Social Security Number and GWID Usage Policy

Policy Summary

All university schools and departments must use the George Washington Identification Numer (GWid) as the primary Identifier for individuals associated with the university, for all university purposes.

Social Security Numbers (SSN) may not be captured, stored, transmitted, displayed or printed, in whole or in part, except where required by law or deemed essential for internal purposes.

When use of the SSN is required, schools and departments are responsible for implementing practices and procedures to protect the confidentiality of SSN data in any and all formats, including but not limited to oral, paper, electronic, stored media, and electronic transmission.

The purpose of this policy is to protect the confidentiality and prevent the unauthorized or accidental disclosure of SSNs by providing consistent and clear parameters for the collection and use of SSN data, where required, and for eliminating unnecessary storage and use of SSNs in university documentation, practices and systems.

Who is Governed by this Policy

• Students
• Staff
• Faculty
• Alumni
• Contractors

Policy

The university is committed to maintaining the privacy of individuals’ personal information, including SSNs, of students, faculty, staff, contractors, and other individuals associated with the university.

A GWid, which is a unique identification number, is assigned automatically to all students, employees, and other individuals associated with the university, at the time a new person record is created in a University Enterprise System. The GWid remains permanently associated with the individual to whom it has been originally assigned.

Once established, the GWid must be used as the primary identifier for an individual in all university systems, reports, processes and on paper documents to identify, track, and to provide service to that individual in their association with the university. 

Use of SSN by university schools and departments is only permitted when required by law or deemed essential for internal purposes.  See Appendix A for examples of approved uses for SSNs.

Where schools and departments are required to request personal information from individuals, generate reports involving personal information, extract personal information from University Enterprise Systems, or otherwise use personally identifying information to accomplish a responsibility, schools and departments must examine their forms, processes and practices to determine whether the use of SSNs is essential or whether use of the GWid and/or some other form or combination of identifying information will suffice.   If a school or department believes that it should obtain or use SSNs for a purpose not listed in Appendix A, a request for such use must be reviewed and approved by a Vice Provost, Associate Vice President or equivalent or higher supervisor responsible for such school or department, in consultation with the GW Privacy Office.    

Schools or departments authorized to collect and use SSNs must adhere to the Personal Information and Privacy Policy. 

In accordance with the GW Data Classification Guide, the SSN is categorized as regulated data and must be handled in a manner consistent with that classification as provided in the Data Management and Protection Standard. Please refer to this standard for specific requirements for the storage, handling, and transmission of SSNs and other regulated data.

Reasonable measures for protecting SSN data include:

• requesting reports with only those data fields that are necessary to perform the job function;
• storing records appropriately and securely, only in University Enterprise Systems secured by GW Information Technology, and in accordance with applicable government regulations and requirements as set forth in the GW Data Management and Protection Standard.
• retaining only appropriate and necessary evidence of the collection of SSN data (e.g. forms signed by the individuals);
• only using encrypted mechanisms when receiving or transmitting SSNs; and
• destroying and deleting documents (paper and electronic) and any storage media containing SSNs in a timely and secure fashion, consistent with the university’s Records Management Policy.

Definitions

Social Security Number (SSN): A 9-digit number issued by the federal government, through the Social Security Administration, primarily used to track individuals for taxation purposes. SSN may be interpreted to include Taxpayer Identity Number (TIN).

GWid: the eight-digit number that follows the letter “G”, assigned to all individuals (students, staff, faculty, contractors) at the time of their enrollment or employment at GW. 

Identifier: a unique attribute assigned to facilitate and track within the university’s departments and information systems information about a student, a faculty or staff member, or other person or entity associated with the university.

University Enterprise System: a computing  system  maintained  by GW Information Technology that  is used  by  more  than  one   school or division   and that contains financial, managerial, confidential or other sensitive or mission critical information.  Examples of Enterprise Systems include Banner, the Kronos time reporting system, and Oracle.                                                         

Procedures

• Appendix A: Examples of Appropriate Purposes for Use of SSNs 

Related Information

• Personal Information and Privacy Policy
• Privacy of Student Records Policy
• Records Management Policy
• Data Management and Protection Standard

 

Contacts