For purposes of the unemployment insurance system, administered by the Employment Security Department (ESD), employers must report certain information about their employees, including Social Security numbers (SSNs), to the ESD. The ESD uses SSNs to, among other things, verify a person's employment and verify that unemployment insurance benefits are being charged to the appropriate employer.
The Department of Labor and Industries (L&I) also requires SSNs for certain purposes related to workers' compensation and prevailing wage requirements. For example, contractors on public works projects must provide certified payroll records to the L&I that include employee SSNs, as part of the L&I verification and investigation process into potential prevailing wage law violations.
Generally, both federal and state laws prohibit commercial entities and state and local governments from disclosing the SSNs of individuals, unless otherwise allowed by law. A person's SSN is also one of the pieces of information exempt from disclosure under the Public Records Act.
The ESD and the L&I must examine their current practices that involve disclosing individuals' full SSNs of persons in agency correspondences with nongovernmental third parties. If disclosure is not required to comply with federal or state law, the agency must:
"Correspondence" refers to written communications and electronic mail and excludes financial transactions or communications sent through secured or encrypted methods.
"Nongovernmental third party" excludes subdivisions, agencies, and instrumentalities of government.
The substitute bill adds definitions, includes the consideration of complying with state law, and extends the time in which agencies must cease using full SSNs.
(In support) Thousands of consumers have had their personal data breached and SSNs are some of the most personal data that needs to be protected. This bill asks government agencies to help protect constituents from identity theft.
(Opposed) None.
(Other) The bill goes in the right direction and aligns with agency best practices. Some of the terms in the bill can be interpreted too broadly. The bill would impact how the L&I shares information with banks that make payments to injured workers and with other entities that help the L&I collect debts. The bill would impact the Self-Insured Employer Program. The L&I needs more time to replace their processes. Consumer reporting agencies are already highly regulated by federal law regarding information sharing and should be exempted.