Social Security Administration:

Disclosure Policy for Law Enforcement Allows Information Sharing, but SSA Needs to Ensure Consistent Application

GAO-03-919: Published: Sep 30, 2003. Publicly Released: Sep 30, 2003.

Additional Materials:


Barbara D. Bovbjerg
(202) 512-5491


Office of Public Affairs
(202) 512-4800

Law enforcement agencies' efforts to investigate the events of September 11th increased awareness that federal agencies collect and maintain personal information on individuals such as name, social security number, and date of birth that could be useful to law enforcement. The Social Security Administration (SSA) is one of the country's primary custodians of personal information. Although the Privacy Act protects much of this information, generally, federal agencies can disclose information to law enforcement. However, determining when the need for disclosure takes priority over an individual's privacy is not clear. GAO was asked to describe (1) SSA's disclosure policy for law enforcement and how it compares with the Privacy Act and those of other federal agencies, (2) SSA's experience sharing information with law enforcement, and (3) law enforcement's experience obtaining information under SSA's policy.

Although SSA's disclosure policy permits the sharing of information with law enforcement entities, it is more restrictive than the Privacy Act and the disclosure policies of most federal agencies. While the Privacy Act permits disclosures to law enforcement for any type of crime, SSA only allows disclosures under certain conditions. For example, for serious and violent crimes, SSA will disclose information to law enforcement if the individual whose information is sought has been indicted or convicted of that crime. Even when information is disclosed, it might be limited to results obtained from verifying a social security number and name unless the investigation concerns fraud in SSA or other federal benefit programs, then the agency can work with law enforcement officials as part of a task force or joint investigation. However, the disclosure policies for law enforcement of the Internal Revenue Service (IRS) and the Census Bureau, both of which have requirements prescribed in their statutes, are also more restrictive than the Privacy Act and the policies of most federal agencies. SSA officials consider SSA's disclosure policy integral to carrying out the agency's mission. The various restrictions in SSA's disclosure policy create a complex policy that is confusing and could cause inconsistent application across the agency's more than 1,300 field offices. This could result in uneven treatment of law enforcement requests. Because aggregated data were not available, GAO was unable to assess the extent to which SSA does not consistently apply its policy. However, GAO was told of instances in which SSA officials in some field offices did not give law enforcement information that appeared to be permitted under the policy as well as instances in which they gave them more than what appeared to be allowed. Generally, law enforcement officials find the limited information SSA shares useful to their investigation, but many law enforcement officials, particularly state and local law enforcement officials, are not familiar with the policy or the process for requesting information from SSA. Most law enforcement officials expressed a desire for more information than is currently permitted under SSA's policy, but SSA maintains that providing more information would hurt its ability to carry out its primary mission.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: SSA makes instructions for the agency's disclosure policy for law enforcement available to the public and to law enforcement. The agency provides extensive instructions to its employees through the Program Operations Manual System (POMS) and the agency's regional offices Intranet sites. In addition, SSA reviewed its policy and revised the POMS sections that address law enforcement disclosures. Further, SSA reported that it is providing refresher training as appropriate to clarify SSA's disclosure policy.

    Recommendation: To help ensure consistent application of SSA's disclosure policy for law enforcement in all of its offices and to better assist law enforcement agencies making disclosure requests, the Commissioner of SSA should take steps to eliminate confusion about the agency's disclosure policy. These steps could include clarifying SSA's policy; providing additional or refresher training to staff; or delegating decision-making authority for law enforcement requests to specified locations such as the OIG, regional privacy coordinators, or other units that SSA determines would have expertise in this area.

    Agency Affected: Social Security Administration

  2. Status: Closed - Implemented

    Comments: The Social Security Administration (SSA) reviewed and revised its policy for disclosing information to law enforcement and published its policy in the Program Operations Manual System (POMS). The revised law enforcement and privacy policies are available to the law enforcement community and the public via SSA's Internet web site.

    Recommendation: To help ensure consistent application of SSA's disclosure policy for law enforcement in all of its offices and to better assist law enforcement agencies making disclosure requests, the Commissioner of SSA should provide law enforcement with information on SSA's disclosure policy and procedures. For example, this information could be provided on its Web site, in informational pamphlets, or some other written format.

    Agency Affected: Social Security Administration


Explore the full database of GAO's Open Recommendations »

Oct 8, 2020

Jul 16, 2020

Mar 30, 2020

Mar 16, 2020

Dec 16, 2019

Oct 17, 2019

Aug 10, 2018

Jun 25, 2018

Mar 13, 2018

Looking for more? Browse all our products here