Personal Privacy in an Information Society. Conclusions


As noted above, the Commission believes that most concern over the use of the SSN as identifier and authenticator can be traced to two sources: (1) the belief that the SSN may facilitate the exchange, consolidation, and linkage of records or information about individuals for purposes which may be unfair to them; and (2) resentment at being labelled with a number. Revisions in Federal policy on the use of the SSN must recognize these concerns.

As to the first point, the Commission agrees with many students of the issue 8 that the SSN is a surrogate for the problem of record linkage, exchange, and consolidation. Much of the Commission's work in other areas has focused on finding solutions to this problem. Although the SSN is often used to facilitate record exchanges, it is only one of many possible ways that records and information can be, and currently are being, linked, exchanged, and consolidated. Technical studies 9 indicate that record-matching techniques using a combination of attributes and labels other than numerical labels (e.g., name, address, birth date, sex) are entirely adequate in many situations and record-keeping organizations do use such means of identification and authentication instead of the SSN. The U.S. Department of Transportation's National Driver Register office, and TRW Credit Data, provide two examples of organizations with large record systems that rely largely on labels other than numerical labels for identification and authentication purposes. The National Driver Register keeps records of license suspensions and revocations throughout the United States and supplies information to States upon request. TRW Credit Data is a large, automated credit bureau described in detail in Chapter 2.

The National Driver Register (NDR) contains about 5.77 million records. It receives 94,000 inquiries daily, produces 3,500 possible matches every day, and mails 900 probable matches to the States. Yet the SSN (or another unique identifier) is not the primary identifier used in this system. Instead, NDR first uses name and date of birth as primary identifiers and then uses sex, height, weight, and eye color to discriminate among records of people with similar or identical names and birth dates. The SSN is, in some cases, used to facilitate this discrimination process, but it is not available for all drivers listed in the system.

Similarly, TRW Credit Data, which has approximately 50 million records in its system, does not use the SSN or another unique identifier as its primary identifier. Like the NDR, it relies on data elements such as name, address, zip code, and age to facilitate its matching processes.10

It is true that if organizations other than the Social Security Administration were forbidden to collect and use the SSN, their exchange of records might be inhibited for a time. Such a prohibition or restriction would, however, be extraordinarily costly and cumbersome, and it would also inhibit record exchanges everyone perceives as wholly desirable along with those perceived to be threatening. Furthermore, organizations which now rely on the SSN would devise alternative methods of identification and authentication that are equally effective for record exchanges.

In any case, the question of the appropriate limitations on exchange of records would remain even if the SSN were done away with altogether. The Commission finds that restrictions on the collection and use of the SSN to inhibit exchange beyond those already contained in law would be costly and cumbersome in the short run, ineffectual in the long run, and would also distract public attention from the need to formulate general policies on record exchanges.

The Commission is sensitive to the second point-the belief that being labelled with the SSN is dehumanizing. Clearly, a society in which each of us is called upon at every turn to state "name, rank, and serial number" is not pleasing to contemplate. The Commission fails to see, however, how drastically restricting the use of the Social Security number would make much difference in this respect, since any other widely used numerical label would, as pointed out earlier, be likely to engender the same feeling. Nonetheless, the Commission believes that some of the concern about dehumanization could be diminished if government agencies and private organizations would examine the circumstances under which they request an individual's SSN, and continue only those in which the SSN furthers a legitimate and valid record-keeping purpose.