EIU Office of Internal Auditing

#133.2 - Social Security Numbers

Approved: May 23, 2011

Monitor: Vice President for Business Affairs

In accordance with the State’s “Identity Protection Act” (5 ILCS 179/1 et seq.), this policy controls the collection, use and disclosure of Social Security numbers by University employees including student workers.

Employees are permitted to use or disclose an individual’s Social Security number only when:

1. Required to do so under State or Federal law, rules, or regulations, or the collection, use, or disclosure of the Social Security number is otherwise necessary for the performance of the University’s duties and responsibilities;
2. The need and purpose for the Social Security number is documented before collection of the Social Security number; and
3. The Social Security number collected is relevant to the documented need and purpose.

With respect to the collection, use and disclosure of Social Security numbers, employees shall not:

1. Use an individual’s Social Security number for any purpose other than the purpose for which it was collected;
2. Require the use of an individual’s Social Security number to access an Internet website;
3. Sell, lease, loan, trade or rent an individual’s Social Security number to a third party for any purpose;
4. Publicly post, display or make available to the general public an individual’s Social Security number;
5. Print an individual’s Social Security number on any card required for the individual to access products or services provided by the University;
6. Require an individual to transmit a Social Security number over the Internet, including but not limited to websites, online forms and email messages, unless the connection is secure or the Social Security number is encrypted; and
7. Print an individual’s Social Security number on any materials that are mailed to the individual, through the U.S. Postal Service, the University’s Mail Services, any private mail service, email, or any similar method of delivery, unless the use of the number on the document is required by State or Federal law with the following exceptions:

• • Social Security numbers may be included in applications and forms sent by mail in connection with admission and enrollment at the University, to establish, amend or terminate an account, contract or policy, or to confirm the accuracy of the Social Security number.
  • A Social Security number that is permissibly mailed may not be printed, in whole or part, on a postcard or other mailer that does not require an envelope or be visible on an envelope without the envelope having been opened.

Only those areas identified by the University on the SSN Stated Purpose List are authorized to collect, use and/or disclose Social Security numbers and are only authorized to do so for the stated purpose(s). No other area may utilize Social Security numbers for any purpose.

Any area authorized to collect, use and/or disclose Social Security numbers must do so in a manner that makes the number easily redacted if required to be released as part of a public records request so that no more than five sequential digits of a Social Security number are accessible as part of personal information. Additionally, all departments and/or offices shall redact Social Security numbers from information or documents before allowing the public inspection or copying of the information or documents.

All individuals in areas identified by the University as authorized to collect, use and/or disclose Social Security numbers will undergo annual training regarding the proper methods for collecting, using and/or disclosing Social Security numbers.

Any additions to the list of employees or departments authorized to utilize Social Security numbers must be approved by the appropriate Vice President and President.