15 CFR § 2004.28 - Use and collection of Social Security numbers.
We will collect Social Security numbers only when it is necessary and we are authorized to do so. At least annually, the Privacy Act Office will inform employees who are authorized to collect information that:
(a) Individuals may not be denied any right, benefit or privilege as a result of refusing to provide their Social Security numbers, unless the collection is authorized either by a statute or by a regulation issued prior to 1975; and
(b) They must inform individuals who are asked to provide their Social Security numbers:
(1) If providing a Social Security number is mandatory or voluntary;
(2) If any statutory or regulatory authority authorizes collection of a Social Security number; and
(3) The uses that will be made of the Social Security number.