N.Y. General Business Law § 399-ddd: Confidentiality of social security account number

* § 399-ddd. Confidentiality of social security account number.

Beginning on and after January first, two thousand eight:

1. (a) As used in this section "social security account number" shall

include the number issued by the federal social security administration

and any number derived from such number. Such term shall not include any

number that has been encrypted.

(b) For purposes of this section, the term "incarcerated individual"

means a person confined in any local correctional facility as defined in

subdivision sixteen of section two of the correction law or in any

correctional facility as defined in paragraph (a) of subdivision four of

section two of the correction law pursuant to such person's conviction

of a criminal offense.

2. No person, firm, partnership, association or corporation, not

including the state or its political subdivisions, shall do any of the

following:

(a) Intentionally communicate to the general public or otherwise make

available to the general public in any manner an individual's social

security account number. This paragraph shall not apply to any

individual intentionally communicating to the general public or

otherwise making available to the general public his or her social

security account number.

(b) Print an individual's social security account number on any card

or tag required for the individual to access products, services or

benefits provided by the person, firm, partnership, association or

corporation.

(c) Require an individual to transmit his or her social security

account number over the internet, unless the connection is secure or the

social security account number is encrypted.

(d) Require an individual to use his or her social security account

number to access an internet web site, unless a password or unique

personal identification number or other authentication device is also

required to access the internet website.

(e) Print an individual's social security account number on any

materials that are mailed to the individual, unless state or federal law

requires the social security account number to be on the document to be

mailed. Notwithstanding this paragraph, social security account numbers

may be included in applications and forms sent by mail, including

documents sent as part of an application or enrollment process, or to

establish, amend or terminate an account, contract or policy, or to

confirm the accuracy of the social security account number. A social

security account number that is permitted to be mailed under this

section may not be printed, in whole or part, on a postcard or other

mailer not requiring an envelope, or visible on the envelope or without

the envelope having been opened.

(f) Encode or embed a social security number in or on a card or

document, including, but not limited to, using a bar code, chip,

magnetic strip, or other technology, in place of removing the social

security number as required by this section.

(g) Knowingly use the labor or time of or employ any incarcerated

individual in this state, or in any other jurisdiction, in any capacity

that involves obtaining access to, collecting or processing social

security account numbers of other individuals.

3. This section does not prevent the collection, use, or release of a

social security account number as required by state or federal law, the

use of a social security account number for internal verification, fraud

investigation or administrative purposes or for any business function

specifically authorized by 15 U.S.C. 6802.

4. Any person, firm, partnership, association or corporation having

possession of the social security account number of any individual

shall, to the extent that such number is maintained for the conduct of

business or trade, take reasonable measures to ensure that no officer or

employee has access to such number for any purpose other than for a

legitimate or necessary purpose related to the conduct of such business

or trade and provide safeguards necessary or appropriate to preclude

unauthorized access to the social security account number and to protect

the confidentiality of such number.

5. Any waiver of the provisions of this section is contrary to public

policy, and is void and unenforceable.

6. No person may file any document available for public inspection

with any state agency, political subdivision, or in any court of this

state that contains a social security account number of any other

person, unless such other person is a dependent child, or has consented

to such filing, except as required by federal or state law or

regulation, or by court rule.

7. Whenever there shall be a violation of this section, application

may be made by the attorney general in the name of the people of the

state of New York to a court or justice having jurisdiction by a special

proceeding to issue an injunction, and upon notice to the defendant of

not less than five days, to enjoin and restrain the continuance of such

violations; and if it shall appear to the satisfaction of the court or

justice that the defendant has, in fact, violated this section, an

injunction may be issued by such court or justice, enjoining and

restraining any further violation, without requiring proof that any

person has, in fact, been injured or damaged thereby. In any such

proceeding, the court may make allowances to the attorney general as

provided in paragraph six of subdivision (a) of section eighty-three

hundred three of the civil practice law and rules, and direct

restitution. In connection with any such proposed application, the

attorney general is authorized to take proof and make a determination of

the relevant facts and to issue subpoenas in accordance with the civil

practice law and rules. Whenever the court shall determine that a

violation of subdivision two of this section has occurred, the court may

impose a civil penalty of not more than one thousand dollars for a

single violation and not more than one hundred thousand dollars for

multiple violations resulting from a single act or incident. The second

violation and any violation committed thereafter shall be punishable by

a civil penalty of not more than five thousand dollars for a single

violation and not more than two hundred fifty thousand dollars for

multiple violations resulting from a single act or incident. No person,

firm, partnership, association or corporation shall be deemed to have

violated the provisions of this section if such person, firm,

partnership, association or corporation shows, by a preponderance of the

evidence, that the violation was not intentional and resulted from a

bona fide error made notwithstanding the maintenance of procedures

reasonably adopted to avoid such error.

* NB There are 2 § 399-ddd's