Guidelines on Use of the Social Security Account Number by the University

It is the purpose of these guidelines to:

1. Review the conditions placed on the University by federal law for use of the social security account number.

2. Set forth examples of permissible and impermissible use of the social security account number.

3. Establish policy for the University in accordance with requirements of federal law.

Pertinent Federal Law

Effective December 31, 1974, the federal Privacy Act of 1974 conditioned use of the "social security account number" of an individual by any "Federal, State or local governmental agency." The basic requirements of the act were two-fold:

1. that no governmental agency could "deny to any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his social security account number" except refusal to disclose after a request pursuant to requirements of pre-existing federal statutes or pursuant to pre-existing federal or state statutes or regulations through which a system of records had already (before January 1, 1975) been set up.

2. that solicitation by a governmental agency of an individual's social security number be accompanied by the agency's statement of whether the disclosure is mandatory or voluntary, what statutory or other authority supports the request, and what uses will be made of the number.

When first enacted, the Privacy Act had no penalty for its violation nor statutory enforcer of its provisions. Through the Tax Reform Act of 1976 (94 P.L. 455), however, violation of the act was made a misdemeanor. Then, through enactment in 1981, of the Omnibus Reconciliation Act (97 P.L. 123) Congress raised violation of the act to a felony for which the convicted violator "shall be fined not more than $5,000 or imprisoned for not more than five years, or both. "However, with these changes, four specific uses of the social security number were made permissible bases for requiring disclosure of the social security number. These were "the administration of any tax, general public assistance, driver's license, or motor vehicle registration law within [the requesting or using agency's] jurisdiction."

Particular uses of the Social Security Number by the University

The social security number is a convenient, established personal identifier for keeping track of extensive administrative information. The number can be used to process tuition bills, announce and record grades, keep track of campus vehicles, maintain infirmary records, process graduate school applications, and report data to federal and state authorities, to name a few applications. However, only some of the foregoing can be accomplished through coerced disclosure of the social security number and none can be accomplished without disclosure of the use to which the number is put, without creating the elements of a felony crime.

For example, a student may be requested to disclose on the application for resident tuition status the student's social security number. The model application at Appendix B of the residence Manual, though, conforms to statutory requirements by placing the word "voluntary" beside the appropriate blank on the form and setting forth on the form the following acknowledgment of the resident status applicant:

I hereby acknowledge that completion of Item 2 (Social Security number) is voluntary, is requested by the institution solely for administrative convenience and record-keeping accuracy, and is requested only to provide a personal identifier for the internal records of this institution.

On the other hand, N.C.G.S. § 116-44.4(f) authorizes the Boards of Trustees of each constituent institution to enact ordinances for the registration of vehicles on campus. This is an express statutory grant of authority under which a campus traffic ordinance could require that vehicle owners disclose their social security numbers as a means for recording and tracking vehicle ownership. Such use is expressly authorized. Furthermore, if a campus traffic ordinance requiring such use of the social security number had been enacted and the consequent record system was functioning prior to January 1, 1975, this use would be authorized by the Privacy Act as originally passed by Congress.

Similarly, mandatory disclosure of the social security number to trace debtors and collect debts owed the institution by set-off against state income tax refunds under N.C.G.S. Chapter 105A (Set-Off Debt Collection Act) is authorized. This is because the set-off process, as stated by the North Carolina Attorney General, is incident to the administration of a tax, a use authorized by the Tax Reform Act of 1976. (The Attorney General has also issued an opinion that disclosure by an institution pursuant to debt collection under the State Employee Debt Collection Act, N.C.G.S. Chapter 143, Article 60, is permissible provided that the disclosure be treated as a voluntary disclosure to be accompanied by the requisite institutional statement to the individual.)

In general, institutional use of the social security number must be accomplished by the prior institutional statement of basis (voluntary/mandatory), authority for disclosure, if any, and intended use. More often than not, the individual has the option of disclosure or nondisclosure. It is in this typical context that use of the number for admissions applications, tuition billing, grade reporting, infirmary records, and data reporting to external agencies will fall.

Administrative Action

It is the policy of the University of North Carolina that the social security account number shall be used within the university only in a manner consistent with the laws of the United States. Such usage shall be understood to include the following:

1. That any University use of the social security number shall fall within those uses authorized by federal law for mandatory disclosure or be uses where the individual is requested to voluntary disclose the number.

2. That uses of the social security number authorized by federal law for mandatory disclosure from the individual consist only of the following:

a. disclosure required by federal statute.

b. disclosure to a federal, state, or local governmental agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to January 1, 1975.

c. disclosure to any state, political subdivision, or agency to establish personal identification pursuant to administration of a tax law within the jurisdiction of the state or political subdivision.

d. disclosure to any state, political subdivision, or agency to establish personal identification pursuant to administration of a general public assistance law within the jurisdiction of the state or political subdivision.

e. disclosure to any state, political subdivision, or agency to establish personal identification pursuant to administration of a driver's license law within the jurisdiction of the state or political subdivision.

f. disclosure to any state, political subdivision, or agency to establish personal identification pursuant to administration of a motor vehicle registration law within the jurisdiction of the state or political subdivision.

3. That request by an employee of the University of North Carolina for disclosure and release of a social security number with respect to University business for a use not previously authorized shall be supported by a University statement to the individual indicating (a) whether the disclosure is mandatory or voluntary, (b) what statutory or other authority supports the disclosure, and (c) what use will be made of the disclosure.

4. That a constituent institution, in lieu of soliciting disclosure of a social security number may establish a "dummy" social security number or other identifier for an individual, provided that the constituent institution does not have an affirmative duty, established by federal law, to obtain the actual social security number.

5. That a constituent institution in lieu of soliciting use of a social security number already disclosed to it, may translate or encode the number into a form in which the social security number is not personally identifiable except by application of a decoder and then may use the number as transformed without reference to restriction under federal law, provided that the institution does not have an affirmative duty, established by federal law, to use the actual social security account number.

[This is a rewrite of Administrative Memorandum #172.]