[House Report 110-339]
[From the U.S. Government Publishing Office]



110th Congress                                                   Report
                        HOUSE OF REPRESENTATIVES
 1st Session                                                    110-339

======================================================================



 
  SOCIAL SECURITY NUMBER PRIVACY AND IDENTITY THEFT PREVENTION ACT OF 
                                  2007

                                _______
                                

 September 24, 2007.--Committed to the Committee of the Whole House on 
            the State of the Union and ordered to be printed

                                _______
                                

    Mr. Rangel, from the Committee on Ways and Means, submitted the 
                               following

                              R E P O R T

                             together with

                            ADDITIONAL VIEWS

                        [To accompany H.R. 3046]

      [Including cost estimate of the Congressional Budget Office]

  The Committee on Ways and Means, to whom was referred the 
bill (H.R. 3046) to amend the Social Security Act to enhance 
Social Security account number privacy protections, to prevent 
fraudulent misuse of the Social Security account number, and to 
otherwise enhance protection against identity theft, and for 
other purposes, having considered the same, report favorably 
thereon with an amendment and recommend that the bill as 
amended do pass.

                                CONTENTS

                                                                   Page
  I. Introduction....................................................15
          A. Purpose and Summary.................................    15
          B. Background..........................................    16
          C. Legislative History.................................    16
 II. Section-by-Section Summary......................................19
III. Votes of the Committee..........................................42
          A. Motion to Report the Bill...........................    42
          B. Votes on Amendments.................................    42
 IV. Budget Effects of the Bill......................................43
          A. Committee Estimate of Budgetary Effects.............    43
          B. Statement Regarding New Budget Authority and Tax 
              Expenditures.......................................    43
          C. Cost Estimate Prepared by the Congressional Budget 
              Office.............................................    43
  V. Other Matters to be Discussed under the Rules of the House......50
          A. Committee Oversight Findings and Recommendations....    50
          B. Earmarks and Tax and Tariff Benefits................    50
          C. Constitutional Authority Statement..................    50
          D. Information Relating to Unfunded Mandates...........    50
 VI. Changes in Existing Law Made by the Bill, as Reported...........50
VII. Additional Views................................................70
  The amendment is as follows:
  Strike all after the enacting clause and insert the 
following:

SECTION 1. SHORT TITLE AND TABLE OF CONTENTS.

  (a) Short Title.--This Act may be cited as the ``Social Security 
Number Privacy and Identity Theft Prevention Act of 2007''.
  (b) Table of Contents.--The table of contents is as follows:

Sec. 1. Short title and table of contents.
Sec. 2. Restrictions on the sale or display to the general public of 
social security account numbers by governmental entities.
Sec. 3. Prohibition of display of social security account numbers on 
checks issued for payment by governmental entities.
Sec. 4. Prohibition of the display of social security account numbers 
on certain government identification cards or tags.
Sec. 5. Prohibition of inmate access to social security account 
numbers.
Sec. 6. Measures to preclude unauthorized disclosure by governmental 
entities of social security account numbers and protect the 
confidentiality of such numbers.
Sec. 7. Uniform standards for truncation of the social security account 
number.
Sec. 8. Prohibition of the sale, purchase, and display to the general 
public of the social security account number in the private sector.
Sec. 9. New criminal penalties for misuse of social security account 
numbers.
Sec. 10. Extension of civil monetary penalty authority.
Sec. 11. Criminal penalties for employees of the Social Security 
Administration who knowingly and fraudulently issue social security 
cards or social security account numbers.
Sec. 12. Enhanced penalties in cases of terrorism, drug trafficking, 
crimes of violence, or prior offenses.
Sec. 13. Regulatory and enforcement authority with respect to misuse of 
the social security account number.
Sec. 14. Study on feasibility of banning social security account number 
as an authenticator.

SEC. 2. RESTRICTIONS ON THE SALE OR DISPLAY TO THE GENERAL PUBLIC OF 
                    SOCIAL SECURITY ACCOUNT NUMBERS BY GOVERNMENTAL 
                    ENTITIES.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) is amended by adding at the end the following new 
clause:
  ``(x)(I) A governmental entity (as defined in subclause (X)) may not 
sell or display to the general public any social security account 
number if such number has been disclosed to such governmental entity 
pursuant to the assertion by such governmental entity to any person 
that disclosure of such number is a statutory or regulatory 
requirement. Notwithstanding the preceding sentence, such number may be 
sold or displayed to the general public in accordance with the 
exceptions specified in subclauses (II), (III), (IV), (V), (VI), (VII), 
and (VIII) (and for no other purpose).
  ``(II) Notwithstanding subclause (I), a social security account 
number may be sold by a governmental entity to the extent that such 
sale is specifically authorized by this Act or the Privacy Act of 1974.
  ``(III) Notwithstanding subclause (I), a social security account 
number may be sold by a governmental entity to the extent that is 
necessary or appropriate for law enforcement or national security 
purposes, as determined under regulations which shall be issued as 
provided in section 1129C.
  ``(IV) Notwithstanding subclause (I), a social security account 
number may be sold by a governmental entity to the extent that such 
sale is required to comply with a tax law of the United States or of 
any State (or political subdivision thereof).
  ``(V) Notwithstanding subclause (I), a social security account number 
may be sold by a State department of motor vehicles as authorized under 
subsection (b) of section 2721 of title 18, United States Code, if such 
number is to be used pursuant to such sale solely for purposes 
permitted under paragraph (1), (6), or (9) of such subsection.
  ``(VI) Notwithstanding subclause (I), a social security account 
number may be sold or otherwise made available by a governmental entity 
to a consumer reporting agency (as defined in section 603(f) of the 
Fair Credit Reporting Act (15 U.S.C. 1681a(f))) for use or disclosure 
solely for permissible purposes described in section 604(a) of such Act 
(15 U.S.C. 1681b(a)).
  ``(VII) Notwithstanding subclause (I), a social security account 
number may be sold by a governmental entity to the extent necessary for 
research (other than market research) conducted by any governmental 
entity for the purpose of advancing the public good, on the condition 
that the researcher provides adequate assurances that the social 
security account numbers will not be used to harass, target, or 
publicly reveal information concerning any identifiable individuals, 
that information about identifiable individuals obtained from the 
research will not be used to make decisions that directly affect the 
rights, benefits, or privileges of specific individuals, and that the 
researcher has in place appropriate safeguards to protect the privacy 
and confidentiality of any information about identifiable individuals, 
including procedures to ensure that the social security account numbers 
will be encrypted or otherwise appropriately secured from unauthorized 
disclosure. In the case of medical research, the Commissioner of Social 
Security shall maintain ongoing consultation with the Office for Civil 
Rights of the Department of Health and Human Services to ensure that 
the sale or purchase of social security account numbers which 
constitute personally identifiable medical information is permitted 
only in compliance with existing Federal rules and regulations 
prescribed by the Secretary of Health and Human Services pursuant to 
section 264(c) of the Health Insurance Portability and Accountability 
Act of 1996 (110 Stat. 2033).
  ``(VIII) Notwithstanding subclause (I), a social security account 
number may be sold or displayed to the general public by a governmental 
entity under such other circumstances as may be specified in 
regulations issued as provided in section 1129C.
  ``(IX) This clause does not apply with respect to a social security 
account number of a deceased individual.
  ``(X) For purposes of this clause, the term `governmental entity' 
means an executive, legislative, or judicial agency or instrumentality 
of the Federal Government or of a State or political subdivision 
thereof, a Federally recognized Indian tribe, or a trustee appointed in 
a case under title 11, United States Code. Such term includes a person 
acting as an agent of such an agency or instrumentality, Indian tribe, 
or trustee. For purposes of this subclause, the term `State' has the 
meaning provided in subparagraph (D)(iii)(II).
  ``(XI) For purposes of this clause, the term `sell' means, in 
connection with a social security account, to obtain, directly or 
indirectly, anything of value in exchange for such number. Such term 
does not include the submission of such number as part of the process 
for applying for any type of Government benefits or programs (such as 
grants, loans, or welfare or other public assistance programs) or as 
part of the administration of, or provision of benefits under, an 
employee benefit plan.
  ``(XII) For purposes of this clause, the term `display to the general 
public' shall have the meaning provided such term in section 
208A(a)(3)(A). In any case in which a governmental entity requires 
transmittal to such governmental entity of an individual's social 
security account number by means of the Internet without ensuring that 
such number is encrypted or otherwise appropriately secured from 
disclosure, any such transmittal of such number as so required shall be 
treated, for purposes of this clause, as a `display to the general 
public' of such number by such governmental entity for purposes of this 
clause.
  ``(XIII) For purposes of this clause, the term `social security 
account number' includes any derivative of such number. Notwithstanding 
the preceding sentence, any expression, contained in or on any item 
sold or displayed to the general public, shall not be treated as a 
social security account number solely because such expression sets 
forth not more than the last 4 digits of such number, if the remainder 
of such number cannot be determined based solely on such expression or 
any other matter presented in or on such item.
  ``(XIV) Nothing in the preceding subclauses of this clause shall be 
construed as superseding, altering, or affecting any statute, 
regulation, order, or interpretation in effect under any other Federal 
or State law, except to the extent that such statute, regulation, 
order, or interpretation is inconsistent with such subclauses, and then 
only to the extent of the inconsistency. For purposes of this 
subclause, a statue, regulation, order, or interpretation is not 
inconsistent with the preceding subclauses of this clause if the 
protection such statute, regulation, order, or interpretation affords 
any person is greater than the protection provided under such 
subclauses.''.
  (b) Effective Date and Related Rules.--
          (1) In general.--Initial final regulations prescribed to 
        carry out the provisions of section 205(c)(2)(C)(x) of the 
        Social Security Act (added by this section) shall be issued not 
        later than the last date of the 18th calendar month following 
        the date of the enactment of this Act. Such provisions shall 
        take effect, with respect to matters governed by such 
        regulations issued by the Commissioner of Social Security or 
        any other agency or instrumentality of the United States, 1 
        year after the date of the issuance of such regulations by the 
        Commissioner or such other agency or instrumentality, 
        respectively. Such provisions shall apply in the case of 
        displays to the general public, as defined in section 
        208A(a)(3) of such Act (added by section 8 of this Act), to 
        such displays originally occurring after such 1-year period. 
        Such provisions shall not apply with respect to any display of 
        a record (containing a social security account number (or any 
        derivative thereof)) generated prior to the close of such 1-
        year period.
          (2) Sunset of exception.--The last sentence of subclause 
        (XIII) of section 205(c)(2)(C)(x) of the Social Security Act 
        (added by this section) shall cease to be effective with 
        respect to sales or displays to the general public occurring 
        after 2 years after the effective date of the initial final 
        regulations prescribed to carry out the provisions of such 
        section 205(c)(2)(C)(x).

SEC. 3. PROHIBITION OF DISPLAY OF SOCIAL SECURITY ACCOUNT NUMBERS ON 
                    CHECKS ISSUED FOR PAYMENT BY GOVERNMENTAL ENTITIES.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) (as amended by section 2 of this Act) is amended 
further by adding at the end the following new clause:
  ``(xi) No governmental entity (as defined in clause (x)(X)) may 
include the social security account number of any individual (or any 
derivative of such number) on any check issued for any payment by such 
governmental entity or on any document attached to or accompanying such 
a check.''.
  (b) Effective Date.--The amendment made by this section shall apply 
with respect to checks (and documents attached to or accompanying such 
checks) issued after 1 year after the date of the enactment of this 
Act.

SEC. 4. PROHIBITION OF THE DISPLAY OF SOCIAL SECURITY ACCOUNT NUMBERS 
                    ON CERTAIN GOVERNMENT IDENTIFICATION CARDS OR TAGS.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) (as amended by the preceding provisions of this 
Act) is amended further by adding at the end the following new clause:
  ``(xii) No governmental entity (as defined in clause (x)(X)), and no 
other person offering benefits in connection with an employee benefit 
plan maintained by such governmental entity, may display a social 
security account number (or any derivative thereof) on any card or tag 
that is commonly provided--
          ``(I) to employees of such governmental entity,
          ``(II) in the case of a governmental entity which is an 
        educational institution, to its students, or
          ``(III) in the case of a governmental entity which is a 
        medical institution, to its patients,
(or to their family members) for purposes of identification or include 
on such card or tag a magnetic strip, bar code, or other means of 
communication which conveys such number (or derivative thereof). The 
requirements of this clause shall also apply to the Medicare card 
issued by the Department of Health and Human Services.''.
  (b) Effective Date.--The amendment made by this section shall apply 
with respect to cards or tags issued after 1 year after the date of the 
enactment of this Act, except that the last sentence of section 
205(c)(2)(C)(xii) (as added by this section) shall take effect 2 and 
one-half years after the date of the enactment of this Act.

SEC. 5. PROHIBITION OF INMATE ACCESS TO SOCIAL SECURITY ACCOUNT 
                    NUMBERS.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) (as amended by the preceding provisions of this 
Act) is amended further by adding at the end the following new clause:
  ``(xiii) No governmental entity (as defined in clause (x)(X)) may 
employ, or enter into a contract for the use or employment of, 
prisoners in any capacity that would allow such prisoners access to the 
social security account numbers of other individuals (or any 
derivatives of such numbers). For purposes of this clause, the term 
`prisoner' means an individual confined in a jail, prison, or other 
penal institution or correctional facility.''.
  (b) Effective Date.--
          (1) In general.--Except as provided in paragraph (2), the 
        amendment made by this section shall apply with respect to 
        employment of prisoners, or entry into contract for the use or 
        employment of prisoners, on or after the date of the enactment 
        of this Act.
          (2) Treatment of current arrangements.--In the case of--
                  (A) prisoners employed as described in clause (xiii) 
                of section 205(c)(2)(C) of the Social Security Act (as 
                added by this section) on the date of the enactment of 
                this Act, and
                  (B) contracts described in such clause in effect on 
                such date,
        the amendment made by this section shall take effect 90 days 
        after the date of the enactment of this Act.

SEC. 6. MEASURES TO PRECLUDE UNAUTHORIZED DISCLOSURE BY GOVERNMENTAL 
                    ENTITIES OF SOCIAL SECURITY ACCOUNT NUMBERS AND 
                    PROTECT THE CONFIDENTIALITY OF SUCH NUMBERS.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) (as amended by the preceding provisions of this 
Act) is amended further by adding at the end the following new clause:
  ``(xiv) Except as otherwise provided in this paragraph, in the case 
of any governmental entity (as defined in clause (x)(X)) having access 
to an individual's social security account number--
          ``(I) no officer or employee thereof shall have access to 
        such number for any purpose other than the effective 
        administration of the statutory provisions governing its 
        functions,
          ``(II) such governmental entity shall restrict, to the 
        satisfaction of the Commissioner of Social Security, access to 
        social security account numbers obtained thereby to officers 
        and employees thereof whose duties or responsibilities require 
        access for the administration or enforcement of such 
        provisions, and
          ``(III) such governmental entity shall provide such other 
        safeguards as the Commissioner determines to be necessary or 
        appropriate to preclude unauthorized access to the social 
        security account number and to otherwise protect the 
        confidentiality of such number.
For purposes of this clause the term `social security account number' 
includes any derivative thereof.''.
  (b) Effective Date.--The amendment made by this section shall take 
effect 1 year after the date of the enactment of this Act.

SEC. 7. UNIFORM STANDARDS FOR TRUNCATION OF THE SOCIAL SECURITY ACCOUNT 
                    NUMBER.

  (a) In General.--Section 205(c)(2)(C) of the Social Security Act (42 
U.S.C. 405(c)(2)(C)) (as amended by the preceding provisions of this 
Act) is amended further by adding at the end the following new clause:
  ``(xv) The truncation by any governmental entity (as defined in 
clause (x)(X)) or by any person in the private sector of an 
individual's social security account number which is used by such 
governmental entity or person otherwise in accordance with the 
requirements of this Act shall be in accordance with a uniform 
truncation standard which shall be specified in regulations prescribed 
by the Commissioner of Social Security. Under such standard, the number 
as truncated shall set forth not more than the last 4 digits of the 
number. Nothing in this clause shall be construed to authorize any use 
of the social security account number which is not otherwise authorized 
by this title or regulations prescribed thereunder.''.
  (b) Effective Date.--Initial final regulations prescribed to carry 
out the provisions of section 205(c)(2)(C)(xv) of the Social Security 
Act (added by this section) shall be issued not later than the last 
date of the 18th calendar month following the date of the enactment of 
this Act. Such provisions shall take effect, with respect to matters 
governed by such regulations issued by the Commissioner or any other 
agency or instrumentality of the United States, 1 year after the date 
of the issuance of such regulations by the Commissioner or such other 
agency or instrumentality, respectively.

SEC. 8. PROHIBITION OF THE SALE, PURCHASE, AND DISPLAY TO THE GENERAL 
                    PUBLIC OF THE SOCIAL SECURITY ACCOUNT NUMBER IN THE 
                    PRIVATE SECTOR.

  (a) In General.--Title II of the Social Security Act is amended by 
inserting after section 208 (42 U.S.C. 408) the following new section:
``prohibition of the sale, purchase, and display to the general public 
      of the social security account number in the private sector
  ``Sec. 208A.  (a) Definitions.--For purposes of this section:
          ``(1) Person.--
                  ``(A) In general.--Subject to subparagraph (B), the 
                term `person' means any individual, partnership, 
                corporation, trust, estate, cooperative, association, 
                or any other entity.
                  ``(B) Exclusion of governmental entities.--Such term 
                does not include a governmental entity. Nothing in this 
                subparagraph shall be construed to authorize, in 
                connection with a governmental entity, an act or 
                practice otherwise prohibited under this section or 
                section 205(c)(2)(C).
          ``(2) Selling and purchasing.--
                  ``(A) In general.--Subject to subparagraph (B)--
                          ``(i) Sell.--The term `sell' in connection 
                        with a social security account number means to 
                        obtain, directly or indirectly, anything of 
                        value in exchange for such number.
                          ``(ii) Purchase.--The term `purchase' in 
                        connection with a social security account 
                        number means to provide, directly or 
                        indirectly, anything of value in exchange for 
                        such number.
                  ``(B) Exceptions.--The terms `sell' and `purchase' in 
                connection with a social security account number do not 
                include the submission of such number as part of--
                          ``(i) the process for applying for any type 
                        of Government benefits or programs (such as 
                        grants or loans or welfare or other public 
                        assistance programs),
                          ``(ii) the administration of, or provision of 
                        benefits under, an employee benefit plan, or
                          ``(iii) the sale, lease, merger, transfer, or 
                        exchange of a trade or business.
          ``(3) Display to the general public.--
                  ``(A) In general.--The term `display to the general 
                public' means, in connection with a social security 
                account number, to intentionally place such number in a 
                viewable manner on an Internet site that is available 
                to the general public or to make such number available 
                in any other manner intended to provide access to such 
                number by the general public.
                  ``(B) Internet transmissions.--In any case in which a 
                person requires transmittal to such person of an 
                individual's social security account number by means of 
                the Internet without ensuring that such number is 
                encrypted or otherwise well-secured from disclosure, 
                any such transmittal of such number as so required 
                shall be treated as a `display to the general public' 
                of such number by such person.
          ``(4) Social security account number.--
                  ``(A) In general.--The term `social security account 
                number' has the meaning given such term in section 
                208(e), except that such term includes any derivative 
                of such number.
                  ``(B) 4-digit expression.--Notwithstanding the 
                preceding sentence, for purposes of subsection 
                (b)(1)(A), any expression, contained in or on any item 
                sold or displayed to the general public, shall not be 
                treated as a social security account number solely 
                because such expression sets forth not more than the 
                last 4 digits of such number, if the remainder of such 
                number cannot be determined based solely on such 
                expression or any other matter presented in or on such 
                item.
          ``(5) Governmental entity.--
                  ``(A) In general.--The term `governmental entity' 
                means an executive, legislative, or judicial agency or 
                instrumentality of the Federal Government, a State or 
                political subdivision thereof, a Federally recognized 
                Indian tribe, or a trustee appointed in a case under 
                title 11, United States Code. Such term includes a 
                person acting as an agent of such an agency or 
                instrumentality, Indian tribe, or trustee.
                  ``(B) State.--The term `State' includes the District 
                of Columbia, the Commonwealth of Puerto Rico, the 
                Virgin Islands, Guam, the Commonwealth of the Northern 
                Marianas, and the Trust Territory of the Pacific 
                Islands.
  ``(b) Prohibition of Sale, Purchase, and Display to the General 
Public.--
          ``(1) In general.--Except as provided in paragraph (2), it 
        shall be unlawful for any person to--
                  ``(A) sell or purchase a social security account 
                number or display to the general public a social 
                security account number, or
                  ``(B) obtain or use any individual's social security 
                account number for the purpose of locating or 
                identifying such individual with the intent to harass, 
                harm, or physically injure such individual or using the 
                identity of such individual for any illegal purpose.
          ``(2) Exceptions.--
                  ``(A) In general.--Notwithstanding paragraph (1), and 
                subject to paragraph (3), a social security account 
                number may be sold or purchased by any person to the 
                extent provided in this subsection (and for no other 
                purpose) as follows:
                          ``(i) to the extent necessary for law 
                        enforcement, including (but not limited to) the 
                        enforcement of a child support obligation, as 
                        determined under regulations issued as provided 
                        in section 1129C;
                          ``(ii) to the extent necessary for national 
                        security purposes, as determined under 
                        regulations issued as provided in section 
                        1129C;
                          ``(iii) to the extent necessary for public 
                        health purposes;
                          ``(iv) to the extent necessary in emergency 
                        situations to protect the health or safety of 1 
                        or more individuals;
                          ``(v) to the extent that the sale or purchase 
                        is required to comply with a tax law of the 
                        United States or of any State (or political 
                        subdivision thereof);
                          ``(vi) to the extent that the sale or 
                        purchase is to or by a consumer reporting 
                        agency (as defined in section 603(f) of the 
                        Fair Credit Reporting Act (15 U.S.C. 1681a(f))) 
                        for use or disclosure solely for permissible 
                        purposes described in section 604(a) of such 
                        Act (15 U.S.C. 1681b(a)); and
                          ``(vii) to the extent necessary for research 
                        (other than market research) conducted by an 
                        agency or instrumentality of the United States 
                        or of a State or political subdivision thereof 
                        (or a person acting as an agent of such an 
                        agency or instrumentality) for the purpose of 
                        advancing the public good, on the condition 
                        that the researcher provides adequate 
                        assurances that--
                                  ``(I) the social security account 
                                numbers will not be used to harass, 
                                target, or publicly reveal information 
                                concerning any identifiable 
                                individuals;
                                  ``(II) information about identifiable 
                                individuals obtained from the research 
                                will not be used to make decisions that 
                                directly affect the rights, benefits, 
                                or privileges of specific individuals; 
                                and
                                  ``(III) the researcher has in place 
                                appropriate safeguards to protect the 
                                privacy and confidentiality of any 
                                information about identifiable 
                                individuals, including procedures to 
                                ensure that the social security account 
                                numbers will be encrypted or otherwise 
                                appropriately secured from unauthorized 
                                disclosure.
                  ``(B) Medical research.--In the case of research 
                referred to in subparagraph (A)(vii) consisting of 
                medical research, the Commissioner of Social Security 
                shall maintain ongoing consultation with the Office for 
                Civil Rights of the Department of Health and Human 
                Services to ensure that the sale or purchase of social 
                security account numbers which constitute personally 
                identifiable medical information is permitted only in 
                compliance with existing Federal rules and regulations 
                prescribed by the Secretary of Health and Human 
                Services pursuant to section 264(c) of the Health 
                Insurance Portability and Accountability Act of 1996 
                (110 Stat. 2033).
          ``(3) Consent and other circumstances determined by 
        regulation.--Notwithstanding paragraph (1), a social security 
        account number assigned to an individual may be sold or 
        purchased by any person--
                  ``(A) to the extent consistent with such individual's 
                voluntary and affirmative written consent to the sale 
                or purchase, but only if--
                          ``(i) the terms of the consent and the right 
                        to refuse consent are presented to the 
                        individual in a clear, conspicuous, and 
                        understandable manner,
                          ``(ii) the individual is placed under no 
                        obligation to provide consent to any such sale 
                        or purchase, and
                          ``(iii) the terms of the consent authorize 
                        the individual to limit the sale or purchase to 
                        purposes directly associated with the 
                        transaction with respect to which the consent 
                        is sought, and
                  ``(B) under such circumstances as may be deemed 
                appropriate in regulations issued as provided under 
                section 1129C.
  ``(c) Prohibition of Display on Checks.--It shall be unlawful for any 
person to include the social security account number of any other 
individual on any check issued for any payment by such person or on any 
document attached to or accompanying such a check.
  ``(d) Prohibition of Unauthorized Disclosure to Government Agencies 
or Instrumentalities.--
          ``(1) In general.--It shall be unlawful for any person to 
        communicate by any means to any agency or instrumentality of 
        the United States or of any State or political subdivision 
        thereof the social security account number of any individual 
        other than such person without the written permission of such 
        individual, unless the number was requested by the agency or 
        instrumentality. In the case of an individual who is legally 
        incompetent, permission provided by the individual's legal 
        representatives shall be deemed to be permission provided by 
        such individual.
          ``(2) Exceptions.--Paragraph (1) shall not apply to the 
        extent necessary--
                  ``(A) for law enforcement, including (but not limited 
                to) the enforcement of a child support obligation, or
                  ``(B) for national security purposes,
        as determined under regulations issued as provided under 
        section 1129C.
  ``(e) Prohibition of the Displays on Cards or Tags Required for 
Access to Goods, Services, or Benefits.--No person may display a social 
security account number on any card or tag issued to any other person 
for the purpose of providing such other person access to any goods, 
services, or benefits or include on such card or tag a magnetic strip, 
bar code, or other means of communication which conveys such number.
  ``(f) Prohibition of the Displays on Employee Identification Cards or 
Tags.--No person that is an employer, and no other person offering 
benefits in connection with an employee benefit plan maintained by such 
employer or acting as an agent of such employer, may display a social 
security account number on any card or tag that is commonly provided to 
employees of such employer (or to their family members) for purposes of 
identification or include on such card or tag a magnetic strip, bar 
code, or other means of communication which conveys such number.
  ``(g) Measures to Preclude Unauthorized Disclosure of Social Security 
Account Numbers and Protect the Confidentiality of Such Numbers.--
Subject to the preceding provisions of this section, any person having 
access to the social security account number of any individual other 
than such person shall, to the extent that such access is maintained 
for the conduct of such person's trade or business--
          ``(1) ensure that no officer or employee thereof has access 
        to such number for any purpose other than as necessary for the 
        conduct of such person's trade or business,
          ``(2) restrict, in accordance with regulations of the 
        Commissioner of Social Security, access to social security 
        account numbers obtained thereby to officers and employees 
        thereof whose duties or responsibilities require access for the 
        conduct of such person's trade or business, and
          ``(3) provide such safeguards as may be specified, in 
        regulations of the Commissioner of Social Security, to be 
        necessary or appropriate to preclude unauthorized access to the 
        social security account number and to otherwise protect the 
        confidentiality of such number.
  ``(h) Deceased Individuals.--This section does not apply with respect 
to the social security account number of a deceased individual.
  ``(i) Applicability of Other Protections.--Nothing in the preceding 
subsections of this section shall be construed as superseding, 
altering, or affecting any statutory provision, regulation, order, or 
interpretation in effect under any other Federal or State law, except 
to the extent that such statutory provision, regulation, order, or 
interpretation is inconsistent with such subsections, and then only to 
the extent of the inconsistency. For purposes of this subclause, a 
statutory provision, regulation, order, or interpretation is not 
inconsistent with the preceding subsections of this section if the 
protection such statutory provision, regulation, order, or 
interpretation affords any person is greater than the protection 
provided under such subsections.''.
  (b) Effective Date and Related Rules.--
          (1) In general.--Initial final regulations prescribed to 
        carry out the provisions of section 208A of the Social Security 
        Act (added by this section) shall be issued not later than the 
        last date of the 18th calendar month following the date of the 
        enactment of this Act. Such provisions shall take effect, with 
        respect to matters governed by such regulations issued by the 
        Commissioner of Social Security or any other agency or 
        instrumentality of the United States, 1 year after the date of 
        the issuance of such regulations by the Commissioner of Social 
        Security or such other agency or instrumentality, respectively. 
        Section 208A(b) of such Act shall apply in the case of displays 
        to the general public (as defined in section 208A(a)(3) of such 
        Act) to such displays to the general public originally 
        occurring after such 1-year period. Such provisions shall not 
        apply with respect to any such display to the general public of 
        a record (containing a social security account number (or any 
        derivative thereof)) generated prior to the close of such 1-
        year period.
          (2) Sunset of exception.--Section 208A(a)(4)(B) of the Social 
        Security Act (added by this section) shall cease to be 
        effective with respect to sales, purchases, or displays to the 
        general public occurring after 2 years after the effective date 
        of the initial final regulations prescribed to carry out the 
        provisions of section 208A of such Act.

SEC. 9. NEW CRIMINAL PENALTIES FOR MISUSE OF SOCIAL SECURITY ACCOUNT 
                    NUMBERS.

  (a) In General.--Section 208 of the Social Security Act (42 U.S.C. 
408) is amended--
          (1) in subsection (a), by inserting ``or'' at the end of 
        paragraph (8) and by inserting after paragraph (8) the 
        following new paragraph:
          ``(9) willfully acts or fails to act so as to cause a 
        violation of section 208A(b)(1)(B);''.
          (2) by redesignating subsections (b) through (e) as 
        subsections (c) through (f), respectively;
          (3) in subsection (c)(1) (as so redesignated), by inserting 
        ``or (b)'' after ``subsection (a)''; and
          (4) by inserting after subsection (a) the following new 
        subsection:
  ``(b)(1) Whoever--
          ``(A) knowingly, and with intent to commit, or to aid or 
        abet, any activity that constitutes a violation of Federal law, 
        or a violation of any applicable law of a State or political 
        subdivision thereof if the maximum penalty of such applicable 
        law includes imprisonment for 5 years or more--
                  ``(i) possesses the social security account number of 
                another person without lawful authority, or
                  ``(ii) possesses a social security card, knowing that 
                the social security account number or other identifying 
                information displayed on the card has been altered, 
                counterfeited, or forged or that the card was falsely 
                made, stolen, or obtained from the Social Security 
                Administration by use of false information;
        if such activity is committed, or aided or abetted, with intent 
        to use such social security account number, social security 
        card, or other identifying information displayed on such card 
        in furtherance of such violation;
          ``(B) being--
                  ``(i) an officer or employee of any governmental 
                entity (as defined in section 205(c)(2)(C)(x)(X)), or
                  ``(ii) a person acting as an agent of a governmental 
                entity (as so defined),
        willfully acts or fails to act so as to cause a violation of 
        clause (vi)(II), (xi), (xii), or (xv) of section 205(c)(2)(C);
          ``(C) being a trustee appointed in a case under title 11, 
        United States Code (or an officer or employee thereof or a 
        person acting as an agent thereof), willfully acts or fails to 
        act so as to cause a violation of clause (xi) or (xv) of 
        section 205(c)(2)(C); or
          ``(D) willfully acts or fails to act so as to cause a 
        violation of subsection (c), (d), (e), or (f) of section 208A 
        or, as a person in the private sector, willfully acts or fails 
        to act so as to cause a violation of section 205(c)(2)(C)(xv);
shall be guilty of a misdemeanor and upon conviction thereof shall be 
fined under title 18, United States Code, or imprisoned for not more 
than 1 year, or both.
  ``(2)(A) Whoever--
          ``(i) with intent to deceive, discloses, sells, or transfers 
        his own social security account number, assigned to him by the 
        Commissioner of Social Security (in the exercise of the 
        Commissioner's authority under section 205(c)(2) to establish 
        and maintain records), to any person;
          ``(ii) without lawful authority, offers, for a fee, to 
        acquire for any individual, or to assist in acquiring for any 
        individual, an additional social security account number or a 
        number that is purported to be a social security account 
        number;
          ``(iii) being--
                  ``(I) an officer or employee of any governmental 
                entity (as defined in section 205(c)(2)(C)(x)(X)), or
                  ``(II) a person acting as an agent of a governmental 
                entity (as so defined),
        willfully acts or fails to act so as to cause a violation of 
        clause (x), (xiii), or (xiv) of section 205(c)(2)(C);
          ``(iv) being a trustee appointed in a case under title 11, 
        United States Code (or an officer or employee thereof or a 
        person acting as an agent thereof), willfully acts or fails to 
        act so as to cause a violation of clause (x) or (xiv) of 
        section 205(c)(2)(C); or
          ``(v) willfully acts or fails to act so as to cause a 
        violation of subsection (b)(1)(A) or (g) of section 208A;
shall be fined, imprisoned, or both, as provided in subparagraph (B).
  ``(B) A person convicted of a violation described in subparagraph (A) 
shall--
          ``(i) be fined under title 18, United States Code, imprisoned 
        not more than 1 year, or both; and
          ``(ii) if the offense is committed under false pretenses or 
        for commercial advantage, personal gain, or malicious harm, be 
        fined under title 18, United States Code, imprisoned not more 
        than 5 years, or both.''.
  (b) Effective Dates.--The amendments made by this section shall apply 
with respect to each violation occurring after the date of the 
enactment of this Act, except that subparagraphs (B), (C), and (D) of 
section 208(b)(1) of such Act and clauses (iii), (iv), and (v) of 
section 208(b)(2)(A) of such Act (added by subsection (a)(3)) shall 
apply, in connection with violations of clause (x), (xi), (xii), 
(xiii), (xiv), or (xv) of section 205(c)(2)(C) or section 208A, with 
respect to each violation occurring on or after the effective date 
applicable with respect to such violation under section 2, 3, 4, 5, 6, 
7, or 8.

SEC. 10. EXTENSION OF CIVIL MONETARY PENALTY AUTHORITY.

  (a) Application of Civil Money Penalties to Elements of Criminal 
Violations.--Section 1129(a) of the Social Security Act (42 U.S.C. 
1320a-8(a)) is amended--
          (1) by redesignating paragraphs (2) and (3) as paragraphs (4) 
        and (5), respectively;
          (2) by designating the last sentence of paragraph (1) as a 
        new paragraph (2), appearing after and below paragraph (1); and
          (3) by inserting after paragraph (2) (as designated under 
        paragraph (2) of this subsection) the following:
  ``(3) Any person (including an organization, agency, or other entity) 
who--
          ``(A) uses a social security account number that such person 
        knows or should know has been assigned by the Commissioner of 
        Social Security (in an exercise of authority under section 
        205(c)(2) to establish and maintain records) on the basis of 
        false information furnished to the Commissioner by any person;
          ``(B) falsely represents a number to be the social security 
        account number assigned by the Commissioner of Social Security 
        to any individual, when such person knows or should know that 
        such number is not the social security account number assigned 
        by the Commissioner to such individual;
          ``(C) with intent to deceive, alters a social security card 
        that the person knows or should know was issued by the 
        Commissioner of Social Security, or possesses such a card with 
        intent to alter it;
          ``(D) buys or sells a card that such person knows or should 
        know is, or is purported to be, a card issued by the 
        Commissioner of Social Security, or possesses such a card with 
        intent to buy or sell it;
          ``(E) counterfeits a social security card, or possesses a 
        counterfeit social security card with intent to buy or sell it;
          ``(F) discloses, uses, compels the disclosure of, or 
        knowingly sells or purchases the social security account number 
        of any person in violation of the laws of the United States;
          ``(G) with intent to deceive the Commissioner of Social 
        Security as to such person's true identity (or the true 
        identity of any other person), furnishes or causes to be 
        furnished false information to the Commissioner with respect to 
        any information required by the Commissioner in connection with 
        the establishment and maintenance of the records provided for 
        in section 205(c)(2);
          ``(H) without lawful authority, offers, for a fee, to acquire 
        for any individual, or to assist in acquiring for any 
        individual, an additional social security account number or a 
        number which is purported to be a social security account 
        number;
          ``(I) with intent to deceive, discloses, sells, or transfers 
        his own social security account number, assigned to him by the 
        Commissioner of Social Security under section 205(c)(2)(B), to 
        any person;
          ``(J) knowingly, and with intent to commit, or to aid or 
        abet, any activity that constitutes a violation of Federal law, 
        or a violation of any applicable law of a State or political 
        subdivision thereof if the maximum penalty of such applicable 
        law includes imprisonment for 5 years or more--
                  ``(i) possesses a social security account number of 
                another individual without lawful authority, or
                  ``(ii) possesses a social security card, knowing that 
                the social security account number or other identifying 
                information displayed on the card has been altered, 
                counterfeited, or forged or that the card was falsely 
                made, stolen, or obtained from the Social Security 
                Administration by use of false information,
        if such activity is committed, or aided or abetted, with intent 
        to use such social security account number, social security 
        card, or other identifying information displayed on such card 
        in furtherance of such violation;
          ``(K) being--
                  ``(i) an officer or employee of a governmental entity 
                (as defined in section 205(c)(2)(C)(x)(X)), or
                  ``(ii) a person acting as an agent of a governmental 
                entity (as so defined),
        willfully acts or fails to act so as to cause a violation of 
        clause (vi)(II), (x), (xi), (xii), (xiii), (xiv), or (xv) of 
        section 205(c)(2)(C);
          ``(L) being a trustee appointed in a case under title 11, 
        United States Code (or an officer or employee thereof or a 
        person acting as an agent thereof), willfully acts or fails to 
        act so as to cause a violation of clause (x), (xi), (xiv), or 
        (xv) of section 205(c)(2)(C);
          ``(M) violates section 208A (relating to prohibition of the 
        sale, purchase, or display of the social security account 
        number in the private sector) or, as a person in the private 
        sector, violates section 205(c)(2)(C)(xv); or
          ``(N) violates section 208(g) (relating to fraud by social 
        security administration employees);
shall be subject to, in addition to any other penalties that may be 
prescribed by law, a civil money penalty of not more than $5,000 for 
each violation. Such person shall also be subject to an assessment, in 
lieu of damages sustained by the United States resulting from such 
violation, of not more than twice the amount of any benefits or 
payments paid as a result of such violation.''.
  (b) Effective Dates.--The amendments made by this section shall apply 
with respect to violations committed after the date of the enactment of 
this Act, except that subparagraphs (J), (K), (L), and (M) of section 
1129(a)(3) of the Social Security Act (added by subsection (a)) shall 
apply with respect to violations of the provisions of clause (x), (xi), 
(xii), (xiii), (xiv), or (xv) of section 205(c)(2)(C) or section 208A 
occurring on or after the applicable effective date provided in 
connection with such provisions under section 2, 3, 4, 5, 6, 7, or 8 of 
this Act.

SEC. 11. CRIMINAL PENALTIES FOR EMPLOYEES OF THE SOCIAL SECURITY 
                    ADMINISTRATION WHO KNOWINGLY AND FRAUDULENTLY ISSUE 
                    SOCIAL SECURITY CARDS OR SOCIAL SECURITY ACCOUNT 
                    NUMBERS.

  (a) In General.--Section 208 of the Social Security Act (as amended 
by section 9) is amended further by adding at the end the following new 
subsection:
  ``(g)(1) Whoever is an employee of the Social Security Administration 
and knowingly and fraudulently sells or transfers one or more social 
security account numbers or social security cards shall, upon 
conviction, be guilty of a felony and fined under title 18, United 
States Code, imprisoned as provided in paragraph (2), or both.
  ``(2) Imprisonment for a violation described in paragraph (1) shall 
be for--
          ``(A) not more than 5 years, in the case of an employee of 
        the Social Security Administration who has fraudulently sold or 
        transferred not more than 50 social security account numbers or 
        social security cards,
          ``(B) not more than 10 years, in the case of an employee of 
        the Social Security Administration who has fraudulently sold or 
        transferred more than 50, but not more than 100, social 
        security account numbers or social security cards, or
          ``(C) not more than 20 years, in the case of an employee of 
        the Social Security Administration who has fraudulently sold or 
        transferred more than 100 social security account numbers or 
        social security cards.
  ``(3) For purposes of this subsection--
          ``(A) The term `social security employee' means any State 
        employee of a State disability determination service, any 
        officer, employee, or contractor of the Social Security 
        Administration, any employee of such a contractor, or any 
        volunteer providing services or assistance in any facility of 
        the Social Security Administration.
          ``(B) The term `social security account number' means a 
        social security account number assigned by the Commissioner of 
        Social Security under section 205(c)(2)(B) or another number 
        that has not been so assigned but is purported to have been so 
        assigned.
          ``(C) The term `social security card' means a card issued by 
        the Commissioner of Social Security under section 205(c)(2)(G), 
        another card which has not been so issued but is purported to 
        have been so issued, and banknote paper of the type described 
        in section 205(c)(2)(G) prepared for the entry of social 
        security account numbers, whether fully completed or not.''.
  (b) Effective Date.--The amendment made by this section shall apply 
with respect to violations occurring on or after the date of the 
enactment of this Act.

SEC. 12. ENHANCED PENALTIES IN CASES OF TERRORISM, DRUG TRAFFICKING, 
                    CRIMES OF VIOLENCE, OR PRIOR OFFENSES.

  (a) Amendments to Title II.--Section 208 of the Social Security Act 
(as amended by the preceding provisions of this Act) is amended 
further--
          (1) in subsection (a), by striking ``shall be fined'' and all 
        that follows and inserting the following: ``shall be fined, 
        imprisoned, or both, as provided in subsection (c).'';
          (2) in subsection (b)(2)(B)(ii) (as added by section 9), by 
        striking ``be fined'' and all that follows and inserting the 
        following: ``be fined, imprisoned, or both, as provided in 
        subsection (c).'';
          (3) by striking subsection (d);
          (4) by redesignating subsection (c) as subsection (d); and
          (5) by inserting after subsection (b) the following new 
        subsection:
  ``(c) A person convicted of a violation described in subsection (a) 
or a violation described in subsection (b)(2)(A) which is subject to 
subsection (b)(2)(B)(ii) shall be--
          ``(1) fined under title 18, United States Code, or imprisoned 
        for not more than 5 years, or both, in the case of an initial 
        violation, subject to paragraphs (3) and (4),
          ``(2) fined under title 18, United States Code, or imprisoned 
        for not more than 10 years, or both, in the case of a violation 
        which occurs after a prior conviction for another offense under 
        subsection (a) becomes final, subject to paragraphs (3) and 
        (4),
          ``(3) fined under title 18, United States Code, or imprisoned 
        for not more than 20 years, in the case of a violation which is 
        committed to facilitate a drug trafficking crime (as defined in 
        section 929(a)(2) of title 18, United States Code) or in 
        connection with a crime of violence (as defined in section 
        924(c)(3) of title 18, United States Code) involving force 
        against the person of another, subject to paragraph (4), and
          ``(4) fined under title 18, United States Code, or imprisoned 
        for not more than 25 years, in the case of a violation which is 
        committed to facilitate an act of international or domestic 
        terrorism (as defined in paragraphs (1) and (5), respectively, 
        of section 2331 of title 18, United States Code).''.
  (b) Amendments to Title VIII.--Section 811 of such Act (42 U.S.C. 
1011) is amended--
          (1) in subsection (a), by striking ``shall be fined'' and all 
        that follows and inserting ``shall be fined, imprisoned, or 
        both, as provided in subsection (b).'';
          (2) by redesignating subsection (b) as subsection (c); and
          (3) by inserting after subsection (a) the following new 
        subsection:
  ``(b) Punishment.--A person convicted of a violation described in 
subsection (a) shall be--
          ``(1) fined under title 18, United States Code, or imprisoned 
        for not more than 5 years, or both, in the case of an initial 
        violation, subject to paragraphs (3) and (4),
          ``(2) fined under title 18, United States Code, or imprisoned 
        for not more than 10 years, or both, in the case of a violation 
        which occurs after a prior conviction for another offense under 
        subsection (a) becomes final, subject to paragraphs (3) and 
        (4),
          ``(3) fined under title 18, United States Code, or imprisoned 
        for not more than 20 years, in the case of a violation which is 
        committed to facilitate a drug trafficking crime (as defined in 
        section 929(a)(2) of title 18, United States Code) or in 
        connection with a crime of violence (as defined in section 
        924(c)(3) of title 18, United States Code) involving force 
        against the person of another, subject to paragraph (4), and
          ``(4) fined under title 18, United States Code, or imprisoned 
        for not more than 25 years, in the case of a violation which is 
        committed to facilitate an act of international or domestic 
        terrorism (as defined in paragraphs (1) and (5), respectively, 
        of section 2331 of title 18, United States Code).''.
  (c) Amendments to Title XVI.--Section 1632 of such Act (42 U.S.C. 
1383a) is amended--
          (1) in subsection (a), by striking ``shall be fined'' and all 
        that follows and inserting ``shall be fined, imprisoned, or 
        both, as provided in subsection (b).'';
          (2) by redesignating subsections (b) and (c) as subsections 
        (c) and (d), respectively; and
          (3) by inserting after subsection (a) the following new 
        subsection:
  ``(b) A person convicted of a violation described in subsection (a) 
shall be--
          ``(1) fined under title 18, United States Code, or imprisoned 
        for not more than 5 years, or both, in the case of an initial 
        violation, subject to paragraphs (3) and (4),
          ``(2) fined under title 18, United States Code, or imprisoned 
        for not more than 10 years, or both, in the case of a violation 
        which occurs after a prior conviction for another offense under 
        subsection (a) becomes final, subject to paragraphs (3) and 
        (4),
          ``(3) fined under title 18, United States Code, or imprisoned 
        for not more than 20 years, in the case of a violation which is 
        committed to facilitate a drug trafficking crime (as defined in 
        section 929(a)(2) of title 18, United States Code) or in 
        connection with a crime of violence (as defined in section 
        924(c)(3) of title 18, United States Code) involving force 
        against the person of another, subject to paragraph (4), and
          ``(4) fined under title 18, United States Code, or imprisoned 
        for not more than 25 years, in the case of a violation which is 
        committed to facilitate an act of international or domestic 
        terrorism (as defined in paragraphs (1) and (5), respectively, 
        of section 2331 of title 18, United States Code).''.
  (d) Effective Date.--The amendments made by this section shall apply 
with respect to violations occurring after the date of the enactment of 
this Act.

SEC. 13. REGULATORY AND ENFORCEMENT AUTHORITY WITH RESPECT TO MISUSE OF 
                    THE SOCIAL SECURITY ACCOUNT NUMBER.

   Title XI of the Social Security Act is amended by inserting after 
section 1129B (42 U.S.C. 1320a-7b) the following new section:
 ``regulatory and enforcement authority with respect to misuse of the 
                     social security account number
  ``Sec. 1129C.  (a) Regulatory Authority.--
          ``(1) In general.--The Commissioner of Social Security shall 
        prescribe regulations to carry out the provisions of clauses 
        (vi)(II), (x), (xi), (xii), (xiii), (xiv), and (xv) of section 
        205(c)(2)(C) and section 208A. Such regulations shall be issued 
        in consultation with the Federal Trade Commission, the Attorney 
        General of the United States, the Secretary of Homeland 
        Security, the Secretary of Health and Human Services, the 
        Secretary of the Treasury, the Federal banking agencies (as 
        defined in section 3 of the Federal Deposit Insurance Act), the 
        National Credit Union Administration, the Securities and 
        Exchange Commission, State attorneys general, and such 
        representatives of the State insurance commissioners as may be 
        designated by the National Association of Insurance 
        Commissioners.
          ``(2) Treatment of matters relating to law enforcement and 
        national security.--In issuing the regulations described in 
        paragraph (1) with respect to the provisions of 
        205(c)(2)(C)(x)(III), paragraph (A) or (B) of section 
        208A(b)(2), or section 208A(c)(2) (relating to law enforcement 
        and national security), the sale or purchase of Social Security 
        account numbers may be authorized only if the Commissioner (or 
        the agency or instrumentality delegated authority to issue such 
        regulations under paragraph (5)) determines that--
                  ``(A) such sale or purchase would serve a compelling 
                public interest that cannot reasonably be served 
                through alternative measures, and
                  ``(B) such sale or purchase will not pose an 
                unreasonable risk of identity theft, or bodily, 
                emotional, or financial harm to an individual (taking 
                into account any restrictions and conditions that the 
                agency or instrumentality issuing the regulations 
                imposes on the sale, purchase, or disclosure).
          ``(3) Treatment of other matters in general discretion of the 
        commissioner.--
                  ``(A) In general.--In issuing the regulations 
                described in paragraph (1) with respect to the 
                provisions of section 205(c)(2)(C)(x)(VIII) or section 
                208A(b)(3)(B), the sale, purchase, or display to the 
                general public of social security account numbers may 
                be authorized only after considering, among other 
                relevant factors--
                          ``(i) the extent to which the authorization 
                        of the sale, purchase, or display of the social 
                        security account number would serve a 
                        compelling public interest that cannot 
                        reasonably be served through alternative 
                        measures,
                          ``(ii) the associated cost or burden of the 
                        authorization to the general public, 
                        businesses, commercial enterprises, non-profit 
                        organizations, and Federal, State, and local 
                        governments; and
                          ``(iii) the associated benefit of the 
                        authorization to the general public, 
                        businesses, commercial enterprises, non-profit 
                        associations, and Federal, State, and local 
                        governments.
                  ``(B) Restrictions and conditions.--If, after 
                considering the factors in subparagraph (A), the sale, 
                purchase, or display to the general public of social 
                security account numbers is authorized under 
                regulations referred to in subparagraph (A), the 
                Commissioner (or the agency or instrumentality 
                delegated authority to issue such regulations under 
                paragraph (5)) shall impose restrictions and conditions 
                on the sale, purchase, or display to the general public 
                to the extent necessary--
                          ``(i) to provide reasonable assurances that 
                        social security account numbers will not be 
                        used to commit or facilitate fraud, deceptions, 
                        or crime, and
                          ``(ii) to prevent an unreasonable risk of 
                        identity theft or bodily, emotional, or 
                        financial harm to any individual, considering 
                        the nature, likelihood, and severity of the 
                        anticipated harm that could result from the 
                        sale, purchase, or display to the general 
                        public of social security account numbers, 
                        together with the nature, likelihood, and 
                        extent of any benefits that could be realized.
                  ``(C) 5-year expiration date for regulations.--At the 
                end of the 5-year period beginning on the effective 
                date of any final regulations issued pursuant to this 
                paragraph--
                          ``(i) such regulations shall expire, and
                          ``(ii) new regulations may be issued pursuant 
                        to this paragraph.
          ``(4) Administrative procedure.--In the issuance of 
        regulations pursuant to this subsection, notice shall be 
        provided as described in paragraphs (1), (2), and (3) of 
        section 553(b) of title 5, United States Code, and opportunity 
        to participate in the rule making shall be provided in 
        accordance with section 553(c) of such title.
          ``(5) Delegation to other agencies.--Any agency or 
        instrumentality of the United States may exercise the authority 
        of the Commissioner under this subsection, with respect to 
        matters otherwise subject to regulation by such agency or 
        instrumentality, to the extent determined appropriate in 
        regulations of the Commissioner.
          ``(6) Consultation and coordination.--Each agency and 
        instrumentality exercising authority to issue regulations under 
        this subsection shall consult and coordinate with the other 
        such agencies and instrumentalities for the purposes of 
        assuring, to the extent possible, that the regulations 
        prescribed by each such agency or instrumentality are 
        consistent and comparable, as appropriate, with the regulations 
        prescribed by the other such agencies and instrumentalities. 
        The Commissioner shall undertake to facilitate such 
        consultation and coordination.
          ``(7) Definitions and special rules.--
                  ``(A) For purposes of this subsection, the terms 
                `sell', `purchase', and `display to the general public' 
                shall have the meanings provided such terms under 
                section 205(c)(2)(C)(x) or section 208A(a), as 
                applicable.
                  ``(B) For purposes of this subsection, section 
                205(c)(2)(C)(x)(XI) shall apply.
  ``(b) Coordination of Enforcement With Other Agencies.--The 
Commissioner may provide, by regulation, for enforcement by any other 
agency or instrumentality of the United States of the provisions of 
section 208A and regulations prescribed pursuant to subsection (a)(1) 
with respect to section 208A.
  ``(c) Actions by States With Respect to Misuse in Private Sector or 
by State and Local Governments.--
          ``(1) Civil actions.--In any case in which the attorney 
        general of a State (as defined in section 205(c)(2)(C)(x)(X)) 
        has reason to believe that an interest of the residents of that 
        State has been or is threatened or adversely affected by an act 
        or practice described in paragraph (2), the State, as parens 
        patriae, may bring a civil action on behalf of the residents of 
        the State in a district court of the United States of 
        appropriate jurisdiction, to--
                  ``(A) enjoin that act or practice;
                  ``(B) enforce compliance with the regulation;
                  ``(C) obtain civil penalties in an amount of $11,000 
                per violation not to exceed a total of $5,000,000; or
                  ``(D) obtain such other legal and equitable relief as 
                the district court may consider to be appropriate.
        Before filing an action under this subsection, the attorney 
        general of the State involved shall provide to the Commissioner 
        of Social Security and the Attorney General of the United 
        States a written notice of that action and a copy of the 
        complaint for that action. If the State attorney general 
        determines that it is not feasible to provide the notice 
        described in this subparagraph before the filing of the action, 
        the State attorney general shall provide the written notice and 
        the copy of the complaint as soon after the filing of the 
        complaint as practicable. Any reference in this subsection to 
        the attorney general of a State shall be deemed also to be a 
        reference to any equivalent official of such State.
          ``(2) Acts or practices subject to enforcement.--An act or 
        practice described in this paragraph is--
                  ``(A) an act or practice by an executive, 
                legislative, or judicial agency or instrumentality of 
                the State involved or a political subdivision thereof, 
                a person acting as an agent thereof, or any officer or 
                employee of the foregoing or person acting as an agent 
                of the foregoing that violates clause (vi)(II), (x), 
                (xi), (xii), (xiii), (xiv), or (xv) of section 
                205(c)(2)(C) or any regulation promulgated thereunder, 
                or
                  ``(B) an act or practice by any person that violates 
                section 208A or any regulation promulgated thereunder.
          ``(3) Attorney general authority.--On receiving notice under 
        paragraph (1), the Attorney General of the United States shall 
        have the right--
                  ``(A) to move to stay the action, pending the final 
                disposition of a pending Federal matter as described in 
                paragraph (4);
                  ``(B) to intervene in an action under paragraph (1);
                  ``(C) upon so intervening, to be heard on all matters 
                arising therein; and
                  ``(D) to file petitions for appeal.
          ``(4) Pending criminal proceedings.--If the Attorney General 
        of the United States has instituted a criminal proceeding under 
        section 208 alleging an act or practice described in paragraph 
        (2) in connection with any State, such State may not, during 
        the pendency of such proceeding or action, bring an action 
        under this subsection against any defendant named in the 
        criminal proceeding.
          ``(5) Rule of construction.--For purposes of bringing any 
        civil action under paragraph (1), nothing in this subsection 
        shall be construed to prevent an attorney general of a State 
        from exercising the powers conferred on the attorney general by 
        the laws of that State to conduct investigations, administer 
        oaths and affirmations, or compel the attendance of witnesses 
        or the production of documentary and other evidence.
          ``(6) Venue; service of process.--Any action brought under 
        paragraph (1) may be brought in any district court of the 
        United States that meets applicable requirements relating to 
        venue under section 1391 of title 28, United States Code. In an 
        action brought under paragraph (1), process may be served in 
        any district in which the defendant is an inhabitant or may be 
        found.
  ``(d) Remedies to Individuals for Violations by the Federal 
Government of Requirements Relating to Social Security Account 
Numbers.--
          ``(1) Civil actions.--Any individual who is aggrieved by an 
        act or practice by any person acting as an officer, employee, 
        or agent of an agency or instrumentality of the Federal 
        Government in violation of the requirements of clause (vi)(II), 
        (x), (xi), (xii), (xiii), (xiv), or (xv) of subsection 
        (c)(2)(C) with respect to the social security account number 
        assigned to such individual under subsection (c)(2)(B) may 
        commence a civil action for appropriate equitable relief or 
        actual damages.
          ``(2) Venue; service of process.--An action under this 
        subsection action may be brought in the district court of the 
        United States for the judicial district in which the plaintiff 
        resides, or has his principal place of business, in which the 
        violation took place, or in which the defendant resides or may 
        be found, and process may be served in any other district in 
        which a defendant resides or may be found.
          ``(3) Jurisdiction.--The district courts of the United States 
        shall have jurisdiction, without respect to the amount in 
        controversy or the citizenship of the parties, to grant the 
        relief provided for in paragraph (1).
          ``(4) Attorney's fees.--In any action under this subsection, 
        the court in its discretion may allow a reasonable attorney's 
        fee and costs of action to either party.
  ``(e) Ongoing GAO Review on Efficacy of Regulations.--
          ``(1) In general.--The Comptroller General of the United 
        States shall conduct an ongoing review of the efficacy of the 
        regulations prescribed by any agency or instrumentality of the 
        United States pursuant to this section. Such review shall 
        consider the extent to which such regulations are consistent 
        with, and in furtherance of the purposes of, the amendments 
        made by the Social Security Number Privacy and Identity Theft 
        Prevention Act of 2007.
          ``(2) Report.--Not later than 4 years after the effective 
        date of any final regulations issued by any agency or 
        instrumentality of the United States pursuant to this section, 
        the Comptroller General shall report to each House of the 
        Congress regarding the results of the review of such 
        regulations conducted under this paragraph. Such report shall 
        include the Comptroller General's recommendations for such 
        statutory or regulatory changes as the Comptroller General 
        considers appropriate.''.

SEC. 14. STUDY ON FEASIBILITY OF BANNING SOCIAL SECURITY ACCOUNT NUMBER 
                    AS AN AUTHENTICATOR.

  (a) Study.--As soon as practicable after the date of the enactment of 
this Act, the Commissioner of Social Security shall enter into an 
arrangement with the National Research Council under which the Council 
shall carry out a study to determine--
          (1) the extent of the use of social security account numbers 
        as a primary means of authenticating identity;
          (2) the extent of the use of social security account numbers 
        for verification in commercial transactions; and
          (3) the feasibility of a prohibition on such use.
The study shall also examine possible alternatives to social security 
account numbers for verification purposes and uses in authenticating 
identity.
  (b) Report.--The arrangement entered into with the Council under this 
section shall provide for submission by the Council to the Commissioner 
and to each House of the Congress of a report setting forth the results 
of the Council's study under this section, together with the Council's 
findings and recommendations, no later than 1 year after the effective 
date of the initial final regulations issued by the Commissioner 
pursuant to the amendments made by section 2 of this Act.

                            I. INTRODUCTION


                         A. Purpose and Summary

    The purpose of the ``Social Security Number Privacy and 
Identity Theft Prevention Act of 2007,'' H.R. 3046, is to 
enhance Social Security number (SSN) privacy protections, 
prevent misuse of SSNs, and to otherwise enhance protections 
against identity theft.
    The bill would restrict the sale, purchase and display to 
the general public of SSNs in the public and private sectors; 
provide additional measures to protect SSN privacy; and create 
criminal and civil monetary penalties for persons who misuse 
SSNs.

                             B. Background

    The SSN was created in 1936 to track workers' earnings for 
the purpose of paying Social Security taxes and determining 
eligibility and benefit amounts upon retirement, or later upon 
disability. Since 1936, the Social Security Administration 
(SSA) has issued more than 400 million SSNs.
    Although the SSN was originally created for administering 
the Social Security program, its use has expanded dramatically 
throughout both the public and private sectors. Federal use of 
the SSN was first mandated by President Roosevelt in 1943 with 
Executive Order 9397. This Executive Order required that any 
Federal department establishing a new system of permanent 
account numbers pertaining to an individual must exclusively 
utilize the SSN and that such personal information must be kept 
confidential. Today the SSN is required for the administration 
of a number of government benefit programs and the Federal 
income tax.
    In addition to uses mandated by Federal law, the SSN is 
also widely used in the public and private sectors for purposes 
that are neither required nor prohibited by law. As a result, 
the SSN is generally regarded as the single-most widely used 
record identifier by both government and private sectors within 
the United States.
    Ubiquitous use of SSNs and the ease with which individuals 
can access another person's SSN have raised serious concerns 
over privacy and opportunities for identity theft and fraud. 
The Federal Trade Commission (FTC), SSA, the SSA Inspector 
General and others acknowledge that SSNs play a pivotal role in 
identity theft. Even worse, terrorists may steal, fake, or 
purchase SSNs in order to operate in our society and abet their 
nefarious acts. The FTC reported in 2003 that 10 million 
Americans fell prey to identity theft in the prior year. A more 
recent survey by Gartner, Inc. estimated the number of identity 
theft victims at 15 million in 2006. The FTC study found that 
victims spent an estimated $5 billion to rehabilitate their 
good names, and businesses lost over $50 billion to identity 
theft-related fraud in a single year. Protecting the privacy of 
SSNs will help to protect our individual and national security.
    The absence of overarching Federal law regulating the sale, 
purchase, and public display of SSNs, and the growing threat 
represented by SSN misuse and identity theft, have prompted a 
need to better protect the privacy and integrity of SSNs.

                         C. Legislative History

    During the 106th Congress, the Subcommittee on Social 
Security held hearings on Social Security program integrity on 
March 30, 2000 (106-38); representative payees on May 4, 2000 
(106-57); use and misuse of SSNs on May 9 and May 11, 2000 
(106-108); and the processing of attorney's fees on June 14, 
2000 (106-70). The information gained from these hearings led 
to the introduction of H.R. 4857, the ``Privacy and Identity 
Protection Act of 2000,'' on July 13, 2000. The bill enhanced 
privacy protections for individuals, prevented fraudulent 
misuse of the SSN, and provided additional safeguards for 
Social Security and Supplemental Security Income (SSI) 
beneficiaries with representative payees. A further hearing on 
protecting privacy and preventing misuse of the SSN was held on 
July 17, 2000 (106-43). On July 20, 2000, the Subcommittee on 
Social Security ordered favorably reported H.R. 4857, as 
amended. The Committee on Ways and Means ordered the bill 
favorably reported, as amended on September 28, 2000 (H. Rept. 
106-996 Part 1). The bill was not considered by the full House, 
as other committees of jurisdiction did not complete 
consideration of the bill.
    During the 107th Congress, the Subcommittee on Social 
Security held a hearing on protecting privacy and preventing 
misuse of SSNs on May 22, 2001 (107-31). In response to 
information gathered at this hearing and previous hearings in 
the 106th Congress, H.R. 2036, the ``Social Security Number 
Privacy and Identity Theft Prevention Act of 2001,'' was 
introduced on May 25, 2001. The bill restricted the sale, 
purchase, and display of SSNs, limited dissemination of SSNs by 
credit reporting agencies, and made it more difficult for 
businesses to deny services if a customer refused to provide 
his or her SSN. Further hearings were held on preventing 
identity theft by terrorists and criminals, held jointly with 
the Committee on Financial Services, Subcommittee on Oversight 
and Investigations on November 8, 2001 (107-51); protecting the 
privacy of SSNs and preventing identity theft on April 29, 2002 
(107-71); and preserving the integrity of SSNs and preventing 
their misuse by terrorists and identity thieves, held jointly 
with the Committee on Judiciary, Subcommittee on Immigration, 
Border Security, and Claims on September 19, 2002 (107-81). 
Neither the House nor the Senate acted on the bill.
    During the 108th Congress, the Subcommittee on Social 
Security held a hearing on the use and misuse of SSNs on July 
10, 2003 (108-35). The Government Accountability Office (GAO--
then known as the General Accounting Office) witness testified 
that SSNs are widely utilized in both the public and private 
sectors as an identifier, and cited numerous examples where 
public and private databases had been compromised and personal 
data, including SSNs, had been stolen. They also found that in 
some cases, the display of SSNs in public records and easily 
accessible websites provided an opportunity for identity 
thieves. The SSA Inspector General testified that the most 
important step in preventing SSN misuse is to limit its easy 
availability through public records, sale on the open market, 
and unnecessary use. Consumer advocate witnesses testified 
regarding the growing crime of identity theft, its impact on 
victims, and the need to protect the privacy of SSNs. A law 
enforcement witness testified that SSNs arekey to the takeover 
of another individual's identity, described difficulties in prosecuting 
identity theft, and stated the need to restrict SSN use to necessary 
purposes.
    Based on information gathered at this hearing and hearings 
in previous Congresses, Social Security Subcommittee Chairman 
E. Clay Shaw, Jr. and Ranking Member Robert T. Matsui 
introduced H.R. 2971, the ``Social Security Number Privacy and 
Identity Theft Prevention Act of 2003,'' on July 25, 2003. The 
bill was referred to the Committee on Ways and Means, the 
Committee on Financial Services, and the Committee on Energy 
and Commerce. The Subcommittee on Social Security held a 
further hearing on enhancing SSN privacy on June 15, 2004, and 
marked up the bill on July 15, 2004. The bill was reported 
favorably to the full Committee on Ways and Means on July 15, 
2004, as amended, by voice vote. On July 21, 2004, the 
Committee on Ways and Means marked up H.R. 2971, as amended by 
the Subcommittee. Chairman Thomas offered an amendment in the 
nature of a substitute, which was agreed to by voice vote. The 
Committee then ordered favorably reported H.R. 2971, as 
amended, by a roll call vote of 33 yeas to 0 nays. The bill was 
not considered by the full House, as other committees of 
jurisdiction did not complete consideration of the bill.
    In addition, during the 106th, 107th, 108th and 109th 
Congresses, Subcommittee Chairman Shaw and other Members of 
Congress asked the GAO for a number of reports to inform the 
debate on SSN privacy and integrity. These reports explained 
how government agencies and private sector businesses such as 
consumer reporting agencies, information resellers, and health 
care organizations collect, utilize, and safeguard SSNs (Social 
Security: Government and Commercial Use of the Social Security 
Number is Widespread, GAO/HEHS-99-28; Social Security Numbers: 
Government Benefits from SSN Use But Could Provide Better 
Safeguards, GAO-02-352; Social Security Numbers: Private Sector 
Entities Routinely Obtain and Use SSNs, and Laws Limit the 
Disclosure of This Information, GAO 04-11; Social Security 
Numbers: Use is Widespread and Protections Vary, GAO-04-768T; 
Personal Information: Key Federal Privacy Laws Do Not Require 
Information Resellers to Safeguard All Sensitive Data, GAO-06-
674).
    During the 109th Congress, the Subcommittee on Social 
Security held a series of five hearings on SSN high risk 
issues. The hearings addressed the role of SSNs in abetting 
identity theft, and discussed the impact of prohibiting or 
restricting the use, sale, purchase, or display of SSNs by 
individuals, businesses, or the government. Based on these and 
prior hearings, Subcommittee Chairman Shaw and Full Committee 
Ranking Member Charles B. Rangel introduced H.R. 1745, the 
``Social Security Number Privacy and Identity Theft Protection 
Act of 2005,'' on April 20, 2005. The bill was referred to the 
Committee on Ways and Means, the Committee on Financial 
Services, and the Committee on Energy and Commerce. The bill 
was not reported.
    During the 110th Congress, the Subcommittee on Social 
Security held a hearing on protecting the privacy of the SSN 
from identity theft on June 21, 2007. The GAO witness testified 
that SSNs are vulnerable to misuse because there is no Federal 
standard for truncating SSNs, which allows identity thieves to 
piece together portions of SSNs from different sources. The SSA 
Inspector General testified that Federal efforts to protect the 
SSN should be improved by limiting the use of the SSNs on 
school and hospital identification cards. An expert on 
technology and data privacy testified that the SSN should not 
be used as an identifier or authenticator, that steps should be 
taken to reduce the use and exposure of SSNs, and that 
businesses have alternatives to over-reliance on SSNs for 
record matching and verification. Also during the 110th 
Congress, GAO issued a report identifying which Federal 
agencies provide records containing SSNs to state and local 
record keepers, and the significant vulnerabilities that remain 
in the protection of SSNs in public records (Social Security 
Numbers: Federal Actions Could Further Decrease Availability in 
Public Records, though Other Vulnerabilities Remain, GAO-07-
752).
    Based on information gathered at this hearing and hearings 
in previous Congresses, Social Security Subcommittee Chairman 
Michael R. McNulty and Ranking Member Sam Johnson introduced 
H.R. 3046, the ``Social Security Number Privacy and Identity 
Theft Prevention Act of 2007,'' on July 16, 2007. The bill was 
referred to the Committee on Ways and Means. On July 18, 2007, 
the Committee marked-up the bill; and Chairman Rangel offered 
an amendment in the nature of a substitute, which was agreed to 
by voice vote. The Committee then ordered favorably reported 
H.R. 3046, as amended, by a rollcall vote of 41 yeas to 0 nays.

                     II. SECTION-BY-SECTION SUMMARY


Sec. 1. Short title

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    Section 1 provides that the Act may be cited as the 
``Social Security Number Privacy and Identity Theft Prevention 
Act of 2007.''

                           REASON FOR CHANGE

    The section identifies the short title for the bill.

Sec. 2. Restrictions on the sale or display to the general public of 
        Social Security account numbers by governmental entities

                              CURRENT LAW

    The SSN is required by law for the administration of a 
number of Federal programs. In addition, Federal law permits 
States to require the SSN in the administration of certain 
State programs, and in other cases Federal law requires the 
States to use the SSN in the administrationof Federal or State 
programs. No Federal law regulates the overall use of SSNs by Federal, 
State or local governments. The ``Department of Transportation and 
Related Agencies Appropriations Act'' (P.L. 106-346) amended the 
``Driver's Privacy Protection Act of 1994'' (P.L. 103-322) to require 
States to obtain express consent of drivers before sharing or selling 
drivers' ``highly restricted personal information,'' including SSNs, 
except under very limited circumstances.

                        EXPLANATION OF PROVISION

    The bill would restrict the sale or display to the general 
public of full or partial SSNs by Federal, State or local 
governmental agencies and their agents, by a Federally 
recognized Indian tribe, or by a bankruptcy trustee. The sale 
of SSNs would be permitted as follows:
    1. As specifically authorized by the ``Social Security 
Act'' (P.L. 74-271) or the ``Privacy Act of 1974'' (P.L. 93-
579), which includes data-matching performed by SSA and 
reimbursed by other agencies for the administration of programs 
whose purposes are compatible with the Social Security Act;
    2. For law enforcement or national security purposes;
    3. For tax compliance;
    4. By State departments of motor vehicles for use by a 
government agency in carrying out its functions; for use by an 
insurer for claims investigation, anti-fraud activities, and 
rating or underwriting; and for use by an employer to obtain or 
verify information about a holder of a commercial driver's 
license;
    5. To a consumer reporting agency under the ``Fair Credit 
Reporting Act'' (FCRA, P.L. 91-508) solely for use or 
disclosure for permissible purposes under the FCRA as follows: 
as ordered by a court or a Federal grand jury subpoena; as 
instructed by the consumer in writing; for the extension of 
credit based on a consumer's application; for review or 
collection of a consumer's account; for employment purposes; 
for insurance underwriting based on a consumer's application; 
when there is a legitimate business need regarding a 
transaction the consumer initiates; to review whether a 
customer meets the terms of his or her account; to determine a 
consumer's eligibility for a license or other benefit granted 
by a government agency; to analyze the credit or prepayment 
risks associated with an existing credit obligation; and for 
use by State and local officials for child support payment 
purposes;
    6. For government research advancing the public good.
    In addition, the Commissioner of Social Security would be 
permitted to authorize sale and display to the general public 
of SSNs in other circumstances as determined appropriate.
    The restrictions on sale or display to the general public 
of SSNs would not apply to SSNs of deceased persons.
    The restrictions that would be established under this 
provision would not override other restrictions or limitations 
in Federal or State law or regulations in effect to the extent 
that they provide greater protections for SSNs than would be 
created under this bill.
    The bill would define ``governmental entity'' as an 
executive, legislative, or judicial agency or instrumentality 
of the Federal or State government, including a Federally 
recognized Indian tribe, a bankruptcy trustee, and agents of 
the entity.
    The bill would define ``sell'' as obtaining anything of 
value, directly or indirectly, in exchange for an SSN. However, 
the submission of the SSN in the process of applying for 
government benefits or programs, and in the administration of 
an employee benefit plan, would not be considered a sale.
    ``Display to the general public'' would mean to 
intentionally place an SSN in a viewable manner on an Internet 
site that is available to the general public or to provide 
access to the general public by other means. In addition, 
requiring an individual to transmit his or her SSN over the 
Internet without ensuring the number is encrypted or otherwise 
protected would be considered a prohibited display to the 
general public.
    ``Social Security account number'' would include a partial 
SSN. However, the bill would provide a temporary exemption 
permitting government entities to sell and publicly display the 
last four digits of an SSN for two years after the effective 
date of the final regulations.

                           REASON FOR CHANGE

    The Federal government created the SSN, under the authority 
of the Social Security Act, and its use has since been required 
for a broad range of interactions between individuals and the 
government, including tax administration, many benefit 
programs, and driver's and professional licenses. While there 
are laws protecting the privacy of SSNs held by certain 
agencies or under specific circumstances, there is no 
comprehensive law protecting the privacy of SSNs held by 
Federal, State, and local government agencies. As a result, 
SSNs may be sold, displayed on the Internet, or otherwise made 
available to the general public on paper, computer disk, or 
other means to individuals requesting a copy--for example 
through open court or other government records--and may be 
obtained by third parties who can subsequently sell or display 
the information to others.
    Since SSNs are the key to accessing an individual's 
financial and other personal information, the wide 
accessibility of SSNs has raised serious concerns over privacy. 
Testimony before the Subcommittee on Social Security highlights 
the relative ease by which an individual can obtain another 
person's SSN and use the information to commit identity theft 
or other crimes. Restricting the display to the general public 
and sale of SSNs by governments will help curb fraudulent 
activity by making it more difficult for criminals to access 
this personal information.
    The bill would provide specific exceptions to permit the 
continuation of SSN exchanges that provide important benefits 
in the public interest such as law enforcement; administration 
of government programs, including SSI, Medicaid, and 
unemployment insurance; administration of employee benefits; 
limited commercial purposes such as granting credit and 
insurance; tax administration; and government research 
advancing the public good.
    In addition, authority would be given to the Commissioner 
to authorize sale and display to the general public of SSNs as 
determined appropriate under guidelines specified in section 13 
of the bill. Since SSN use is so pervasive in both the public 
and private sectors, is linked to so many government and 
business transactions, and because of evolving needs regarding 
SSN utilization and new technologies to facilitate information 
exchanges, this exception is intended to allow the Commissioner 
or agencies to which it delegates authority to thoroughly 
evaluate how SSNs are sold and displayed, the degree to which 
they are convenient versus essential to such exchanges, and to 
modify the rules as needed. However, it is expected that this 
authority would be used extremely judiciously, and not merely 
for the sake of facilitating transactions or data-matching that 
could be reasonably accomplished without the use of the SSN. In 
comparing the costs and benefits of authorizing SSN sale or 
display to the general public and whether the authorization 
serves a compelling public interest that cannot reasonably be 
served through alternative measures, it is expected that the 
Commissioner and other agencies would give significant weight 
to the need to maintain individuals' privacy and safety, as 
well as the bill's purpose of preventing identity theft.
    With respect to the exception for research advancing the 
public good, the intent is to preserve the government's ability 
to conduct scientific, epidemiological, and social scientific 
research that would benefit the public. In the case of research 
involving medical information on individuals, it is expected 
that SSA will only authorize sale of SSNs in strict compliance 
with Federal rules and regulations on the privacy of medical 
information.
    The bill also provides a ``transition rule,'' which permits 
the government to use the last four digits of the SSN where the 
sale or public display is otherwise prohibited, to provide a 
period of transition to less reliance overall on the SSN and 
its derivatives. In combination with the effective date of the 
implementation rules, this transition rule permits government 
sale and display of the SSN for four and one-half years after 
enactment, in order to accommodate the transition to the 
prohibitions on sale and public display.
    The restrictions on sale and display to the general public 
of SSNs would not apply to the SSNs of deceased persons. This 
is because the sale and public availability of information on 
deceased individuals is necessary to prevent waste, fraud, and 
abuse. SSA compiles a Death Master File (DMF), which contains 
the name, date of birth, date of death, SSN, and other 
information for about 70 million individuals. The SSA DMF is 
used by leading government, financial, investigative, and 
credit reporting organizations, in medical research and by 
other industries to verify identity as well as to prevent fraud 
and comply with the ``Uniting and Strengthening America by 
Providing Appropriate Tools Required to Intercept and Obstruct 
Terrorism Act of 2001'' (USA PATRIOT Act, P.L. 107-56).
    The restrictions on sale and display by government 
agencies, trustees, and their agents would only apply to SSNs 
they require individuals or others to provide. During Social 
Security Subcommittee hearings on the bill, court and other 
public records administrators testified they receive numerous 
documents filed by individuals, businesses, and attorneys that 
often include SSNs the government did not require to be 
submitted, and of which they are therefore unaware. They stated 
redaction of ``incidentally'' included SSNs would create a 
serious administrative burden, and it would require significant 
resources to review each document and redact such incidental 
SSNs. Therefore, the bill would make government agencies, 
trustees, and their agents responsible only for those SSNs they 
require individuals to submit, since they should be able to 
easily locate and redact them. For example, a court requiring 
individuals to provide their SSNs on a coversheet for filed 
documents could remove the coversheet or redact the SSN before 
selling the court record or displaying it to the general 
public. With respect to SSNs submitted in court documents 
absent the court's requirement to do so, the individual 
communicating the SSN in the document, not the court, would be 
held responsible according to section 8 of the bill.
    The restrictions established under this bill would serve as 
a floor of protection for SSNs, and are not intended to 
override SSN protections in Federal or State law or regulations 
in effect to the extent they provide greater restrictions on 
SSN sale, purchase, or display to the general public than would 
be created under the bill. For example, this bill is not 
intended to circumvent the provision included in section 1735 
of the ``Food, Agriculture, Conservation, and Trade Act of 
1990'' (P.L. 101-624) preventing the disclosure of SSNs 
maintained as the result of laws enacted on or after October 1, 
1990.

                             EFFECTIVE DATE

    Initial final regulations to carry out the provisions would 
have to be issued by the Commissioner of Social Security or any 
other agency to which the Commissioner delegates authority 
within 18 calendar months after the date of enactment. The 
provisions would take effect one year after issuance of initial 
final regulations. The provisions would not apply to display of 
records generated prior to the date the provisions become 
effective. The temporary exemption to allow sale and display of 
the last four digits of the SSN would expire two years after 
the effective date of the initial final regulations.

Sec. 3. Prohibition of display of Social Security account numbers on 
        checks issued for payment by governmental entities

                              CURRENT LAW

    No Federal law regulates the overall use of SSNs by 
Federal, State, or local governments. However, the ``Social 
Security Number Confidentiality Act of 2000'' (P.L. 106-433) 
specifically directed the Secretary of the Treasury to take 
necessary action to ensure that SSNs are not visible on or 
through unopened mailings of checks or other drafts.

                        EXPLANATION OF PROVISION

    The bill would prohibit Federal, State, or local 
governments, or bankruptcy trustees, from including full or 
partial SSNs on checks issued for payment or on any documents 
accompanying checks.

                           REASON FOR CHANGE

    The Subcommittee on Social Security has heard testimony 
from the Postal Inspection Service and consumer advocates that 
mail theft and rifling through trash for discarded documents 
are means by which identity thieves gain access to personal 
information, including SSNs.

                             EFFECTIVE DATE

    Provision would apply with respect to checks (and documents 
attached to or accompanying such checks) issued after one year 
after enactment.

Sec. 4. Prohibition of the display of Social Security account numbers 
        on certain government identification cards or tags

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    The bill would prohibit government agencies and those 
providing employee benefits for a government agency from 
displaying an individual's full or partial SSN on any 
identification card or tag issued to employees or employees' 
family members; on identification cards issued to students at 
government educational institutions; on identification tags 
issued to patients at government medical institutions; and on 
Medicare cards. This would include use of a magnetic strip, bar 
code, or other means of communication to convey the full or 
partial SSN.

                           REASON FOR CHANGE

    SSNs are often utilized as employee identification numbers 
or customer account numbers for the sake of convenience. 
However, the display of SSNs on military identification tags, 
employee identification cards, student identification cards, 
patient identification cards and tags, health benefit cards, 
the Medicare card, customer cards, and on other cards or tags 
that are required to be submitted or displayed to others, which 
are frequently carried in individuals' wallets, unnecessarily 
increases the risk of identity theft. Similar prohibitions have 
been enacted under several State laws, and the Centers for 
Medicare and Medicaid Services and the Department of Defense 
are both evaluating their use of SSNs in light of identity 
theft concerns. This provision is not intended to prevent 
inclusion of encrypted SSNs (those that are transformed by a 
secret code to appear as other than the nine-digit number 
assigned by the Commissioner of Social Security when read or 
otherwise accessed by unauthorized parties).

                             EFFECTIVE DATE

    Provision would apply with respect to cards or tags issued 
after one year after enactment, except for Medicare cards, for 
which the prohibition would first apply two and one-half years 
after enactment.

Sec. 5. Prohibition of inmate access to Social Security account numbers

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    The bill would prohibit Federal, State or local governments 
from employing prisoners in any capacity that would allow 
prisoners access to full or partial SSNs of other individuals.

                           REASON FOR CHANGE

    Prisoners, including those who may have been incarcerated 
for identity theft, should not have access to SSNs or 
derivatives of SSNs, thereby posing a serious risk of identity 
theft or fraud. The Subcommittee on Social Security has heard 
testimony regarding a serious instance where use of prisoner 
labor to process personal information resulted in a case of 
stalking (Beverly Dennis, et al v. Metromail, et al., No. 96-
04451, District Court, Travis County, Texas).

                             EFFECTIVE DATE

    Provision would apply with respect to employment or entry 
into contract for employment of prisoners on or after 
enactment. In the case of employment or contracts for 
employment in effect on the date of enactment, provision would 
take effect 90 days after enactment.

Sec. 6. Measures to preclude unauthorized disclosure by governmental 
        entities of Social Security account numbers and protect the 
        confidentiality of such numbers

                              CURRENT LAW

    The Social Security Act requires officers and employees of 
Federal and State governments to keep SSNs and related records 
confidential. It also prohibits officers and employees from 
disclosing SSNs or related records.
    The Privacy Act of 1974 requires Federal agencies to 
establish appropriate administrative, technical and physical 
safeguards to ensure the security and confidentiality of the 
agencies' systems of records. The term ``records'' includes any 
personally identifiable item or information about an individual 
that is maintained by an agency.

                        EXPLANATION OF PROVISION

    With respect to Federal, State, and local government 
employees and their agents, the bill would restrict access to 
SSNs and any derivative thereof to employees whose 
responsibilities require access for administration or 
enforcement of the government agency's functions. Government 
agencies and their agents would be required to provide 
safeguards to prevent unauthorized access to SSNs and protect 
their confidentiality.

                           REASON FOR CHANGE

    There have been numerous reported cases of computer hackers 
obtaining SSNs from universities and other institutions. In 
addition, the Subcommittee on Social Security has heard 
testimony on how identity theft rings may plant an employee 
inside an organization to access SSNs and other personal 
information. Finally, there have been numerous recent instances 
where government agencies have failed to adequately secure 
confidential data which includes SSNs, such as the U.S. 
Department of Veterans Affairs and the State of Ohio.
    Also, the Personal Responsibility and Work Opportunity Act 
of 1996 (P.L. 105-33) requires state agencies to collect SSNs 
from applicants for professional licenses, drivers' licenses 
and marriage licenses. In 1997, the Balanced Budget Act (P.L. 
104-193) amended this requirement to include recreational 
licenses. The goal of these provisions was to enhance the 
ability of family support agencies to locate parents who were 
not supporting their children and enforce child support payment 
orders.
    Citizens obtain drivers licenses, professional licenses and 
marriage licenses in government offices. Hunting, fishing and 
boating licenses, in addition to being available through 
government offices or online, are typically sold in retail 
stores, outdoor marinas, or public parks, where, according to 
testimony provided to the Subcommittee on Social Security in 
2006, transactions are relatively open; employees processing 
the sale are often young, seasonal workers with very little 
training of any type; and data security protocols rarely 
include more than closing the cover on the receipt book.
    The Committee believes that government agencies and their 
agents (as in the case of retailers of recreational licenses) 
that ask or require individuals to provide their SSN to obtain 
benefits or services have a responsibility to safeguard SSNs 
from unauthorized access by employees or other individuals.
    This provision is not intended to prevent government 
employees or those to whom government agencies contract work 
from accessing SSNs in cases where it is necessary for 
performance of their duties, or to impede data exchanges 
between government agencies that include SSN information and 
are in accordance with section 2 of the bill. For example, it 
is not the intent to prevent State unemployment insurance 
agencies from sending wage records or claim information to 
other Federal, State, or local government agencies (e.g. for 
purposes of determining eligibility or benefit amounts for 
Temporary Assistance to Needy Families, Housing and Urban 
Development assistance, Food Stamps, SSI, etc.).

                             EFFECTIVE DATE

    Provision would take effect one year after the date of 
enactment.

Sec. 7. Uniform standards for truncation of the Social Security account 
        number

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    This bill would restrict the sale, purchase, and public 
display of the SSN, and certain other uses of the SSN, in both 
the public and private sectors. In situations not regulated by 
this bill, government entities and the private sector may 
voluntarily choose to use a truncated version of the SSN. 
However, if they choose to do so, the bill would require any 
truncated version of an individual's SSN to be limited to not 
more than the last four digits of the SSN.

                           REASON FOR CHANGE

    A 2007 report by the GAO (Social Security Numbers: Federal 
Actions Could Decrease Availability in Public Records, though 
Other Vulnerabilities Remain, GAO-07-752), recommended that 
Congress enact truncation standards for SSNs. GAO found that 
because there are no uniform truncation standards, identity 
thieves may be able to reconstruct full SSNs by combining 
different truncated versions of the SSN available from public 
and private sources. This bill would create a uniform 
truncation standard--limited to no more than the last four 
digits of the SSN, which are randomly generated--with which 
government and private sector entities must comply to limit 
identity thieves' access to full or partial SSNs.

                             EFFECTIVE DATE

    Initial final regulations to carry out the provisions would 
have to be issued by the Commissioner (or any agency to which 
it delegates authority) within 18 calendar months after the 
date of enactment. The provision would take effect one year 
after issuance of initial final regulations.

Sec. 8. Prohibition of the sale, purchase, and display to the general 
        public of the Social Security account number in the private 
        sector

                              CURRENT LAW

    The Gramm-Leach-Bliley Act (GLBA, P.L. 106-102) restricts 
the ability of financial institutions to disclose nonpublic 
personal information about consumers, including SSNs, to 
nonaffiliated third parties, although consumers must opt-out of 
such sharing arrangements.Moreover, GLBA allows financial 
institutions to sell SSNs among their affiliates, who may number in the 
thousands and may not themselves be financial institutions. Consumers 
have no opt-out right under GLBA against selling of SSNs to affiliates, 
which is often done for marketing purposes.
    FCRA regulates businesses that regularly provide 
information about consumers to third parties for purposes of 
determining eligibility for credit, employment, insurance, and 
for any other legitimate business need in a transaction 
initiated by a consumer. Entities that provide such reports on 
consumers are considered to fall under FCRA's coverage. 
Moreover, FCRA requires companies that provide such information 
to abide by certain consumer protections, such as allowing 
consumers to view and correct inaccuracies in such reports.
    The ``Health Insurance Portability and Accountability Act'' 
(HIPAA, P.L. 104-191) Privacy Rule limits health plans, health 
care clearinghouses, and health care providers from disclosing 
certain protected information, including SSNs. Individuals must 
give specific authorization before health care providers and 
other covered entities may disclose protected information in 
most non-routine circumstances.
    However, no Federal law regulates the overall sale, 
purchase, and display to the general public of SSNs in the 
private sector.

                        EXPLANATION OF PROVISION

    The bill would prohibit the sale, purchase or display to 
the general public of a full or partial SSN. It also prohibits 
using an SSN to find an individual with the intent to harass, 
harm, or physically injure the individual, or using the 
individual's identity for illegal purposes.
    The bill would provide exceptions to the prohibitions on 
SSN sale and purchase for law enforcement, including but not 
limited to enforcement of a child support obligation; national 
security purposes; public health; in emergency situations to 
protect the health or safety of one or more individuals; for 
tax compliance; by or to a consumer reporting agency for use or 
disclosure for permissible purposes described in FCRA (see 
Explanation of Provision under section 2 of the bill); and 
government or publicly-funded research (for advancing the 
public good and with restrictions to protect privacy of 
individuals).
    The bill would also provide an exception for sale and 
purchase of SSNs with the affirmative, written consent of the 
individual so long as consent is voluntary, the terms are 
presented clearly and conspicuously, and the individual may 
limit the sale or purchase to purposes directly associated with 
the transaction.
    In addition, the Commissioner of Social Security would be 
permitted to authorize sale, purchase or public display of SSNs 
in other circumstances as deemed appropriate.
    The bill would prohibit the display of the full or partial 
SSN of another person on any check issued for payment or on any 
documents accompanying checks.
    The bill would prohibit the unauthorized disclosure of 
another person's SSN to a government agency or instrumentality 
that did not request the SSN.
    In addition, the bill would prohibit the display of full or 
partial SSNs on employee identification cards or tags, or cards 
or tags businesses and others require individuals to use to 
access goods and services. The restrictions would also prohibit 
including the SSN on a magnetic strip, bar code, or other means 
which would convey the SSN.
    The bill would require businesses and other entities that 
collect and store SSNs to prevent unauthorized access by 
employees or other individuals.
    These prohibitions would not apply to SSNs of deceased 
persons.
    The restrictions that would be established under this 
provision would not override other restrictions or limitations 
in Federal or State law or regulations in effect to the extent 
they provide greater protections for SSNs than would be created 
under this provision in the bill.
    The bill would define a ``person'' to which these 
prohibitions apply as any individual, partnership, corporation, 
trust, estate, cooperation, association, or any other entity, 
other than a governmental entity.
    The bill would define ``sell'' as obtaining, directly or 
indirectly, anything of value in exchange for the SSN. 
``Purchase'' would mean to provide, directly or indirectly, 
anything of value in exchange for the SSN. The terms ``sell'' 
and ``purchase'' would not include submission of the SSN when 
applying for government benefits or programs, use of SSNs in 
administration of employee benefit plans, or incidental 
transmission of SSNs as part of the sale, lease, merger, 
transfer, or exchange of a trade or business.
    The exception for the transfer of an SSN as part of the 
sale, lease, merger, transfer, or exchange of a trade or 
business in the definitions of ``sell'' and ``purchase'' 
recognizes that there may be SSNs embedded in data files, 
employee files or loan documents of legitimate businesses that 
may be transferred when a business or certain assets are sold, 
where the transfer of the SSN is incidental to the transaction. 
The Committee intends that this exception encompasses not only 
the sale of a trade or business in its entirety, but also the 
sale of parts of a business and the sale of assets, but only 
where the primary economic value being transferred is derived 
from assets other than personally identifiable information such 
as SSNs. Examples of such a covered transfer of assets include 
a proposed or actual securitization, secondary market sale, 
sale of servicing rights, or similar transaction related to 
mortgages and student loans, where an SSN is embedded in the 
loan file. If SSNs are included in such a transfer, then the 
recipient is obligated to safeguard them as required under the 
bill.
    ``Display to the general public'' would mean to 
intentionally place an SSN in a viewablemanner on an Internet 
site that is available to the general public or to provide access to 
the general public by other means. In addition, requiring an individual 
to transmit his or her SSN over the Internet without ensuring the 
number is encrypted or otherwise protected would be considered a 
prohibited display to the general public.
    ``Social Security account number'' would include any 
derivative of the SSN. However, with respect to the 
restrictions on sale, purchase or public display of the SSN, 
the bill would provide a temporary exemption permitting private 
entities to purchase, sell and publicly display the last four 
digits of an SSN for two years after the effective date of the 
final regulations.

                           REASON FOR CHANGE

    Use of SSNs in the private sector has proliferated for 
purposes unrelated to administration of the Social Security 
program, collection of taxes, or other purposes authorized 
under Federal law. Businesses often request SSNs from their 
customers. For example, information resellers, consumer 
reporting agencies, and financial institutions obtain SSNs and 
other personal information from customers, public records, and 
other sources to determine an individual's identity and 
accumulate information about them for certain purposes, which 
may include for marketing purposes or to provide that 
information to businesses or others for a fee. As a result, 
Americans are increasingly concerned that the SSN they disclose 
for one purpose may be subsequently sold to third parties and 
used for other purposes without their knowledge or consent. For 
example, an individual discloses his or her SSN to get a bank 
loan. The bank sends the information to a consumer reporting 
agency to request a credit report. The consumer reporting 
agency assembles information on the individual and associates 
it with the SSN. Under current law, the consumer reporting 
agency may then incidentally or purposefully sell the SSN and 
other information to insurance companies, credit companies, 
information resellers, law enforcement, government agencies, 
private investigators, and others.
    Financial institutions are allowed under current law to 
disclose nonpublic personal information they gather from 
consumers or from other sources such as credit bureaus to their 
affiliates, which may number in the thousands and may not 
themselves be financial institutions. Affiliations between 
businesses and financial institutions may often be based on 
joint-marketing agreements, thus the sale of nonpublic personal 
information such as SSNs is often done for marketing purposes.
    In addition, such widespread use of SSNs increases the risk 
that business employees, computer hackers, or others may obtain 
unauthorized access and misuse SSNs to commit identity theft or 
other crimes. According to a 2003 survey sponsored by the FTC, 
among identity theft victims who knew the identity of the 
criminal, 23 percent said the person responsible worked at a 
company or financial institution that had access to the 
victim's personal information.
    The bill would restrict the sale, purchase, and display to 
the general public of SSNs. For example, display to the general 
public would include making records containing SSNs available 
on paper, computer disk, or other media, in addition to display 
over the Internet. The bill would also require that SSNs be 
appropriately safeguarded when collected and stored. The intent 
is to limit transmission of SSNs in order to minimize 
opportunities for SSN misuse and identity theft.
    In limiting the transmission of SSNs, it is not the intent 
to prevent individuals from voluntarily providing their own 
SSNs to facilitate a transaction that they initiate or to 
prevent businesses from utilizing SSNs in a transaction that 
the individual authorizes. For example, if an individual 
voluntarily gives his or her own SSN to a business so that it 
may provide goods or services, it is not the intent of the bill 
to call such an exchange the ``sale'' or ``purchase'' of the 
SSN simply because it is facilitating the transaction.
    The prohibition against the sale or purchase of SSNs would 
not prevent financial institutions from complying with the 
customer identification program requirements of the USA PATRIOT 
Act. Under the USA PATRIOT Act, banks, savings associations, 
credit unions and securities firms are required to verify 
identification information provided by their customers when 
establishing an account. Financial institutions that utilize 
verification services offered by consumer reporting agencies 
and other information resellers generally are not selling or 
purchasing their customers' SSNs when they check them against a 
database because the financial institution and the verification 
service provider each already possess the SSN. The verification 
service merely affirms whether the SSN and other identification 
information provided by the customer to the financial 
institution match the information in the provider's database. 
If the SSN itself is not being exchanged for something of 
value, then the transaction would not be considered a sale or 
purchase of the SSN.
    With respect to the exemption for activities of consumer 
reporting agencies for purposes described in section 604(a) of 
FCRA, sales and purchases of SSNs by CRAs that are in 
furtherance of those specified purposes (such a sale or 
purchase of an SSN as part of authenticating a customer's 
identity in order to ensure that he or she receives the correct 
report, or compiling information used in providing a consumer 
report) are not intended to constitute a prohibited sale or 
purchase under the bill.
    The exemption for tax compliance recognizes that SSNs are 
also used in tax administration, and that tax law extends to a 
wide variety of transactions including, for example, payment of 
mortgages where interest is tax-deductible, securities sales, 
and even car loans, where if there is a default and the 
creditor writes off the loss, the value of the discharged debt 
must be reported for tax purposes.
    In addition, during the course of the Subcommittee on 
Social Security's consideration of the bill, the Federal 
Deposit Insurance Corporation (FDIC) and some financial 
institutions expressed concern that the bill's restrictions on 
sale and purchase of SSNs could be interpreted to impede the 
FDIC's resolution or liquidation of failed insured depository 
institutions, or other business mergers and acquisitions. The 
bill's language specifying that ``sell'' or ``purchase'' does 
not include the sale, lease, merger, transfer, or exchange of a 
trade or business is intended to make clear that the FDIC may 
share SSNs in carrying out its responsibilities, and SSNs may 
be conveyed as part of the merger, acquisition, etc. of a 
business.
    With respect to the exception for research advancing the 
public good, the intent is to preserve the government's ability 
to conduct scientific, epidemiological, and social scientific 
research that would benefit the public. It is not intended to 
facilitate private commercial research for product or service 
development or marketing. In the case of non-publicly sponsored 
or funded research advancing the public good, the Commissioner 
would have the ability to authorize SSN sale and purchase where 
appropriate, under its general regulatory authority. In the 
case of research involving medical information on individuals, 
it is expected that the Commissioner will only authorize sale 
of SSNs in strict compliance with Federal rules and regulations 
on the privacy of medical information.
    With respect to the exception for affirmative written 
consent of the individual, the intent is to enable individuals 
to authorize the sale or purchase of their own SSNs if they 
determine it is in their own best interest. Businesses and 
others soliciting such consent from the individual must explain 
clearly and understandably what giving consent would entail and 
the uses that might be made of the individual's SSN. 
Preferably, the explanation and solicitation of consent would 
be a distinct document or other communication separate from 
other explanations or solicitations from the business or other 
persons. The terms of consent, and the explanation of the right 
to refuse consent or to limit the SSN's exchange solely to a 
specific transaction, should not be obscured by other 
explanations, authorizations, solicitations or other text that 
might be included in the same document. No individual should be 
obligated to provide consent; however, businesses and others 
may provide an explanation of the advantages and disadvantages 
(with equal prominence given to both) of providing versus 
refusing consent.
    With respect to the exception permitting the Commissioner 
to authorize additional exceptions to the general prohibition 
on SSN sale, purchase, and display to the general public, for 
the same reasons discussed under section 2 of the bill, the 
expectation is that this authority would be used extremely 
judiciously and only when there are no other reasonable 
alternative measures that could attain the same objective.
    For the same reasons discussed under section 3, the bill 
would prohibit display of another individual's SSN on any check 
issued for payment or documents accompanying the checks because 
identity thieves may gain access to personal information, 
including SSNs, by rifling through trash for discarded 
documents.
    Section 2 of the bill would prohibit government agencies 
from selling or displaying to the general public SSNs they 
require individuals to disclose to the government. However, 
many of the SSNs that appear in government records--
particularly court records, documents from attorneys, title 
companies, or other businesses and individuals--are the result 
of including a person's SSN on papers submitted to the court 
for the sake of convenience. Government agencies do not have 
the resources to comb through innumerable documents searching 
for such ``incidental'' inclusion of SSNs. As a result, an 
individual's SSN could be displayed to the public without the 
government record-keeper realizing it. Therefore, to prevent 
inadvertent sale or display of SSNs by government agencies, the 
bill would prohibit the submission of the SSN to government 
agencies absent the government agency's requiring that the 
number be submitted or the individual's written consent. Thus, 
this provision does not prohibit submission of another 
individual's SSN for the purpose of applying for benefits on 
their behalf, such as when a parent files an application on 
behalf of a child.
    Also, for the same reasons discussed under section 4, the 
bill would prevent private sector employers and those providing 
employee benefits from displaying an individual's full or 
partial SSN on any identification card or tag issued to the 
employee or an employee's family member. In addition, the bill 
would prevent businesses from displaying full or partial SSNs 
on cards or tags used to access goods and services. Individuals 
who must carry such cards and tags with their SSNs are at 
greater risk of identity theft should their wallets or purses 
be stolen or lost. According to an FTC-sponsored survey, 14 
percent of identity theft victims said their personal 
information was obtained from a lost or stolen wallet or 
checkbook. This provision is not intended to prevent inclusion 
of encrypted SSNs (those that are transformed by a secret code 
to appear as other than the nine-digit number assigned by the 
Commissioner of Social Security when read or otherwise accessed 
by unauthorized parties).
    The restrictions on private sector sale, purchase, and 
display to the general public of SSNs would not apply to the 
SSNs of deceased persons. This is because the sale and public 
availability of information on deceased individuals is 
necessary to prevent fraud. As mentioned in the discussion 
under section 2 of the bill, the SSA DMF is used by both public 
and private sector entities to prevent fraud and comply with 
the USA PATRIOT Act. By methodically running financial, credit, 
payment and other applications against the DMF, the financial 
community, insurance companies, security firms and State and 
local governments are better able to identify and prevent 
identity fraud. The USA PATRIOT Act requires an effort to 
verify the identity of customers, including procedures to 
verify customer identity and maintaining records of information 
used to verify identity.
    As discussed under section 2, this bill is intended to 
serve as a floor of protection for SSNs and is not intended to 
override SSN protections in Federal or State law or regulations 
in effect to the extent they provide greater restrictions. For 
example, this bill is not intended to enable SSN sale, 
purchase, or display to the general public by health providers 
that would otherwise be prohibited under the HIPAA Privacy 
Rule.

                             EFFECTIVE DATE

    Initial final regulations to carry out the provisions would 
have to be issued by the Commissioner or any other agency to 
which the Commissioner delegates authority within 18 calendar 
months after the date of enactment. The provisions would take 
effect one year after issuance of initial final regulations. 
The prohibition on public display of SSNs would only apply with 
respect to records generated after the effective date of the 
regulations. The temporary exemption to allow purchase, sale 
and display of the last four digits of the SSN would expire two 
years after the effective date of the initial final 
regulations.

Sec. 9. New criminal penalties for misuse of Social Security account 
        numbers

                              CURRENT LAW

    Section 208 of the Social Security Act provides criminal 
penalties for fraudulently obtaining an SSN from SSA or the 
misuse of an SSN. In such cases, section 208 specifies that 
persons shall be guilty of a felony and upon conviction shall 
be fined under Title 18, United States Code (up to $250,000 for 
an individual and up to $500,000 for an organization) and/or 
imprisoned for up to five years.
    In addition, depending upon the facts, certain sections 
under Title 18 of the United States Code are applicable to the 
misuse of SSNs, including 18 U.S.C. Sec. 1028(a)(7), the 
``Identity Theft and Assumption Deterrence Act of 1998'' (P.L. 
105-318), which prohibits the knowing transfer or use of 
another person's SSN without lawful authority. The ``Internet 
False Identification Prevention Act of 2000'' (P.L. 106-578) 
closed some loopholes in the ``Identity Theft and Assumption 
Deterrence Act of 1998'' by prohibiting the transfer of a false 
identification document by electronic means, including on a 
template or computer file or disk.
    Lastly, the ``Identity Theft Penalty Enhancement Act'' 
(P.L. 108-275) establishes penalties for aggravated identity 
theft. The law prescribes sentences, to be imposed in addition 
to the punishments provided for the related felonies, of: (1) 
two years' imprisonment for knowingly transferring, possessing, 
or using, without lawful authority, a means of identification 
of another person during and in relation to specified felony 
violations; and (2) five years' imprisonment for knowingly 
taking such action with respect to a means of identification or 
a false identification document during and in relation to 
specified felony violations pertaining to terrorist acts. The 
law also prohibits a court from: (1) placing any person 
convicted of such a violation on probation; (2) reducing any 
sentence for the related felony to take into account the 
sentence imposed for such a violation; or (3) providing for 
concurrent terms of imprisonment for a violation of this Act 
and a violation under any other Act.
    The law also expands the existing identify theft 
prohibition to: (1) cover possession of a means of 
identification of another with intent to commit specified 
unlawful activity; (2) increase penalties for violations; and 
(3) include acts of domestic terrorism within the scope of a 
prohibition against facilitating an act of international 
terrorism. Finally, the law modifies provisions regarding 
embezzlement and theft of public money, property, or records to 
provide for combining amounts from all the counts for which the 
defendant is convicted in a single case for purposes of 
determining which penalties apply.

                        EXPLANATION OF PROVISION

    The bill would expand the types of SSN misuse to which 
criminal penalties apply and would establish a two-tier penalty 
structure that creates new categories of misdemeanor and felony 
violations.
    The bill would provide for criminal misdemeanor penalties, 
which are subject to fines under Title 18 of the United States 
Code and/or imprisonment for up to one year. It would apply to 
government employees and private sector individuals who: (1) 
display SSNs on checks issued for payment; (2) display SSNs on 
identification cards; or (3) violate the uniform truncation 
standards. It would apply to private sector entities who 
communicate another person's SSN to a government entity when 
not required. It would apply to government employees who 
display SSNs on drivers' licenses and vehicle registrations. 
Finally, the misdemeanor penalty would apply to the knowing 
unlawful possession of another person's SSN card or a 
fraudulent SSN card with an intent to use the SSN in 
furtherance of a violation of law.
    The bill would also provide for criminal felony penalties, 
which are subject to fines under Title 18 of the United States 
Code and/or imprisonment for up to five years. The felony 
provision would apply to individuals who obtain or use an SSN 
with intent to harass, harm or physically injure another 
person.
    The bill would also create enhanced penalties for repeat 
offenders and for violations committed to facilitate drug 
trafficking or terrorism.
    Finally, the bill would provide for both criminal 
misdemeanor and felony penalties for certain violations. These 
penalties apply to persons who sell their own SSN with the 
intent to deceive, or assist an individual in acquiring an 
additional SSN for a fee. It would apply to government entities 
that: (1) sell or display the SSN in violation of section 2 of 
the bill; (2) give inmates access to SSNs; or (3) fail to 
protect SSNs as required under section 6 of the bill. It would 
also apply to private sector entities who: (1) sell, purchase 
or display the SSN in violation of section 8 of the bill; or 
(2) fail to protect the confidentiality of the SSN in violation 
of section 8 of the bill. These violations would be subject to 
a felony charge if they are committed under false pretenses, or 
for commercial advantage, personal gain, or malicious harm.

                           REASON FOR CHANGE

    Identity theft often begins with the misuse of an SSN. 
While advances have been made to prosecute those individuals 
who assist another person to improperly acquire an additional 
SSN or a number that purports to be an SSN, SSA Inspector 
General and the Department of Justice have continued to 
encounter some problems, for example in prosecuting individuals 
who operate over the Internet or at a flea market. It is 
appropriate to close loopholes to prevent individuals assisting 
another person to improperly acquire an additional SSN or a 
number that purports to be an SSN. In addition, it is 
appropriate to establish penalties for those who violate the 
prohibitions on sale, purchase and display to the general 
public established under this bill.
    In addition, the SSA Inspector General has investigated 
individuals who have sold or transferred their own SSN to a 
third person with intent to deceive and has encountered 
problems in the prosecution. While such an individual may 
potentially be prosecuted under the criminal statutes involving 
conspiracy or aiding and abetting, because of the gravity of 
SSN misuse, it is appropriate to address this problem head on 
and provide criminal penalties when an individual sells or 
transfers his or her own SSN with intent to deceive.
    With respect to violations that are punishable as either a 
misdemeanor or a felony, this two-tier structure is intended to 
provide prosecutors with additional flexibility in charging 
violators. The ``aggravating'' circumstances under which a 
violation would be a felony rather than a misdemeanor are drawn 
from the HIPAA Privacy Rule, which also contains a multi-tiered 
structure of penalties.

                             EFFECTIVE DATE

    The criminal penalties would apply to violations that occur 
after enactment, except for violations of prohibitions created 
under this bill. In such cases, the criminal penalties would 
apply to violations that occur on or after the applicable 
effective dates.

Sec. 10. Extension of civil monetary penalty authority

                              CURRENT LAW

    Section 1129 of the Social Security Act authorizes the 
Commissioner to impose civil monetary penalties and assessments 
on any person who makes a false statement or representation of 
a material fact, or omits a material fact while providing a 
statement, for use in determining eligibility for Social 
Security or SSI benefits or the benefit amount. The 
Commissioner may impose a civil monetary penalty of up to 
$5,000 for each violation, and an assessment of up to twice the 
amount of benefits or payments paid as a result of such 
violation.
    Currently, an individual who improperly obtains an SSN from 
SSA or misuses another person's SSN is not subject to civil 
monetary penalties and assessments under section 1129, except 
in cases of SSN misuse related to the receipt of Social 
Security or SSI benefits.

                        EXPLANATION OF PROVISION

    The bill would expand the types of activities to which 
civil monetary penalties and assessments apply. Specifically, 
it would authorize the Commissioner to impose (in addition to 
any other penalties that may apply) civil monetary penalties 
and assessments on persons who: (1) use an SSN obtained through 
false information; (2) falsely represent an SSN to be their 
own; (3) with intent to deceive, alter an SSN card; (4) buy or 
sell an SSN card or a card purported to be an SSN card; (5) 
counterfeit an SSN card; (6) disclose, use or compel the 
disclosure of the SSN of any person in violation of any Federal 
law; (7) provide false information to obtain an SSN; (8) offer 
to acquire, for a fee, an additional SSN for an individual; (9) 
disclose, sell or transfer a person's own SSN with intent to 
deceive; (10) knowingly possess an SSN unlawfully or possess an 
altered or counterfeited SSN with the intent to commit a 
felony; (11) as a government officer, violate prohibitions on 
display of SSNs on drivers' licenses, sale and display of SSNs, 
displaying SSNs on checks and identification cards, inmate 
access to SSNs, security and protection of SSNs, or truncation 
standards; (12) as a bankruptcy trustee, sell or display SSNs, 
display SSNs on checks, fail to protect the confidentiality of 
SSNs, or violate truncation standards; (13) sell, purchase or 
display SSNs, or violate truncation standards; or (14) as an 
SSA employee, violate section 11 of the bill (relating to 
fraudulent issuance of SSNs).

                           REASON FOR CHANGE

    SSN misuse, not related to the determination of eligibility 
for, or the amount of, Social Security or SSI benefits, can 
also result in considerable costs for the government, the 
private sector, and individuals who are victims of fraud. In 
many cases, the costs of SSN misuse extend beyond monetary 
losses.
    The SSN is a valuable commodity today for criminals. As the 
Subcommittee on Social Security has heard in testimony, the use 
of the SSN has grown so that it is interwoven into many aspects 
of every day life. It has become the de facto national 
identifier, used as a ``breeder document'' to obtain a driver's 
license or a credit card, open a bank account or secure a loan.
    Because of the prevalence of the use of the SSN in society 
and the gravity of SSN misuse, it is appropriate to provide for 
civil monetary penalties and assessments for violations of the 
law relating to SSN misuse in general.

                             EFFECTIVE DATE

    The civil monetary penalties would apply to violations that 
occur after enactment, except with respect to violations of 
prohibitions created under this bill. In such cases, the civil 
monetary penalties would apply to violations that occur on or 
after the applicable effective date.

Sec. 11. Criminal penalties for employees of the Social Security 
        Administration who knowingly and fraudulently issue Social 
        Security cards or Social Security account numbers

                              CURRENT LAW

    SSA employees who fraudulently sell SSNs to third parties 
may be tried under a number of criminal statutes, including but 
not limited to 18 U.S.C. 371 (conspiracy) and 18 U.S.C. 
Sec. 641 (theft of government property).

                        EXPLANATION OF PROVISION

    The bill would provide for criminal penalties for SSA 
employees (including contract workers, State Disability 
Determination Service workers and volunteers in an SSA 
facility) who knowingly and fraudulently sell or transfer SSNs 
or Social Security cards, with the penalty based on the number 
of SSNs or Social Security cards fraudulently issued, as 
follows: (1) up to 50 SSNs or cards: up to 5 years 
imprisonment; (2) 51 to 100 SSNs or cards: up to 10 years 
imprisonment; or (3) 101 or more SSNs or cards: up to 20 years 
imprisonment.

                           REASON FOR CHANGE

    Crimes of fraud against the integrity of the SSN are of 
great concern because of the far-reaching implication such 
crimes have upon the integrity of SSA, the potential impact on 
innocent individuals due to identity theft, and possible misuse 
of SSNs in terrorist activities. This is especially true when 
the crime is perpetrated, at least in part, by an SSA employee. 
SSA employees issuing SSNs are in a position of trust. When 
this trust is violated, the effect on SSA's programs and 
operations and on the public in general can be devastating. 
Fortunately, the number of SSA employees taking part in these 
crimes is small, but participation in such crimes by any SSA 
employee to any extent cannot be tolerated.
    SSA and the SSA Inspector General are concerned that 
current laws do not provide an adequate deterrent to SSA 
employees tempted to facilitate these crimes. In several recent 
investigations involving SSA employees, the employee when 
caught has received little, if any, prison time though the 
employee may have fraudulently issued hundreds of SSNs. The 
Committee is concerned because the SSNs issued have usually not 
previously been issued to anyone else. Even a thorough credit 
check would not show this SSN to be fraudulent. This could 
allow a criminal to more easily assimilate into our society. 
Therefore, it is appropriate to provide for enhanced criminal 
penalties for SSA employees who abuse their position of trust 
and assist in the fraudulent issuance of SSNs.

                             EFFECTIVE DATE

    The penalties would apply to violations that occur on or 
after enactment.

Sec. 12. Enhanced penalties in cases of terrorism, drug trafficking, 
        crimes of violence, or prior offenses

                              CURRENT LAW

    Sections 208, 811 and 1632 of the Social Security Act 
(regarding Social Security benefits, Special Benefits for 
Certain World War II Veterans and SSl benefits, respectively) 
provide that persons who willingly and knowingly commit fraud 
shall be guilty of a felony and upon conviction shall be fined 
under Title 18, United States Code, and/or imprisoned for up to 
five years.
    Examples of violations to which penalties apply include 
making false statements or representations of fact to obtain 
benefits or increase benefit payments; failing to disclose an 
event that affects an individual's initial or continued right 
to receive benefits; and engaging in various types of SSN 
misuse or fraud (such as using an SSN obtained on the basis of 
false information; falsely representing an SSN to be one's own 
with intent to deceive; buying or selling an SSN card; 
counterfeiting an SSN card; or disclosing, using or compelling 
the disclosure of the SSN of any person in violation of any 
Federal law).
    Penalties apply to violations committed by individuals (or 
organizations) acting in the capacity of a representative payee 
(or prospective representative payee) for a beneficiary other 
than the individual's spouse. If the court determines that the 
violation also includes willful misuse of funds, the court may 
require full or partial restitution of funds to the 
beneficiary.

                        EXPLANATION OF PROVISION

    The bill would enhance criminal penalties under sections 
208, 811 and 1632 of the Social Security Act with respect to 
(a) repeat offenders and (b) violations committed to facilitate 
a drug trafficking crime, a crime of violence, or an act of 
international or domestic terrorism.
    Specifically, the bill would provide for: (1) fines and/or 
imprisonment for up to five years for first offenders; (2) 
fines and/or imprisonment for up to 10 years for repeat 
offenders; (3) fines or imprisonment for up to 20 years for 
persons convicted of violations for the purpose of facilitating 
a drug trafficking crime or a crime of violence against 
persons; and (4) fines or imprisonment for up to 25 years for 
persons convicted of violations for the purpose of facilitating 
an act of international or domestic terrorism.

                           REASON FOR CHANGE

    The expanded use of the SSN in today's society has made it 
a very valuable commodity for criminals. As the Subcommittee on 
Social Security has heard in several hearings, the SSN is 
considered a prime ``breeder document,'' a valuable commodity 
used to obtain a driver's license or credit card, as well as 
open a bank account or obtain a loan. In addition to being a 
lynchpin for identity theft crimes, the SSN also assists 
terrorists in assimilating into our society and avoiding 
detection.
    The integrity of the SSN is vital. Its importance in both 
identity theft and homeland security is universally recognized. 
Providing new, enhanced, structured penalties appropriately 
reflects the vital importance of the SSN and the commitment of 
the Congress, SSA and the SSA Inspector General to its 
protection.

                             EFFECTIVE DATE

    The penalties would apply to violations that occur after 
enactment.

Sec. 13. Regulatory and enforcement authority with respect to misuse of 
        the Social Security account number

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    The bill would direct the Commissioner of Social Security 
to issue regulations regardingthe sale, purchase, or display to 
the general public of SSNs and to provide an opportunity for public 
comment on regulations in accordance with the ``Administrative 
Procedure Act'' (P.L. 79-404). The Commissioner would be required to 
consult with the Attorney General of the United States, the Secretary 
of Health and Human Services, the Secretary of Homeland Security, the 
Secretary of the Treasury, the Federal Trade Commission, the 
Comptroller of the Currency, the Director of the Office of Thrift 
Supervision, the Board of Governors of the Federal Reserve System, the 
Federal Deposit Insurance Corporation, the National Credit Union 
Administration, the Securities and Exchange Commission, State Attorneys 
General and representatives of the State insurance commissioners as 
designated by the National Association of Insurance Commissioners.
    When authorizing the sale, purchase, or display of SSNs for 
law enforcement or national security purposes, the Commissioner 
would be required to find that the sale, purchase or display 
would serve a compelling public interest that cannot reasonably 
be served through alternative measures, and would not pose an 
unreasonable risk of identity theft, or harm to an individual.
    The Commissioner would be able to authorize the sale, 
purchase, or display to the general public of SSNs for purposes 
other than law enforcement or national security, only after 
considering whether the authorization serves a compelling 
public interest and considering the costs and benefits to the 
general public, businesses, commercial enterprises, non-profit 
associations, and governments. If the Commissioner authorizes 
the sale, purchase, or display to the general public of SSNs, 
he or she would be required to impose restrictions and 
conditions to reduce the likelihood of fraud and crime and to 
prevent an unreasonable risk of identity theft or bodily, 
emotional or financial harm to individuals.
    The Committee intends that any exceptions made under this 
section of the bill by SSA, or any other agency to which 
rulemaking authority is delegated, would conform to the 
purposes of this Act: to prevent SSN misuse and identity theft 
by reducing the availability of SSNs in documents obtainable by 
identity thieves. The Committee expects SSA or other agencies 
to consider an exception to allow the sale or purchase of SSNs 
to the extent necessary to prevent fraud in financial 
transactions initiated by a consumer. FCRA requires information 
sellers to comply with certain consumer protections if they are 
compiling and selling consumer information for determining 
consumer eligibility for credit, employment, insurance, 
licensing and other government benefits, or for any other 
legitimate business need in transactions initiated by the 
consumer. Any further exceptions promulgated by an agency 
regarding fraud should be tailored narrowly to the purpose of 
detecting and investigating fraud in violation of civil or 
criminal statutes and/or regulations or identity theft. 
Furthermore, they should be written in such manner that does 
not allow sellers or buyers of SSNs to circumvent the 
requirements and applicability of FCRA by selling or buying 
SSNs for purposes already covered by the exception relating to 
section 604(a) of FCRA, but doing so in a way that does not 
subject them to FCRA's regulations. Finally, SSNs sold or 
bought under such an exception should be restricted from use 
for any secondary purposes not related to the transaction.
    The Commissioner would have the authority to delegate 
rulemaking to other Federal agencies, as appropriate. The 
Commissioner would delegate this authority to any agency or 
instrumentality which would otherwise have regulatory authority 
over such matters. The Commissioner would also facilitate 
coordination and consistent rulemaking and enforcement by other 
agencies.
    With respect to any regulation issued under the 
Commissioner's general authority to provide for an exemption 
from the bill's prohibition on sale, purchase or display, such 
regulations would expire five years after their effective 
dates. One year prior to the expiration of the regulations, GAO 
would be required to conduct a review of the efficacy of the 
regulations and the extent to which such regulations are 
consistent with and in furtherance of the purpose of this bill. 
The Commissioner may use the results of the review to issue new 
regulations consistent with the guidelines provided in this 
bill, as listed above.
    This bill would authorize any State Attorney General to 
bring a civil action in a United States district court to 
enforce compliance with the statute and related regulations by 
State and local governments and the private sector. An Attorney 
General may bring an action when he or she has reason to 
believe that an interest of the State's residents is threatened 
or adversely affected by State or local governments or private 
entities that violate this statute. Attorneys General may seek 
to enjoin the act or practice, enforce compliance with the 
regulation, obtain limited civil penalties of $11,000 per 
violation not to exceed a total of $5,000,000, or other 
appropriate legal and equitable relief.
    In addition, this bill would give individuals limited 
standing to sue a Federal agency for violations of prohibitions 
and requirements established under this bill. An individual 
would be allowed to sue a Federal agency in a United States 
district court only if the individual's SSN was involved in the 
violation. The individual would only be allowed to sue for 
injunctive relief and actual damages, and could recover 
attorney's fees and costs of the action.

                           REASON FOR CHANGE

    The SSN is widely used throughout the public and private 
sectors. Some uses are authorized or required under law, others 
are to facilitate data-matching and record-keeping, and still 
others are simply for the sake of convenience. The development 
of coordinated regulations regarding SSN sale, purchase, and 
display across such diverse agencies and businesses makes it 
necessary to centralize regulatory authority with SSA (which is 
responsible for issuing SSNs).
    In addition, to address concerns that the limited statutory 
list of exceptions does not enumerate all instances in which 
the sale, purchase, and display of SSNs may be essential and 
irreplaceable for government and business transactions, the 
Commissioner would be given authority to authorize the sale, 
purchase or display to the general public of SSNs. The bill 
provides guidelines to ensure SSNs are exchanged only when 
there is no other alternative that could reasonably accomplish 
the objective, and with due consideration for the unintended 
and potentially harmful consequences to individuals, government 
agencies, and businesses that may result.
    SSNs are used widely in government and the private sectors 
for many diverse purposes, and in industry sectors that maybe 
overseen by their own regulatory bodies, such as the financial 
services industry. To most effectively issue regulations that 
address these various concerns, the Commissioner has the 
authority to delegate, by regulation, rulemaking and 
enforcement of these provisions to other agencies. Agencies 
tasked with this authority may be better suited to issue and 
enforce regulations within the domain of their jurisdiction and 
expertise.
    This bill would encourage private sector entities to change 
their business practices to reduce reliance on the SSN. As 
business models change and as research progresses to employ 
authentication devices other than the SSN, the regulations 
should be reviewed and revised as appropriate to ensure that 
the regulations meet the goals of this bill. To ensure that the 
regulations authorized by the Commissioner are consistent with 
the goals of this statute, any final regulation issued under 
the regulator's general exemption authority will expire five 
years after its effective date. This provision ensures that 
regulations issued under this bill will undergo regular and 
consistent reviews to ensure that the regulations effectively 
and functionally limit the sale, purchase and display of the 
SSN in the private sector and discourage excessive use of and 
reliance on the SSN. The GAO assessment would also provide 
Congress and regulators the opportunity to review the 
effectiveness of regulations granting permissible sale, 
purchase and display of SSNs and the extent to which they are 
consistent with the purpose of this bill.
    State Attorneys General would assist in enforcement efforts 
under this bill through civil actions. As in other areas of 
Federal law, State Attorneys General can support compliance 
with Federal law by supplementing the enforcement resources of 
Federal agencies, and they are well-positioned to be aware of 
unlawful acts and practices in their states. State Attorneys 
General would be required to inform SSA and the U.S. Attorney 
General of any enforcement actions they intend to undertake, 
and State action would be precluded where the Federal 
government has initiated a criminal proceeding.
    Federal agencies, like State and local governments, have 
unique and frequent access to SSNs. Federal agencies are 
commonly required by law to use the SSN as an identifier and 
often use the SSN for record-keeping purposes in the 
administration of government benefits. Therefore, it is just as 
important for Federal agencies to protect the confidentiality 
of the SSN, as well as limit its sale and display, as it is for 
State and local government agencies. This bill would strengthen 
enforcement against Federal agencies that are not in compliance 
with the bill by allowing individuals to take action against 
Federal agencies in limited situations where they may be 
harmed.

                             EFFECTIVE DATE

    The regulatory authority would be effective upon enactment.

Sec. 14. Study on feasibility of banning Social Security account number 
        as an authenticator

                              CURRENT LAW

    No provision.

                        EXPLANATION OF PROVISION

    This bill would direct the Commissioner of Social Security 
to enter into an arrangement with the National Research Council 
for the Council to conduct a study to determine the extent to 
which SSNs are used as a primary means of authenticating 
identity and the extent to which SSNs are used for verification 
in commercial transactions. It would also require the Council 
to determine the feasibility of prohibiting use of the SSN as 
an authenticator and possible alternatives to the SSN for 
verification purposes and uses in authenticating identity.

                           REASON FOR CHANGE

    Identity theft is facilitated by the fact that the SSN is 
used by business and governments as an identifier, to 
distinguish one person from another, as well as an 
authenticator, or evidence that a person is who they say they 
are. This insecure practice is analogous to someone using the 
same element for their user ID as for their password in order 
to gain access to a computer network. At a hearing before the 
Subcommittee on Social Security, a witness for the Association 
for Computing Machinery explained that knowledge of an SSN is 
not sufficient to reliably authenticate any party in a 
transaction, but this use is commonplace.
    While some businesses have begun to discontinue the use of 
SSNs as passwords on their phone and online accessible 
networks, many businesses still depend on the SSN as an 
authenticator of identity. This practice continues to make the 
SSN a primary instrument of identity theft, since once the SSN 
is acquired, access to an individual's sensitive information is 
easily obtainable. When the SSN is used as a password, a 
cancelled check and an SSN can provide a criminal sufficient 
information to gain access to a person's account online or by 
phone.
    This provision authorizes the Commissioner to arrange for 
the National Research Council to conduct a study on the 
prevalence of this practice and whether it can be reduced. The 
Committee also intends that the examination of possible 
alternatives to SSNs for verification purposes and uses in 
authenticating identity include the last four digits of the 
SSN.

                             EFFECTIVE DATE

    Under its arrangement with the Commissioner, the Council 
would be required to submit a report to the Commissioner and to 
each House of the Congress no later than one year after the 
effective date of the initial final regulations issued under 
section 2 of the bill (that is, three and one-half years after 
enactment).

                      III. VOTES OF THE COMMITTEE

    In compliance with clause 3(b) of rule XIII of the Rules of 
the House of Representatives, the following statements are made 
concerning the vote of the Committee on Ways and Means in its 
consideration of the bill, H.R. 3046.

                       MOTION TO REPORT THE BILL

    The bill, H.R. 3046, as amended, was ordered favorably 
reported by a rollcall vote of 41 yeas to 0 nays (with a quorum 
being present). The vote was as follows:

----------------------------------------------------------------------------------------------------------------
        Representatives             Yea       Nay     Present     Representative      Yea       Nay     Present
----------------------------------------------------------------------------------------------------------------
Mr. Rangel.....................        X   ........  .........  Mr. McCrery......        X   ........  .........
Mr. Stark......................        X   ........  .........  Mr. Herger.......        X   ........  .........
Mr. Levin......................        X   ........  .........  Mr. Camp.........        X   ........  .........
Mr. McDermott..................        X   ........  .........  Mr. Ramstad......        X   ........  .........
Mr. Lewis (GA).................        X   ........  .........  Mr. Johnson......        X   ........  .........
Mr. Neal.......................        X   ........  .........  Mr. English......        X   ........  .........
Mr. McNulty....................        X   ........  .........  Mr. Weller.......        X   ........  .........
Mr. Tanner.....................        X   ........  .........  Mr. Hulshof......        X   ........  .........
Mr. Becerra....................        X   ........  .........  Mr. Lewis (KY)...        X   ........  .........
Mr. Doggett....................        X   ........  .........  Mr. Brady........        X   ........  .........
Mr. Pomeroy....................        X   ........  .........  Mr. Reynolds.....        X   ........  .........
Mrs. Tubbs Jones...............        X   ........  .........  Mr. Ryan.........        X   ........  .........
Mr. Thompson...................        X   ........  .........  Mr. Cantor.......        X   ........  .........
Mr. Larson.....................        X   ........  .........  Mr. Linder.......        X   ........  .........
Mr. Emanuel....................        X   ........  .........  Mr. Nunes........        X   ........  .........
Mr. Blumenauer.................        X   ........  .........  Mr. Tiberi.......        X   ........  .........
Mr. Kind.......................        X   ........  .........  Mr. Porter.......        X   ........  .........
Mr. Pascrell...................        X   ........  .........
Ms. Berkley....................        X   ........  .........
Mr. Crowley....................        X   ........  .........
Mr. Van Hollen.................        X   ........  .........
Mr. Meek.......................        X   ........  .........
Ms. Schwartz...................        X   ........  .........
Mr. Davis (AL).................        X   ........  .........
----------------------------------------------------------------------------------------------------------------

                     IV. BUDGET EFFECTS OF THE BILL


               A. Committee Estimate of Budgetary Effects

    In compliance with clause 3(d)(2) of rule XIII of the Rules 
of the House of Representatives, the following statement is 
made concerning the effects on the budget of this bill, H.R. 
3046, as amended and reported: The Committee agrees with the 
estimate prepared by the Congressional Budget Office (CBO), 
which is included below.

    B. Statement Regarding New Budget Authority and Tax Expenditures

    In compliance with clause 3(c)(2) of rule XIII of the Rules 
of the House of Representatives, the Committee states that H.R. 
3046 does not include any new budget authority or tax 
expenditures.

      C. Cost Estimate Prepared by the Congressional Budget Office

    In compliance with clause 3(c)(3) of rule XIII of the Rules 
of the House of Representatives, requiring a cost estimate 
prepared by the Congressional Budget Office, the following 
report by CBO is provided:

                                     U.S. Congress,
                               Congressional Budget Office,
                                     Washington, DC, July 30, 2007.
Hon. Charles B. Rangel,
Chairman, Committee on Ways and Means,
House of Representatives, Washington, DC.
    Dear Mr. Chairman: The Congressional Budget Office has 
prepared the enclosed cost estimate for H.R. 3046, the Social 
Security Number Privacy and Identity Theft Prevention Act of 
2007.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contacts are Sheila 
Dacey (for federal costs), Lisa Ramirez-Branum (for the state 
and local impact), and Paige Piper-Bach (for the private-sector 
impact).
            Sincerely,
                                         Robert A. Sunshine
                                   (For Peter R. Orszag, Director).
    Enclosure.

H.R. 3046--Social Security Number Privacy and Identity Theft Prevention 
        Act of 2007

    Summary: H.R. 3046 would provide new safeguards for the use 
of Social Security numbers (SSNs) and penalties for SSN misuse. 
The bill would:
           Bar the sale, purchase, or display of the 
        SSN in both the public and private sectors, with 
        certain exceptions;
           Prohibit the display of SSNs (including 
        magnetic strips or bar codes that contain them) on 
        government checks, employer-issued identification cards 
        or tags, and Medicare cards;
           Require government and private entities to 
        limit access to SSNs and assure that they have 
        safeguards to prevent breaches of confidentiality;
           Require the Government Accountability Office 
        (GAO) and the Social Security Administration (SSA) to 
        study the effectiveness of regulations related to this 
        bill and the feasibility of additional safeguards; and
           Create or expand civil and criminal 
        penalties for SSN misuse.
    Enacting H.R. 3046 could affect direct spending and 
revenues, but CBO estimates that any such effects would not be 
significant. Complying with the bill's standards would cause 
federal agencies to incur additional administrative expenses. 
Those costs--which CBO estimates at $43 million over the 2008-
2012 period--would generally come from agencies' salary and 
expense budgets, which are subject to annual appropriation.
    H.R. 3046 contains a number of intergovernmental mandates 
as defined in the Unfunded Mandates Reform Act (UMRA), 
including limitations on the sale, display, and use of SSNs by 
state, local, and tribal governments. CBO estimates that the 
aggregated costs of complying with those mandates would 
probably exceed the threshold established in UMRA for 
intergovernmental mandates ($66 million in 2007, adjusted 
annually for inflation) in at least one of the first five years 
that the mandates are in effect.
    H.R. 3046 also would impose private-sector mandates as 
defined in UMRA. CBO cannot determine whether the aggregate 
direct costs of complying with those mandates would exceed the 
annual threshold for private-sector mandates established by 
UMRA ($131 million in 2007, adjusted annually for inflation) 
because such costs would depend on the specific regulations 
that would be issued under the bill.
    Estimated cost to the Federal Government: The estimated 
budgetary impact of H.R. 3046 is shown in the following table. 
The costs of the legislation fall primarily in budget functions 
050 (national defense), 570 (Medicare), 650 (Social Security), 
and 700 (veterans benefits and services), but could affect 
numerous other budget functions as well. As explained below, 
CBO cannot estimate some potential costs in cases where 
agencies do not yet know how they would implement certain 
provisions.
    Basis of estimate: Federal agencies already comply, or are 
moving to comply, with most requirements of H.R. 3046. The 
bill's budgetary effects would stem from a few provisions that 
would change agencies' practices or assign new enforcement 
responsibilities. For this estimate, CBO assumes that the bill 
will be enacted in the fall of 2007.

Spending subject to appropriation

    CBO estimates that implementing H.R. 3046 would cost $43 
million over the 2008-2012 period, assuming that the necessary 
amounts will be appropriated near the start of each fiscal year 
and that spending will follow historical patterns for similar 
activities.

----------------------------------------------------------------------------------------------------------------
                                                                       By fiscal year, in millions of dollars--
                                                                    --------------------------------------------
                                                                       2008     2009     2010     2011     2012
----------------------------------------------------------------------------------------------------------------
                                 CHANGES IN SPENDING SUBJECT TO APPROPRIATION\1\

Prohibiting Display of SSN on Government ID Tags or Cards:
    Estimated Authorization Level..................................       16        *        6       10       10
    Estimated Outlays..............................................       11        5        5       10       10
Regulation and Enforcement:
    Estimated Authorization Level..................................        1        *        *        *        *
    Estimated Outlays..............................................        1        *        *        *        *
Studies:
    Estimated Authorization Level..................................        *        *        1        *        *
    Estimated Outlays..............................................        *        *        1        *        *
    Total Changes:
        Estimated Authorization Level..............................       17        *        7       10       10
        Estimated Outlays..........................................       12        5        6       10      10
----------------------------------------------------------------------------------------------------------------
\1\Enacting H.R. 3046 also could affect direct spending and revenues, but CBO estimates that any such effects
  would not be significant.
Note.--SSN = Social Security number; * = less than $500,000.

    Prohibiting Display of SSN on ID Tags or Cards. The bill 
would prohibit government agencies from displaying SSNs 
(including magnetic strips or bar codes that contain them) on 
certain government-issued identification cards or tags. 
Government agencies could not display an SSN on employee, 
student, or patient identification tags or on Medicare cards. 
The requirement would affect cards or tags issued one year 
after the date of enactment, or in the case of Medicare cards, 
two and one-half years after enactment. In total, CBO estimates 
that implementing the provision would cost $41 million over the 
2008-2012 period, subject to the availability of appropriated 
funds. The estimated costs to major agencies are described 
below.
    Department of Defense. The Geneva Convention calls for 
military personnel to have a number displayed on their 
identification cards, and the Department of Defense (DoD) has 
chosen to use the SSN. Under the bill, DoD would have to revamp 
its records and cards to use another unique identifier for 6.5 
million personnel. Based on information from DoD, CBO estimates 
that implementing this provision would cost $2 million over the 
2008-2009 period, assuming the availability of appropriated 
funds. Subsequent ongoing costs would be negligible.
    Veterans Affairs. The bill would prohibit the Department of 
Veterans Affairs (VA) from using a patient's SSN on the 
identity cards or tags used by its medical facilities. Based on 
information from the department, CBO estimates that it would 
cost $9 million to make the necessary changes to its computer 
systems. In addition, VA would plan to replace older, but still 
valid, cards at a cost of $5 million. Assuming appropriation of 
the estimated amounts, CBO estimates that VA would spend $10 
million in 2008 and $4 million in 2009 to implement the 
requirement.
    Medicare. The Medicare program uses the SSN as the basis of 
its Health Insurance Claim Number and displays that number on 
the Medicare card. Over 42 million Medicare beneficiaries have 
a Medicare card and several million new beneficiaries are added 
to the Medicare rolls annually.
    Under H.R. 3046, CBO assumes that the Centers for Medicare 
and Medicaid Services (CMS) would continue to use the SSN-based 
claim number to process and pay claims, but would remove the 
number from the Medicare card. CBO estimates that CMS would 
increase spending on beneficiary outreach and provider 
education in 2009, but that such costs would total less than 
$500,000. In 2010, CMS would begin to issue Medicare cards that 
do not display a claim number to new enrollees and 
beneficiaries who request a replacement card. CBO estimates 
that it would cost CMS $5 million in 2010, and $10 million in 
each of fiscal years 2011 and 2012 to implement the changes. 
The bulk of the new costs would stem from handling additional 
inquiries from beneficiaries and providers who would be 
confused by the change. Based on information provided by CMS 
and SSA, CBO estimates that up to 10 million beneficiaries 
would be affected by the change annually and that 10 percent of 
them would contact the agencies with questions. In addition, 
the agencies would incur small costs for replacement cards for 
beneficiaries who request them.
    CMS could choose to adopt a different strategy and change 
the claim number so that it is no longer based on the SSN. That 
strategy would require changes to CMS computer systems that 
would be more expensive than removing the claim number from the 
card.
    Regulation and Enforcement. The Social Security 
Administration would take the lead in drafting regulations to 
govern compliance with the new law in both the public and 
private sectors and would prosecute violations. CBO estimates 
the agency's new tasks would cost $1 million in 2008, assuming 
the availability of appropriated funds. Costs would be less 
than $500,000 in other years.
    Some additional costs are likely, however. H.R. 3046 would 
require all federal agencies to demonstrate to SSA that they 
allow access only to employees who need SSNs to carry out their 
statutory responsibilities and have safeguards to prevent 
unauthorized access and breaches of confidentiality. That 
provision would apply to all SSNs in the agencies' possession, 
including paper records. Its implications for contractors (who 
handle key responsibilities, especially in the areas of welfare 
and child support enforcement) are unclear. According to GAO, 
every federal agency uses the SSN in some way. CBO cannot 
estimate the cost of this provision to SSA or to other agencies 
because it would depend on SSA's approach to implementing the 
bill's requirements.
    Studies. H.R. 3046 would authorize two new studies. It 
would require the Commissioner of SSA to contract with the 
National Research Council to study the feasibility of banning 
the SSN as a primary means of authenticating identity. It also 
would require GAO to conduct a review of the effectiveness of 
the regulations issued pursuant to this legislation and report 
on the results. CBO estimates that the combined cost of the 
studies would total about $1 million in 2010, but would be less 
than $500,000 in other years.

Direct spending and revenues

    Implementing H.R. 3046 could affect direct spending and 
revenues, but CBO estimates that any such effects would not be 
significant.
    Civil Actions. H.R. 3046 would permit individuals to sue 
the federal government in federal district court for violations 
relating to the privacy of SSNs. Under the bill, if a plaintiff 
prevailed in such lawsuit, payment for damages and attorneys 
fees would be made by the Treasury's Judgment Fund. Payments 
from that fund are considered increases in direct spending. 
Considering current governmentwide practices regarding privacy 
and identity theft, CBO estimates that enacting H.R. 3046 would 
lead to an increase in the number of civil actions against the 
government and an increase in direct spending to pay claims, 
but that such costs would likely be less than $500,000 in each 
year.
    Civil and Criminal Penalties. H.R. 3046 could increase 
federal revenues and direct spending as a result of the 
collection of additional civil and criminal penalties assessed 
for misuse of SSNs. Collections of civil penalties are recorded 
in the budget as revenues and deposited in the Treasury. 
Collections of criminal penalties are recorded as revenues, 
deposited in the Crime Victims Fund, and later spent. CBO 
estimates that any additional revenues and direct spending 
would not be significant because of the relatively small number 
of cases likely to be involved.
    Child Support Enforcement. Requiring government agencies to 
remove SSNs from checks could raise administrative costs to the 
child support enforcement (CSE) program and/or delay 
distribution of collections. Many states currently use SSNs as 
their primary identifier when distributing child support, and 
the federal government covers the bulk of states' costs for 
administering CSE. CBO expects that the bill's requirement 
would have an additional cost to the federal government but 
that cost would be small because of the widespread and 
increasing use of electronic funds transfers to distribute 
payments rather than checks.
    Estimated impact on state, local, and tribal governments: 
H.R. 3046 contains a number of intergovernmental mandates as 
defined in UMRA. Specifically, the bill would restrict or 
prohibit government agencies from:
           Selling or displaying SSNs that have been 
        disclosed to the agency because of a mandatory 
        requirement (applies only to documents issued after the 
        requirements become effective);
           Displaying SSNs on checks or check stubs;
           Placing SSNs on student or employee 
        identification cards or coding them into magnetic 
        strips or bar codes on those documents; and
           Allowing prisoners access to SSNs of other 
        individuals.
    The bill also would require state and local governments to 
restrict access to SSNs and their derivatives to employees 
whose access is essential to effective administration of 
programs. In addition, the governments would have to implement 
safeguards to preclude unauthorized access to SSNs and their 
derivatives and to protect individual confidentiality.
    While state and local governments have taken steps to 
reduce the use of SSNs, many continue to use them for a variety 
of purposes. Based on information from GAO and from state and 
local officials, CBO estimates that the costs of complying with 
the mandates in the bill would probably exceed the 
intergovernmental threshold established in UMRA ($66 million in 
2007, adjusted annually for inflation) in at least one of the 
first five years the mandates are in effect.
    The bill would allow exceptions for the display or sale of 
SSNs when such use or display is authorized by the Social 
Security Act, necessary for law enforcement, national security 
or tax law purposes, done in compliance with certain motor 
vehicle laws, or used for consumerreporting practices and 
nonmarket research for advancing the public good. The bill's 
restrictions on the sale or display (which includes Internet 
transmissions that are not encrypted or otherwise secured) of SSNs 
would be prospective, and would not require state and local governments 
to redact SSNs from existing documents that are publicly available.
    However, if state and local governments do not currently 
have a system in place to safeguard SSNs, any such governments 
would have to implement a new system for handling any documents 
issued when the regulations become effective (up to two and a 
half years following enactment). If state or local governments 
use SSNs on checks and check-stubs as part of their 
recordkeeping and tracking procedures, they would have to alter 
those systems and remove the SSNs. They also would have to 
implement systems for removing SSNs from many documents that 
currently include SSNs and that are available to the public. 
Likewise, some public institutions of higher education might 
have to alter their document systems for identification cards 
or tags to remove SSNs that are coded electronically onto a 
magnetic strip or digitized as part of a bar code. Finally, any 
government agency that uses SSNs would have to implement 
safeguards to preclude unauthorized access to SSNs and their 
derivatives and to protect confidentiality.
    Because of the large number of governments affected by 
these provisions (particularly municipal governments), even 
small changes to existing systems would result in total costs 
that exceed the threshold established in UMRA. There are over 
75,000 municipal governments, so even small one-time costs--for 
example, as little as $5,000--would add up to costs over $66 
million in a given year. Counties and states, on the other 
hand, while fewer in number (there are about 3,600 counties in 
the United States), are more dependent on SSNs for various 
recordkeeping and identification purposes and would thus be 
likely to face significantly higher costs because of the 
complexity and scope of their recordkeeping systems. (Some 
counties estimate that altering their systems to use 
identifiers other than SSNs or to eliminate display of SSNs 
would result in one-time costs ranging from $40,000 to over $1 
million, depending on the county and the scope of the changes 
that would need to be made).
    Estimated impact on the private sector: H.R. 3046 would 
impose private-sector mandates, as defined in UMRA, on certain 
private entities. CBO cannot determine the direct costs of 
complying with those mandates because such costs would depend 
on the specific regulations that would be issued under the 
bill. Consequently, CBO cannot determine whether the aggregate 
direct costs of complying with those mandates would exceed the 
annual threshold for private-sector mandates established by 
UMRA ($131 million in 2007, adjusted annually for inflation).
    The bill would impose private-sector mandates on certain 
private entities by generally prohibiting the purchase, sale, 
or display of an SSN to the general public, including on the 
Internet, with some exceptions. In addition, the bill would 
establish a uniform truncation standard requiring that 
truncated SSNs be limited to the last four digits of the 
number. Private entities also would be prohibited from:
           Making unnecessary disclosures of another 
        individual's SSN to government agencies;
           Displaying an SSN on checks;
           Displaying an SSN on cards or tags issued to 
        employees, family members, or other individuals; and
           Displaying an SSN on any card or tag issued 
        to another person to access goods, services, or 
        benefits.
    Private entities that maintain SSNs in their records for 
the conduct of their business would be required to limit access 
to those records and institute safeguards to protect the 
confidentiality of those records. The Commissioner of Social 
Security would be required to issue regulations to implement 
the requirements, safeguards, and standards imposed by the 
bill. The direct cost to private entities of complying with 
those mandates would depend on regulations issued under the 
bill.
    Previous CBO estimate: On May 25, 2007, CBO transmitted a 
cost estimate for H.R. 948, the Social Security Number 
Protection Act of 2007, as ordered reported by the House 
Committee on Energy and Commerce on May 10, 2007. That bill has 
similar provisions regarding the sale, purchase, or display of 
SSNs by entities in the private sector, but fewer requirements 
on government agencies. CBO estimated that H.R. 948 would not 
have a significant impact on spending subject to appropriation.
    H.R. 948 also contains provisions that would impose 
intergovernmental mandates on state and local governments. 
However, because the Federal Trade Commission, the federal 
agency directed to carry out the provisions relating to the use 
of SSNs, does not have jurisdiction over those governments or 
public universities, the cost of mandates in H.R. 948 would be 
below the threshold established in UMRA.
    The mandates on the private sector in H.R. 948 are similar 
to those in H.R. 3046, except that the Federal Trade Commission 
would be required--under H.R. 948--to issue the regulations 
prohibiting an entity in the private sector from selling or 
purchasing a Social Security number.
    Estimate prepared by: Federal Costs: Social Security 
Administration--Sheila Dacey; Veterans Affairs--Sunita D'Monte; 
Treasury--Matthew Pickford; Defense--Jason Wheelock. Federal 
Revenues: Emily Schlect. Impact on State, Local, and Tribal 
Governments: Lisa Ramirez-Branum. Impact on the Private Sector: 
Paige Piper-Bach, Ralph Smith.
    Estimate approved by: Peter H. Fontaine, Deputy Assistant 
Director for Budget Analysis.

     V. OTHER MATTERS TO BE DISCUSSED UNDER THE RULES OF THE HOUSE


          A. Committee Oversight Findings and Recommendations

    With respect to clause 3(c)(1) of rule XIII of the Rules of 
the House of Representatives (relating to oversight findings), 
the Committee, based on public hearing testimony, concludes 
that it is appropriate and timely to consider the bill as 
reported.

                B. Earmarks and Tax and Tariff Benefits

    With respect to clause 9 of rule XXI of the Rules of the 
House, H.R. 3046, as amended, does not contain any 
Congressional earmarks, limited tax benefits, or limited tariff 
benefits as defined in clause 9(d), 9(e), or 9(f) of rule XXI.

                 C. Constitutional Authority Statement

    With respect to clause (3)(d)(1) of rule XIII of the Rules 
of the House of Representatives, relating to Constitutional 
Authority, the Committee states that the Committee's action in 
reporting the bill is derived from Article I of the 
Constitution, Section 8 (``The Congress shall have power to lay 
and collect taxes, duties, imposts, and excises, to pay the 
debts and to provide for * * * the general Welfare of the 
United States.'')

              D. Information Relating to Unfunded Mandates

    This information is provided in accordance with Section 423 
of the Unfunded Mandates Reform Act of 1995 (P.L. 104-4).
    The Committee has determined that the bill does impose a 
Federal intergovernmental mandate on State, local, or tribal 
governments. The Committee has determined that the bill does 
contain Federal mandates on the private sector.

       VI. CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

  In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italic, existing law in which no change is 
proposed is shown in roman):

                          SOCIAL SECURITY ACT




           *       *       *       *       *       *       *
TITLE II--FEDERAL OLD-AGE, SURVIVORS, AND DISABILITY INSURANCE BENEFITS

           *       *       *       *       *       *       *



           EVIDENCE, PROCEDURE, AND CERTIFICATION FOR PAYMENT

  Sec. 205. (a) * * *

           *       *       *       *       *       *       *

  (c)(1) * * *
  (2)(A) * * *

           *       *       *       *       *       *       *

  (C)(i) * * *

           *       *       *       *       *       *       *

  (x)(I) A governmental entity (as defined in subclause (X)) 
may not sell or display to the general public any social 
security account number if such number has been disclosed to 
such governmental entity pursuant to the assertion by such 
governmental entity to any person that disclosure of such 
number is a statutory or regulatory requirement. 
Notwithstanding the preceding sentence, such number may be sold 
or displayed to the general public in accordance with the 
exceptions specified in subclauses (II), (III), (IV), (V), 
(VI), (VII), and (VIII) (and for no other purpose).
  (II) Notwithstanding subclause (I), a social security account 
number may be sold by a governmental entity to the extent that 
such sale is specifically authorized by this Act or the Privacy 
Act of 1974.
  (III) Notwithstanding subclause (I), a social security 
account number may be sold by a governmental entity to the 
extent that is necessary or appropriate for law enforcement or 
national security purposes, as determined under regulations 
which shall be issued as provided in section 1129C.
  (IV) Notwithstanding subclause (I), a social security account 
number may be sold by a governmental entity to the extent that 
such sale is required to comply with a tax law of the United 
States or of any State (or political subdivision thereof).
  (V) Notwithstanding subclause (I), a social security account 
number may be sold by a State department of motor vehicles as 
authorized under subsection (b) of section 2721 of title 18, 
United States Code, if such number is to be used pursuant to 
such sale solely for purposes permitted under paragraph (1), 
(6), or (9) of such subsection.
  (VI) Notwithstanding subclause (I), a social security account 
number may be sold or otherwise made available by a 
governmental entity to a consumer reporting agency (as defined 
in section 603(f) of the Fair Credit Reporting Act (15 U.S.C. 
1681a(f))) for use or disclosure solely for permissible 
purposes described in section 604(a) of such Act (15 U.S.C. 
1681b(a)).
  (VII) Notwithstanding subclause (I), a social security 
account number may be sold by a governmental entity to the 
extent necessary for research (other than market research) 
conducted by any governmental entity for the purpose of 
advancing the public good, on the condition that the researcher 
provides adequate assurances that the social security account 
numbers will not be used to harass, target, or publicly reveal 
information concerning any identifiable individuals, that 
information about identifiable individuals obtained from the 
research will not be used to make decisions that directly 
affect the rights, benefits, or privileges of specific 
individuals, and that the researcher has in place appropriate 
safeguards to protect the privacy and confidentiality of any 
information about identifiable individuals, including 
procedures to ensure that the social security account numbers 
will be encrypted or otherwise appropriately secured from 
unauthorized disclosure. In the case of medical research, the 
Commissioner of Social Security shall maintain ongoing 
consultation with the Office for Civil Rights of the Department 
of Health and Human Services to ensure that the sale or 
purchase of social security account numbers which constitute 
personally identifiable medical information is permitted only 
in compliance with existing Federal rules and regulations 
prescribed by the Secretary of Health and Human Services 
pursuant to section 264(c) of the Health Insurance Portability 
and Accountability Act of 1996 (110 Stat. 2033).
  (VIII) Notwithstanding subclause (I), a social security 
account number may be sold or displayed to the general public 
by a governmental entity under such other circumstances as may 
be specified in regulations issued as provided in section 
1129C.
  (IX) This clause does not apply with respect to a social 
security account number of a deceased individual.
  (X) For purposes of this clause, the term ``governmental 
entity'' means an executive, legislative, or judicial agency or 
instrumentality of the Federal Government or of a State or 
political subdivision thereof, a Federally recognized Indian 
tribe, or a trustee appointed in a case under title 11, United 
States Code. Such term includes a person acting as an agent of 
such an agency or instrumentality, Indian tribe, or trustee. 
For purposes of this subclause, the term ``State'' has the 
meaning provided in subparagraph (D)(iii)(II).
  (XI) For purposes of this clause, the term ``sell'' means, in 
connection with a social security account, to obtain, directly 
or indirectly, anything of value in exchange for such number. 
Such term does not include the submission of such number as 
part of the process for applying for any type of Government 
benefits or programs (such as grants, loans, or welfare or 
other public assistance programs) or as part of the 
administration of, or provision of benefits under, an employee 
benefit plan.
  (XII) For purposes of this clause, the term ``display to the 
general public'' shall have the meaning provided such term in 
section 208A(a)(3)(A). In any case in which a governmental 
entity requires transmittal to such governmental entity of an 
individual's social security account number by means of the 
Internet without ensuring that such number is encrypted or 
otherwise appropriately secured from disclosure, any such 
transmittal of such number as so required shall be treated, for 
purposes of this clause, as a ``display to the general public'' 
of such number by such governmental entity for purposes of this 
clause.
  (XIII) For purposes of this clause, the term ``social 
security account number'' includes any derivative of such 
number. Notwithstanding the preceding sentence, any expression, 
contained in or on any item sold or displayed to the general 
public, shall not be treated as a social security account 
number solely because such expression sets forth not more than 
the last 4 digits of such number, if the remainder of such 
number cannot be determined based solely on such expression or 
any other matter presented in or on such item.
  (XIV) Nothing in the preceding subclauses of this clause 
shall be construed as superseding, altering, or affecting any 
statute, regulation, order, or interpretation in effect under 
any other Federal or State law, except to the extent that such 
statute, regulation, order, or interpretation is inconsistent 
with such subclauses, and then only to the extent of the 
inconsistency. For purposes of this subclause, a statue, 
regulation, order, or interpretation is not inconsistent with 
the preceding subclauses of this clause if the protection such 
statute, regulation, order, or interpretation affords any 
person is greater than the protection provided under such 
subclauses.
  (xi) No governmental entity (as defined in clause (x)(X)) may 
include the social security account number of any individual 
(or any derivative of such number) on any check issued for any 
payment by such governmental entity or on any document attached 
to or accompanying such a check.
  (xii) No governmental entity (as defined in clause (x)(X)), 
and no other person offering benefits in connection with an 
employee benefit plan maintained by such governmental entity, 
may display a social security account number (or any derivative 
thereof) on any card or tag that is commonly provided--
          (I) to employees of such governmental entity,
          (II) in the case of a governmental entity which is an 
        educational institution, to its students, or
          (III) in the case of a governmental entity which is a 
        medical institution, to its patients,
(or to their family members) for purposes of identification or 
include on such card or tag a magnetic strip, bar code, or 
other means of communication which conveys such number (or 
derivative thereof). The requirements of this clause shall also 
apply to the Medicare card issued by the Department of Health 
and Human Services.
  (xiii) No governmental entity (as defined in clause (x)(X)) 
may employ, or enter into a contract for the use or employment 
of, prisoners in any capacity that would allow such prisoners 
access to the social security account numbers of other 
individuals (or any derivatives of such numbers). For purposes 
of this clause, the term ``prisoner'' means an individual 
confined in a jail, prison, or other penal institution or 
correctional facility.
  (xiv) Except as otherwise provided in this paragraph, in the 
case of any governmental entity (as defined in clause (x)(X)) 
having access to an individual's social security account 
number--
          (I) no officer or employee thereof shall have access 
        to such number for any purpose other than the effective 
        administration of the statutory provisions governing 
        its functions,
          (II) such governmental entity shall restrict, to the 
        satisfaction of the Commissioner of Social Security, 
        access to social security account numbers obtained 
        thereby to officers and employees thereof whose duties 
        or responsibilities require access for the 
        administration or enforcement of such provisions, and
          (III) such governmental entity shall provide such 
        other safeguards as the Commissioner determines to be 
        necessary or appropriate to preclude unauthorized 
        access to the social security account number and to 
        otherwise protect the confidentiality of such number.
For purposes of this clause the term ``social security account 
number'' includes any derivative thereof.
  (xv) The truncation by any governmental entity (as defined in 
clause (x)(X)) or by any person in the private sector of an 
individual's social security account number which is used by 
such governmental entity or person otherwise in accordance with 
the requirements of this Act shall be in accordance with a 
uniform truncation standard which shall be specified in 
regulations prescribed by the Commissioner of Social Security. 
Under such standard, the number as truncated shall set forth 
not more than the last 4 digits of the number. Nothing in this 
clause shall be construed to authorize any use of the social 
security account number which is not otherwise authorized by 
this title or regulations prescribed thereunder.

           *       *       *       *       *       *       *


                               PENALTIES

  Sec. 208. (a) Whoever--
          (1)  * * *

           *       *       *       *       *       *       *

          (8) discloses, uses, or compels the disclosure of the 
        social security number of any person in violation of 
        the laws of the United States; or
          (9) willfully acts or fails to act so as to cause a 
        violation of section 208A(b)(1)(B);
shall be guilty of a felony and upon conviction thereof [shall 
be fined under title 18, United States Code, or imprisoned for 
not more than five years, or both.] shall be fined, imprisoned, 
or both, as provided in subsection (c).
  (b)(1) Whoever--
          (A) knowingly, and with intent to commit, or to aid 
        or abet, any activity that constitutes a violation of 
        Federal law, or a violation of any applicable law of a 
        State or political subdivision thereof if the maximum 
        penalty of such applicable law includes imprisonment 
        for 5 years or more--
                  (i) possesses the social security account 
                number of another person without lawful 
                authority, or
                  (ii) possesses a social security card, 
                knowing that the social security account number 
                or other identifying information displayed on 
                the card has been altered, counterfeited, or 
                forged or that the card was falsely made, 
                stolen, or obtained from the Social Security 
                Administration by use of false information;
        if such activity is committed, or aided or abetted, 
        with intent to use such social security account number, 
        social security card, or other identifying information 
        displayed on such card in furtherance of such 
        violation;
          (B) being--
                  (i) an officer or employee of any 
                governmental entity (as defined in section 
                205(c)(2)(C)(x)(X)), or
                  (ii) a person acting as an agent of a 
                governmental entity (as so defined),
        willfully acts or fails to act so as to cause a 
        violation of clause (vi)(II), (xi), (xii), or (xv) of 
        section 205(c)(2)(C);
          (C) being a trustee appointed in a case under title 
        11, United States Code (or an officer or employee 
        thereof or a person acting as an agent thereof), 
        willfully acts or fails to act so as to cause a 
        violation of clause (xi) or (xv) of section 
        205(c)(2)(C); or
          (D) willfully acts or fails to act so as to cause a 
        violation of subsection (c), (d), (e), or (f) of 
        section 208A or, as a person in the private sector, 
        willfully acts or fails to act so as to cause a 
        violation of section 205(c)(2)(C)(xv);
shall be guilty of a misdemeanor and upon conviction thereof 
shall be fined under title 18, United States Code, or 
imprisoned for not more than 1 year, or both.
  (2)(A) Whoever--
          (i) with intent to deceive, discloses, sells, or 
        transfers his own social security account number, 
        assigned to him by the Commissioner of Social Security 
        (in the exercise of the Commissioner's authority under 
        section 205(c)(2) to establish and maintain records), 
        to any person;
          (ii) without lawful authority, offers, for a fee, to 
        acquire for any individual, or to assist in acquiring 
        for any individual, an additional social security 
        account number or a number that is purported to be a 
        social security account number;
          (iii) being--
                  (I) an officer or employee of any 
                governmental entity (as defined in section 
                205(c)(2)(C)(x)(X)), or
                  (II) a person acting as an agent of a 
                governmental entity (as so defined),
        willfully acts or fails to act so as to cause a 
        violation of clause (x), (xiii), or (xiv) of section 
        205(c)(2)(C);
          (iv) being a trustee appointed in a case under title 
        11, United States Code (or an officer or employee 
        thereof or a person acting as an agent thereof), 
        willfully acts or fails to act so as to cause a 
        violation of clause (x) or (xiv) of section 
        205(c)(2)(C); or
          (v) willfully acts or fails to act so as to cause a 
        violation of subsection (b)(1)(A) or (g) of section 
        208A;
shall be fined, imprisoned, or both, as provided in 
subparagraph (B).
  (B) A person convicted of a violation described in 
subparagraph (A) shall--
          (i) be fined under title 18, United States Code, 
        imprisoned not more than 1 year, or both; and
          (ii) if the offense is committed under false 
        pretenses or for commercial advantage, personal gain, 
        or malicious harm, be fined, imprisoned, or both, as 
        provided in subsection (c).
  (c) A person convicted of a violation described in subsection 
(a) or a violation described in subsection (b)(2)(A) which is 
subject to subsection (b)(2)(B)(ii) shall be--
          (1) fined under title 18, United States Code, or 
        imprisoned for not more than 5 years, or both, in the 
        case of an initial violation, subject to paragraphs (3) 
        and (4),
          (2) fined under title 18, United States Code, or 
        imprisoned for not more than 10 years, or both, in the 
        case of a violation which occurs after a prior 
        conviction for another offense under subsection (a) 
        becomes final, subject to paragraphs (3) and (4),
          (3) fined under title 18, United States Code, or 
        imprisoned for not more than 20 years, in the case of a 
        violation which is committed to facilitate a drug 
        trafficking crime (as defined in section 929(a)(2) of 
        title 18, United States Code) or in connection with a 
        crime of violence (as defined in section 924(c)(3) of 
        title 18, United States Code) involving force against 
        the person of another, subject to paragraph (4), and
          (4) fined under title 18, United States Code, or 
        imprisoned for not more than 25 years, in the case of a 
        violation which is committed to facilitate an act of 
        international or domestic terrorism (as defined in 
        paragraphs (1) and (5), respectively, of section 2331 
        of title 18, United States Code).
  [(b)] (d)(1) Any Federal court, when sentencing a defendant 
convicted of an offense under subsection (a) or (b), may order, 
in addition to or in lieu of any other penalty authorized by 
law, that the defendant make restitution to the victims of such 
offense specified in paragraph (4).

           *       *       *       *       *       *       *

  [(c) Any person or other entity who is convicted of a 
violation of any of the provisions of this section, if such 
violation is committed by such person or entity in his role as, 
or in applying to become, a certified payee under section 
205(j) on behalf of another individual (other than such 
person's spouse), upon his second or any subsequent such 
conviction shall, in lieu of the penalty set forth in the 
preceding provisions of this section, be guilty of a felony and 
shall be fined under title 18, United States Code, or 
imprisoned for not more than five years, or both.]
  [(d)] (e) Any individual or entity convicted of a felony 
under this section or under section 1632(b) may not be 
certified as a payee under section 205(j). For the purpose of 
subsection (a)(7), the terms ``social security number'' and 
``social security account number'' mean such numbers as are 
assigned by the Commissioner of Social Security under section 
205(c)(2) whether or not, in actual use, such numbers are 
called social security numbers.
  [(e)] (f)(1)  * * *

           *       *       *       *       *       *       *

  (g)(1) Whoever is an employee of the Social Security 
Administration and knowingly and fraudulently sells or 
transfers one or more social security account numbers or social 
security cards shall, upon conviction, be guilty of a felony 
and fined under title 18, United States Code, imprisoned as 
provided in paragraph (2), or both.
  (2) Imprisonment for a violation described in paragraph (1) 
shall be for--
          (A) not more than 5 years, in the case of an employee 
        of the Social Security Administration who has 
        fraudulently sold or transferred not more than 50 
        social security account numbers or social security 
        cards,
          (B) not more than 10 years, in the case of an 
        employee of the Social Security Administration who has 
        fraudulently sold or transferred more than 50, but not 
        more than 100, social security account numbers or 
        social security cards, or
          (C) not more than 20 years, in the case of an 
        employee of the Social Security Administration who has 
        fraudulently sold or transferred more than 100 social 
        security account numbers or social security cards.
  (3) For purposes of this subsection--
          (A) The term ``social security employee'' means any 
        State employee of a State disability determination 
        service, any officer, employee, or contractor of the 
        Social Security Administration, any employee of such a 
        contractor, or any volunteer providing services or 
        assistance in any facility of the Social Security 
        Administration.
          (B) The term ``social security account number'' means 
        a social security account number assigned by the 
        Commissioner of Social Security under section 
        205(c)(2)(B) or another number that has not been so 
        assigned but is purported to have been so assigned.
          (C) The term ``social security card'' means a card 
        issued by the Commissioner of Social Security under 
        section 205(c)(2)(G), another card which has not been 
        so issued but is purported to have been so issued, and 
        banknote paper of the type described in section 
        205(c)(2)(G) prepared for the entry of social security 
        account numbers, whether fully completed or not.

PROHIBITION OF THE SALE, PURCHASE, AND DISPLAY TO THE GENERAL PUBLIC OF 
        THE SOCIAL SECURITY ACCOUNT NUMBER IN THE PRIVATE SECTOR

  Sec. 208A. (a) Definitions.--For purposes of this section: 
          (1) Person.--
                  (A) In general.--Subject to subparagraph (B), 
                the term ``person'' means any individual, 
                partnership, corporation, trust, estate, 
                cooperative, association, or any other entity.
                  (B) Exclusion of governmental entities.--Such 
                term does not include a governmental entity. 
                Nothing in this subparagraph shall be construed 
                to authorize, in connection with a governmental 
                entity, an act or practice otherwise prohibited 
                under this section or section 205(c)(2)(C).
          (2) Selling and purchasing.--
                  (A) In general.--Subject to subparagraph 
                (B)--
                          (i) Sell.--The term ``sell'' in 
                        connection with a social security 
                        account number means to obtain, 
                        directly or indirectly, anything of 
                        value in exchange for such number.
                          (ii) Purchase.--The term ``purchase'' 
                        in connection with a social security 
                        account number means to provide, 
                        directly or indirectly, anything of 
                        value in exchange for such number.
                  (B) Exceptions.--The terms ``sell'' and 
                ``purchase'' in connection with a social 
                security account number do not include the 
                submission of such number as part of--
                          (i) the process for applying for any 
                        type of Government benefits or programs 
                        (such as grants or loans or welfare or 
                        other public assistance programs),
                          (ii) the administration of, or 
                        provision of benefits under, an 
                        employee benefit plan, or
                          (iii) the sale, lease, merger, 
                        transfer, or exchange of a trade or 
                        business.
          (3) Display to the general public.--
                  (A) In general.--The term ``display to the 
                general public'' means, in connection with a 
                social security account number, to 
                intentionally place such number in a viewable 
                manner on an Internet site that is available to 
                the general public or to make such number 
                available in any other manner intended to 
                provide access to such number by the general 
                public.
                  (B) Internet transmissions.--In any case in 
                which a person requires transmittal to such 
                person of an individual's social security 
                account number by means of the Internet without 
                ensuring that such number is encrypted or 
                otherwise well-secured from disclosure, any 
                such transmittal of such number as so required 
                shall be treated as a ``display to the general 
                public'' of such number by such person.
          (4) Social security account number.--
                  (A) In general.--The term ``social security 
                account number'' has the meaning given such 
                term in section 208(e), except that such term 
                includes any derivative of such number.
                  (B) 4-digit expression.--Notwithstanding the 
                preceding sentence, for purposes of subsection 
                (b)(1)(A), any expression, contained in or on 
                any item sold or displayed to the general 
                public, shall not be treated as a social 
                security account number solely because such 
                expression sets forth not more than the last 4 
                digits of such number, if the remainder of such 
                number cannot be determined based solely on 
                such expression or any other matter presented 
                in or on such item.
          (5) Governmental entity.--
                  (A) In general.--The term ``governmental 
                entity'' means an executive, legislative, or 
                judicial agency or instrumentality of the 
                Federal Government, a State or political 
                subdivision thereof, a Federally recognized 
                Indian tribe, or a trustee appointed in a case 
                under title 11, United States Code. Such term 
                includes a person acting as an agent of such an 
                agency or instrumentality, Indian tribe, or 
                trustee.
                  (B) State.--The term ``State'' includes the 
                District of Columbia, the Commonwealth of 
                Puerto Rico, the Virgin Islands, Guam, the 
                Commonwealth of the Northern Marianas, and the 
                Trust Territory of the Pacific Islands.
  (b) Prohibition of Sale, Purchase, and Display to the General 
Public.--
          (1) In general.--Except as provided in paragraph (2), 
        it shall be unlawful for any person to--
                  (A) sell or purchase a social security 
                account number or display to the general public 
                a social security account number, or
                  (B) obtain or use any individual's social 
                security account number for the purpose of 
                locating or identifying such individual with 
                the intent to harass, harm, or physically 
                injure such individual or using the identity of 
                such individual for any illegal purpose.
          (2) Exceptions.--
                  (A) In general.--Notwithstanding paragraph 
                (1), and subject to paragraph (3), a social 
                security account number may be sold or 
                purchased by any person to the extent provided 
                in this subsection (and for no other purpose) 
                as follows:
                          (i) to the extent necessary for law 
                        enforcement, including (but not limited 
                        to) the enforcement of a child support 
                        obligation, as determined under 
                        regulations issued as provided in 
                        section 1129C;
                          (ii) to the extent necessary for 
                        national security purposes, as 
                        determined under regulations issued as 
                        provided in section 1129C;
                          (iii) to the extent necessary for 
                        public health purposes;
                          (iv) to the extent necessary in 
                        emergency situations to protect the 
                        health or safety of 1 or more 
                        individuals;
                          (v) to the extent that the sale or 
                        purchase is required to comply with a 
                        tax law of the United States or of any 
                        State (or political subdivision 
                        thereof);
                          (vi) to the extent that the sale or 
                        purchase is to or by a consumer 
                        reporting agency (as defined in section 
                        603(f) of the Fair Credit Reporting Act 
                        (15 U.S.C. 1681a(f))) for use or 
                        disclosure solely for permissible 
                        purposes described in section 604(a) of 
                        such Act (15 U.S.C. 1681b(a)); and
                          (vii) to the extent necessary for 
                        research (other than market research) 
                        conducted by an agency or 
                        instrumentality of the United States or 
                        of a State or political subdivision 
                        thereof (or a person acting as an agent 
                        of such an agency or instrumentality) 
                        for the purpose of advancing the public 
                        good, on the condition that the 
                        researcher provides adequate assurances 
                        that--
                                  (I) the social security 
                                account numbers will not be 
                                used to harass, target, or 
                                publicly reveal information 
                                concerning any identifiable 
                                individuals;
                                  (II) information about 
                                identifiable individuals 
                                obtained from the research will 
                                not be used to make decisions 
                                that directly affect the 
                                rights, benefits, or privileges 
                                of specific individuals; and
                                  (III) the researcher has in 
                                place appropriate safeguards to 
                                protect the privacy and 
                                confidentiality of any 
                                information about identifiable 
                                individuals, including 
                                procedures to ensure that the 
                                social security account numbers 
                                will be encrypted or otherwise 
                                appropriately secured from 
                                unauthorized disclosure.
                  (B) Medical research.--In the case of 
                research referred to in subparagraph (A)(vii) 
                consisting of medical research, the 
                Commissioner of Social Security shall maintain 
                ongoing consultation with the Office for Civil 
                Rights of the Department of Health and Human 
                Services to ensure that the sale or purchase of 
                social security account numbers which 
                constitute personally identifiable medical 
                information is permitted only in compliance 
                with existing Federal rules and regulations 
                prescribed by the Secretary of Health and Human 
                Services pursuant to section 264(c) of the 
                Health Insurance Portability and Accountability 
                Act of 1996 (110 Stat. 2033).
          (3) Consent and other circumstances determined by 
        regulation.--Notwithstanding paragraph (1), a social 
        security account number assigned to an individual may 
        be sold or purchased by any person--
                  (A) to the extent consistent with such 
                individual's voluntary and affirmative written 
                consent to the sale or purchase, but only if--
                          (i) the terms of the consent and the 
                        right to refuse consent are presented 
                        to the individual in a clear, 
                        conspicuous, and understandable manner,
                          (ii) the individual is placed under 
                        no obligation to provide consent to any 
                        such sale or purchase, and
                          (iii) the terms of the consent 
                        authorize the individual to limit the 
                        sale or purchase to purposes directly 
                        associated with the transaction with 
                        respect to which the consent is sought, 
                        and
                  (B) under such circumstances as may be deemed 
                appropriate in regulations issued as provided 
                under section 1129C.
  (c) Prohibition of Display on Checks.--It shall be unlawful 
for any person to include the social security account number of 
any other individual on any check issued for any payment by 
such person or on any document attached to or accompanying such 
a check.
  (d) Prohibition of Unauthorized Disclosure to Government 
Agencies or Instrumentalities.--
          (1) In general.--It shall be unlawful for any person 
        to communicate by any means to any agency or 
        instrumentality of the United States or of any State or 
        political subdivision thereof the social security 
        account number of any individual other than such person 
        without the written permission of such individual, 
        unless the number was requested by the agency or 
        instrumentality. In the case of an individual who is 
        legally incompetent, permission provided by the 
        individual's legal representatives shall be deemed to 
        be permission provided by such individual.
          (2) Exceptions.--Paragraph (1) shall not apply to the 
        extent necessary--
                  (A) for law enforcement, including (but not 
                limited to) the enforcement of a child support 
                obligation, or
                  (B) for national security purposes,
        as determined under regulations issued as provided 
        under section 1129C.
  (e) Prohibition of the Displays on Cards or Tags Required for 
Access to Goods, Services, or Benefits.--No person may display 
a social security account number on any card or tag issued to 
any other person for the purpose of providing such other person 
access to any goods, services, or benefits or include on such 
card or tag a magnetic strip, bar code, or other means of 
communication which conveys such number.
  (f) Prohibition of the Displays on Employee Identification 
Cards or Tags.--No person that is an employer, and no other 
person offering benefits in connection with an employee benefit 
plan maintained by such employer or acting as an agent of such 
employer, may display a social security account number on any 
card or tag that is commonly provided to employees of such 
employer (or to their family members) for purposes of 
identification or include on such card or tag a magnetic strip, 
bar code, or other means of communication which conveys such 
number.
  (g) Measures to Preclude Unauthorized Disclosure of Social 
Security Account Numbers and Protect the Confidentiality of 
Such Numbers.--Subject to the preceding provisions of this 
section, any person having access to the social security 
account number of any individual other than such person shall, 
to the extent that such access is maintained for the conduct of 
such person's trade or business--
          (1) ensure that no officer or employee thereof has 
        access to such number for any purpose other than as 
        necessary for the conduct of such person's trade or 
        business,
          (2) restrict, in accordance with regulations of the 
        Commissioner of Social Security, access to social 
        security account numbers obtained thereby to officers 
        and employees thereof whose duties or responsibilities 
        require access for the conduct of such person's trade 
        or business, and
          (3) provide such safeguards as may be specified, in 
        regulations of the Commissioner of Social Security, to 
        be necessary or appropriate to preclude unauthorized 
        access to the social security account number and to 
        otherwise protect the confidentiality of such number.
  (h) Deceased Individuals.--This section does not apply with 
respect to the social security account number of a deceased 
individual.
  (i) Applicability of Other Protections.--Nothing in the 
preceding subsections of this section shall be construed as 
superseding, altering, or affecting any statutory provision, 
regulation, order, or interpretation in effect under any other 
Federal or State law, except to the extent that such statutory 
provision, regulation, order, or interpretation is inconsistent 
with such subsections, and then only to the extent of the 
inconsistency. For purposes of this subclause, a statutory 
provision, regulation, order, or interpretation is not 
inconsistent with the preceding subsections of this section if 
the protection such statutory provision, regulation, order, or 
interpretation affords any person is greater than the 
protection provided under such subsections.

           *       *       *       *       *       *       *


TITLE VIII--SPECIAL BENEFITS FOR CERTAIN WORLD WAR II VETERANS

           *       *       *       *       *       *       *


SEC. 811. PENALTIES FOR FRAUD.

  (a) In General.--Whoever--
          (1)  * * *

           *       *       *       *       *       *       *

[shall be fined under title 18, United States Code, imprisoned 
not more than 5 years, or both.] shall be fined, imprisoned, or 
both, as provided in subsection (b).
  (b) Punishment.--A person convicted of a violation described 
in subsection (a) shall be--
          (1) fined under title 18, United States Code, or 
        imprisoned for not more than 5 years, or both, in the 
        case of an initial violation, subject to paragraphs (3) 
        and (4),
          (2) fined under title 18, United States Code, or 
        imprisoned for not more than 10 years, or both, in the 
        case of a violation which occurs after a prior 
        conviction for another offense under subsection (a) 
        becomes final, subject to paragraphs (3) and (4),
          (3) fined under title 18, United States Code, or 
        imprisoned for not more than 20 years, in the case of a 
        violation which is committed to facilitate a drug 
        trafficking crime (as defined in section 929(a)(2) of 
        title 18, United States Code) or in connection with a 
        crime of violence (as defined in section 924(c)(3) of 
        title 18, United States Code) involving force against 
        the person of another, subject to paragraph (4), and
          (4) fined under title 18, United States Code, or 
        imprisoned for not more than 25 years, in the case of a 
        violation which is committed to facilitate an act of 
        international or domestic terrorism (as defined in 
        paragraphs (1) and (5), respectively, of section 2331 
        of title 18, United States Code).
  [(b)] (c) Court Order for Restitution.--
          (1)  * * *

           *       *       *       *       *       *       *


     TITLE XI--GENERAL PROVISIONS, PEER REVIEW, AND ADMINISTRATIVE 
                             SIMPLIFICATION

Part A--General Provisions

           *       *       *       *       *       *       *


SEC. 1129. CIVIL MONETARY PENALTIES AND ASSESSMENTS FOR TITLES II, VIII 
                    AND XVI.

  (a)(1)  * * *

           *       *       *       *       *       *       *

  (2) In addition, the Commissioner of Social Security may make 
a determination in the same proceeding to recommend that the 
Secretary exclude, as provided in section 1128, such a person 
who is a medical provider or physician from participation in 
the programs under title XVIII.
  (3) Any person (including an organization, agency, or other 
entity) who--
          (A) uses a social security account number that such 
        person knows or should know has been assigned by the 
        Commissioner of Social Security (in an exercise of 
        authority under section 205(c)(2) to establish and 
        maintain records) on the basis of false information 
        furnished to the Commissioner by any person;
          (B) falsely represents a number to be the social 
        security account number assigned by the Commissioner of 
        Social Security to any individual, when such person 
        knows or should know that such number is not the social 
        security account number assigned by the Commissioner to 
        such individual;
          (C) with intent to deceive, alters a social security 
        card that the person knows or should know was issued by 
        the Commissioner of Social Security, or possesses such 
        a card with intent to alter it;
          (D) buys or sells a card that such person knows or 
        should know is, or is purported to be, a card issued by 
        the Commissioner of Social Security, or possesses such 
        a card with intent to buy or sell it;
          (E) counterfeits a social security card, or possesses 
        a counterfeit social security card with intent to buy 
        or sell it;
          (F) discloses, uses, compels the disclosure of, or 
        knowingly sells or purchases the social security 
        account number of any person in violation of the laws 
        of the United States;
          (G) with intent to deceive the Commissioner of Social 
        Security as to such person's true identity (or the true 
        identity of any other person), furnishes or causes to 
        be furnished false information to the Commissioner with 
        respect to any information required by the Commissioner 
        in connection with the establishment and maintenance of 
        the records provided for in section 205(c)(2);
          (H) without lawful authority, offers, for a fee, to 
        acquire for any individual, or to assist in acquiring 
        for any individual, an additional social security 
        account number or a number which is purported to be a 
        social security account number;
          (I) with intent to deceive, discloses, sells, or 
        transfers his own social security account number, 
        assigned to him by the Commissioner of Social Security 
        under section 205(c)(2)(B), to any person;
          (J) knowingly, and with intent to commit, or to aid 
        or abet, any activity that constitutes a violation of 
        Federal law, or a violation of any applicable law of a 
        State or political subdivision thereof if the maximum 
        penalty of such applicable law includes imprisonment 
        for 5 years or more--
                  (i) possesses a social security account 
                number of another individual without lawful 
                authority, or
                  (ii) possesses a social security card, 
                knowing that the social security account number 
                or other identifying information displayed on 
                the card has been altered, counterfeited, or 
                forged or that the card was falsely made, 
                stolen, or obtained from the Social Security 
                Administration by use of false information,
        if such activity is committed, or aided or abetted, 
        with intent to use such social security account number, 
        social security card, or other identifying information 
        displayed on such card in furtherance of such 
        violation;
          (K) being--
                  (i) an officer or employee of a governmental 
                entity (as defined in section 
                205(c)(2)(C)(x)(X)), or
                  (ii) a person acting as an agent of a 
                governmental entity (as so defined),
        willfully acts or fails to act so as to cause a 
        violation of clause (vi)(II), (x), (xi), (xii), (xiii), 
        (xiv), or (xv) of section 205(c)(2)(C);
          (L) being a trustee appointed in a case under title 
        11, United States Code (or an officer or employee 
        thereof or a person acting as an agent thereof), 
        willfully acts or fails to act so as to cause a 
        violation of clause (x), (xi), (xiv), or (xv) of 
        section 205(c)(2)(C);
          (M) violates section 208A (relating to prohibition of 
        the sale, purchase, or display of the social security 
        account number in the private sector) or, as a person 
        in the private sector, violates section 
        205(c)(2)(C)(xv); or
          (N) violates section 208(g) (relating to fraud by 
        social security administration employees);
shall be subject to, in addition to any other penalties that 
may be prescribed by law, a civil money penalty of not more 
than $5,000 for each violation. Such person shall also be 
subject to an assessment, in lieu of damages sustained by the 
United States resulting from such violation, of not more than 
twice the amount of any benefits or payments paid as a result 
of such violation.
  [(2)] (4) For purposes of this section, a material fact is 
one which the Commissioner of Social Security may consider in 
evaluating whether an applicant is entitled to benefits under 
title II or title VIII, or eligible for benefits or payments 
under title XVI.
  [(3)] (5) Any person (including an organization, agency, or 
other entity) who, having received, while acting in the 
capacity of a representative payee pursuant to section 205(j), 
807, or 1631(a)(2), a payment under title II, VIII, or XVI for 
the use and benefit of another individual, converts such 
payment, or any part thereof, to a use that such person knows 
or should know is other than for the use and benefit of such 
other individual shall be subject to, in addition to any other 
penalties that may be prescribed by law, a civil money penalty 
of not more than $5,000 for each such conversion. Such person 
shall also be subject to an assessment, in lieu of damages 
sustained by the United States resulting from the conversion, 
of not more than twice the amount of any payments so converted.

           *       *       *       *       *       *       *


  REGULATORY AND ENFORCEMENT AUTHORITY WITH RESPECT TO MISUSE OF THE 
                     SOCIAL SECURITY ACCOUNT NUMBER

  Sec. 1129C. (a) Regulatory Authority.--
  (1) In general.--The Commissioner of Social Security shall 
prescribe regulations to carry out the provisions of clauses 
(vi)(II), (x), (xi), (xii), (xiii), (xiv), and (xv) of section 
205(c)(2)(C) and section 208A. Such regulations shall be issued 
in consultation with the Federal Trade Commission, the Attorney 
General of the United States, the Secretary of Homeland 
Security, the Secretary of Health and Human Services, the 
Secretary of the Treasury, the Federal banking agencies (as 
defined in section 3 of the Federal Deposit Insurance Act), the 
National Credit Union Administration, the Securities and 
Exchange Commission, State attorneys general, and such 
representatives of the State insurance commissioners as may be 
designated by the National Association of Insurance 
Commissioners.
  (2) Treatment of matters relating to law enforcement and 
national security.--In issuing the regulations described in 
paragraph (1) with respect to the provisions of 
205(c)(2)(C)(x)(III), paragraph (A) or (B) of section 
208A(b)(2), or section 208A(c)(2) (relating to law enforcement 
and national security), the sale or purchase of Social Security 
account numbers may be authorized only if the Commissioner (or 
the agency or instrumentality delegated authority to issue such 
regulations under paragraph (5)) determines that--
          (A) such sale or purchase would serve a compelling 
        public interest that cannot reasonably be served 
        through alternative measures, and
          (B) such sale or purchase will not pose an 
        unreasonable risk of identity theft, or bodily, 
        emotional, or financial harm to an individual (taking 
        into account any restrictions and conditions that the 
        agency or instrumentality issuing the regulations 
        imposes on the sale, purchase, or disclosure).
  (3) Treatment of other matters in general discretion of the 
commissioner.--
          (A) In general.--In issuing the regulations described 
        in paragraph (1) with respect to the provisions of 
        section 205(c)(2)(C)(x)(VIII) or section 208A(b)(3)(B), 
        the sale, purchase, or display to the general public of 
        social security account numbers may be authorized only 
        after considering, among other relevant factors--
                  (i) the extent to which the authorization of 
                the sale, purchase, or display of the social 
                security account number would serve a 
                compelling public interest that cannot 
                reasonably be served through alternative 
                measures,
                  (ii) the associated cost or burden of the 
                authorization to the general public, 
                businesses, commercial enterprises, non-profit 
                organizations, and Federal, State, and local 
                governments; and
                  (iii) the associated benefit of the 
                authorization to the general public, 
                businesses, commercial enterprises, non-profit 
                associations, and Federal, State, and local 
                governments.
          (B) Restrictions and conditions.--If, after 
        considering the factors in subparagraph (A), the sale, 
        purchase, or display to the general public of social 
        security account numbers is authorized under 
        regulations referred to in subparagraph (A), the 
        Commissioner (or the agency or instrumentality 
        delegated authority to issue such regulations under 
        paragraph (5)) shall impose restrictions and conditions 
        on the sale, purchase, or display to the general public 
        to the extent necessary--
                  (i) to provide reasonable assurances that 
                social security account numbers will not be 
                used to commit or facilitate fraud, deceptions, 
                or crime, and
                  (ii) to prevent an unreasonable risk of 
                identity theft or bodily, emotional, or 
                financial harm to any individual, considering 
                the nature, likelihood, and severity of the 
                anticipated harm that could result from the 
                sale, purchase, or display to the general 
                public of social security account numbers, 
                together with the nature, likelihood, and 
                extent of any benefits that could be realized.
          (C) 5-year expiration date for regulations.--At the 
        end of the 5-year period beginning on the effective 
        date of any final regulations issued pursuant to this 
        paragraph--
                  (i) such regulations shall expire, and
                  (ii) new regulations may be issued pursuant 
                to this paragraph.
          (4) Administrative procedure.--In the issuance of 
        regulations pursuant to this subsection, notice shall 
        be provided as described in paragraphs (1), (2), and 
        (3) of section 553(b) of title 5, United States Code, 
        and opportunity to participate in the rule making shall 
        be provided in accordance with section 553(c) of such 
        title.
          (5) Delegation to other agencies.--Any agency or 
        instrumentality of the United States may exercise the 
        authority of the Commissioner under this subsection, 
        with respect to matters otherwise subject to regulation 
        by such agency or instrumentality, to the extent 
        determined appropriate in regulations of the 
        Commissioner.
          (6) Consultation and coordination.--Each agency and 
        instrumentality exercising authority to issue 
        regulations under this subsection shall consult and 
        coordinate with the other such agencies and 
        instrumentalities for the purposes of assuring, to the 
        extent possible, that the regulations prescribed by 
        each such agency or instrumentality are consistent and 
        comparable, as appropriate, with the regulations 
        prescribed by the other such agencies and 
        instrumentalities. The Commissioner shall undertake to 
        facilitate such consultation and coordination.
          (7) Definitions and special rules.--
                  (A) For purposes of this subsection, the 
                terms ``sell'', ``purchase'', and ``display to 
                the general public'' shall have the meanings 
                provided such terms under section 
                205(c)(2)(C)(x) or section 208A(a), as 
                applicable.
                  (B) For purposes of this subsection, section 
                205(c)(2)(C)(x)(XI) shall apply.
  (b) Coordination of Enforcement with Other Agencies.--The 
Commissioner may provide, by regulation, for enforcement by any 
other agency or instrumentality of the United States of the 
provisions of section 208A and regulations prescribed pursuant 
to subsection (a)(1) with respect to section 208A.
  (c) Actions by States with Respect to Misuse in Private 
Sector or by State and Local Governments.--
          (1) Civil actions.--In any case in which the attorney 
        general of a State (as defined in section 
        205(c)(2)(C)(x)(X)) has reason to believe that an 
        interest of the residents of that State has been or is 
        threatened or adversely affected by an act or practice 
        described in paragraph (2), the State, as parens 
        patriae, may bring a civil action on behalf of the 
        residents of the State in a district court of the 
        United States of appropriate jurisdiction, to--
                  (A) enjoin that act or practice;
                  (B) enforce compliance with the regulation;
                  (C) obtain civil penalties in an amount of 
                $11,000 per violation not to exceed a total of 
                $5,000,000; or
                  (D) obtain such other legal and equitable 
                relief as the district court may consider to be 
                appropriate.
        Before filing an action under this subsection, the 
        attorney general of the State involved shall provide to 
        the Commissioner of Social Security and the Attorney 
        General of the United States a written notice of that 
        action and a copy of the complaint for that action. If 
        the State attorney general determines that it is not 
        feasible to provide the notice described in this 
        subparagraph before the filing of the action, the State 
        attorney general shall provide the written notice and 
        the copy of the complaint as soon after the filing of 
        the complaint as practicable. Any reference in this 
        subsection to the attorney general of a State shall be 
        deemed also to be a reference to any equivalent 
        official of such State.
          (2) Acts or practices subject to enforcement.--An act 
        or practice described in this paragraph is--
                  (A) an act or practice by an executive, 
                legislative, or judicial agency or 
                instrumentality of the State involved or a 
                political subdivision thereof, a person acting 
                as an agent thereof, or any officer or employee 
                of the foregoing or person acting as an agent 
                of the foregoing that violates clause (vi)(II), 
                (x), (xi), (xii), (xiii), (xiv), or (xv) of 
                section 205(c)(2)(C) or any regulation 
                promulgated thereunder, or
                  (B) an act or practice by any person that 
                violates section 208A or any regulation 
                promulgated thereunder.
          (3) Attorney general authority.--On receiving notice 
        under paragraph (1), the Attorney General of the United 
        States shall have the right--
                  (A) to move to stay the action, pending the 
                final disposition of a pending Federal matter 
                as described in paragraph (4);
                  (B) to intervene in an action under paragraph 
                (1);
                  (C) upon so intervening, to be heard on all 
                matters arising therein; and
                  (D) to file petitions for appeal.
          (4) Pending criminal proceedings.--If the Attorney 
        General of the United States has instituted a criminal 
        proceeding under section 208 alleging an act or 
        practice described in paragraph (2) in connection with 
        any State, such State may not, during the pendency of 
        such proceeding or action, bring an action under this 
        subsection against any defendant named in the criminal 
        proceeding.
          (5) Rule of construction.--For purposes of bringing 
        any civil action under paragraph (1), nothing in this 
        subsection shall be construed to prevent an attorney 
        general of a State from exercising the powers conferred 
        on the attorney general by the laws of that State to 
        conduct investigations, administer oaths and 
        affirmations, or compel the attendance of witnesses or 
        the production of documentary and other evidence.
          (6) Venue; service of process.--Any action brought 
        under paragraph (1) may be brought in any district 
        court of the United States that meets applicable 
        requirements relating to venue under section 1391 of 
        title 28, United States Code. In an action brought 
        under paragraph (1), process may be served in any 
        district in which the defendant is an inhabitant or may 
        be found.
  (d) Remedies to Individuals for Violations by the Federal 
Government of Requirements Relating to Social Security Account 
Numbers.--
          (1) Civil actions.--Any individual who is aggrieved 
        by an act or practice by any person acting as an 
        officer, employee, or agent of an agency or 
        instrumentality of the Federal Government in violation 
        of the requirements of clause (vi)(II), (x), (xi), 
        (xii), (xiii), (xiv), or (xv) of subsection (c)(2)(C) 
        with respect to the social security account number 
        assigned to such individual under subsection (c)(2)(B) 
        may commence a civil action for appropriate equitable 
        relief or actual damages.
          (2) Venue; service of process.--An action under this 
        subsection action may be brought in the district court 
        of the United States for the judicial district in which 
        the plaintiff resides, or has his principal place of 
        business, in which the violation took place, or in 
        which the defendant resides or may be found, and 
        process may be served in any other district in which a 
        defendant resides or may be found.
          (3) Jurisdiction.--The district courts of the United 
        States shall have jurisdiction, without respect to the 
        amount in controversy or the citizenship of the 
        parties, to grant the relief provided for in paragraph 
        (1).
          (4) Attorney's fees.--In any action under this 
        subsection, the court in its discretion may allow a 
        reasonable attorney's fee and costs of action to either 
        party.
  (e) Ongoing Gao Review on Efficacy of Regulations.--
          (1) In general.--The Comptroller General of the 
        United States shall conduct an ongoing review of the 
        efficacy of the regulations prescribed by any agency or 
        instrumentality of the United States pursuant to this 
        section. Such review shall consider the extent to which 
        such regulations are consistent with, and in 
        furtherance of the purposes of, the amendments made by 
        the Social Security Number Privacy and Identity Theft 
        Prevention Act of 2007.
          (2) Report.--Not later than 4 years after the 
        effective date of any final regulations issued by any 
        agency or instrumentality of the United States pursuant 
        to this section, the Comptroller General shall report 
        to each House of the Congress regarding the results of 
        the review of such regulations conducted under this 
        paragraph. Such report shall include the Comptroller 
        General's recommendations for such statutory or 
        regulatory changes as the Comptroller General considers 
        appropriate.

           *       *       *       *       *       *       *


   TITLE XVI--SUPPLEMENTAL SECURITY INCOME FOR THE AGED, BLIND, AND 
DISABLED

           *       *       *       *       *       *       *


Part B--Procedural and General Provisions

           *       *       *       *       *       *       *


                          PENALTIES FOR FRAUD

  Sec. 1632. (a) Whoever--
  (1)  * * *

           *       *       *       *       *       *       *

[shall be fined under title 18, United States Code, imprisoned 
not more than 5 years, or both.] shall be fined, imprisoned, or 
both, as provided in subsection (b).
  (b) A person convicted of a violation described in subsection 
(a) shall be--
          (1) fined under title 18, United States Code, or 
        imprisoned for not more than 5 years, or both, in the 
        case of an initial violation, subject to paragraphs (3) 
        and (4),
          (2) fined under title 18, United States Code, or 
        imprisoned for not more than 10 years, or both, in the 
        case of a violation which occurs after a prior 
        conviction for another offense under subsection (a) 
        becomes final, subject to paragraphs (3) and (4),
          (3) fined under title 18, United States Code, or 
        imprisoned for not more than 20 years, in the case of a 
        violation which is committed to facilitate a drug 
        trafficking crime (as defined in section 929(a)(2) of 
        title 18, United States Code) or in connection with a 
        crime of violence (as defined in section 924(c)(3) of 
        title 18, United States Code) involving force against 
        the person of another, subject to paragraph (4), and
          (4) fined under title 18, United States Code, or 
        imprisoned for not more than 25 years, in the case of a 
        violation which is committed to facilitate an act of 
        international or domestic terrorism (as defined in 
        paragraphs (1) and (5), respectively, of section 2331 
        of title 18, United States Code).
  [(b)] (c)(1)  * * *

           *       *       *       *       *       *       *

  [(c)] (d) Any person or entity convicted of a violation of 
subsection (a) of this section or of section 208 may not be 
certified as a representative payee under section 1631(a)(2).

           *       *       *       *       *       *       *


                         VII. ADDITIONAL VIEWS

                              ----------                              


               ADDITIONAL VIEWS OF HON. KENNY C. HULSHOF

    The absence of overarching Federal law regulating the sale, 
purchase, and display to the general public of Social Security 
numbers (SSNs), and the growing threat represented by SSN 
misuse and identity theft, have prompted a need to better 
protect the privacy and integrity of SSNs. The purpose of the 
``Social Security Number Privacy and Identity Theft Prevention 
Act of 2007,'' H.R. 3046, is to enhance Social Security number 
privacy protections and to otherwise enhance protections 
against identity theft.
    Concerns have been raised that the provisions in H.R. 3046 
would harm a consumer's ability to obtain benefits such as 
credit as stipulated by the Fair Credit Reporting Act (FCRA).
    The bill addresses these concerns by providing exceptions 
to the prohibitions on SSN sale and purchase, as follows: (1) 
by or to a consumer reporting agency for use or disclosure for 
permissible purposes described in the FCRA; (2) with 
affirmative written consent; and (3) under other circumstances 
determined appropriate according to regulations. Also, to 
permit accurate data-matching to continue without jeopardizing 
SSN privacy, the bill provides for the sale and display to the 
general public of the last four digits of the SSN for two years 
after the effective date of the final regulation. This 
authority may be extended with action by Congress.
    As the bill advances through the legislative process, 
continued efforts should be made to protect the accuracy of 
credit reports and other consumer reports, along with the 
legitimate uses of the SSN by financial institutions.
                                                  Kenny C. Hulshof.

               ADDITIONAL VIEWS OF HON. PATRICK J. TIBERI

    I agree with the goal of H.R. 3046, the ``Social Security 
Number Privacy and Identity Theft Prevention Act of 2007.'' We, 
as holders of the public trust, need to do everything within 
our power to ensure our constituents' personal information 
remains exactly that--personal. We need to make sure that key 
information, like a Social Security number, is used in a 
responsible and protected way. Chairman McNulty and Ranking 
Member Johnson deserve a great deal of credit for their 
dedication and hard work on this bill.
    During markup of this legislation I expressed a concern 
about the balance between restricting the use of Social 
Security numbers where there is no compelling purpose, and 
allowing continued use where they may be needed for important 
and legitimate purposes. I would like to take this opportunity 
to elaborate on my comments.
    The bill prohibits the sale, purchase, and display of 
Social Security numbers, with limited exceptions: for law 
enforcement purposes, national security purposes, public health 
purposes, emergency situations, compliance with a tax law, use 
or disclosure by a consumer reporting agency for the 
permissible purposes of section 604(a) of the Fair Credit 
Reporting Act (FCRA), certain research, and when the consumer 
has consented.
    The committee did not explicitly allow the use of Social 
Security numbers for the detection and prevention of fraud or 
to verify a person's identity in connection with financial 
transactions. Banks are mandated by Section 326 of the USA 
PATRIOT Act to have a Customer Identification Program, intended 
to enable the bank to form a reasonable belief that it knows 
the true identity of each customer. It is obviously important 
that the identity verification process produces a high degree 
of confidence in the person's identity.
    The bill authorizes the Social Security Administration to 
provide additional exceptions by regulation. As a former Member 
of the Committee on Financial Services, I note that these uses 
are allowed under the Gramm-Leach-Bliley Act for all 
``nonpublic personal information,'' which includes Social 
Security numbers. It also permits the use of Social Security 
numbers only for FCRA section 604(a), rather than for all of 
the permissible purposes under that Act. Without specific 
attention to this matter, I'm concerned that H.R. 3046 could, 
in fact, overturn Gramm-Leach-Bliley to prohibit the use of 
Social Security numbers for legitimate purposes. They should be 
provided for by statute, rather than left to the chances of a 
regulatory process.
    I appreciate Chairman Rangel's offer to work with me to 
resolve this issue and hope that it can be addressed as the 
bill moves forward.

                                                 Patrick J. Tiberi.

                                  
