University of Maine System in violation of Privacy Act

System's solicitation of Social Security Numbers not in compliance with federal law

By Ryan Robbins
The Maine Campus

The University of Maine System's solicitation of students' Social Security numbers is in violation of federal law and may also be in violation of state law.

The federal Privacy Act requires government agencies to inform individuals whether disclosure of their Social Security number is mandatory and by what law or regulation, and what uses will be made of the number.

Currently, the University of Maine System admissions application asks applicants for their Social Security number, but it does not include a disclosure notice.

While the federal law covers only local, state and federal government agencies, Maine law goes one step further by prohibiting businesses from using Social Security numbers.

Assistant to the Chancellor Kent Price said he was not aware of the Privacy Act's disclosure requirement. "I don't recall any routine set of regulations being sent here from Washington," he said.

Joyce Henckler, assistant vice president for Enrollment Management at UMaine, said the admissions application implies that disclosure of a person's Social Security number is voluntary because the application doesn't say it's mandatory.

"As far as I know, everyone's aware" of the Privacy Act's requirement for a disclosure notice, she said.

Associate Director for Undergraduate Admissions Bill Munsey, said he didn't know whether the university system is considered to be a government agency of the state of Maine and covered by the law.

The seven UMS campuses used to use their own applications until the early 1970s, he said. He said that according to Registrar Emeritus John Collins, the UMS considers itself to be exempt from the disclosure notice requirement.

The Privacy Act exempts government agencies that required disclosure of Social Security numbers before the law was enacted in 1975. However, the exemption allows government agencies to deny rights, benefits or privileges to people who refuse to disclosure their Social Security number if disclosure was required before 1975. It does not exempt government agencies from having to give a disclosure notice.

The UMS has never required students to disclose their Social Security number, according to Price.

Campus Living's summer session housing application requests students to disclose their Social Security number, but it doesn't include a disclosure notice either.

Jennifer Thibodeau, an administrative associate for Campus Living, said the department was not aware of the requirement. "We request that information because that then becomes the student's account number, and that's university policy," she said.

UMS attorney Vendean Vafiades said she was not familiar with the Privacy Act. She said her impression of the law was the UMS isn't required to provide a disclosure notice unless asked. However, a federal district court in Massachusetts ruled in 1980 that a government agency must give a disclosure notice when it asks for a Social Security number. In 1982 a federal district court in Delaware reached the same conclusion.

Under a recent Maine law, businesses operating within the state are prohibited from putting a person's Social Security number on any credit card, customer service card or debit card. The law also prohibits businesses from using Social Security numbers as identifiers.

A person's Social Security number is a master key that can unlock all kinds of information about people, said William Lund, superintendent of Maine's Bureau of Consumer Credit Protection.

"Social Security numbers have become the primary computer identifier in use today," he said.

Maine's law doesn't define what a business is. While UMaine's MaineCard falls under the law's definition as a customer service card and a debit card, Lund said that in his "off-the-cuff" opinion, the university is not affected by the law because it is a non-profit government agency.

State agencies should consider the intent of the law, though, and explore alternatives to using Social Security numbers to identify people, he said.

The law's intent is to prevent the display of Social Security numbers, he said. The law came about after its sponsor's nephew stole his Social Security number from a card in his wallet, Lund said. The sponsor's nephew took the Social Security number and applied for credit cards. The nephew then proceeded to run up the bills, Lund said.

"We've received only a minor number of complaints" since the law took effect, he said. The bureau's biggest issue has been the state employees' health insurance program's using Social Security numbers for identification. Health insurance companies have until July 1 of this year to purge Social Security numbers as identifiers.

"The difficulty for the companies was coming up with an alternative system," Lund said. He added that if a business were to merely place letters before or after a Social Security number, it would still be in violation of the law because the number would still be identifiable.

So far the bureau has had to only bring the law to the attention of businesses complaints have been filed against. "We've not had to do anything more than to bring the law to the attention of individuals," Lund said.

The penalty for failing to comply with the Privacy Act's disclosure notice requirement can be a fine of up to $5,000 for the employee in charge of maintaining records that include Social Security numbers. The penalty under Maine's law is a fine of not more than $1,000.

This story appeared in the March 27, 1995, edition of The Maine Campus.

Copyright 1995, Ryan R. Robbins