Auditor to EDD: Find Ways to Stop Including SSNs in Mailings

The state auditor has called out the California Employment Development Department for unnecessarily exposing recipients of unemployment and disability benefits to the risk of identity theft by including their full Social Security numbers in mailings.

In fiscal year 2017-18, EDD sent more than 17 million pieces of mail to these beneficiaries, all containing full SSNs. EDD has an IT infrastructure modernization underway that would replace SSNs with another unique identifier, but that project won’t reach fruition until 2024 at the soonest.

State Auditor Elaine M. Howle says that’s too long to wait.

“We believe that EDD needs to take near-term measures to better protect its claimants,” she writes in her letter to the Legislature, “and that it cannot wait to address these identity theft risks for the at least five and a half years it will take to complete its modernization project.”  

The audit found that from 2015 to 2018, the full SSNs and other personal information of nearly 300 claimants were “inappropriately disclosed.”

Howle’s report contains two sets of recommendations.

The state Legislature should:

• Require that, by September 2019, state agencies submit to lawmakers a report that identifies the extent to which the agencies mail documents containing full SSNs to individuals; and
• Should amend state law to require all state agencies to develop and implement plans to stop mailing documents that contain full SSNs to individuals no later than December 2022 unless federal law requires the inclusion of full SSNs.”

The Employment Development Department should:

• By December 2021, implement one or more of our proposed solutions or another viable solution to discontinue its use of full SSNs as unique identifiers on all documents that it mails to claimants. Further, it should prioritize addressing documents with the highest mail volumes and should make changes to those documents by March 2020.
• By May 2019 — just a month from now — enact its relatively new plan to review all of its documents with an eye to removing any unnecessary requirements for personal information.   

And the audit notes that one solution it proposed is to replace full SSNs with a modified unique identifier.

"EDD management indicated that this solution would be the least disruptive to its existing systems, policies, and procedures," Howle's report says, "and that EDD supports this solution compared to the others we identified."

In its response to the audit's recommendations, EDD says it agrees with the audit findings and will implement them.