Summary
Law enforcement agencies' efforts to investigate the events of September 11th increased awareness that federal agencies collect and maintain personal information on individuals such as name, social security number, and date of birth that could be useful to law enforcement. The Social Security Administration (SSA) is one of the country's primary custodians of personal information. Although the Privacy Act protects much of this information, generally, federal agencies can disclose information to law enforcement. However, determining when the need for disclosure takes priority over an individual's privacy is not clear. GAO was asked to describe (1) SSA's disclosure policy for law enforcement and how it compares with the Privacy Act and those of other federal agencies, (2) SSA's experience sharing information with law enforcement, and (3) law enforcement's experience obtaining information under SSA's policy.
Although SSA's disclosure policy permits the sharing of information with law enforcement entities, it is more restrictive than the Privacy Act and the disclosure policies of most federal agencies. While the Privacy Act permits disclosures to law enforcement for any type of crime, SSA only allows disclosures under certain conditions. For example, for serious and violent crimes, SSA will disclose information to law enforcement if the individual whose information is sought has been indicted or convicted of that crime. Even when information is disclosed, it might be limited to results obtained from verifying a social security number and name unless the investigation concerns fraud in SSA or other federal benefit programs, then the agency can work with law enforcement officials as part of a task force or joint investigation. However, the disclosure policies for law enforcement of the Internal Revenue Service (IRS) and the Census Bureau, both of which have requirements prescribed in their statutes, are also more restrictive than the Privacy Act and the policies of most federal agencies. SSA officials consider SSA's disclosure policy integral to carrying out the agency's mission. The various restrictions in SSA's disclosure policy create a complex policy that is confusing and could cause inconsistent application across the agency's more than 1,300 field offices. This could result in uneven treatment of law enforcement requests. Because aggregated data were not available, GAO was unable to assess the extent to which SSA does not consistently apply its policy. However, GAO was told of instances in which SSA officials in some field offices did not give law enforcement information that appeared to be permitted under the policy as well as instances in which they gave them more than what appeared to be allowed. Generally, law enforcement officials find the limited information SSA shares useful to their investigation, but many law enforcement officials, particularly state and local law enforcement officials, are not familiar with the policy or the process for requesting information from SSA. Most law enforcement officials expressed a desire for more information than is currently permitted under SSA's policy, but SSA maintains that providing more information would hurt its ability to carry out its primary mission.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change
from "In process" to "Implemented" or "Not implemented" based on our follow up work.
Director:
Team:
Phone:
No director on record
No team on record
No phone on record
Recommendations for Executive Action
Recommendation: To help ensure consistent application of SSA's disclosure policy for law enforcement in all of its offices and to better assist law enforcement agencies making disclosure requests, the Commissioner of SSA should take steps to eliminate confusion about the agency's disclosure policy. These steps could include clarifying SSA's policy; providing additional or refresher training to staff; or delegating decision-making authority for law enforcement requests to specified locations such as the OIG, regional privacy coordinators, or other units that SSA determines would have expertise in this area.
Agency Affected: Social Security Administration
Status: Implemented
Comments: SSA makes instructions for the agency's disclosure policy for law enforcement available to the public and to law enforcement. The agency provides extensive instructions to its employees through the Program Operations Manual System (POMS) and the agency's regional offices Intranet sites. In addition, SSA reviewed its policy and revised the POMS sections that address law enforcement disclosures. Further, SSA reported that it is providing refresher training as appropriate to clarify SSA's disclosure policy.
Recommendation: To help ensure consistent application of SSA's disclosure policy for law enforcement in all of its offices and to better assist law enforcement agencies making disclosure requests, the Commissioner of SSA should provide law enforcement with information on SSA's disclosure policy and procedures. For example, this information could be provided on its Web site, in informational pamphlets, or some other written format.
Agency Affected: Social Security Administration
Status: Implemented
Comments: The Social Security Administration (SSA) reviewed and revised its policy for disclosing information to law enforcement and published its policy in the Program Operations Manual System (POMS). The revised law enforcement and privacy policies are available to the law enforcement community and the public via SSA's Internet web site.
