There are, in fact, legitimate reasons to use SSNs. Researchers often need to link their data to other data from different providers (such as the National Death Index). Agency-specific IDs would make this impossible. Like it or not, SSNs are the closest thing we have to a bureaucratic lingua franca in the US.
It should be standard practice to de-identify data as soon as you get them, and to keep the original data with SSNs and other identifying details in a non-networked secure location. If Berkeley had taken this precaution this mess could have been avoided.