Millions of Californians who collect unemployment or disability have had their identities potentially compromised by the state, a new report found.
The California State Auditor recently determined that the state’s Employment Development Department mailed more than 17 million documents with disability and unemployment claimants’ full Social Security number on them during the fiscal year 2017-18.
“Despite concerns about privacy protection from EDD’s claimants and members of the Legislature, EDD still sends every Disability and Unemployment claimant documents containing full SSN,” the audit found.
The auditor further found that while EDD has taken steps since 2015 to reduce the number of mailings including the full Social Security number, “those efforts have been insufficient.”
In addition, the EDD also “exposed nearly 300 claimants to the risk of identity theft when it inappropriately disclosed their personal information — including SSNs — to others,” according to the audit.
The auditor wrote that “identity theft affects millions of Americans and costs billions of dollars each year.”
Identity thieves can use Social Security numbers to fraudulently open bank accounts, establish credit lines, rack up medical bills and file tax returns.
Patrick Henning, director of the Employment Development Department, wrote in response to the audit that he agreed the report “raises serious concerns on the risks of identity theft.”
He wrote that his office agreed with the auditor’s recommendations and would work to implement them. Henning also said that, “The EDD is committed to protecting the personal information of Californians, including their Social Security numbers.”
So what are the recommendations?
The auditor has called on the Legislature to change state law to require all state agencies to develop plans to stop mailing full SSNs no later than December 2022.
The auditor also lays out a series of recommendations for the EDD, including:
- By May 2019, implement its recently developed plan for reviewing new, revised and existing documents to ensure claimants’ privacy.
- By March 2020, the EDD should “prioritize addressing documents with the highest mail volumes” and make necessary changes.
- By December 2021, complete a full review of existing documents and remove any unnecessary instances of personal information. Also by December 2021, the EDD should implement a solution to discontinue the use of Social Security numbers “as unique identifiers” on all mailed documents.
The Legislature is also considering a request from EDD to add $1.99 million to the agency’s budget to fund five information security positions in order to “accommodate workload growth within the critical functions of information security, including detection and remediation of system security issues, infrastructure improvements, and improved compliance with current state and federal security standards.”