(a) Statutory or regulatory authority must exist for collecting Social Security Numbers for record systems that use the SSNs as a method of identification. Systems without statutory or regulatory authority implemented after January 1, 1975, will not collect Social Security Numbers.

(b) In compliance with OMB M-07-16 (Safeguarding Against and Responding to the Breach of Personally Identifiable Information) collection and storage of SSN will be limited to systems where no other identifier is currently available. While GSA will strive to reduce the collection and storage of SSN and other PII we recognize that some systems continue to need to collect this information.