3 ms·

Why not hash it and simply store it for future cross check while still being technically compliant?

• justrealist 3y ago
  There's no simple "compliant" checkbox here. It's a balance of risks, since there's no single regulatory PII-management regime. And in this case, it's a huge toxic liability that adds almost no value over an email address.
• varenc 3y ago
  SSNs can’t really be anonymized by hashing since they’re essentially sequential numbers. I think the law is at least broad enough to consider a hashed SSN that can be easily reversed to be to equivalent to a real SSN. I agree with others that adtech companies want to proactively avoid SSNs. Too much liability and not at all necessary.
  • klyrs 3y ago
    To clarify, this is one of the must common and dangerous misconception regarding hashing: a SSN is a 9-digit number. Regardless of the strength of your hash, you can hash them all, and compute a lookup table, in a matter of minutes.
    • throw9away6 3y ago
      You don’t have to hash it so it’s not reversible only such that you don’t appear liable in the event of an incident. Technically compliant is good enough
      • varenc 3y ago
        My point is that hashing a 9 digit number is almost certainly not even technically compliant. I believe storing hashed SSNs would incur all the legal liability of storing raw SSNs. The laws are robust enough to at least handle such a trivially reversible hash. No way any expert witness could claim otherwise. Hashed emails on the other hand seem like more of a gray zone (some are reversible, but there's enough variety that not all are). for a fun "challenge", here's my md5 hashed SSN: 46fdccf9acc38d13321b0c13cf541ec9 (spoiler: not my real SSN, but since they're sequential it could be someone's. And, hint, I'd be jealous of them.)