28 CFR 513.31: Limitations.

(a) Social Security Numbers. As of September 27, 1975, Social Security Numbers may not be used in their entirety as a method of identification for any Bureau record system, unless such use is authorized by statute or by regulation adopted prior to January 1, 1975.

(b) Employee records. Access and amendment of employee personnel records under the Privacy Act are governed by Office of Personnel Management regulations published in 5 CFR part 297 and by Department of Justice regulations published in 28 CFR part 16.