It has been a difficult couple of months for many of the data broker industry's heavyweights. In mid-February, ChoicePoint reported that credit reports and other data for more than 140,000 people were provided to criminals posing as legitimate businesses. Later that month, Sen. Charles Schumer, D-N.Y., chastised Westlaw for the ease in which sensitive records can be attained through "egregious loopholes" in its database access policies. Finally, LexisNexis reported that "potentially fraudulent access" may have compromised the records of 32,000 individuals.
These incidents have led to calls for increased regulation of data brokers and other consumer information companies, as well as to questions about privacy and the information that these brokers hold. Social Security numbers (SSNs) are of particular concern, since they are often the base on which identity fraud is built. But what about other information such as names, addresses, and phone numbers? Or more detailed information such as birth date, employer, income, marital status, and home value? Or potentially harmful or embarrassing information such as credit reports, criminal records, bankruptcies, or lawsuits? How does the law cover the creation and distribution of these records?
Privacy Is Not Absolute
Privacy is a complicated area of the law. The Constitution does not identify a specific right of privacy. The privacy rights that we enjoy are implied from a variety of sources and include the right to life and liberty, freedom from warrantless searches, and even the rarely mentioned 3rd Amendment right to not have soldiers "quartered in any house." Courts have also made it clear that privacy of personal information is not absolute. There are few facts about ourselves that are not divulged at one time or another. The more such facts are divulged in the normal course of life, the less privacy protection they receive.
Social Security numbers are especially problematic, since they can be used to forge new and illicit identities. There are contrasting popular views regarding the use of SSNs. One view is that they are only to be used for income tax and Social Security purposes. Another view perceives that they are national identification numbers, available for use by both public and private entities.
Social Security Numbers
The law, of course, lies in the middle. Social Security numbers are controlled by a number of federal statutes that dictate what they can be used for and under what circumstances they can be disclosed. Many government benefit programs require SSNs to determine eligibility. Obtaining a commercial driver's license requires an SSN, and people who pay child support are required to submit them in order to create tracking databases. Similar federal laws allow states to require SSNs on state documents such as professional and marriage licenses, vital statistics documents, and court filings. IRS regulations require private companies to obtain SSNs for any person receiving taxable income--such as wages, dividends, interest, or similar payments.
Many private companies, particularly financial companies, healthcare organizations, and insurers, use SSNs to verify identity. While laws exist that restrict how such companies can distribute SSNs, those laws do not necessarily regulate the right of the company to request an SSN. As a result, it has become common practice to require an SSN in order to obtain credit, participate in an HMO, or obtain insurance. The law, however, may not require the use of SSNs for these purposes. …