New York State has passed a new law, which prevents most persons from requiring others to disclose their Social Security Numbers (“SSNs”). The law may be found at new section 399-ddd to the General Business Law, and becomes effective on December 12, 2012. For this purpose, the SSN is the nine-digit number assigned by the Social Security Administration, and any number derived from it (other than a number which is encrypted). Thus, the first three digits, and the final four digits, by themselves would be treated as an SSN for this purpose.
Under the new law, an employer (other than New York State) cannot require an employee (or potential employee) to disclose his/her SSN, unless one of the following exceptions applies:
–the individual consents to the disclosure;
–the employer is expressly required to obtain the SSN by federal, state or local law or regulation;
–the SSN is to be used for tax compliance, internal verification, fraud investigation, or determining whether the individual has a criminal record; or
–the SSN is requested for employment purposes (such as to administer a claim, benefit or employment procedure; such procedure includes termination, retirement, work injury investigation or claim for unemployment compensation).
Employers should review and revise their forms, policies and procedures to comply with the new law. The law does not provide for a private right of action. It is enforced by New York’s Attorney General , and carries a civil penalty of not more the $500 for the first offense, and of not more than $1,000 for the second and any further offense. It appears that a penalty will not be imposed if a violation of the law is not intentional and results from a bona fide error, notwithstanding the maintenance of procedures reasonably adopted to avoid such error.