To ensure compliance with the SSN Act, we have deleted the social security number from customer statements. Our problem is ACH transactions that use the SSN as the customer's ID number, such as SS deposits or businesses using the SSN as the ID number. We have no control over the Individual ID Field. We tell customers that they must contact the party that initiated the ACH transaction to have the SSN deleted, but is that adequate? How are other banks handling this issue?

I'm looking at the exemption in section 3, at (3)(a)(i) for relief. It says:

(3) It is not a violation of subsection (1)(b) or (g) to use all or more than 4 sequential digits of a social security number if the use is any of the following:

(a) An administrative use of all or more than 4 sequential digits of the social security number in the ordinary course of business, by a person or a vendor or contractor of a person, to do any of the following:

(i) Verify an individual's identity, identify an individual, or do another similar administrative purpose related to an account, transaction, product, service, or employment or proposed account, transaction, product, service, or employment.

Particularly, "...similar administrative purpose related to an account, transaction, product, service..." - I think that applies because you don't have control of the situation. The SSN is the identifier for the activity in this case, and I'd be reluctant to get the customer involved.

Thanks for your response Bartman. I'm glad to hear that you think the exceptions cover the ACH issue that the Bank has no control over.

What about developing the Privacy Policy required under the Act for Jan. 1? Is there a model policy? Do you have one?

WHere can I find the SSN Act online?

Here is a PDF version. I got to it through www.michiganlegislature.org, then searched the compiled laws for "social security number".

Thanks. I appreciate the links.

Section 445.84 (3) says that this does not apply to those who possess social security numbers in the ordinary course of business. Therefore tell me if I'm wrong. We would not have to have a policy in place by Jan 1, 2006

It does not apply if you possess SSNs in the ordinary course of business and you are complying with the Fair Credit Reporting Act or the GLB Privacy Act.