Educause Security Discussion mailing list archives

Re: Last 4 digits of SSN and birthdate


From: Dan Updegrove <updegrove () MAIL UTEXAS EDU>
Date: Fri, 28 Oct 2005 10:36:41 -0500

Elizabeth,

Many of us have come to believe that any and all uses of SSNs -- or partial
SSNs -- as "university id numbers" should be abandoned as quickly as
possible. Among the reasons:

- US Dept of Education regulations regarding student direction information
and FERPA

- Risk of identity theft, as universities tend to allow "university ID
numbers" to appear on correspondence, reports, online displays, et al.,
vastly increasing exposure to individuals with no legitimate business need
to know. Moreover SSNs used as University IDs tend to be embedded in
subsidiary databases and shadow systems, which always need a unique ID for
unambiguous data matching

- Individuals' -- students, faculty, staff, parents, donors -- increasingly
sensitivity about their own risks of identify theft, with concomitant
concerns about any institution still using their SSN for purposes not
required by law

- Number of state laws prohibiting this practice.

I think your concern re the slippery slope is warranted. Good luck in
holding your colleagues to a more prudent approach.

Regards,
Dan


At 12:49 PM 10/26/2005, Elizabeth Shannon wrote:
A representative of University Advancement contacted me and wanted to know
if printing a person's birthday (MM/DD/YYYY) and the last 4 digits of the
person's SSN on pledge cards was acceptable.  The reason for "needing"
this info is it allows staff to search the alumni database much
faster.  Other info printed on the card: first name, middle initial, last
name, phone number, and address.

I can not find any sources prohibiting their request, but I am not
comfortable with displaying this info. I am concerned with the precedence
this  may set with other departments.  Any suggestions or links to info
would be appreciated.

Elizabeth Shannon
Pittsburg State University - Kansas


VP  for Information Technology          Phone (512) 232-9610
The University of Texas at Austin       Fax (512) 232-9607
FAC 248 (Mail code: G9800)              d.updegrove () its utexas edu
P.O. Box
7407                                   http://web.austin.utexas.edu/dau2
Austin, TX 78713-7407

Current thread: