Social Security Numbers
If a federal law requires it, a Minnesota government entity must collect an individual’s Social Security number (SSN) to provide a service or benefit (Federal Privacy Act of 1974, 5 U.S.C. 552a note – Disclosure of Social Security Number). Before collecting an SSN, the entity must (1) know its legal authority to collect the SSN, and (2) give an individual the required federal and state notices at the time of collection.
Restrictions on the collection
Both federal and state laws impose restrictions on the collection of SSNs.
Federal law states that government cannot deny an individual any right, privilege, or benefit if the individual refuses to provide his/her SSN unless the collection is required by federal law (Federal Privacy Act of 1974, 5 U.S.C. 552a note). One example of a federal law requiring SSN collection is the Personal Responsibility and Work Opportunity Reconciliation Act of 1996, which says that an SSN must be collected on an application for any professional license, driver’s license, occupational license, recreational license, or marriage license (42 U.S.C. 666(a)(13)).
Minnesota law states that collection and storage of all data on individuals must be limited to that necessary for the administration and management of programs authorized by law (Minnesota Statutes, section 13.05, subdivision 3).
If an entity does not have federal authority to require an SSN, but wants to collect it, the entity must also consider the language in section 13.05, subdivision 3. Without federal authority, individuals may choose not to give their SSN and the entity cannot refuse to provide a right, privilege, or benefit.
Notice requirements at the time of collection
When a government entity asks for an SSN, federal and state law require the entity to provide a notice (either verbal or written) about issues related to collecting and using the SSN.
Federal law requires an entity to tell an individual three things when collecting an SSN:
- Whether disclosure is mandatory or voluntary
- The statutory or other authority to collect the number
- How the government entity will use the number
(Federal Privacy Act of 1974, 5 U.S.C. 552a note)
An entity is required by state law to provide a Tennessen warning notice at the time of collection because SSNs are private data under Minnesota Statutes, section 13.355. The four requirements of a Tennessen warning are:
- The purpose and intended use of the data
- Whether the individual can refuse or is legally required to provide the requested data
- The known consequences of supplying or refusing to supply the data
- Outside entities or persons with statutorily authorized access to the data
(Minnesota Statutes, section 13.04, subdivision 2)