SOCIAL SECURITY ADMINISTRATION

PRIVACY IMPACT ASSESSMENT

 

·         Name of project.

Social Security Number Establishment and Correction System

·         Unique project identifier.

016-00-SSA/DCS-M-003

·         Privacy Impact Assessment Contact.

      Director
      Division of Enumeration and Death Alerts
      Office of Earnings, Enumeration and Administrative Systems
      Social Security Administration
      6401 Security Boulevard
      Baltimore, MD 21235

·         Describe the information to be collected, why the information is being collected, the intended use of the information and with whom the information will be shared.

The Social Security Number Establishment and Correction (SSNEC) System is a Social Security Administration (SSA) certified and accredited Major Application consisting of several sub-systems that function to assign new Social Security numbers (SSN) and to issue original and replacement Social Security cards.  SSNs are issued to workers and beneficiaries of programs under the Social Security Act as well as to eligible taxpayers and their dependents for purposes of reporting taxable income to the Internal Revenue Service.  The system also establishes the file from which Social Security cards are printed.  The SSNEC System contains all of the information received on original applications for SSNs (e.g., name, date and place of birth, sex, both parents' names, and race/ethnic data); the mailing addresses of the individuals who filed SSN applications; descriptions of the documentation they submitted; and any changes in the information on the applications that are submitted by the SSN holders. The system also contains applications supported by evidence suspected or determined to be fraudulent.  The SSNEC Systems may also note cross-references where multiple numbers have been issued to the same individual, and an indication may be shown that a benefit claim has been made under a particular SSN(s).  We also use information in the SSNEC System to prevent the processing of an SSN card application for an individual whose application is identified as having been supported by evidence that either is suspect and being verified, or has been determined to be fraudulent.  

We generally disclose this information only as necessary to verify that information presented by requesters seeking SSN verification match or do not match the information presented by claimants in our records, to prevent issuance of multiple SSNs, etc., or as authorized by Federal law (e.g., we share information with the Department of Veterans Affairs to administer its programs that are similar to SSA programs).  The SSNEC System is not accessible to members of the public.  

·         Describe the administrative and technological controls that are in place or that are planned to secure the information being collected.

The SSNEC System has undergone authentication and security risk analyses.  The latter includes an evaluation of security and audit controls proven to be effective in protecting the information collected, stored, processed, and transmitted by our information systems.  These include technical, management, and operational controls that permit access to those users who have an official “need to know.”  Audit mechanisms are in place to record sensitive transactions as an additional measure to protect information from unauthorized disclosure or modification.

We protect the information in the SSNEC System by requiring employees who are authorized to access the information system to use a unique Personal Identification Number.  In addition, we store the computerized records in secure areas that are accessible to those employees who require the information to perform their official duties.  Furthermore, all of our employees who have access to our information systems that maintain personal information must sign a sanction document annually that acknowledges penalties for unauthorized access to, or disclosure of, such information.

·         Describe the impact on individuals’ privacy rights.

We collect information only where we have specific legal authority to do so in order to administer our responsibilities under the Social Security Act.  When we collect personal information from individuals, we advise them of our legal authority for requesting the information, the purposes for which we will use and disclose the information, and the consequences of their not providing any or all of the requested information.  The individuals can then make informed decisions as to whether or not they should provide the information.

Are individuals afforded an opportunity to consent to only particular uses of the information?

When we collect information from individuals, we advise them of the purposes for which we will use the information.  We further advise them that we will disclose this information without their prior written consent only when we have specific legal authority to do so

(e.g., the Privacy Act). 

·         Does the collection of this information require a new system of records under the Privacy Act (5 U.S.C. § 552a) or an alteration to an existing system of records?

No.  An existing system of records, Master Files of SSN Number Holders and SSN Applications (60-0058), covers the SSNEC System, and it does not require any changes.

 

PIA CONDUCTED BY PRIVACY OFFICER, SSA:

______________________________                     September 25, 2007

SIGNATURE                                                          DATE

PIA REVIEWED BY SENIOR AGENCY PRIVACY OFFICIAL, SSA:

   /S/    Thomas W. Crawley________                       September 27, 2007

SIGNATURE                                                             DATE