If the user isn’t an administrator and does an export, SSNs should be masked. Otherwise, show the SSN.
You won't be notified about changes to this idea.