Figure 1
Disability and Unemployment Sent More Than 37 Million Documents From EDD’s Mailing Facility
in Fiscal Year 2017–18
Figure 1 is a graphic that describes EDD’s Unemployment Insurance, Disability Insurance, Tax, and Workforce Services programs, which together accounted for 44.5 million pieces of mail that EDD sent from its mailing facility in fiscal year 2017-18. Unemployment Insurance pays wage replacement benefits to workers who have lost their jobs and meet the program’s eligibility requirements. Disability Insurance—which includes the Paid Family Leave program—pays wage replacement benefits to eligible workers who need time off because of illnesses, injuries, or pregnancies, or to care for new children or ill family members. Tax administers the collection, accounting, and auditing of certain payroll taxes. Workforce Services offers public employment services that prepare Californians for participation in the workforce and connect job seekers with employers. The four programs are ordered by their fiscal year 2017-18 mailing volumes; Unemployment Insurance sent 25.5 million pieces of mail, Disability Insurance sent 12.2 million, Tax sent 5.1 million, and Workforce Services sent 1.7 million. Aside from sending the majority of EDD’s mail pieces, Disability Insurance and Unemployment Insurance also mail documents primarily to claimants, whereas Tax mails documents primarily to employers and Workforce Services mails documents primarily to employers and job seekers.
Figure 2
EDD Removed SSNs From Certain Documents That It Mails Millions of Times Each Year, But Its Claimants Are Still at Risk of Identity Theft
Figure 2 is a bar chart that quantifies EDD’s efforts since 2015, which have completely removed SSNs from more than 10 million annual mailings compared to the 13 million mailings that still contain SSNs. The chart consists of two bars, each rising to a total of more than 23 million documents: one bar represents EDD’s efforts from 2015 through 2017 and one represents EDD’s efforts in 2018 or later. The first bar shows that from 2015 through 2017, EDD removed some but not all SSNs from more than 7 million pieces of mail and it had not removed SSNs from more than 15 million pieces of mail. The second bar shows that in 2018 or later, EDD removed all SSNs from more than 10 million pieces of mail. The bar also includes the more than 7 million pieces of mail from which EDD removed some but not all SSNs prior to 2018. These more than 7 million pieces of mail, combined with additional documents that EDD has not addressed since 2015, account for 13 million documents that continue to pose a risk of identity theft for claimants. The mail volumes we depict in the chart are totals based on a selection of 21 documents that EDD sent to Disability Insurance and Unemployment Insurance claimants from its mailing facility in fiscal year 2017-18.
Figure 3
Claimants Have Expressed Concerns to EDD About Its Inclusion of SSNs on Documents It Mails
Figure 3 is a side-by-side display of three concerns claimants expressed to EDD and EDD’s responses to those concerns. The first concern, dated May 2016, states that the claimant’s mail often goes to the wrong location and that it is extremely concerning to the claimant that EDD lists the claimant’s full SSN on mailed documents. The second concern, dated July 2017, questions why EDD needs to print full SSNs on mailed documents and indicates that doing so is a breach of the claimant’s privacy. EDD’s responses to both of those concerns state that EDD is currently in the process of reviewing how to replace SSNs on documents, but that EDD is legally authorized to use SSNs to administer the Unemployment Insurance program. The final concern, dated August 2018, states that every document the claimant has received from EDD by mail has displayed the claimant’s full SSN. The claimants expresses concern of identification theft from mail. EDD’s response indicates that EDD uses SSNs to perform Unemployment and Disability processes and that it notifies individuals if it believes a claimant’s SSN has been compromised due to a handling, processing, or mailing error.
Figure 4
EDD’s Modernization Project Will Take Years to Implement While Claimants’ SSNs Remain Vulnerable
Figure 4 is a timeline of EDD’s modernization project that indicates EDD will not complete the project earlier than September 2024, which leaves an interim period of five and a half years during which EDD could mail approximately 70 million more documents to claimants containing SSNs. EDD began market research for its modernization project in February 2016, completed its business analysis in December 2016, and received approval of its analysis of alternatives from Technology in September 2018. EDD expects to complete detailed development plans for its preferred solution for the project in June 2020. It plans to award a contract and start project implementation in September 2022. Vendor estimates indicate that September 2024 is the earliest EDD could implement the project. Based on the fiscal year 2017-18 mailing rate of 13 million documents containing SSNs, EDD could mail approximately 70 million such documents containing SSNs to claimants before it implements the modernization project.
Figure 5
EDD Could Take Interim Actions to Replace Remaining SSNs on Its High-Volume Documents
Figure 5 is a graphic that displays four solutions EDD could use to replace remaining SSNs on high-volume documents, along with EDD’s estimates of the costs and time it would take to implement each solution. The first proposed solution involves replacing full SSNs with a modified unique identifier; EDD estimated it would cost $3.4 million and take two years and two months to implement this solution. The second solution would provide claimants the option to receive documents online instead of by paper mail; EDD estimated $2.9 million and three years and three months to implement this solution. The third option entails truncating SSNs and enhancing system search functionality; EDD estimated this solution would cost $4.2 million and take four years and three months to implement. This solution would likely provide only partial coverage—roughly 43 percent—of the 13 million documents containing SSNs that we discuss in the Audit Results. According to the IT branch division chief, the overall time to implement this solution may be shorter because EDD could potentially overlap some technical changes involved in both truncating SSNs and enhancing system search functionality. The fourth solution involves replacing SSNs with another unique identifier, which EDD estimated would cost $26.3 million and take three years and eight months to implement. EDD’s estimates are based on the high-volume Disability Insurance and Unemployment Insurance documents we reviewed. Because of the sensitive nature of one of these solutions, we provided EDD an explanation of how it could implement the proposed solution in a separate confidential management letter.