Protecting the Privacy of Social Security Numbers Act

(1) The inappropriate display, sale, or purchase of Social Security numbers has contributed to a growing range of illegal activities, including fraud, identity theft, and, in some cases, stalking and other violent crimes.

(2) While financial institutions, health care providers, and other entities have often used Social Security numbers to confirm the identity of an individual, the general display to the public, sale, or purchase of these numbers has been used to commit crimes, and also can result in serious invasions of individual privacy.

(3) The Federal Government requires virtually every individual in the United States to obtain and maintain a Social Security number in order to pay taxes, to qualify for Social Security benefits, or to seek employment. An unintended consequence of these requirements is that Social Security numbers have become one of the tools that can be used to facilitate crime, fraud, and invasions of the privacy of the individuals to whom the numbers are assigned. Because the Federal Government created and maintains this system, and because the Federal Government does not permit individuals to exempt themselves from those requirements, it is appropriate for the Federal Government to take steps to stem the abuse of Social Security numbers.

(4) The display, sale, or purchase of Social Security numbers in no way facilitates uninhibited, robust, and wide-open public debate, and restrictions on such display, sale, or purchase would not affect public debate.

(5) No one should seek to profit from the display, sale, or purchase of Social Security numbers in circumstances that create a substantial risk of physical, emotional, or financial harm to the individuals to whom those numbers are assigned.

(6) Consequently, this Act provides each individual that has been assigned a Social Security number some degree of protection from the display, sale, and purchase of that number in any circumstance that might facilitate unlawful conduct.

Chapter 47 of title 18, United States Code, is amended by inserting after section 1028A the following:

In this section:

The term display means to intentionally communicate or otherwise make available (on the Internet or in any other manner) to the general public an individual’s Social Security number.

The term person means any individual, partnership, corporation, trust, estate, cooperative, association, or any other entity.

The term purchase means providing directly or indirectly, anything of value in exchange for a Social Security number.

The term sale means obtaining, directly or indirectly, anything of value in exchange for a Social Security number.

The term State means any State of the United States, the District of Columbia, Puerto Rico, the Northern Mariana Islands, the United States Virgin Islands, Guam, American Samoa, and any territory or possession of the United States.

Except as provided in section 1028C, no person may display any individual’s Social Security number to the general public without the affirmatively expressed consent of the individual.

Except as otherwise provided in this section, no person may sell or purchase any individual’s Social Security number without the affirmatively expressed consent of the individual.

In order for consent to exist under subsection (b) or (c), the person displaying or seeking to display, selling or attempting to sell, or purchasing or attempting to purchase, an individual’s Social Security number shall—

(1) inform the individual of the general purpose for which the number will be used, the types of persons to whom the number may be available, and the scope of transactions permitted by the consent; and

(2) obtain the affirmatively expressed consent (electronically or in writing) of the individual.

Nothing in this section shall be construed to prohibit or limit the display, sale, or purchase of a Social Security number— except that, nothing in this subsection shall be construed as permitting a professional or commercial user to display or sell a Social Security number to the general public.

(1) required, authorized, or excepted under any Federal law;

(2) for a public health purpose, including the protection of the health or safety of an individual in an emergency situation;

(3) for a national security purpose;

(4) for a law enforcement purpose, including the investigation of fraud and the enforcement of a child support obligation;

(5) if the display, sale, or purchase of the number is for a use occurring as a result of an interaction between businesses, governments, or business and government (regardless of which entity initiates the interaction), including, but not limited to—

(A) the prevention of fraud (including fraud in protecting an employee’s right to employment benefits);

(B) the facilitation of credit checks or the facilitation of background checks of employees, prospective employees, or volunteers;

(C) the retrieval of other information from other businesses, commercial enterprises, government entities, or private nonprofit organizations; or

(D) when the transmission of the number is incidental to, and in the course of, the sale, lease, franchising, or merger of all, or a portion of, a business;

(6) if the transfer of such a number is part of a data matching program involving a Federal, State, or local agency; or

(7) if such number is required to be submitted as part of the process for applying for any type of Federal, State, or local government benefit or program;

Nothing in this section shall prohibit or limit the display, sale, or purchase of Social Security numbers as permitted under title V of the Gramm-Leach-Bliley Act, or for the purpose of affiliate sharing as permitted under the Fair Credit Reporting Act, except that no entity regulated under such Acts may make Social Security numbers available to the general public, as may be determined by the appropriate regulators under such Acts. For purposes of this subsection, the general public shall not include affiliates or unaffiliated third-party business entities as may be defined by the appropriate regulators.

The chapter analysis for chapter 47 of title 18, United States Code, is amended by inserting after the item relating to section 1028 the following:

The Attorney General shall conduct a study and prepare a report on all of the uses of Social Security numbers permitted, required, authorized, or excepted under any Federal law. The report shall include a detailed description of the uses allowed as of the date of enactment of this Act, the impact of such uses on privacy and data security, and shall evaluate whether such uses should be continued or discontinued by appropriate legislative action.

Not later than 1 year after the date of enactment of this Act, the Attorney General shall report to Congress findings under this subsection. The report shall include such recommendations for legislation based on criteria the Attorney General determines to be appropriate.

The amendments made by this section shall take effect on the date that is 30 days after the date on which the final regulations promulgated under section 5 are published in the Federal Register.

Chapter 47 of title 18, United States Code (as amended by section 3(a)(1)), is amended by inserting after section 1028B the following:

In this section, the term public record means any governmental record that is made available to the general public.

Except as provided in subsections (c), (d), and (e), section 1028B shall not apply to a public record.

Section 1028B shall apply to any public record first posted onto the Internet or provided in an electronic medium by, or on behalf of a government entity after the date of enactment of this section, except as limited by the Attorney General in accordance with paragraph (2).

Not later than 60 days after the date of enactment of this section, the Attorney General shall issue regulations regarding the applicability of section 1028B to any record of a category of public records first posted onto the Internet or provided in an electronic medium by, or on behalf of a government entity prior to the date of enactment of this section. The regulations will determine which individual records within categories of records of these government entities, if any, may continue to be posted on the Internet or in electronic form after the effective date of this section. In promulgating these regulations, the Attorney General may include in the regulations a set of procedures for implementing the regulations and shall consider the following: Nothing in the regulation shall permit a public entity to post a category of public records on the Internet or in electronic form after the effective date of this section if such category had not been placed on the Internet or in electronic form prior to such effective date.

(A) The cost and availability of technology available to a governmental entity to redact Social Security numbers from public records first provided in electronic form after the effective date of this section.

(B) The cost or burden to the general public, businesses, commercial enterprises, non-profit organizations, and to Federal, State, and local governments of complying with section 1028B with respect to such records.

(C) The benefit to the general public, businesses, commercial enterprises, non-profit organizations, and to Federal, State, and local governments if the Attorney General were to determine that section 1028B should apply to such records.

Section 1028B shall apply to any public record of a government entity which contains Social Security numbers extracted from other public records for the purpose of displaying or selling such numbers to the general public.

Not later than 60 days after the date of enactment of this section, the Attorney General shall determine the feasibility and advisability of applying section 1028B to the records listed in paragraph (2) when they appear on paper or on another nonelectronic medium. If the Attorney General deems it appropriate, the Attorney General may issue regulations applying section 1028B to such records.

The records listed in this paragraph are as follows:

(A) Professional or occupational licenses.

(B) Marriage licenses.

(C) Birth certificates.

(D) Death certificates.

(E) Other short public documents that display a Social Security number in a routine and consistent manner on the face of the document.

In determining whether section 1028B should apply to the records listed in paragraph (2), the Attorney General shall consider the following:

(A) The cost or burden to the general public, businesses, commercial enterprises, non-profit organizations, and to Federal, State, and local governments of complying with section 1028B.

(B) The benefit to the general public, businesses, commercial enterprises, non-profit organizations, and to Federal, State, and local governments if the Attorney General were to determine that section 1028B should apply to such records.

The chapter analysis for chapter 47 of title 18, United States Code (as amended by section 3(a)(2)), is amended by inserting after the item relating to section 1028B the following:

The Comptroller General of the United States shall conduct a study and prepare a report on Social Security numbers in public records. In developing the report, the Comptroller General shall consult with the Administrative Office of the United States Courts, State and local governments that store, maintain, or disseminate public records, and other stakeholders, including members of the private sector who routinely use public records that contain Social Security numbers.

Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress a report on the study conducted under paragraph (1). The report shall include a detailed description of the activities and results of the study and recommendations for such legislative action as the Comptroller General considers appropriate. The report, at a minimum, shall include—

(A) a review of the uses of Social Security numbers in non-Federal public records;

(B) a review of the manner in which public records are stored (with separate reviews for both paper records and electronic records);

(C) a review of the advantages or utility of public records that contain Social Security numbers, including the utility for law enforcement, and for the promotion of homeland security;

(D) a review of the disadvantages or drawbacks of public records that contain Social Security numbers, including criminal activity, compromised personal privacy, or threats to homeland security;

(E) the costs and benefits for State and local governments of removing Social Security numbers from public records, including a review of current technologies and procedures for removing Social Security numbers from public records; and

(F) an assessment of the benefits and costs to businesses, their customers, and the general public of prohibiting the display of Social Security numbers on public records (with separate assessments for both paper records and electronic records).

The prohibition with respect to electronic versions of new classes of public records under section 1028C(b) of title 18, United States Code (as added by subsection (a)(1)) shall not take effect until the date that is 60 days after the date of enactment of this Act.

Except as provided in subsection (b), the Attorney General may prescribe such rules and regulations as the Attorney General deems necessary to carry out the provisions of section 1028B(e)(5) of title 18, United States Code (as added by section 3(a)(1)).

Not later than 1 year after the date of enactment of this Act, the Attorney General, in consultation with the Commissioner of Social Security, the Chairman of the Federal Trade Commission, and such other heads of Federal agencies as the Attorney General determines appropriate, shall conduct such rulemaking procedures in accordance with subchapter II of chapter 5 of title 5, United States Code, as are necessary to promulgate regulations to implement and clarify the uses occurring as a result of an interaction between businesses, governments, or business and government (regardless of which entity initiates the interaction) permitted under section 1028B(e)(5) of title 18, United States Code (as added by section 3(a)(1)).

In promulgating the regulations required under paragraph (1), the Attorney General shall, at a minimum, consider the following:

(A) The benefit to a particular business, to customers of the business, and to the general public of the display, sale, or purchase of an individual’s Social Security number.

(B) The costs that businesses, customers of businesses, and the general public may incur as a result of prohibitions on the display, sale, or purchase of Social Security numbers.

(C) The risk that a particular business practice will promote the use of a Social Security number to commit fraud, deception, or crime.

(D) The presence of adequate safeguards, procedures, and technologies to prevent—

(i) misuse of Social Security numbers by employees within a business; and

(ii) misappropriation of Social Security numbers by the general public, while permitting internal business uses of such numbers.

(E) The presence of procedures to prevent identity thieves, stalkers, and other individuals with ill intent from posing as legitimate businesses to obtain Social Security numbers.

(F) The impact of such uses on privacy.

Part A of title XI of the Social Security Act (42 U.S.C. 1301 et seq.) is amended by adding at the end the following:

A commercial entity may not require an individual to provide the individual’s Social Security number when purchasing a commercial good or service or deny an individual the good or service for refusing to provide that number except—

(1) for any purpose relating to—

(A) obtaining a consumer report for any purpose permitted under the Fair Credit Reporting Act;

(B) a background check of the individual conducted by a landlord, lessor, employer, voluntary service agency, or other entity as determined by the Attorney General;

(C) law enforcement; or

(D) a Federal, State, or local law requirement; or

(2) if the Social Security number is necessary to verify the identity of the consumer to effect, administer, or enforce the specific transaction requested or authorized by the consumer, or to prevent fraud.

A violation of this section shall be deemed to be a violation of section 1129(a)(3)(F).

A violation of this section shall be deemed to be a violation of section 208(a)(8).

No class action alleging a violation of this section shall be maintained under this section by an individual or any private party in Federal or State court.

In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that is prohibited under this section, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—

(i) enjoin that practice;

(ii) enforce compliance with such section;

(iii) obtain damages, restitution, or other compensation on behalf of residents of the State; or

(iv) obtain such other relief as the court may consider appropriate.

Before filing an action under subparagraph (A), the attorney general of the State involved shall provide to the Attorney General—

(I) written notice of the action; and

(II) a copy of the complaint for the action.

Clause (i) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the State attorney general determines that it is not feasible to provide the notice described in such subparagraph before the filing of the action.

With respect to an action described in subclause (I), the attorney general of a State shall provide notice and a copy of the complaint to the Attorney General at the same time as the State attorney general files the action.

On receiving notice under paragraph (1)(B), the Attorney General shall have the right to intervene in the action that is the subject of the notice.

If the Attorney General intervenes in the action under paragraph (1), the Attorney General shall have the right to be heard with respect to any matter that arises in that action.

For purposes of bringing any civil action under paragraph (1), nothing in this section shall be construed to prevent an attorney general of a State from exercising the powers conferred on such attorney general by the laws of that State to—

(A) conduct investigations;

(B) administer oaths or affirmations; or

(C) compel the attendance of witnesses or the production of documentary and other evidence.

In any case in which an action is instituted by or on behalf of the Attorney General for violation of a practice that is prohibited under this section, no State may, during the pendency of that action, institute an action under paragraph (1) against any defendant named in the complaint in that action for violation of that practice.

Any action brought under paragraph (1) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.

In an action brought under paragraph (1), process may be served in any district in which the defendant—

(i) is an inhabitant; or

(ii) may be found.

This section shall not apply on or after the date that is 6 years after the effective date of this section.

Not later than the date that is 6 years and 6 months after the date of enactment of this Act, the Attorney General, in consultation with the chairman of the Federal Trade Commission, shall issue a report evaluating the effectiveness and efficiency of section 1150A of the Social Security Act (as added by subsection (a)) and shall make recommendations to Congress as to any legislative action determined to be necessary or advisable with respect to such section, including a recommendation regarding whether to reauthorize such section.

The amendment made by subsection (a) shall apply to requests to provide a Social Security number occurring after the date that is 1 year after the date of enactment of this Act.

The first sentence of section 1129(a)(1) of the Social Security Act (42 U.S.C. 1320a–8(a)(1)) is amended—

(A) by striking who and inserting who—;

(B) by striking makes and all that follows through shall be subject to and inserting the following:

(A) makes, or causes to be made, a statement or representation of a material fact, for use in determining any initial or continuing right to or the amount of monthly insurance benefits under title II or benefits or payments under title VIII or XVI, that the person knows or should know is false or misleading;

(B) makes such a statement or representation for such use with knowing disregard for the truth; or

(C) omits from a statement or representation for such use, or otherwise withholds disclosure of, a fact which the individual knows or should know is material to the determination of any initial or continuing right to or the amount of monthly insurance benefits under title II or benefits or payments under title VIII or XVI and the individual knows, or should know, that the statement or representation with such omission is false or misleading or that the withholding of such disclosure is misleading, shall be subject to;

(C) by inserting or each receipt of such benefits while withholding disclosure of such fact after each such statement or representation;

(D) by inserting or because of such withholding of disclosure of a material fact after because of such statement or representation; and

(E) by inserting or such a withholding of disclosure after such a statement or representation.

The first sentence of section 1129A(a) of the Social Security Act (42 U.S.C. 1320a–8a(a)) is amended—

(A) by striking who and inserting who—; and

(B) by striking makes and all that follows through shall be subject to and inserting the following:

(1) makes, or causes to be made, a statement or representation of a material fact, for use in determining any initial or continuing right to or the amount of monthly insurance benefits under title II or benefits or payments under title VIII or XVI, that the person knows or should know is false or misleading;

(2) makes such a statement or representation for such use with knowing disregard for the truth; or

(3) omits from a statement or representation for such use, or otherwise withholds disclosure of, a fact which the individual knows or should know is material to the determination of any initial or continuing right to or the amount of monthly insurance benefits under title II or benefits or payments under title VIII or XVI and the individual knows, or should know, that the statement or representation with such omission is false or misleading or that the withholding of such disclosure is misleading, shall be subject to.

Section 1129(a) of the Social Security Act (42 U.S.C. 1320a–8(a)), as amended by subsection (a)(1), is amended—

(1) by redesignating paragraph (2) as paragraph (4);

(2) by redesignating the last sentence of paragraph (1) as paragraph (2) and inserting such paragraph after paragraph (1); and

(3) by inserting after paragraph (2) (as so redesignated) the following:

(3) Any person (including an organization, agency, or other entity) who—

(A) uses a Social Security account number that such person knows or should know has been assigned by the Commissioner of Social Security (in an exercise of authority under section 205(c)(2) to establish and maintain records) on the basis of false information furnished to the Commissioner by any person;

(B) falsely represents a number to be the Social Security account number assigned by the Commissioner of Social Security to any individual, when such person knows or should know that such number is not the Social Security account number assigned by the Commissioner to such individual;

(C) knowingly alters a Social Security card issued by the Commissioner of Social Security, or possesses such a card with intent to alter it;

(D) knowingly displays, sells, or purchases a card that is, or purports to be, a card issued by the Commissioner of Social Security, or possesses such a card with intent to display, purchase, or sell it;

(E) counterfeits a Social Security card, or possesses a counterfeit Social Security card with intent to display, sell, or purchase it;

(F) discloses, uses, compels the disclosure of, or knowingly displays, sells, or purchases the Social Security account number of any person in violation of the laws of the United States;

(G) with intent to deceive the Commissioner of Social Security as to such person’s true identity (or the true identity of any other person) furnishes or causes to be furnished false information to the Commissioner with respect to any information required by the Commissioner in connection with the establishment and maintenance of the records provided for in section 205(c)(2);

(H) offers, for a fee, to acquire for any individual, or to assist in acquiring for any individual, an additional Social Security account number or a number which purports to be a Social Security account number; or

(I) being an officer or employee of a Federal, State, or local agency in possession of any individual’s Social Security account number, willfully acts or fails to act so as to cause a violation by such agency of clause (vi)(II) or (x) of section 205(c)(2)(C), shall be subject to, in addition to any other penalties that may be prescribed by law, a civil money penalty of not more than $5,000 for each violation. Such person shall also be subject to an assessment, in lieu of damages sustained by the United States resulting from such violation, of not more than twice the amount of any benefits or payments paid as a result of such violation.

Section 1129(e)(2)(B) of the Social Security Act (42 U.S.C. 1320a–8(e)(2)(B)) is amended by striking In the case of amounts recovered arising out of a determination relating to title VIII or XVI, and inserting In the case of any other amounts recovered under this section,.

(1) Section 1129(b)(3)(A) of the Social Security Act (42 U.S.C. 1320a–8(b)(3)(A)) is amended by striking charging fraud or false statements.

(2) Section 1129(c)(1) of the Social Security Act (42 U.S.C. 1320a–8(c)(1)) is amended by striking and representations and inserting, representations, or actions.

(3) Section 1129(e)(1)(A) of the Social Security Act (42 U.S.C. 1320a–8(e)(1)(A)) is amended by striking statement or representation referred to in subsection (a) was made and inserting violation occurred.

Except as provided in paragraph (2), the amendments made by this section shall apply with respect to violations of sections 1129 and 1129A of the Social Security Act (42 U.S.C. 1320–8 and 1320a–8a), as amended by this section, committed after the date of enactment of this Act.

Section 1129(a)(3)(I) of the Social Security Act (42 U.S.C. 1320a–8(a)(3)(I)), as added by subsection (b), shall apply with respect to violations of that section occurring on or after the effective date described in section 3(c).

Section 201 of the Social Security Protection Act of 2004 is repealed.

No person may obtain any individual’s Social Security number for purposes of locating or identifying an individual with the intent to physically injure, harm, or use the identity of the individual for any illegal purpose.

Section 208(a) of the Social Security Act (42 U.S.C. 408(a)) is amended—

(1) in paragraph (8), by inserting or after the semicolon; and

(2) by inserting after paragraph (8) the following:

(9) except as provided in subsections (e) and (f) of section 1028B of title 18, United States Code, knowingly and willfully displays, sells, or purchases (as those terms are defined in section 1028B(a) of title 18, United States Code) any individual’s Social Security account number without having met the prerequisites for consent under section 1028B(d) of title 18, United States Code; or

(10) obtains any individual’s Social Security number for the purpose of locating or identifying the individual with the intent to injure or to harm that individual, or to use the identity of that individual for an illegal purpose;.

Any individual aggrieved by an act of any person in violation of this Act or any amendments made by this Act may, if otherwise permitted by the laws or rules of the court of a State, bring in an appropriate court of that State— It shall be an affirmative defense in any action brought under this paragraph that the defendant has established and implemented, with due care, reasonable practices and procedures to effectively prevent violations of the regulations prescribed under this Act. If the court finds that the defendant willfully or knowingly violated the regulations prescribed under this subsection, the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under subparagraph (B).

(A) an action to enjoin such violation;

(B) an action to recover for actual monetary loss from such a violation, or to receive up to $500 in damages for each such violation, whichever is greater; or

(C) both such actions.

An action may be commenced under this subsection not later than the earlier of—

(A) 5 years after the date on which the alleged violation occurred; or

(B) 3 years after the date on which the alleged violation was or should have been reasonably discovered by the aggrieved individual.

The remedy provided under this subsection shall be in addition to any other remedies available to the individual.

Any person who the Attorney General determines has violated any section of this Act or of any amendments made by this Act shall be subject, in addition to any other penalties that may be prescribed by law—

(A) to a civil penalty of not more than $5,000 for each such violation; and

(B) to a civil penalty of not more than $50,000, if the violations have occurred with such frequency as to constitute a general business practice.

Any willful violation committed contemporaneously with respect to the Social Security numbers of 2 or more individuals by means of mail, telecommunication, or otherwise, shall be treated as a separate violation with respect to each such individual.

The provisions of section 1128A of the Social Security Act (42 U.S.C. 1320a–7a), other than subsections (a), (b), (f), (h), (i), (j), (m), and (n) and the first sentence of subsection (c) of such section, and the provisions of subsections (d) and (e) of section 205 of such Act (42 U.S.C. 405) shall apply to a civil penalty action under this subsection in the same manner as such provisions apply to a penalty or proceeding under section 1128A(a) of such Act (42 U.S.C. 1320a–7a(a)), except that, for purposes of this paragraph, any reference in section 1128A of such Act (42 U.S.C. 1320a–7a) to the Secretary shall be deemed to be a reference to the Attorney General.