Elimination of Social Security Numbers as Primary Identifiers and Identity Management

The Federal Trade Commission has issued its final report on "Security in Numbers: SSNs and ID Theft". The report, based upon extensive fact-finding by the FTC that included a workshop with remarks from three experts from higher education, focuses on the use of SSNs in the private sector. The report was developed pursuant to a recommendation of the President's Identity Theft Task Force, which was established in May 2006 to develop a coordinated plan to prevent identity theft, prosecute identity thieves, and help victims recover from the crime.

Below is a summary of the final recommendations:

Recommendation 1: Improve Consumer Authentication (to make it more difficult to use SSNs to commit identity theft) - "the Commission recommends that Congress consider establishing national consumer authentication standards covering all private sector entities that maintain consumer accounts."

The U.S. Department of Education, through its Family Policy Compliance Office, has issued its Final Rules on the Family Educational Rights and Privacy Act (FERPA). The rules cover a variety of issues of interest to IT leaders, ranging from information security topics to the use of SSN's and Student ID's as electronic identifiers. A more thorough analysis will be available in the next few days.

For more information, see:

Federal Register Notice: http://www.access.gpo.gov/su_docs/aces/fr-cont.html

Final Rule (PDF): http://www.ed.gov/legislation/FedRegister/finrule/2008-4/120908a.pdf

Final Rule (HTML): http://www.ed.gov/legislation/FedRegister/finrule/2008-4/120908a.html

The U.S. Department of Education has issued a Notice of Proposed Rulemaking with proposed regulations pertaining to the Family Education Rights and Privacy (FERPA). Among other things, "the proposed regulations respond to changes in information technology and address other issues identified through the Department's experience administering FERPA," according to the Notice. Additionally, the regulations are needed to implement amendments to FERPA contained in the USA Patriot Act and the Campus Sex Crimes Prevention Act, to implement two U.S. Supreme Court decisions interpreting FERPA, and to make other necessary changes.

Among the IT-related changes are:

The Federal Trade Commission (FTC) has announced that it is seeking comments on the use of Social Security Numbers (SSNs) in the private sector. This inquiry is in response to a recommendation in the President’s Identity Theft Task Force Strategic Plan that called for the development of a comprehensive record on the uses of the SSN in the private sector and evaluate the necessity of those uses.