New York is the most recent jurisdiction to enact legislation intended to protect employees from identity theft. New York recently amended its Labor Law, adding section 203-d to prohibit all employers, regardless of size, from:
- publicly posting or displaying an employee’s Social Security number;
- visibly printing an employee’s Social Security number on any identification badge or card, including any time card;
- placing a Social Security number in files with unrestricted access; or
- communicating to the general public employees’ personal identifying information including: Social Security numbers, home addresses or telephone numbers, personal electronic mail addresses, Internet identification names or passwords, parent’s surname before marriage, or drivers’ license numbers.
The law also prohibits employers from using a Social Security number as an identification number for purposes of any occupational licensing. Employers must take “reasonable measures” to ensure that the personal identifying information is not disseminated. Such measures include, informing employees of their rights under the new law, as well as implementing procedures and mechanisms to safeguard the information.
The law imposes a civil penalty of up to $500 on any employer for a “knowing violation” of this statute. A violation is “knowing” if an employer has not implemented any policies or procedures to safeguard against such violation, including procedures to notify employees of the law.
Labor Law section 203-d is silent as to what constitutes a single “violation.” Consequently, it remains unclear whether an employer’s publication of a single list containing the personal identifying information of several employees would amount to single or multiple violations.
The Labor Law amendment also is silent as to whether there is a private right of action and whether employers are restricted from using the last four digits of an employee’s Social Security number or any number derived from the full Social Security number for identification purposes, seniority lists or for any other reason. The Labor Law amendment does not define “Social Security number,” unlike New York’s Public Officers’ Law and General Business Law which defines “Social Security Account Number” to include “the nine digit account number issued by the federal social security administration and any number derived therefrom.”
The New York State Department of Labor, charged with interpreting and enforcing the Labor Law, has not issued any regulations that would provide guidance regarding these issues.