EPIC Encourages FinCEN to Center Privacy and Data Security in Consumer Identification Methods

Yesterday EPIC submitted comments urging the Financial Crimes Enforcement Network (FinCEN) to require strong privacy and security protections in their Consumer Identification Program (CIP) Rule that governs how banks obtain full Social Security Numbers (SSN) from third-party verifiers when a consumer opens an account or applies for a credit card. FinCEN specifically sought information in response to their proposal to allow banks to collect only a partial SSN, along with biographic information, and obtain the full SSN from a third-party service.

EPIC detailed the weaknesses of using SSNs as an identifier and the growing data security risks from widespread government and commercial collection and storage of SSNs. Further, EPIC recommended that FinCEN allow banks to obtain full SSN from third-party verifiers but prohibit the collection of other biographic information from third-party verifiers. EPIC argued that in the broader commercial surveillance ecosystem, “FinCEN should be careful not to endorse general-purpose data brokering and should not support an industry that has been deeply destructive to privacy while facilitating fraud and identity theft.”

Finally, EPIC strongly encouraged FinCEN to mandate data minimization and data deletion for third-party verifiers to protect consumer financial privacy. FinCEN should also discourage banks from relying on biometrics to validate identity, and to specifically avoid employing 1:many remote biometric identity verification.

EPIC regularly submits comments and advocates for consumer financial privacy and responsible digital identification. Recently, EPIC submitted comments to the Consumer Financial Protection Bureau suggesting ways to strengthen the privacy and data security in their personal financial data rights rulemaking.