The Complainant in this matter was concerned that the governmental entity’s application for
employment requires an applicant to provide their Social Security Number (SS#). The
Government Data Privacy Act (GDPA) requires government entities to only “obtain and process
only the minimum amount of personal data reasonably necessary to efficiently achieve a
specified purpose”. See Utah Code § 63A-19-401(2)(a)(ii). Representatives from the
governmental entity said they require a SS# in order to verify an applicant’s identity. They also
said a SS# is necessary to differentiate between various applicants and employees and that no
other information would be sufficient to achieve this purpose. Therefore it appears the
governmental entity only processes the minimum amount of personal data necessary.
The governmental entity also indicated that an applicant’s SS# is not disclosed to employees
involved in the hiring process. Instead only individuals with special rights are able to access an
applicant’s SS# and only when necessary to complete the hiring process. Limiting access to and
the use of sensitive personal data like a SS# protects individuals’ privacy rights as required by
Utah Code § 63A-12-103(4).
It was also noted that the governmental entity’s employment application does not contain a
privacy notice. Utah Code § 63A-19-402(1) requires governmental entities to provide a privacy
notice “from whom the governmental entity requests or collects personal data”. The
governmental entity was encouraged to review their employment application to ensure it
complies with the notice requirements in the GDPA. Providing a privacy notice when requesting
or collecting an individual’s personal data protects individuals’ transparency rights as required
by Utah Code § 63A-12-103(4).