California agency is exposing millions of people to identity theft, audit finds

The California agency tasked with distributing unemployment, disability and parental leave benefits routinely puts recipients at risk for identity theft by including their full Social Security numbers and other personal information on millions of documents mailed each year, according to a state audit released Thursday.

And while the Employment Development Department agrees that it should immediately stop printing Social Security numbers on so many documents, it will be two years before the agency could do so because of its aged computer system.

State lawmakers ordered the audit last year after learning that the department had not stopped printing full Social Security numbers on many of the most commonly used forms sent in the mail, despite lawmakers and consumers raising questions about the practice in 2015. When auditors began their investigation last year, they found that the department still did not have a plan for removing Social Security numbers from many mailed documents. Instead, the agency said it planned to wait until upgrading its computer system in 2024.

Former Assemblywoman Catharine Baker (R-Dublin), who helped push for the audit last year, said auditors were right to point out that waiting five years was not good enough. Baker said that waiting for the agency to upgrade its computer system was particularly problematic given the state’s poor track record with technology projects, which have routinely come in late, over-budget and riddled with problems.

She said she was relieved to see that the Employment Development Department will begin working on a plan now to remove the highly sensitive information from most of the forms sent to customers’ homes.

“I’m sorry that it took an independent audit to point out something that is fairly obvious,” Baker said Thursday.

In a statement, EDD Director Patrick W. Henning said the department has agreed to “immediately implement solutions” identified in the audit.

“The EDD is committed to protecting the personal information of Californians, including their Social Security numbers,” he said.

The audit found that the department had in recent years reduced the number of forms mailed with full Social Security numbers by 10 million a year, but was still sending 17 million other documents with the information to more than a million people.

The department exposed nearly 300 people to identity theft between 2015 and 2018 by inadvertently disclosing their Social Security numbers, including one incident in 2015 when multiple people’s claim documents with personal information were included in one envelope. Those affected were notified by the agency.

The Employment Development Department agreed with the audit’s findings that Social Security numbers should be replaced with a unique identifier, saying it could accomplish this on its most frequently mailed forms within two years at a cost of $3.4 million.

The audit recommended that the state Legislature force all agencies to stop using Social Security numbers on mailed documents by passing a law barring the practice as of December 2022. If an agency can’t meet that deadline, auditors said, it should pay for credit monitoring beginning the next year for people they put at risk.

melody.gutierrez@latimes.com

Follow @MelodyGutierrez on Twitter and sign up for our Essential Politics newsletter.