'Do You Really Need My Social Security Number?' Data Collection Practices in the Digital Age
North Carolina Journal of Law and Technology, Vol. 10, No. 1, 2008
58 Pages Posted: 30 Oct 2010
Date Written: 2007
Abstract
The emergence of giant data aggregators, the prevalence of outsourcing, and the continued expansion of the internet have converged in recent years to create conditions ripe for identity theft on an unprecedented scale. Despite universal acknowledgement in the literature of the connection between social security numbers and identity theft, a fundamental question remains not just unanswered, but also unasked: Do data aggregators really need to collect and use the social security number? The absence of this question and its answer is a failure of the law. Rational actors will engage in behaviors so long as the expected benefits exceed the expected losses. Thus, data aggregators continue their data collection practices even where alternatives are available because others, including consumers, bear the brunt of the $53 billion lost and hundreds of millions of hours wasted annually as a result of identity theft. In the wake of numerous high-profile data breaches within the last five years, consumers have advanced various theories of recovery after their data has been compromised. Claims based on breach of contract, negligence, breach of fiduciary duty and others have all been consistently rejected by the courts. Recognizing the magnitude of the problem and lack of adequate federal or judicial action, over twenty states have enacted laws since 2001 aimed at reducing social security number misuse and overuse. Yet these laws are riddled with exceptions and, like the federal laws before them, largely preserve the status quo. This paper discusses the recent cases and statutes addressing data privacy and security, and concludes by suggesting specific federal reforms that would squarely confront the problem of social security number overuse while minimally impacting current business practices.
Suggested Citation: Suggested Citation