§ 1.32 Collection, use, disclosure, and protection of Social Security numbers.

(a) Treasury must only collect full Social Security numbers (SSNs) when relevant and necessary to accomplish a legally authorized purpose related to a Treasury mission. In the absence of another compelling justification for the use of the full SSN (approved by the relevant component Head and the Departmental Senior Agency Official for Privacy), Treasury must only collect and maintain full SSNs: (1) As a unique identifier for identity verification purposes related to cyber security, law enforcement, intelligence, and/or security background investigations; (2) When required by external entities to perform a function for or on behalf of Treasury; (3) When collection is expressly required by statute or regulation; (4) For statistical and other research purposes; (5) To ensure the delivery of government benefits, privileges, and services; and (6) When there are no reasonable, alternative means for meeting business requirements. (b) Treasury must not display the Social Security number on the outside of any package sent by mail. (c) Treasury must not display the Social Security number on any document sent by mail unless there are no reasonable, alternative means for meeting business requirements and masking or truncating/partially redacting the SSN are not feasible. (d) Whenever feasible, Treasury must mask, or truncate/partially redact Social Security numbers visible to authorized Treasury/component information technology users so they only see the portion (if any) of the Social Security number required to perform their official Treasury duties. (e) An individual must not be denied any right, benefit, or privilege provided by law by a component because of such individual's refusal to disclose their Social Security number. (f) The provisions of paragraph (e) of this section do not apply with respect to: (1) Any disclosure which is required by Federal statute; or (2) The disclosure of a Social Security number to any Federal, State, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual. (g) When Treasury requests that an individual discloses their Social Security number, it must inform the individual: (1) Whether that disclosure is mandatory or voluntary; (2) By what statutory or other authority such number is solicited; and (3) What uses are made of the number. (h) Treasury must provide the information in this section in the notice discussed in § 1.28(b)(2)(iv). (See section 7 of the Privacy Act of 1974 set forth at 5 U.S.C. 552a, note.)