University of Maryland Policy on the Collection, Use and Protection of ID Numbers

The University of Maryland is dedicated to ensuring the privacy and proper handling of confidential information relating to students, faculty, staff and individuals associated with the University. Traditionally, the Social Security Number (SSN) has been used as a common “person” identifier and the key to University “person” databases. The purpose of this policy is to authorize the creation of new methods of unique identification that will replace reliance on the SSN and allow for easy identification of a person for University transactions.

Use of the SSN as an identifier will be discontinued, except where required for employment, IRS reporting, Office of Institutional Research, Planning & Assessment, federal student financial aid processing, state and federal reporting and a limited number of other business transactions. While the SSN will be collected and retained as authorized by law, it will not be used for routine identification or authentication purposes. Instead, a unique, nine digit university identification number called U ID Number will be assigned to each individual. For computer access, individuals will also have a unique Directory ID. For complete authentication, these identifiers (U ID Number and Directory ID) are accompanied by the use of a PIN or password.

1. The University of Maryland prohibits the use of a person’s SSN as a publicly visible identification number for University-related transactions, unless specifically required by law or business necessity. A listing of currently approved uses is provided in Appendix A. This list is subject to change.
2. The University of Maryland will use SSN as a data element but not as a key for access to databases.
3. Each member of the University community will be assigned a unique identification number that will not be the same as nor derived from the individual’s SSN. This number is called the U ID Number.
4. Software systems purchased or developed by the University of Maryland will not display a SSN either in read-only format or on print or other system output, unless authorized by law or business necessity.
5. Name and directory systems, purchased or developed by the University of Maryland, will be keyed for access by an individual’s unique U ID Number, not the SSN.
6. When databases need to utilize SSN, they will use secure conversion tables or other technical mechanisms that automatically cross-reference SSN and other information within systems. In exceptional circumstances, it may be necessary to use SSN as an alternate search field. All such cases shall be referred to the data custodian (Registrar’s Office for students, UHR for employees) who shall seek approval from the University Data Policy Advisory Committee (DPAC) DPAC has a strict procedure for reviewing and approving requests for the use of SSN in any campus application or database. Justifications must be submitted to the appropriate divisional DPAC representative for committee review and consideration of approval. In addition, any transmission of data containing SSN over any communication network must be transmitted using a secure methodology.
7. Systems or technology developed or purchased by the University of Maryland after the effective date of this policy shall comply with these provisions.
8. For computer access or login purposes, members of the University community will also be assigned a Directory ID. The Directory ID will be used as a standard identifier for all computer resource authentication purposes but individuals may also be allowed to authenticate by using their U ID Number.
9. Campus validation of University of Maryland photo ID cards will be by reference to either the holder’s U ID Number or bar code.

Timeframe for Implementation: The University of Maryland recognizes that some of its major systems are currently keyed for access to SSN as an identifier and that the conversion of all systems will take time and resources. The expectation is that there will be a steady and purposeful movement away from dependency on SSN. Appropriate interim measures may be developed until such time as the conversion to U ID Numbers is complete.

“Legacy” Data: The University recognizes that the SSN must be retained and used as a person identifier in older “legacy” data pertaining to ex-students and ex-employees as it is impractical to assign U ID numbers to these individuals.

Protection of ID Data Held in Secondary or Derivative Data Files: Any University office that collects and maintains an individual’s social security number in any media must: 1) Ensure that the number is stored in a secure and confidential environment; 2) eliminate using the number for any purpose except those specifically addressed in this policy; 3) begin a steady and purposeful movement away from its dependency on the SSN in performing its functions and  processes; and 4) follow University guidelines for the retention and destruction of records containing the SSN.

Notification Requirement: Any University office that collects SSN from an individual must provide a disclosure statement approved by the Data Policy Advisory Committee. Notifications for students, employees, and affiliates/guests are provided in Appendix B.

(Subject to change)

Employment: The SSN is required for a variety of employment matters; such as tax withholding, FICA, Medicare, etc. SSN may also be used and maintained if it is supplied by an employee as documentation when completing the Federal I-9 Employment Authorization Form.

Application and Receipt of Financial Aid: Any student who applies for student aid by use of the federal Free Application For Student Assistance (FAFSA) is required to provide his SSN. Students are also required to provide SSNs when applying for student education loans. Tuition Remission: The SSN is required for state reporting of taxable tuition remission benefits received by employees, their spouses and dependents, and by graduate assistants. Veterans Administration Benefits: The SSN is required for enrollment verification and reporting on all Veterans Administration beneficiaries.

IRS Reporting: The SSN is used for producing federally required 1098-T forms, which report the amount of tuition paid to the University during the tax year. Copies of these forms are mailed to students each year, and the information reported to the IRS. In addition, the University reports the value of all taxable and non-taxable scholarships and grants awarded to non-resident aliens to the IRS.

Inter-Institutional Communication and Information Exchange: Many institutions, including postsecondary educational institutions, use the SSN as a student identifier. To ensure the accuracy of inter-institutional data exchanges (transcripts, transfer credit evaluations, USM ArtSys data base, MHEC, etc.) the SSN may be used for the exchange of information from student academic records between appropriate institutions including other colleges and universities.

Tracking Name Changes of Students and Alumni: The SSN is also used internally to track name changes of students and alumni of the University.

“Use of Social Security Number (SSN) - Students

Section 15-110 of the Education Article of the Annotated Code of Maryland prohibits the use of SSN on University identification cards. Section 7(b) of the Privacy Act of 1974 (5 U.S.C. 522a) and section 10-624 of the State Government Article of the Annotated Code of Maryland, also require that when any Federal, State, or local government agency requests an individual to disclose his or her Social Security Number (SSN), that individual must also be advised whether the disclosure is mandatory or voluntary, by what statutory or other authority the number is solicited, what use will be made of it, the specific consequences for failure to provide the information, whether the information is generally available for public inspection and whether the information is made available or transferred to or shared with any entity other than the University.

Accordingly, each applicant for admission is advised that disclosure of his or her SSN is required as a condition for making application to the University of Maryland for purposes of administering federal financial aid programs and complying with various State and Federal reporting requirements including reporting to the IRS. The University may use a student’s SSN to accurately report federally required data, to generate various federal tax and financial aid reports, and to ensure the accuracy of student data that is exchanged within the University of Maryland, between post-secondary education institutions, with the University System of Maryland and other outside entities as necessary or required for the conduct of legitimate University business and consistent with applicable law. The SSN will be maintained in a secure and confidential manner and not be re-disclosed for any other purpose.

The authority for requesting disclosure of a student’s SSN is grounded in various federal laws including but not limited to: 42 USC 405c, affecting wage reporting and withholdings; 34 CFR 668.14 and 34 CFR 668.16, relating to student aid programs; and 26 CFR 1.6050S-1, addressing Internal Revenue Code reporting requirements pertaining to tuition payments.

In addition, it should be noted that the SSN of a parent, guardian or spouse of an applicant is also requested if the student claims dependency on that person for financial aid or residency for tuition purposes. A parent, guardian or spouse is advised that disclosure of his or her SSN is necessary for the above student purpose and failure to provide it may affect the student’s financial aid or tuition status. A parent’s, guardian’s or spouse’s SSN will only be used for the purpose for which it was collected and will not be maintained in any other system of records.  A unique U ID Number is assigned to students as part of their initial application to the University and is used for all University identification purposes.”

“Use of Social Security Number (SSN) – Employees

Section 7(b) of the Privacy Act of 1974 (5 U.S.C. 522a) and section 10-624 of the State Government Article of the Annotated Code of Maryland, requires that when any Federal, State, or local government agency requests an individual to disclose his or her social security number, that individual must also be advised whether the disclosure is mandatory or voluntary, by what statutory or other authority the number is solicited, what use will be made of it, the specific consequences for failure to provide the information, whether the information is generally available for public inspection and whether the information is made available or transferred to or shared with any entity other than the University .

Accordingly, each employee is advised that disclosure of his or her SSN is required as a condition of employment at the University of Maryland in complying with State and Federal employment matters including but not limited to, the withholding and reporting of State and Federal income tax, FICA, and Medicare insurance tax. Additionally, the SSN may be used and maintained, when supplied by an employee, as documentation for completing the Federal I-9 Employment Authorization Form. The employee’s SSN will be used to accurately record state and federal required data as necessary or required for the conduct of legitimate University business and consistent with applicable law. This number will be maintained in a secure and confidential manner and not be re-disclosed for any other purpose.

The authority for requesting disclosure of an employee’s SSN is grounded in various federal laws including but not limited to, 42 U.S.C. 405c, affecting wage reporting and withholdings.

Efforts to limit the use of SSN include the issuance of a unique U ID Number that is assigned to all employees as part of their initial employment and will be used for all University identification purposes.”

“Use of Social Security Number (SSN) – Affiliates/Guests who receive University services and are not students, employees, or non-paid appointees.

Section 7(b) of the Privacy Act of 1974 (5 U.S.C. 522a) and section 10-624 of the State Government Article of the Annotated Code of Maryland, requires that when any Federal, State, or local government agency requests an individual to disclose his or her social security number, that individual must also be advised whether the disclosure is mandatory or voluntary, by what statutory or other authority the number is solicited, what use will be made of it, the specific consequences for failure to provide the information, whether the information is generally  available for public inspection and whether the information is made available or transferred to or shared with any entity other than the University .

Accordingly, each affiliate/guest is advised that disclosure of his or her SSN is requested as a condition of applying for services from the University of Maryland for the purpose of administering those services. The University may use an affiliate or guest’s SSN to accurately identify affiliates/guests, to coordinate services administered by different departments, and to ensure accuracy of data as necessary for the conduct of legitimate University Business and consistent with applicable law. The SSN will be maintained in a secure and confidential manner and not be re-disclosed for any other purpose.

A unique U ID Number is assigned to affiliates/guests as part of their initial request to receive University services and is used for all University identification purposes.”