Policy 2.32 and 3.17 - Collection and Use of Social Security Numbers

Date: March 20, 2017

Supersedes:
NA

This policy explains the permissible collection and use of employee and student Social Security Numbers by college personnel.

Purpose

To ensure that policies and procedures relating to the collection, maintenance and dissemination of Social Security Numbers (SSNs) are implemented and maintained at Schenectady County Community College (SCCC) in accordance with state and federal regulations, as well as applicable SUNY policy.

Policy

SCCC is committed to maintaining the privacy and confidentiality of an individual’s SSN as mandated by law. It is the policy of SCCC that the use of the SSN as a common identifier and the primary key to databases be discontinued, except where required for employment, financial aid, and a limited number of other permissible business transactions. Further, the college shall limit the collection of social security numbers to only when required by law or where there is a recognized business need.

Disclosure statements explaining why the SSN is being collected and how it will be used will be provided whenever a SSN is requested, in compliance with the Federal Privacy Act of 1974.

Background

Legal Requirements: Collection, Use, and Dissemination of SSNs

(a) New York State Law Education Law Section 2-b

New York State law prohibits Institutions of higher education from displaying student SSNs on public listings of grades, class rosters, student ID cards, student directories, or anything else unless specifically authorized or required by law.

(b) Family Educational Rights and Privacy Act (FERPA)

FERPA protects the privacy of student educational records and requires schools to minimize collection and use of student SSNs. SSNs should be collected only for the purpose of beginning the application process (before a student identification number is assigned), processing student loans, employment, and to meet other legal obligations.

(c) State University of New York Policy Use of Social Security Numbers, Document Number: 6604, Effective Date: July 01, 2001

The State University policy concurs with the general intent of Education Law Section 2-b, to eliminate the unnecessary use and publication of student social security numbers so as to reduce the potential for misuse. Accordingly, any unnecessary use of student social security numbers, which it is practical to eliminate and at reasonable cost to the college, should be eliminated. 

Guidelines

  1. Many of the measures required in this policy have been for all practical purposes already put in place, but no formal policy had previously been adopted by the College. For example, a movement away from social security numbers to randomly generated student and employee identification numbers had been implemented years ago. There are areas where the collection of social security numbers exists, particularly at the entry point for students (admissions and financial aid), employment, and contractors who use their social security number as a tax ID number. In those areas where SSNs are collected, used and stored, the College will undertake implementation of this policy. Data collectors and custodians will be responsible for maintaining the privacy and confidentiality of SSNs on their systems as mandated by law.
  2. All forms on which persons are required to provide Social Security Numbers must now contain or have appended to them a statement explaining the College’s request; e.g., the legal obligation on which the request is based, if there is one and the use that will be made of the Social Security Number. For example, on an employment form, the following text can be used: “The Federal Privacy Act of 1974 requires that you be notified that disclosure of your Social Security Number is required pursuant to the Internal Revenue Service Code. The Social Security Number is required to verify your identity.”
  3. If the Social Security Number is not required, but requested, the fact that supplying it is voluntary should be noted and the option of assigning a temporary, “dummy number” should be offered. For example, on an admissions application, the following text may be used: The Federal Privacy Act of 1974 requires that you be notified that disclosure of your Social Security Number is voluntary and not required for application to SCCC. If you do not choose to disclose your Social Security Number, a temporary identification number will be generated for you.
  4. If the Social Security Number is not mandated by law, but is needed for a business purpose, e.g., in the early stages of the admissions process (e.g., to match standardized test scores or FAFSA information or for recovery chargeback money), a disclosure statement of the following form may be used: The Federal Privacy Act of 1974 requires that you be notified that disclosure of your Social Security Number is not mandated by law; however, failure to do so may delay or even prevent your enrollment. The College uses your Social Security Number to [insert purpose of collection]. The College will not disclose your Social Security Number for any purpose not required by law without your consent.
  5. The SCCC Identification Number will be assigned to all students, employees, and associated individuals at the earliest point possible in the individual’s contact or association with the College. The Identification Number replaces the Social Security Number as a common, unique identifier and key to databases. The Identification Number will be used in all future electronic and paper data systems to identify, track, and service individuals associated with the College.
  6. Social Security Numbers will be stored as a confidential attribute associated with an individual. They will be used as allowed and mandated by law.
  7. Grades and other pieces of personal information will not be publicly posted or displayed with the Social Security Number. Class lists, rosters, student ID cards, and other reports will not display the Social Security Number: the SCCC Identification Person Number will be used instead.
  8. Encryption of Social Security Numbers is required between server and employee workstations and whenever data is transmitted over unsecured networks.
  9. Paper and electronic documents containing Social Security Numbers will be handled, used, stored, and disposed of in a secure fashion. Records containing SSNs or other confidential information will not be downloaded or stored on College or personal computers or other electronic devices that are not secured against unauthorized access.
  10. Social Security Numbers will be released by the College to entities outside the College only as allowed by law, when permission is granted by the individual, or when Legal Counsel has approved the release; and when released, such release shall be in as secure a manner as practicable.

Compliance

If there has been a breach of data security, including Social Security Numbers, the College will implement measures set forth in its data breach notification policy as required by State Technology Law Section 208(8). An employee or student who has intentionally breached the confidentiality of Social Security Numbers will be subject to disciplinary action or sanctions up to and including discharge and dismissal in accordance with College policy and procedures. Oversight of this policy shall be the responsibility of the Chief Information Officer or his/her designee. This policy shall become effective ninety (90) days after date of adoption to allow the affected personnel time to modify any business processes needed to enable full compliance.