With so much uncertainty regarding when the COVID-19 pandemic will subside sufficiently to allow people to return to work, including retailers, there seems to be a clear consensus that what lies ahead on the other side is an unknown world known as the “new normal.”
Although the contours of future business and social interactions remain undefined, they seem likely to require more hand washing throughout the day, distancing in office spaces and restaurants, and probably the permanent disappearance of the hearty handshake for greetings and departures.
Given the vast increase in the use of, and dependency upon, digital connections at home now, along with an increased need for government surveillance to facilitate contact tracing through location tracking, there also will be an understandable growing sensitivity to how much personally identifiable information is being collected, stored and disseminated — especially after the virus subsides or can be dealt with through effective treatments or a vaccine.
So here’s a quick recommendation that Congress could adopt in any of its coming COVID-19 funding packages: Prohibit the use by any non-federal governmental entity from using a Social Security number as a personal identifier. The unrestricted requests for these numbers seemingly are made any time we fill out a form online.
But why?
This identification system was created by law in 1936 for the sole purpose of tracking the earnings histories of U.S. workers to determine their entitlement to Social Security benefits and compute their benefit levels.
Today, the Social Security Administration has issued more than 450 million assigned numbers to nearly every legal resident in the United States. According to the SSA, this “very universality has led to its adoption throughout government and the private sector as a chief means of identifying and gathering information about an individual.”
As we begin to plan for a new normal, it’s time to return to the original intent of Social Security numbers, by limiting their widespread use for unintended and unauthorized purposes as an unofficial national identifier.
The SSA itself acknowledges that every year, “millions of Americans become victims of identity theft. Identity theft occurs when someone steals your personally identifiable information and pretends to be you. They can use this information to open bank or credit card accounts, file taxes, or make new purchases in your name.”
In our post-pandemic world, it’s likely that bad actors will ramp up their identity theft activities, and Social Security numbers can be keys that unlock doors that have a wealth of personal information behind them.
This means that restricting the use of these numbers to the Social Security system itself can help stem the flow of dire economic consequences — both for individuals and businesses — when these numbers are acquired through hacking, malware and the like.
And there is no countervailing public policy reason the current widespread use of these numbers should continue, especially since the law is clear about the limits that Congress intended when it acted more than 80 years ago.
The Privacy Act of 1974, which gave citizens protection from certain information disclosures and a right to review and fix their own records, also created an enduring gap by not including Social Security number requests made by businesses and non-federal agencies.
In effect, this shifted the burden on individuals to refuse giving over their number when asked for it by these entities. But as a practical matter, how many of us have ever exercised this right of refusal, especially since it could lead to a withholding of benefits by a requesting provider?
Congress recognized this problem, in part, when it enacted a subsequent law 30 years later that bars states from putting Social Security numbers on drivers’ licenses, identification cards or vehicle registrations.
These prohibitions have been on place since 2005, and have clearly demonstrated that massive processing of individual information is possible without using these numbers.
In the new normal, the logical next step should move beyond these laws to explicitly discontinue the use of Social Security numbers for many unintended purposes. Let’s have Congress establish a permanent prohibition, along with penalties that provide real teeth for the widespread use of Social Security numbers.
States already have shown that they can develop their own alternate identification systems for more tailored purposes. The American private sector, rooted deeply in innovation and competition, also can develop comparable individual identifiers that do not rely on Social Security numbers.
The upside of this change would be welcomed by the public at large as it navigates through a brave new world where better privacy protection can become an unintended positive outcome from the unprecedented public health crisis that we all are enduring.
