Among all of the data protection bills circulating in Congress, the House Energy and Commerce Committee approved on July 26th, a legislation designed to restrict the sale of Social Security numbers. The Social Security Number Protection Act (H.R. 1078), introduced by Rep. Markey, makes it a crime for a person to sell or purchase SSNs in violation of rules that would be promulgated by the Federal Trade Commission. The FTC would be given authority to determine appropriate exemptions and to enforce civil compliance with the bill’s restrictions. Under the bill, violators would be subject to civil penalties of $11,000 per violation.

Rep. Ed. Markey (D-Mass.) supported rationalized the proposed bill,

If someone actually obtains a Social Security number on the Internet, they have a critically important piece of information that can be used to locate a person, get access to their finances, or engage in a variety of other illegal activities. By stopping unregulated commerce in Social Security numbers, this bill will help reduce the incidence of pretexting crimes, identity thefts and other frauds or crimes involving misuse of a person’s Social Security number.

The bill contains important exceptions, e.g. for law enforcement, national security, emergency situations, and voluntary, affirmative written consent, and for legitimate consumer credit verification. The bill would also preempt any state statute or regulation that expressly restricts or prohibits the sale of Social Security numbers.

The movement behind this bill is more than clear to all of us - something needs to be done to stop the free flow of stolen or legitimately obtained SSNs. - The SSN has grown beyond what it was originally intended to do – uniquely identify recipients of benefits. When the SSN was first introduced, it was specifically pointed out that it would not be used to uniquely identify a person for any and all purposes and that the number was not meant to be a multipurpose personal identification number. Yet, years later, we have witnessed the "functionality creep" of the Social Security number as it is used for almost all government and some private sector purposes.

One of the problems with this pending legislation is that is somewhat resembles what CAN-SPAM did to address the problem of email spam. It allowed FTC to pursue spammers, it preempted "stronger" state laws, and in retrospect it did little to ease the problem of spam. Hopefully by the time this proposed legislation becomes a law, it would grow to be a stronger law that would squarely address the increasing problem of identity theft.