NY Social Security Number Protection Law- Are You in Compliance?

As you already know, the New York Social Security Number Protection Law (New York General Business Law Section 399-dd) became effective Jan. 1, 2008. It prohibits your business from:

• Making a Social Security number available to the general public whether intentional or not.
• Printing Social Security numbers on any card or tag required for an individual to access products, services, or benefits provided by the company.
• Requiring an individual to transmit his/her Social Security number over the Internet, unless the connection is secure or the number is encrypted.
• Requiring an individual to use his/her Social Security number to access an Internet website, unless a password, PIN, or other type of authenticating device is also required for the individual to access the website.
• Printing an individual's Social Security number on any materials that are mailed to the individual, unless a state or federal law requires the number to be on the document being mailed.

However, there are some additional provisions that some employers may not be aware of. The prohibitions highlighted below became effective Jan. 3:

• Encoding or embedding a Social Security number in or on a card or document, including but not limited to, using a bar code, magnetic strip, or other technology, in place of removing the Social Security number.
• Filing any document available for public inspection with any State agency, political subdivision, or in any court that contains a Social Security account number of any other person, unless such other is a dependent child or has consented to such filing, except as required by federal or State law or regulation, or by court rule.

In addition, another law went into affect early this year which has additional employer requirements. The New York Employee Personal Identifying Law (NYS Labor Law 203-d) also became effective Jan. 3. This law requires the creation of policies and procedures to prevent the prohibited practices outlined below, as well as employee notification of these policies and procedures.

• Employers are prohibited from the following actions:
• Publicly posting an employee's Social Security number.
• Visibly printing a Social Security number on any identification badge or card, including any time cards.
• Placing a Social Security number in files with unrestricted access.
• Communicating an employee's personal identifying information to the general public. Personal identifying information is defined as a Social Security number, home address or telephone number, e-mail address, Internet identification name/password, parent's surname prior to marriage or driver's license number.

Also, a social security number shall not be used as an identification number for purposes of any occupational licensing.

A civil penalty of up to $500 may be imposed on any employer who knowingly violated this section. It shall be presumptive evidence that a violation of this section was knowing if the employer has not put in place any policies or procedures to safeguard against such violation, including procedures to notify relevant employees of these provisions.

Employers are encouraged to review all processes and procedures to ensure any future use of social security numbers complies with these regulations and also to ensure employee identifying information is properly safeguarded and accessible only to those with a need to know. Any written policies and procedures created to meet the requirements under this law should be reviewed by legal counsel to ensure proper compliance.

If you have any questions regarding this or any other HR-related topics, please contact either HR Helpline staff: Kathy Novak at (585) 256-4618 or Jennifer Suppé at (585) 256-4608.

Source: NYS Consumer Protection Board's Business Privacy Guide, NYS General Business Law, NYS Labor Law.