rotenberg: no. under the safeguards rule, they can inspect and i think sanction, but a fine would require subsequent violation of the settlement or order with the company and the ftc under the safeguards rule currently would not have the ability to inspect or prevent prior to the breach occurring. >> so is there any way under existing law for appropriate federal agency to levy a fine or some type of significant penalty on the company to deter or two? mr. rotenberg: for the ftc to levy a fine they would have to find a breach under the fair credit reporting act. under section five they will have to have a consent order and a subsequent violation. it's not a very effective enforcement machine. >> i concur. thank you very much. >> senator scott. scott: the equifax breach is still catastrophic for so many in south carolina. if you think about the numbers of individuals impacted by the breach in my home state, 2.4 million south carolinians have their personal information exposed, stolen through the equifa

rotenberg? >> i think the answer is clearly yes. >> mr. smith. >> i think that with respect to the equifax -- with respect to the equifax incident, one of the things that we need to keep in mind is that according to news reports the credit reporting database was not, in fact, compromised. a compromise of a credit reporting database, i'd have to think about whether it would -- whether it would present -- >> so you're the one that started off by saying it provides critically important benefits fits, it's indispensable, the breach of 145 million you don't think has a systemic impact on the u.s. financial system? >> i think that the risk would be able to be managed by banks but i do think that it's going to be something that would need to be actively managed because what it would present -- >> is that a yes or no so to systemic impact? could be manage the, a lot of things could be managed. does that have a systemic impact on the financial system. >> i'm not prepared to say it would have a systemic impact but i'd like to think that through. >>

rotenberg. >> thank you for the question. i've spent many years before many congressional committees urging that limits be established on the use of the social security number. but we have never argued for replacing the social security number. the key point is that the ssn serves an important purpose in the management of certain government record systems. that's what it was established for, and that's where the legal authority exists the problem is that the ssn was adopted in the private sector, and used as an identifier for general purposes. this is actually contributed to identity theft and financial fraud. it's an imperfect identifier. it's used both as a password and as an authenticator. it was intended for neither. so when we talk about the social security number, we would not say replace the ssn. as i describe in my testimony, we would say limit the use of the ssn. it should only be available in the private sector for lawful purposes. >> thank you. mr. jaikaran. >> the social security number is a piece of personally ide