the Attorney General of the United States, the Secretary of Homeland Security,
the Secretary of Health and Human Services, the Secretary of the Treasury, the
Federal banking agencies (as defined in section 3 of the Federal Deposit
Insurance Act), the National Credit Union Administration, the Securities and
Exchange Commission, State attorneys general, and such representatives of the
State insurance commissioners as may be designated by the National Association
of Insurance Commissioners.
(2)Treatment of
matters relating to law enforcement and national securityIn issuing the regulations described in
paragraph (1) with respect to the provisions of 205(c)(2)(C)(x)(III), paragraph
(A) or (B) of section 208A(b)(2), or section 208A(c)(2) (relating to law
enforcement and national security), the sale or purchase of social security
account numbers may be authorized only if the Commissioner (or the agency or
instrumentality delegated authority to issue such regulations under paragraph
(5)) determines that—
(A)such sale or purchase would serve a
compelling public interest that cannot reasonably be served through alternative
measures, and
(B)such sale or purchase will not pose an
unreasonable risk of identity theft, or bodily, emotional, or financial harm to
an individual (taking into account any restrictions and conditions that the
agency or instrumentality issuing the regulations imposes on the sale,
purchase, or disclosure).
(3)Treatment of
other matters in general discretion of the Commissioner
(A)In issuing the
regulations described in paragraph (1) with respect to the provisions of
section 205(c)(2)(C)(x)(VIII) or section 208A(b)(3)(B), the sale, purchase, or
display to the general public of social security account numbers may be
authorized only after considering, among other relevant factors—
(i)the extent to
which the authorization of the sale, purchase, or display of the social
security account number would serve a compelling public interest that cannot
reasonably be served through alternative measures,
(ii)the associated cost or burden of the
authorization to the general public, businesses, commercial enterprises,
non-profit organizations, and Federal, State, and local governments, and
(iii)the associated
benefit of the authorization to the general public, businesses, commercial
enterprises, non-profit associations, and Federal, State, and local
governments.
(B)Restrictions and
conditionsIf, after
considering the factors in subparagraph (A), the sale, purchase, or display to
the general public of social security account numbers is authorized under
regulations referred to in subparagraph (A), the Commissioner (or the agency or
instrumentality delegated authority to issue such regulations under paragraph
(5)) shall impose restrictions and conditions on the sale, purchase, or display
to the general public to the extent necessary—
(i)to provide reasonable assurances that
social security account numbers will not be used to commit or facilitate fraud,
deceptions, or crime, and
(ii)to prevent an unreasonable risk of identity
theft or bodily, emotional, or financial harm to any individual, considering
the nature, likelihood, and severity of the anticipated harm that could result
from the sale, purchase, or display to the general public of social security
account numbers, together with the nature, likelihood, and extent of any
benefits that could be realized.
(C)5-year
expiration date for regulationsAt the end of the 5-year period beginning
on the effective date of any final regulations issued pursuant to this
paragraph—
(i)such regulations
shall expire, and
(ii)new regulations
may be issued pursuant to this paragraph.
(4)In the issuance of
regulations pursuant to this subsection, notice shall be provided as described
in paragraphs (1), (2), and (3) of section 553(b) of title 5, United States
Code, and opportunity to participate in the rule making shall be provided in
accordance with section 553(c) of such title.
(5)Delegation to
other agenciesAny agency or instrumentality of the United States
may exercise the authority of the Commissioner under this subsection, with
respect to matters otherwise subject to regulation by such agency or
instrumentality, to the extent determined appropriate in regulations of the
Commissioner.
(6)Consultation and
coordinationEach agency and instrumentality exercising authority
to issue regulations under this subsection shall consult and coordinate with
the other such agencies and instrumentalities for the purposes of assuring, to
the extent possible, that the regulations prescribed by each such agency or
instrumentality are consistent and comparable, as appropriate, with the
regulations prescribed by the other such agencies and instrumentalities. The
Commissioner shall undertake to facilitate such consultation and
coordination.
(7)Definitions and
special rules
(A)For purposes of
this subsection, the terms sell, purchase, and
display to the general public shall have the meanings provided
such terms under section 205(c)(2)(C)(x) or section 208A(a), as
applicable.
(B)For purposes of
this subsection, section 205(c)(2)(C)(x)(XI) shall apply.
(b)Coordination of
enforcement with other agenciesThe Commissioner may provide, by
regulation, for enforcement by any other agency or instrumentality of the
United States of the provisions of section 208A and regulations prescribed
pursuant to subsection (a)(1) with respect to section 208A.
(c)Actions by
States with respect to misuse in private sector or by State and local
governments
(1)In any case in which
the attorney general of a State (as defined in section 205(c)(2)(C)(x)(X)) has
reason to believe that an interest of the residents of that State has been or
is threatened or adversely affected by an act or practice described in
paragraph (2), the State, as parens patriae, may bring a civil action on behalf
of the residents of the State in a district court of the United States of
appropriate jurisdiction, to—
(A)enjoin that act or
practice;
(B)enforce compliance
with the regulation;
(C)obtain civil
penalties in an amount of $11,000 per violation not to exceed a total of
$5,000,000; or
(D)obtain such other
legal and equitable relief as the district court may consider to be
appropriate.
Before
filing an action under this subsection, the attorney general of the State
involved shall provide to the Commissioner of Social Security and the Attorney
General of the United States a written notice of that action and a copy of the
complaint for that action. If the State attorney general determines that it is
not feasible to provide the notice described in this subparagraph before the
filing of the action, the State attorney general shall provide the written
notice and the copy of the complaint as soon after the filing of the complaint
as practicable. Any reference in this subsection to the attorney general of a
State shall be deemed also to be a reference to any equivalent official of such
State.(2)Acts or
practices subject to enforcementAn act or practice described in
this paragraph is—
(A)an act or practice by an executive,
legislative, or judicial agency or instrumentality of the State involved or a
political subdivision thereof, a person acting as an agent thereof, or any
officer or employee of the foregoing or person acting as an agent of the
foregoing that violates clause (vi)(II), (x), (xi), (xii), (xiii), (xiv), or
(xv) of section 205(c)(2)(C) or any regulation promulgated thereunder,
or
(B)an act or practice
by any person that violates section 208A or any regulation promulgated
thereunder.
(3)Attorney General
authorityOn receiving notice under paragraph (1), the Attorney
General of the United States shall have the right—
(A)to move to stay
the action, pending the final disposition of a pending Federal matter as
described in paragraph (4);
(B)to intervene in an
action under paragraph (1);
(C)upon so
intervening, to be heard on all matters arising therein; and
(D)to file petitions
for appeal.
(4)Pending criminal
proceedingsIf the Attorney General of the United States has
instituted a criminal proceeding under section 208 alleging an act or practice
described in paragraph (2) in connection with any State, such State may not,
during the pendency of such proceeding or action, bring an action under this
subsection against any defendant named in the criminal proceeding.
(5)For purposes of bringing any civil action under
paragraph (1), nothing in this subsection shall be construed to prevent an
attorney general of a State from exercising the powers conferred on the
attorney general by the laws of that State to conduct investigations,
administer oaths and affirmations, or compel the attendance of witnesses or the
production of documentary and other evidence.
(6)Venue; service
of processAny action brought under paragraph (1) may be brought
in any district court of the United States that meets applicable requirements
relating to venue under section 1391 of title 28, United States Code. In an
action brought under paragraph (1), process may be served in any district in
which the defendant is an inhabitant or may be found.
(d)Remedies to
individuals for violations by the Federal Government of requirements relating
to social security account numbers
(1)Any individual who is aggrieved by an act or practice by
any person acting as an officer, employee, or agent of an agency or
instrumentality of the Federal Government in violation of the requirements of
clause (vi)(II), (x), (xi), (xii), (xiii), (xiv), or (xv) of subsection
(c)(2)(C) with respect to the social security account number assigned to such
individual under subsection (c)(2)(B) may commence a civil action for
appropriate equitable relief or actual damages.
(2)Venue; service
of processAn action under this subsection action may be brought
in the district court of the United States for the judicial district in which
the plaintiff resides, or has his principal place of business, in which the
violation took place, or in which the defendant resides or may be found, and
process may be served in any other district in which a defendant resides or may
be found.
(3)The
district courts of the United States shall have jurisdiction, without respect
to the amount in controversy or the citizenship of the parties, to grant the
relief provided for in paragraph (1).
(4)In any action under this subsection, the court in its
discretion may allow a reasonable attorney’s fee and costs of action to either
party.
(e)Ongoing GAO
review on efficacy of regulations
(1)The Comptroller General of the United States shall
conduct an ongoing review of the efficacy of the regulations prescribed by any
agency or instrumentality of the United States pursuant to this section. Such
review shall consider the extent to which such regulations are consistent with,
and in furtherance of the purposes of, the amendments made by the
Social Security Number Privacy and Identity
Theft Prevention Act of 2009.
(2)Not later than 4 years after the effective
date of any final regulations issued by any agency or instrumentality of the
United States pursuant to this section, the Comptroller General shall report to
each House of the Congress regarding the results of the review of such
regulations conducted under this paragraph. Such report shall include the
Comptroller General’s recommendations for such statutory or regulatory changes
as the Comptroller General considers
appropriate.
.
14.Study on feasibility
of banning social security account number as an authenticator
(a)As soon as practicable after the date of
the enactment of this Act, the Commissioner of Social Security shall enter into
an arrangement with the National Research Council under which the Council shall
carry out a study to determine—
(1)the extent of the
use of social security account numbers as a primary means of authenticating
identity;
(2)the extent of the use of social security
account numbers for verification in commercial transactions; and
(3)the feasibility of
a prohibition on such use.
The study shall also examine
possible alternatives to social security account numbers for verification
purposes and uses in authenticating identity.(b)The arrangement entered into with the
Council under this section shall provide for submission by the Council to the
Commissioner and to each House of the Congress of a report setting forth the
results of the Council’s study under this section, together with the Council’s
findings and recommendations, no later than 1 year after the effective date of
the initial final regulations issued by the Commissioner pursuant to the
amendments made by section 2 of this Act.