N.Y. General Business Law § 399-ddd*2: Disclosure of social security number

* § 399-ddd. Disclosure of social security number. 1. As used in this

section, "social security account number" shall include the number

issued by the federal social security administration and any number

derived from such number. Such term shall not include any number that

has been encrypted.

2. No person, firm, partnership, association or corporation, not

including the state or its political subdivisions, shall require an

individual to disclose or furnish his or her social security account

number, for any purpose in connection with any activity, or to refuse

any service, privilege or right to an individual wholly or partly

because such individual refuses to disclose or furnish such number,

unless one of the exceptions enumerated in subdivision three of this

section applies.

3. The provisions of this section shall not apply in the following

instances:

(a) The individual consents to the acquisition or use of his or her

social security account number.

(b) The social security account number is expressly required by

federal, state, or local law or regulation.

(c) The social security account number is to be used for internal

verification or fraud investigation.

(d) The social security account number is to be used for any business

function permitted or allowed under the Gramm Leach Bliley Act, P.L.

106-102 (1999).

(e) The social security account number is requested in connection with

a request for credit or a credit transaction initiated by the consumer

or in connection with a lawful request for a consumer report or

investigative consumer report, as such terms are defined in section

three hundred eighty-a of this chapter.

(f) The social security account number is requested in connection with

a deposit account or an investment.

(g) The social security account number is requested for purposes of

employment, including in the course of the administration of a claim,

benefit, or procedure related to the individual's employment by the

person, including the individual's termination from employment,

retirement from employment, injury suffered during the course of

employment, or to check on an unemployment insurance claim of the

individual.

(h) The social security account number is requested for purposes of

tax compliance.

(i) The social security account number is requested for the purpose

of:

i. the collection of child or spousal support;

ii. determining whether an individual has a criminal record; or

iii. blood or organ donation.

(j) The social security account number is requested in connection with

any interaction with a governmental law enforcement agency or is used in

conjunction with the enforcement of a judgment of a court of competent

jurisdiction by a sheriff or marshal.

(k) The social security account number is requested for the purpose of

verifying an individual's identity or age in order to allow such

individual to obtain access to, or enroll in, a marketing program that

is restricted to individuals of a certain age.

(l) i. The social security account number is requested by an

individual, firm, corporation, or other entity doing business pursuant

to a franchise issued by a political subdivision of the state or a

license, franchise, certificate or other authorization issued by the New

York state public service commission.

ii. The social security account number is requested by an individual,

firm, corporation, or other entity regulated by the New York state

public service commission, the federal communications commission, or the

federal energy regulatory commission.

iii. The social security account number is requested by a banking

institution, as defined in section nine-f of the banking law, or one of

its affiliates.

(m) The social security account number is requested by an authorized

insurer, as defined in section one hundred seven of the insurance law,

for the purpose of furnishing information to the Centers for Medicare

and Medicaid Services within the United States Department of Health and

Human Services.

4. Whenever there shall be a violation of this section, application

may be made by the attorney general in the name of the people of the

state of New York to a court or justice having jurisdiction by a special

proceeding to issue an injunction, and upon notice to the defendant of

not less than five days, to enjoin and restrain the continuance of such

violation; and if it shall appear to the satisfaction of the court or

justice that the defendant has, in fact, violated this section, an

injunction may be issued by such court or justice, enjoining and

restraining any further violation, without requiring proof that any

person has, in fact, been injured or damaged thereby. In any such

proceeding, the court may make allowances to the attorney general as

provided in paragraph six of subdivision (a) of section eighty-three

hundred three of the civil practice law and rules, and direct

restitution. In connection with any such proposed application, the

attorney general is authorized to take proof and make a determination of

the relevant facts and to issue subpoenas in accordance with the civil

practice law and rules. Whenever the court shall determine that a

violation of subdivision two of this section has occurred, the court

shall impose a civil penalty of not more than five hundred dollars. The

second offense and any offense committed thereafter shall be punishable

by a civil penalty of not more than one thousand dollars.

5. No person, firm, partnership, association or corporation shall be

deemed to have violated the provisions of this section if such person,

firm, partnership, association or corporation shows, by a preponderance

of the evidence, that the violation was not intentional and resulted

from a bona fide error made notwithstanding the maintenance of

procedures reasonably adopted to avoid such error.

* NB There are 2 § 399-ddd's