SIUE Identity-Protection Policy Frequently Asked Questions
The purpose of the following frequently asked questions is to provide general guidance to employees of SIUE who either Request, Receive, Use, Retain, Disclose, or Destroy a document containing an individual's Social Security Number (SSN) in performance of their assigned responsibilities; and to protect the confidentiality of SSNs that are collected, used, and retained by the University in conducting its business affairs.
Please Note: Click on each question to view the response.
- Who has access to a Social Security Number (SSN) at SIUE?
- Access to SSNs will be limited to only those SIUE employees/student employees who have a University business need for the information.
- As an employee of SIUE, what must I tell an individual when requesting their SSN?
- I must inform the individual whose SSN is being requested as to the purpose(s) and use in obtaining the SSN. A paper-based statement, electronic statement/notification, or a written statement added to an existing business form which the individual receives, are acceptable means of disclosure. Departments/units may use the standard
Statement of Purpose (SOP) (
attachment) or may modify this statement to meet their specific needs.
- As an employee of SIUE, can I ask, or send an individual's SSN over the internet?
- SIUE shall not request nor require an individual to transmit their SSN over the internet nor should SIUE transmit a SSN over the internet, or through an email service, unless the SSN is strictly encrypted. E-mail accounts with standard password accesses are not considered secure connections.
- As an employee of SIUE, can I receive/request a SSN from anyone other than the individual to whom it is assigned?
- Receiving a SSN from anyone other than the individual whose SSN is assigned is only appropriate if the disclosure is part of the University's business processes, and the SSN owner has received a disclosure as to how their SSN will be utilized including any secondary uses/disclosures. University/internal sharing of SSNs are permissible, so long as the SSN owner has been provided with the appropriate disclosure as to how their SSN will be utilized, and the appropriate data security measures have been taken.
- As an employee of SIUE, can I disclose a SSN to a contractor or subcontractor?
- If for any reason SIUE must disclose a SSN to a contractor or subcontractor, the SIUE entity involved must request and receive a copy of the contractor's or subcontractor's policy on how they will protect the SSN/data in their operations or processes. Additionally, the SSN owner must/or has received a disclosure as to how their SSN will be utilized including any secondary uses/disclosures.
- As an employee of SIUE, what must I do if a document is requested, that displays an individual's SSN, and is requested by an outside agency?
- Unless otherwise authorized by law, an individual's SSN will be redacted before releasing the document for public inspection or copying the document. Using SSNs requested from an individual shall be accomplished in a manner that makes the Social Security Number (SSN) easily redacted (blackened out) if required to be released as part of a public records request (Freedom of Information Act request).
- Can I publicly display or post an individual's Social Security Number (SSN)?
- You cannot publicly post or display, or visibly print on identification cards or badges, for any reason, an individual's SSN. The SSN can only be used for the purpose which it was authorized and collected as stated on the standard Statement of Purpose (SOP) form which was provided to the individual originally.
- How do I protect/store documents that contain an individual's SSN?
- The University will ensure to the extent practicable, the confidentiality of SSNs. Social Security Numbers are considered sensitive data elements and will be managed, protected, and secured in locked file cabinets with restricted access to those employees who need the SSN in conducting its business affairs.
- How long should I maintain and store records, employment applications/documents used during the hiring process?
- As soon as allowable under state, federal or University policy, a document in either electronic or paper format containing a SSN where the need for the information is no longer relevant, should be securely destroyed as per University policy. All questions pertaining to the University's Records Retention/Destruction Schedule should be directed to Gary R. Dunn, University Records Officer, 618 650-3982/
- Who is the point of contact should I have additional questions regarding the SIUE Identity-Protection Policy?
- You should contact Bill Misiak, Manager of Employee Relations, Office of Human Resources at 618 650-2159/