social security money

Recent high-profile breaches illustrate the need to protect Social Security numbers by businesses. But some say the way to protect them is by not using them at all, and instead move toward using some other kind of identifier. Still, beyond the benefits, there are some drawbacks if the U.S. was to start using a national digital ID system, according to data security lawyers.

Basically, a digital ID, which should be encrypted and secure, is a way to replace the Social Security number for use in the private sector. But Behnam Dayanim, an attorney with Paul Hastings, told Legaltech News that the idea of a national identifier has always been “controversial.”

Social Security numbers have “come to be used as a proxy for an identifier,” Dayanim explained, adding that for companies, this was never supposed to be the case. However, many companies no longer store Social Security numbers in electronic records, given the risk of them getting released in a breach. Once actors get hold of a Social Security number, they can use it to get access to all sorts of information, Dayanim said.

Still, Social Security numbers are so ubiquitous that “that number is with us for the foreseeable future,” he said. And, given the number of breaches, “I don't think anybody can regard their Social Security number as truly secure at this point.”

But a digital identifier would pose issues as well, given that it would become an important piece of information and thus be sought after by hackers. “No matter what you do, you will have to protect the identifier,” Dayanim said.

He said that even with another identification system in place, there will still be the risk of lawsuits, as “you are never going to get away from that.” There is also the risk of enforcement actions, which will continue.

Also, if an identifier is used by the financial services sector, “you would need buy-in from the entire financial services industry,” Dayanim said. That means such organizations as banks and crediting-reporting agencies.

Dayanim said legal issues flow from some basic questions about the use of identifiers. He says these include:

• What form will the identifier take?

• How will it be protected?

• What are the consequences if it were to be compromised?

There are also proposals to use a biometric-based identifier, such as from a fingerprint or retina, which have the advantage that they cannot be changed, Dayanim said. But they too have limitations, as in his view, “biometrics cannot be viewed as a panacea.”

Laura Jehl, an attorney with Baker & Hostetler, noted that the use of blockchain technology is one option to remedy the concerns with identification getting stolen by hackers. The use of blockchain could “solve all sorts of problems,” she told Legaltech News. Blockchain is “immutable and transparent,” she added, also pointing out that by use of this technology users “only share information [they] need to share for that transaction.”

This is crucial, as consumer advocates and others often point out that credit-reporting agencies gather data on individuals whether the individual agrees to it or not. There is no requirement that the individual gives his or her permission to gather the data.

In response to some of these concerns, the Sovrin Foundation has come up with an identity network. It is not an identity provider, the foundation says, but “a global identity network which allows people to securely store identity information over which the individual has total control.”

The foundation adds, “This is called 'self-sovereign' identity. We envisage that it will be used by IDPs [identity providers] and many other services at the request of individuals who need to prove their identity.”

These issues, though, will need to be confronted sooner rather than later. There are further upcoming regulatory issues, such as the European Union's forthcoming General Data Protection Regulation (GDPR), which includes the right to be forgotten. This allows individuals living in the EU to request personal information be deleted from company records.