Georgia Southern University Eagle ID Project

Georgia Southern University
Social Security and Personal Identification Numbers Security Policy

Policy Applicants & Students Employees & Affiliates

I. Purpose

This policy addresses the requirements of the Federal Privacy Act of 1974 and amendments regarding requests by the University for Social Security Numbers (SSN) and provides guidelines for policies and procedures on the proper use and disclosure of the SSN and other identification information to ensure that the Federal Privacy Act requirements are met.

II. Background

The Federal Privacy Act of 1974 and amendments establish guidelines under which any state agency may request SSN from individuals. Individuals may not be required to give their SSN unless specific to a Federal or State statute. Agencies may not deny any right, benefit or privilege to any individual because of their refusal to disclose their SSN. It is incumbent on the University to inform the individual whether the disclosure is mandatory or voluntary, by what statute or other authority, and what uses will be made of the SSN. (Reference A)

The SSN was not designed to serve as a universal identification mechanism. Casual use of the SSN has led to the escalation of the crime of identity theft. With the SSN accessible to so many people, it is possible for someone to fraudulently use an individual's SSN to assume another identity and gain access to financial and other personal information, risking an individual's personal credit and confidentiality. For many years, the SSN has been used as an identification number in many computer systems, giving access to private information and allowing an easy way to link database information. Federal Privacy Act compliance serves as a deterrent to identity theft and its consequences. It is the intent of the University to take the necessary precautions to protect the identity of all of its constituents by minimizing or eliminating the use of SSN's for identification purposes.

III. Collection and Release of the SSN

Students

The Board of Regents (BOR) supports the use of alternate identifiers for students as indicated in the BOR policy manual:

"The social security number shall be required from all entering students for a permanent and lasting record. When possible, an alternative number will be assigned and used by institutions for all purposes which do not require the social security number. In no event shall grades be posted by using the social security number. The University System of Georgia is dedicated to insuring the privacy and proper handling of confidential information pertaining to students and employees."

Georgia Southern University will request that a student provide a SSN at the time of application to the University. The SSN will not be used as the student ID number but will be provided to entities requiring SSN, including but not limited to the federal government for financial aid and Tax Relief Act (1997) reporting, Immigration and Naturalization Service, the Board of Regents of the University System of Georgia for statistical reporting purposes, and as required by court order in accordance with the Family Educational Rights and Privacy Act. Information on collection and disclosure of a student SSN can be found in the General Catalog.

Employees

Georgia Southern University will require that an employee provide a SSN at the time of employment. The SSN will not be used as an Employee ID number for internal University uses, but will be provided to external entities requiring a SSN, including but not limited to federal, state and local governments, insurance carriers, and retirement programs. Individuals who are affiliates or vendors will be required to provide a SSN for mandated tax reporting purposes.

IV. Regulations

  1. Systems purchased or developed by Georgia Southern University will not use SSN's as identifiers unless required by law or business necessity.
  2. All Georgia Southern University employees, students and other individuals that require an identifying number will be assigned a unique identification number that is not the same as, or derived from, the individual's SSN. Appropriate security and care will be taken to ensure that access and use of these unique identification numbers is restricted unless required by law or as a business necessity.
  3. Systems purchased or developed by Georgia Southern will use SSN's as data elements only, not as keys to databases. SSN's will not be used for identification purposes unless required by law or as a business necessity.
  4. Systems purchased or developed by Georgia Southern will not display SSN's visually, whether on computer monitors, or on printed forms or other system output, unless required by law or business necessity.
  5. Name and directory systems purchased or developed by Georgia Southern will be tied to an individual's unique identification number, not SSN.
  6. When databases require SSN's, the database will automatically cross-reference between the SSN and other information through the use of conversion tables with systems or other mechanical mechanisms.
  7. No system or technology will be developed or purchased by Georgia Southern unless it is compatible with these regulations.
  8. All campus entities maintaining files utilizing the SSN for identification or any other purpose will ensure that access or use of such information is properly controlled and restricted to prevent unauthorized use.

Reference. A
DISCLOSURE OF SOCIAL SECURITY NUMBER
Section 7 of Pub. L. 93-579 provided that: '(a)(1) It shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his social security account number. '(2) the provisions of paragraph (1) of this subsection shall not apply with respect to - '(A) any disclosure which is required by Federal statute, or '(B) the disclosure of a social security number to any Federal, State, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual. '(b) Any Federal, State, or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.'