BILL ANALYSIS SENATE JUDICIARY COMMITTEE Martha M. Escutia, Chair 2003-2004 Regular Session AB 46 A Assembly Member Simitian B As Amended July 8, 2003 Hearing Date: August 19, 2003 4 Civil Code 6 MTY:rm SUBJECT Colleges and Universities: Use of Social Security Numbers DESCRIPTION This bill would prohibit any private or public university from using a student's social security number for identification in a manner that is available to the public or to an unauthorized third party. The bill would exempt from this prohibition disclosures or uses of social security numbers authorized under the federal Family Educational Rights and Privacy Act (FERPA). BACKGROUND Recent press accounts suggest that universities' practice of using social security numbers as identification numbers for students have caused some students to be victims of identity theft. This bill, as well as SB 25 (Bowen), seek to address this problem by restricting the sharing and use of social security numbers by educational institutions. CHANGES TO EXISTING LAW Existing law prohibits private entities and individuals from making social security numbers public. Existing law also prohibits those entities and individuals from using social security numbers as passwords or identification card numbers for new accounts. [Civil Code Sec. 1798.85.] Existing federal law , the Family Educational Rights and (more) AB 46 (Simitian) Page 2 Privacy Act (FERPA), provides that federal funds shall not be made available to any educational institution which has "a policy or practice of releasing, or providing access to" a student's social security number. Exceptions to this rule include: 1) when a student over the age of 18 has consented (or, if the student is not 18, with the parents' consent), 2) to other schools for certain educational purposes, 3) for financial aid purposes, or 4) in response to subpoenas, court orders, or requests by certain government agencies. This bill would provide that a public or private university or college in the state may not use a student's social security number for identification in a manner that is available to the public or an unauthorized third party. This bill would exempt the following uses from the general prohibition: 1) for purposes of internal verification or nonpublic administrative purposes, 2) communications with a third party who is authorized by the student to receive the social security number, 3) as permitted under FERPA, and 4) as required by state or federal law. COMMENT 1. Need for the bill The author's office writes that: Identity theft is among the fastest growing crimes in America. The frequent and public use of social security numbers makes them particularly vulnerable to theft. Restricting the public display of social security numbers, which are key financial identifiers, is an important component in protecting students from identity theft. Assembly Bill 46 prohibits California colleges from using social security numbers as public identifying numbers . . . . Under the bill, social security numbers may be used for designated administrative purposes including internal verification, communication with an authorized third party, and as required by state or federal law. AB 46 (Simitian) Page 3 2. Bill essentially codifies existing law Existing federal law already prohibits any institution of higher education that receives federal funds from sharing or releasing a student's social security number, except in certain specified situations. These exceptions include: 1) with the consent of the student (if over 18) or the student's parents (if under 18), 2) to other schools for certain educational purposes, 3) for financial aid purposes, or 4) in response to subpoenas, court orders, or requests by certain government agencies. This bill mirrors the federal law, providing that permissible uses under federal law are also permissible under state law. As a result, assuming that universities are complying with federal law, the bill does not appear to significantly restrict their existing practices. Specifically, Committee staff is informed that the public universities believe that the use of social security numbers on some ID cards is permitted under federal law because it does not involve a "release" of a social security number and because the student has implicitly consented to the use of the number. If this interpretation is correct, then this bill might not prevent what press accounts suggest is one of the most significant problems with respect to colleges' use of social security numbers - the printing of those numbers on ID cards. In addition, existing state law already prohibits the public use of social security numbers by private universities, including the use of social security numbers on ID cards [Civil Code Sec. 1798.95]. By including private universities in the bill, and by exempting uses permitted under federal law, this bill might actually loosen the restrictions on private universities and permit them to use social security numbers on ID cards. WOULD THE BILL RESULT IN ANY ADDITIONAL PROTECTIONS FOR STUDENTS? 3. The Committee has already passed another bill on the AB 46 (Simitian) Page 4 same subject Earlier this year, the Committee passed SB 25 (Bowen), which addresses the same issue as this bill. SB 25 would subject state and local agencies, including the state's public higher education institutions, to the same restrictions that currently exist in state law for private entities. Those provisions in state law are more restrictive than federal law in that they specifically state that social security numbers may not be printed on ID cards or printed on mailers, two practices which are probably permitted under federal law. As a result, SB 25 addresses practices which are not addressed by this bill. SHOULD THE COMMITTEE PASS A BILL WHICH PROVIDES FEWER PROTECTIONS THAN A BILL ALREADY APPROVED BY THE SENATE? Support: California State University; Board of Governors of the California Community Colleges Opposition: None Known HISTORY Source: Author Related Pending Legislation: SB 25 (Bowen) would extend existing restrictions on the use of social security numbers by private entities to all public entities. The bill is awaiting a hearing in the Assembly Appropriations Cmte. If this bill and SB 25 were both to be chaptered, their provisions would conflict in several respects. AB 763 (Liu) would clarify that the existing restriction on printing social security numbers of mailers also prohibits the mailing of a social security number in a manner that makes it visible. Prior Legislation: None Known AB 46 (Simitian) Page 5 Prior Vote: Assembly Public Safety Cmte. (5-2); Assembly Appropriations Cmte. (17-6); Assembly Floor (51-29); Senate Education Cmte. (12-0) **************