The Workplace Stack Exchange is a question and answer site for members of the workforce navigating the professional setting. It only takes a minute to sign up.
Sign up to join this community
One of my employer's customers wants everyone's DOB, last 4 digits of my Social Security number, state of residence and full name. I am not comfortable with this.
They explained it is to keep track of their former employees, I am not doubting their reason, but I think too much can be developed with this information in the wrong hands...
I was asked the exact same thing many years ago and here is how I handled it. Actually, I was asked for the full social. They asked for the information for me and my small staff. The request came through my company's lawyer. So I was dealing with my company's lawyer and the lawyer was dealing with the client. This was just as SSN was becoming a very sensitive number.
Me: "What do they need it for and how they would protect it?"
Lawyer: "What do you think they will use it for?".
M: "I don't know, but before I give my information I need to know that".
L: "I think they want to do a background check on you".
M: "Oh, then I will also need a copy of what they find."
L: "They don't want to do it right away".
M: "Okay, well I will just give it to them when they need to do the background check".
Some time passes...
L: "They just need a number to uniquely identify you in their system."
M: "I reply back with 7 digit phone numbers of each of my staff (prefixed with 99 so there will be no collision with real SSN)."
L is a bit irritated with me at this point; unbeknownst to me, bad mouths me to VPs.
M: I calmly restate that I will be happy to give this information if they can tell me what they need it for and how they will protect it.
L takes some time to find the security person in the client's office.
Security person tells L that she agrees with us that we should not give out this information and takes the phone numbers as alternative.
I got apology email from lawyer and an in-person apology from VP.
Security Person changed policy and communicated to Administrative staff to stop requesting SSN.
It is important that I remained very professional with not a hint of sarcasm during this whole exchange. I also made the point that I was willing to give them this information if there was good reason. I believe a financial institution can and should do background checks on the people working on their systems. If the client would have responded that they need it for a background check I would have responded that I would be happy to give it to the entity that does the check directly rather than passing it through the client's hands.
Once we were on their systems I noticed that the userids were 3 initials and 4 numbers. I am guessing the 4 numbers were the last four digits of the persons SSN. Our userids did not follow the same pattern and used sequential numbers.
By not taking an outwardly hard stand that I would not give my SSN it gave time for everyone to work through the process learning that they should not use SSN. Had I taken a hard stand they might have focused on my being obstinate rather than looking at the policy as the problem.
This sounds like a Social Engineering exploitation. Not only should you not answer this request, you should report this guy to your supervisor.
There is absolutely no reason to comply with this.
If they want to ensure that your company doesn't send over former workers, the only thing they need is the name of the worker. They can check that against their database. If a match is found then your company and theirs can take a closer look at that specific individual.
If they want to ensure that the people your company sends over passes a background check, your company can either provide the results of the background checks or provide the necessary information to a known third party whose job it is to conduct such checks and have them do the research.
If they insist on this type of information, then you should counter that you need assurance that the data is properly secured. This "assurance" should include a list of everyone, including their SSN's, DOB, and address, who will have access to the data. You should also demand that they acknowledge legal liability plus a potential of huge financial damages via written contract in case it is found that this information was lost or stolen from their possession. This negotiation should be handled by the CEOs of both companies so that the seriousness of it is completely understood.
The point is, this isn't a normal request and there are likely many ways to accomplish whatever it is they think they need to.
The only valid reason for this is if the customer wants to perform a background check. I actually complied with a similar request in the past. The customer was a financial institution, and they wanted to establish trust that I would not divulge any trade secrets or other protected information I may have come across. None of my information went to the customer except for my name (not too sensitive, since I was emailing them and talking on conference calls using my full, real name). The company that performed the background check did receive my info and the paperwork was very clear about the use of my information.
In your case it sounds like this is not the reason, so I would respond with "no." There are other ways to establish that you are not a former employee, such as sharing your full name. In the event that there is a false positive, maybe have you sign a document stating that under penalty of perjury you are not a former employee. That gives the customer the CYA they need in case they get nailed with a lawsuit about trying to skirt taxes and benefits by moving employees to contractors without going through the proper process.
