The New York State Social Security number protection law was recently amended to ban companies from requiring individuals to disclose or furnish their Social Security number “for any purpose in connection with any activity.” Individuals who refuse to disclose or furnish their Social Security number may not be denied any service, right, or privilege. Codified in N.Y. General Business Law § 399-ddd, the law defines a “Social Security account number” as the number issued by the federal Social Security Administration as well as any number derived from such number.
There are several exceptions to the general prohibitions of Section 399-ddd. First, the law does not apply to the state or its political subdivisions. Second, there is no violation of the law where individuals consent to acquisition or disclosure of their Social Security number. Individuals may be required to disclose their Social Security number when the request is made pursuant to a federal, state, or local law, or regulation. Further, disclosure of Social Security numbers may be required where the number will be used for internal verification or fraud investigations, or the Social Security number is requested “for purposes of employment.” Despite these exceptions, employers will still be required to safeguard the privacy of employees’ Social Security numbers.
The law does not provide for a private right of action, so individuals adversely affected by any violations of the law cannot sue for damages. Rather, the law is enforced by the New York State attorney general and carries a $500 civil penalty per violation for the first offense and a $1000 penalty per violation for the second offense.
N.Y. General Business Law § 399-ddd will become effective on December 12, 2012.