Report 2018-129

Employment Development Department

March 8, 2019

Elaine M. Howle, CPA
California State Auditor
621 Capitol Mall, Suite 1200
Sacramento, CA 95814

Dear Ms. Howle:

The Labor and Workforce Development Agency has authorized me to respond to the draft findings of the California State Auditor’s Report 2018-129 on the Employment Development Department’s practice of mailing documents containing Social Security numbers. The report raises serious concerns on the risks of identity theft, and the Employment Development Department’s (EDD) is committed to strengthening its efforts to safeguard the personal information of Californians.

I concur with your assessment that EDD must take reasonable interim steps to safeguard customer identifying information while it works to achieve a comprehensive solution. I also appreciate your recognition of EDD’s prior and ongoing efforts to reduce the number of printed and mailed forms containing Social Security numbers, and I appreciate the recommendations contained in the report.

My responses to your specific recommendations are set forth below:

Recommendation One: EDD should implement one or more of our proposed solutions or another viable solution to discontinue its use of full SSNs as a unique identifier on all documents it mails to claimants by December 2021. It should prioritize addressing those documents with the highest mail volume and should make changes to these documents by March 2020.

Agree. Figure 5 of the audit report describes four proposed interim actions that EDD could take to replace Social Security numbers on its high volume documents. EDD will immediately implement the first solution. As noted in Figure 5, the timeline for completing the high-volume documents is two years and two months (to be completed by June 2021), which extends beyond the March 2020 target set forth in the recommendation. In addition, EDD is exploring how to accomplish the second solution simultaneously by shifting priority from other technology projects. EDD will reprioritize current projects and secure necessary funding to accomplish these solutions. Further, in the implementation status report due 60 days from the issuance of the final audit, EDD will describe its plan and anticipated timeline for expeditiously expanding solution one to its remaining forms.

Recommendation Two: To ensure it eliminates any unnecessary uses of personal information in its external communications and to ensure it fully protects its claimants’ privacy, EDD should implement its proposed review process for new, revised, and existing documents by May 2019. Finally, EDD should complete its full review of existing documents and remove any unnecessary instances of personal information by December 2021.

Agree. EDD is developing an Executive Notice that it will issue to all of its executives, managers, and staff by April 15, 2019 to standardize a review process for EDD forms and make this process permanent. EDD is reviewing all of its communications to identify those that have Social Security numbers. EDD held its most recent review on February 22, 2019, and will provide your office with a status update and applicable documentation 60 days from the issuance of the final audit report.

Thank you for the opportunity to provide this response and for the professionalism and courtesy shown by your office and staff throughout this process.

Sincerely,

Patrick W. Henning
Director

Comments

CALIFORNIA STATE AUDITOR’S COMMENTS ON THE RESPONSE FROM THE EMPLOYMENT DEVELOPMENT DEPARTMENT

To provide clarity and perspective, we are commenting on EDD’s response to the audit. The numbers below correspond to the numbers we have placed in the margin of its response.

As a point of clarification, when we recommended that EDD prioritize addressing documents with the highest mail volumes by March 2020, we were referring to the three documents that accounted for nearly 10 million of the 13 million high-volume mailings, as we state here.

The recommendation applies to SSNs as well as other personal information, such as phone numbers, employment histories, and dates of medical treatments, as we state here.