N.Y. Public Officers Law § 96-a: Prohibited conduct

§ 96-a. Prohibited conduct. 1. Beginning on January first, two

thousand ten the state and its political subdivisions shall not do any

of the following, unless required by law:

(a) Intentionally communicate to the general public or otherwise make

available to the general public in any manner an individual's social

security account number. This paragraph shall not apply to any

individual intentionally communicating to the general public or

otherwise making available to the general public his or her social

security account number.

(b) Print an individual's social security account number on any card

or tag required for the individual to access products, services or

benefits provided by the state and its political subdivisions.

(c) Require an individual to transmit his or her social security

account number over the internet, unless the connection is secure or the

social security account number is encrypted.

(d) Require an individual to use his or her social security account

number to access an internet web site, unless a password or unique

personal identification number or other authentication device is also

required to access the internet website.

(e) Include an individual's social security account number, except the

last four digits thereof, on any materials that are mailed to the

individual, or in any electronic mail that is copied to third parties,

unless state or federal law requires the social security account number

to be on the document to be mailed. Notwithstanding this paragraph,

social security account numbers may be included in applications and

forms sent by mail, including documents sent as part of an application

or enrollment process, or to establish, amend or terminate an account,

contract or policy, or to confirm the accuracy of the social security

account number. A social security account number that is permitted to be

mailed under this section may not be printed, in whole or in part, on a

postcard or other mailer not requiring an envelope, or visible on the

envelope or without the envelope having been opened.

(f) Encode or embed a social security number in or on a card or

document, including, but not limited to, using a bar code, chip,

magnetic strip, or other technology, in place of removing the social

security number as required by this section.

(g) Nothing in this section shall prohibit a county clerk or court

from making available a document publicly recorded or filed prior to the

effective date of this section, provided that if any individual requests

redaction of a social security number from a publicly recorded document

available to the public online, such number shall be promptly redacted

by the county clerk. Nothing in this section shall limit disclosure of

criminal history record information currently permitted.

2. As used in this section "social security account number" shall

include the nine digit account number issued by the federal social

security administration and any number derived therefrom. Such term

shall not include any number that has been encrypted.

3. This section does not prevent the collection, use or release of a

social security account number as required by state or federal law, or

the use of a social security account number for internal verification,

fraud investigation or administrative purposes.