“Reporting this isn’t going to change anything.” That was the response we got from one of the largest state agencies in California when we first questioned why it was violating state privacy laws and putting millions at risk for identity theft.
Government agencies, banks and even universities stopped using social security numbers as identifiers years ago due to the risk of ID theft. In 2010, California passed a law that prohibits printing the number “on any materials that are mailed.”
Yet we discovered that California’s Employment Development Department (EDD) was still printing full social security numbers on clearly identifiable documents mailed out every two weeks to millions of Californians.
When we first asked the agency’s PIO what it would take to remove the SSNs from its mailings, she laughed out loud and said “that’s not going to happen.”
Three months (and several news reports) later, it did.
Part 1 – Exposing the Privacy Risk
“California UN-Confidential” began with an investigation into a single viewer complaint and ultimately exposed a privacy risk affecting 2.4 million Californians.
In addition to revealing that the EDD was violating state privacy laws by printing full social security numbers on bi-weekly mailings sent out to anyone collecting unemployment or paid family leave, our first story also revealed that the agency was unapologetic and callous toward people who complained.
In its defense, the agency told us that it was “required to use Social Security Numbers”, and that it was “not administratively feasible for the EDD to only print the last four digits of a SSN on correspondence”.
In response, we crossed referenced a series of state and federal laws to prove the agency was wrong.
As a result, representatives from both state and federal agencies began to publicly call on the EDD to change its practices.
Part 2 – State-Wide Reaction
Following our initial report, people from across the state began notifying us that the EDD mistakenly sent them other people’s unemployment documents, complete with social security numbers and enough information to steal their identities.
When they notified the EDD, viewers told us the agency advised them to simply throw the documents away and made no mention of shredding or otherwise properly disposing of the sensitive information.
Citing our reports, lawmakers from both sides of the aisle demanded that the Employment Development Department immediately make changes.
Part 3 – Forcing Change
Our coverage ultimately shamed the EDD into doing what it had long insisted was impossible.
Within three months of our first report, the agency began redacting social security numbers on the most frequently mailed documents and outlined a multipart plan to phase out the use of social security numbers as identifiers all together.
Public Record Obstacles
Over the past 6 months, the EDD has repeatedly delayed or denied our requests for public records.
In an effort to obtain documents and emails, we were forced to repeatedly revise and re-submit our requests resulting in a total of 64 emails regarding public records alone.
Nearly 6 months later, we are still waiting for most of the documents we requested.
However, we did obtain some critical internal agency emails that revealed, among other things, that the agency had received so many complaints about mailing social security numbers that employees requested “standard language to respond.”
The EDD told us that it does not track complaints.
Nationwide Impact
As part of our investigation, we reached out to every state unemployment agency in the nation and discovered that California is not alone. Only three of the state agencies that responded said they redact social security numbers on all mailed unemployment documents.
Representatives from the U.S. Department of Labor told us they had no idea that any state was still mailing social security numbers. The DOL oversees state unemployment agencies.
Like California, most of the other states mistakenly claim that federal law requires they print the full SSN. However, the Social Security Administration confirms that there is no such law.
Several pieces of federal legislation have now been introduced to addressed our findings.