(a) As used in this section, “college and university” includes all institutions of public higher education and all independent institutions of higher education.

(b) The Office of Privacy Protection in the Department of Consumer Affairs shall establish a task force to conduct a review of the use by all colleges and universities of social security numbers in order to recommend practices to minimize the collection, use, storage, and retention of social security numbers in relation to academic and operational needs and applicable legal requirements.

(c) The task force shall be known as the “College and University Social Security Number Task Force.” The Office of Privacy Protection shall determine the composition of the task force, which shall include, but not be limited to, all of the following:

(1) Two representatives from each of the three institutions of public higher education.

(2) Two representatives of the California Association of Independent Colleges and Universities.

(3) Two representatives each from two organizations devoted to the protection of personal privacy.

(4) One representative from a national organization devoted to the management of information technology in higher education.

(5) One representative from the business community with expertise in technological solutions to privacy concerns.

(6) One representative each from the Assembly Committee on Judiciary and the Senate Committee on Judiciary.

(d) The task force shall seek input, as deemed necessary and appropriate, from all of the following:

(1) Representatives of organizations with expertise in technical policy and practices of Internet disclosure, privacy policy relevant to Internet disclosure, and fostering public integrity and accountability.

(2) The constituencies of the college and university communities, including students, staff, and faculty.

(e) The task force shall review and make recommendations to minimize the collection, use, storage, and retention of social security numbers by California colleges and universities and shall include, but not be limited to, all of the following:

(1) A survey of best practices at colleges and universities and the costs of implementing those best practices.

(2) The necessary use and protection of social security numbers for all of the following:

(A) Research purposes.

(B) Academic purposes, including, but not limited to, academic research, admission, financial aid, and other related operational uses.

(C) Operational uses by academic medical centers, including, but not limited to, patient identification, tracking, and care.

(D) Business purposes, including, but not limited to, the provision of employee benefits, tax purposes, loan programs, and other requirements imposed by current state and federal statutes and regulations.

(E) Another operational need of the college or university.

(3) Current personal privacy protections provided to students, applicants, staff, and faculty of colleges and universities.

(4) Existing state and federal legal requirements, including regulatory requirements, mandating the use of social security numbers at colleges and universities.

(5) The possible use of personal identifiers or other substitutes for social security numbers that protect personal information and meet the operational needs of colleges and universities.

(6) The cost of funding any recommendations presented by the task force, including those that are of minimal cost and can be implemented immediately and those that require additional funding or time to implement.

(f) The task force shall commence meetings no later than May 1, 2008.

(g) (1) On or before July 1, 2010, the task force shall submit a final report of its findings and recommendations to the Office of Privacy Protection, and to the Assembly Committee on Judiciary and the Senate Committee on Judiciary.

(2) The final report shall also include a list of the existing uses of social security numbers common among colleges and universities for routine operations and compliance with state and federal laws.

(3) The findings and recommendations of the task force shall be informational only and shall not be binding on any college or university.

(Amended by Stats. 2008, Ch. 179, Sec. 70. Effective January 1, 2009.)