2018-129 Audit Scope and Objectives

Employment Development Department—Privacy Protection Practices

The audit by the California State Auditor will provide independently developed and verified information related to the privacy protection practices used by the Employment Development Department (EDD) when mailing documents to its customers. The audit's scope will include, but not be limited to, the following activities:

  1. Review and evaluate the laws, rules, and regulations significant to the audit objectives.
  2. Determine whether EDD's policies and procedures for protecting customers' personal information comply with applicable state and federal laws and state policy.
  3. Determine whether EDD has been mailing documents to its customers since 2015 that contain personal information and, if so, determine the following:
    1. EDD's reasons for mailing documents to its customers that contained full social security numbers (SSNs) or other personal information rather than using other alternative methods, such as redacting the SSNs.
    2. To the extent possible, the number of individuals who requested to receive information online only but were mailed documents containing full SSNs or other personal information.
  4. Determine whether EDD provides, or plans to provide, alternatives to mailed documents, including providing online communication. If so, to the extent possible, evaluate the effectiveness of those alternatives to increase customer privacy.
  5. Determine the number of complaints EDD has received from its customers about receiving documents through the mail that contain SSNs, including any complaints related to identity theft. Determine whether EDD adequately responded to those complaints.
  6. Evaluate EDD's efforts since 2015 and plans to better protect personal information of its customers and determine the costs and timelines of these efforts. Determine whether any other resources or low-tech or temporary options are available to resolve this issue.
  7. Review and assess any other issues that are significant to the audit.

California State Auditor's Office
8/8/2018