Meyerson v. Prime Realty Services, LLC

7 Misc. 3d 911

• Court: New York Supreme Court
• Decided: February 28, 2005
• Status: Published

Opinion

OPINION OF THE COURT

Diane A. Lebedeff, J.

This motion poses a question of nationwide first impression as to whether, as between two private citizens or entities and where no statute or governmental regulation requires disclosure, a state consumer protection statute may be utilized to assert a claim that a Social Security number be protected from disclosure as confidential information. In the face of a motion to dismiss by entities which insist on their right to demand plaintiff’s Social Security number, this question must be answered in favor of permitting the claim for protection to proceed.

Because the confidentiality of a Social Security number has been the subject of sharply different legal analyses, no single legal theory has emerged from prior judicial decisions considering this subject in various different fact patterns. For reasons explained below, in relation to a private transaction, this court may well adopt a bright line standard that a Social Security number is prima facie privileged information, with the privilege to be asserted only after the demanding party demonstrates entitlement to confidential information. While the privilege must give way as required by statute, regulation or court order, in ordinary circumstances, the person who holds the Social Security number appears to be free to decline disclosure.

This legal issue is posed by the straightforward facts present here. Petitioner’s landlord and its agents have demanded that she reveal her Social Security number as she completes a form regarding the number of occupants of her apartment. A local law permits the landlord to inquire about apartment occupants, but does not authorize a demand for Social Security numbers (Administrative Code of City of NY § 27-2075 [c]). For reasons not relevant here, the landlord is not currently in possession of petitioner’s Social Security number. Additional facts are added in the second section of this decision addressing the applicability of state consumer protection laws.

Plaintiffs complaint seeks declaratory relief (CPLR 3017 [b]), as well as injunctive and monetary relief under the New York consumer protection statute, General Business Law § 349 (h). The defendants’ motion seeks dismissal of the complaint (CPLR 3211 [a] [1], [7]). Both parties request an award of costs, sanctions and attorneys’ fees (22 NYCRR 130-1.1).

Plaintiff fears disclosure of her Social Security number (SSN) may make her subject to identity theft, which has been a peril recognized for over a decade (Greidinger v Davis, 988 F2d 1344, 1353 [4th Cir 1993] [“an individual’s concern over his SSN’s confidentiality and misuse . . . (is) compelling. For example, armed with one’s SSN, an unscrupulous individual could obtain a person’s welfare benefits or Social Security benefits, order new checks at a new address on that person’s checking account, obtain credit cards, or even obtain the person’s paycheck”]). Misuse of a Social Security number can lead to identity theft, sometimes called “data rape” (Latasha D. McDade, Data Rape: Assault by an Unknown Predator — The Supreme Court Went Wrong In TRW, Inc. v Andrews, 45 S Tex L Rev 395, 396 [2004] [reporting that one instance of identity theft occurs every 79 seconds, stating such theft is particularly likely to be done by office workers who have access to a Social Security number in business records, and citing an instance of a victim left with bills from banks, credit card companies, and retailers in excess of $100,000]). To give one striking example of the degree of sophistication now used by identity thieves: there is already a reported significant problem of such thieves seeking bankruptcy protection to forestall eviction or foreclosure to protect their ill-gotten property interests (Magdalena Reyes Bordeaux, Debtors in Pretension: In Light of the Growing Incidence of Identity Theft, Practitioners Need to Understand How to Expunge a Fraudulent Bankruptcy, 27 LA Law No. 6, at 24 [Sept. 2004]).

Social Security Numbers: A Legal Background

Social Security numbers were first adopted in 1936, when nine-digit account numbers were assigned to persons by the Secretary of Health and Human Services for the purpose of administering the Social Security laws (42 USC § 405 [c] [2] [B]). Federal law provides that Social Security account numbers and related records that are obtained or maintained by “authorized persons” shall be confidential, and no “authorized person” shall disclose any such Social Security account number or related record (42 USC § 405 [c] [2] [C] [viii] [I]).¹

It is beyond doubt that governmental officials of every stripe may demand disclosure of a Social Security number, subject to certain restrictions. The primary limitation is contained in the federal 1974 Privacy Act, which requires that any agency requesting disclosure of a SSN must “inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it” (Pub L 93-579, § 7, 88 Stat 1909).² It is noteworthy that, even when government demands the information, a citizen may assert a claim that the government lacks sufficient need to justify seeking the private information (see, for example, Russell v Board of Plumbing Examiners of County of Westchester, 74 F Supp 2d 339 [SD NY 1999], adhered to on rearg 74 F Supp 2d 349 [SD NY 1999], affd 2001 WL 15628, 2001 US App LEXIS 330 [2d Cir, Jan. 5, 2001] [master plumber application requirements imposed by a county]; see also, Dittman v California, 191 F3d 1020 [9th Cir 1999], cert denied 530 US 1261 [2000] [state requirement that acupuncturist provide Social Security number upon applying for license renewal]). The Privacy Act does permit injunctive relief by individuals against the government, albeit there must be proof of some actual damages to achieve even nominal damages (Doe v Chao, 540 US 614 [2004] [Social Security number revealed when plaintiffs black lung claim forms distributed]).

There is a broad federal policy against the government revealing individuals’ Social Security numbers. There are a variety of federal statutory restrictions on dissemination of such information, such as the federal Driver’s Privacy Protection Act of 1994 (18 USC §§ 2721-2725; see Reno v Condon, 528 US 141, 151 [2000] [act restricting states’ ability to sell private data, which included Social Security numbers on driver license applications, was proper governmental exercise because it “regulates the States as the owners of data bases” being sold in interstate commerce]).³ Additionally, where there is a demand for disclosure of Social Security numbers under federal or state freedom of information laws, such numbers are universally held to be confidential (see Sherman v United States Dept. of Army, 244 F3d 357, 361 n 6 [5th Cir 2001] [Social Security numbers are protected by concept of “informational privacy” and disclosure would be “unwarranted invasion of personal privacy” under 5 USC § 552 (b) (7) (C)]; State ex rel. Beacon Journal Publ. Co. v Akron, 70 Ohio St 3d 605, 608, 640 NE2d 164, 167 [1994] [under state open records ldw Social Security numbers of public employees subject to employees’ legitimate expectation of privacy and “a federal right to privacy . . . protects against governmental disclosure of the private details of one’s life”]).⁴

The foregoing authorities reflect a broad recognition of the confidential nature of a Social Security number. This result is not inconsistent generally with common-law view of private information, described in United States Dept. of Justice v Reporters Comm. for Freedom of Press (489 US 749, 763-764 [1989]), a case involving the confidentiality of individual criminal history records, as follows:

“To begin with, both the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person. In an organized society, there are few facts that are not at one time or another divulged to another . . . According to Webster’s initial definition, information may be classified as ‘private’ if it is ‘intended for or restricted to the use of a particular person or group or class of persons: not freely available to the public.’ ”

As the Supreme Court concluded, the fact that the information resides in a governmental or other scattered record does not automatically defeat a privacy claim.

The Supreme Court also addressed the privacy tort theories which have achieved recognition in many jurisdictions:

“[A right to control private information was first enunciated in] Warren & Brandéis, The Right to Privacy, 4 Harv. L. Rev. 193, 198 (1890-1891) (‘The common law secures to each individual the right of determining, ordinarily, to what extent his thoughts, sentiments, and emotions shall be communicated to others . . . [E]ven if he has chosen to give them expression, he generally retains the power to fix the limits of the publicity which shall be given them’). The common law recognized that one did not necessarily forfeit a privacy interest in matters made part of the public record, albeit the privacy interest was diminished and another who obtained the facts from the public record might be privileged to publish it. See . . . Restatement (Second) of Torts § 652D, pp. 385-386 (1977) (‘[T]here is no liability for giving publicity to facts about the plaintiff’s life that are matters of public record, such as the date of his birth . . . On the other hand, if the record is one not open to public inspection, as in the case of income tax returns, it is not public and there is an invasion of privacy when it is made so’); W. Keeton, D. Dobbs, R. Keeton, & D. Owens, Prosser & Keeton on Law of Torts § 117, p. 859 (5th ed. 1984) (‘[M]erely because [a fact] can be found in a public recor[d] does not mean that it should receive widespread publicity if it does not involve a matter of public concern’).” (489 US at 763 n 15.)⁵

It is also observed that New York generally follows the same principles set forth above. For instance, in relation to freedom of information requests, Social Security numbers are redacted (Matter of Beyah v Goord, 309 AD2d 1049, 1052 [3d Dept 2003] [prisoner request for guards’ Social Security numbers]; Parker v State of New York, 269 AD2d 255 [1st Dept 2000] [same]; Bibeau v Cantiague Figure Skating Club, 294 AD2d 525 [2d Dept 2002] [Social Security number to be redacted from plaintiffs proof of earnings tendered in discovery]; Adler v Jackson, 185 Misc 2d 45 [Sup Ct, Queens County 2000] [Department of Motor Vehicles could properly require disclosure of Social Security number on license application under Privacy Act provisions]).

Concluding this broad review of the treatment of Social Security numbers, it is clear that the weight of authority favors treating a Social Security number as private and confidential information. In casting for a proper legal characterization, the law appears to support a conclusion that a Social Security number is protected by something akin to a privilege against disclosure, which privilege is to be asserted only after legal authority for the demand is demonstrated.

Consumer Protection Statutory Claim

Plaintiff seeks relief upon the claim that her landlord’s request for her Social Security number constitutes a violation of New York’s consumer protection statute (General Business Law § 349 [h]), upon the allegation that her landlord deceptively represented that she was required by law to provide personal and confidential information, including her birth date and Social Security number, in order to secure a renewal lease and to avoid eviction. A prima facie case of deceptive practices pursuant to General Business Law § 349 requires a showing that defendants’ acts are directed to consumers, that they are deceptive or misleading in a material way and that plaintiff has been injured thereby (Zurakov v Register.Com, Inc., 304 AD2d 176 [1st Dept 2003], citing Oswego Laborers’ Local 214 Pension Fund v Marine Midland Bank, 85 NY2d 20, 25-26 [1995]).

To elaborate upon the facts, in September of 2003, the landlord sent a renewal lease with a letter directing her to complete and execute a form which required such information in relation to each occupant of plaintiffs apartment. The form stated it was “[i]n accordance with New York City Administrative Code, Section 27-2075 (c)” and that “[failure to reply is grounds for eviction.” The included “Lease Renewal Instructions” stated that all enclosed forms “must be signed if you would like to renew your lease for your apartment. You must completely sign and enter all information requested.” Plaintiff alleges that the landlord routinely sends the same forms to all rent-regulated tenants in the buildings it owns or manages.

Upon receiving the lease renewal packet, plaintiff sought legal advice as to whether she was required to complete the affidavit and provide all information demanded. The landlord refused to withdraw the demand for information.

The landlord baldly asserts that it is entitled to demand disclosure of the plaintiffs Social Security number, urging such demand is specifically authorized by applicable laws. Landlord relies on Administrative Code § 27-2075 (c), which relates to maximum permitted occupancy of an apartment. The provision states, in relevant part, that “[o]n written demand ... by the owner when he or she rents a dwelling unit or any time thereafter, the tenant shall submit an affidavit setting forth the names and relationship of all occupants residing within the dwelling unit and the ages of any minors.” By its plain language, the code provision relied upon by defendants does not authorize a demand for Social Security numbers of apartment occupants, or for the birth dates of all adult occupants.

Further, to the extent landlord’s forms could be understood as threatening eviction for noncompliance, such threat must also be viewed as inaccurate since courts have held that a tenant cannot be evicted for noncompliance with section 27-2075 of the Administrative Code (Tabak v Pinzon, NYLJ, Mar. 18, 1999, at 30, col 4 [Civ Ct, NY County] [“mere non-response to a Demand Notice alone is an insufficient basis to evict a rent controlled tenant”]; 338 W. 17th St. Assoc. v Katehis, NYLJ, Oct. 5, 1994, at 22, col 2 [Civ Ct, NY County] [noting that “Housing Maintenance Code was enacted to protect tenants from substandard tenements and housing conditions which were clearly a threat to the very lives and health of the occupants,” and “(w)hile landlords have an affirmative duty to investigate conditions at their buildings and ensure that the buildings meet the legal standards, the Code was never intended to be used as a sword by a landlord who seeks to evict low rent tenants who have not been proven to be a danger to the building”]). Despite defendants’ protests, a plain English reading of the form tendered leads to a reader’s reasonable conclusion that failure to provide the information demanded is grounds for eviction and nonrenewal of a lease.

Nor do defendants advance any other showing of a right to obtain Social Security numbers of occupants of the apartments. This unit is not one in which the tenant receives governmental benefits (see, e.g., Matter of Waterside Redevelopment Co. v Department of Hous. Preserv. & Dev., 270 AD2d 87 [1st Dept 2000] [income inquiry for tenants of City-Aided Limited Profit Housing Companies under article 2 of the Private Housing Finance Law], lv denied 95 NY2d 765 [2000]). The landlord has not initiated a luxury decontrol inquiry under the Rent Stabilization Law, which would not entitle it to Social Security information in any event (Administrative Code § 26-504.1; Matter of Shapiro v New York State Div. of Hous. & Community Renewal, NYLJ, Apr. 8, 1998, at 28, col 4 [Sup Ct, NY County, Tolub, J.] [“As the tax department advised the Governor in his July 7, 1993 letter, The Tax Law prohibits use of tax return information for nontax purposes’ and ‘(u)nder federal law, social security numbers cannot be used for the purpose of denying rent control to high-income tenants through the matching program envisioned by the bill’ (Commissioner’s letter in Governor’s Bill Jacket, Laws of 1993, Chapter 253)”], affd 262 AD2d 18 [1st Dept 1999], affd as mod, sub nom. Matter of Elkin v Roldan, 94 NY2d 853 [1999]), which means verification is by name and address only. It can also be noted that this same confidential treatment of Social Security numbers is respected in the course of summary landlord-tenant proceedings (see Cambridge Dev., LLC v McCarthy, 2003 NY Slip Op 51433[U] [Civ Ct, NY County 2003, Lebovits, J.] [permitting tenant to redact Social Security numbers from documents produced in non-primary-residence summary proceedings]).

Accordingly, there is no legal support for the form’s instructions that tenants “must” complete the affidavit or to the claim the defendants’ demands were authorized by law. Because a “deceptive act or practice” under the consumer protection statute is a representation or omission “likely to mislead a reasonable consumer acting reasonably under the circumstances” (Oswego Laborers’ Local 214 Pension Fund v Marine Midland Bank, supra, 85 NY2d at 26), the landlord’s form clearly is deceptive.

Defendants then maintain that plaintiff has not shown injury, which is required by General Business Law § 349 (h), which permits “any person . . . injured by reason of any violation” of the statute to bring an action to enjoin the unlawful act or practice and/or an action to recover actual damages or $50. Defendants argue plaintiff alleges no actual damages, other than anxiety and distress, as well as prelitigation attorney’s fees which appear to be an item of pecuniary damage separate and apart from the costs of litigation. The court determines the pleading is proper in form and sufficient under the statute. As stated in relation to another consumer fraud claim, Goshen v Mutual Life Ins. Co. of N.Y. (98 NY2d 314, 326 [2002]), on this motion to dismiss, “the pleadings are necessarily afforded a liberal construction” and a plaintiff accorded “the benefit of every possible favorable inference.” Accordingly, this branch of the motion is denied with leave to renew after amplification of the pleading or discovery. .

Further, it cannot be doubted that a privacy invasion claim— and an accompanying request for attorney’s fees — may be stated under General Business Law § 349 based on nonpecuniary injury, such as deprivation of the right to maintain the privacy of medical records (see Anonymous v CVS Corp., 188 Misc 2d 616 [Sup Ct, NY County 2001], grant of class certification affd 293 AD2d 285 [1st Dept 2002]; see also Remsburg v Docusearch, Inc., 149 NH 148, 816 A2d 1001 [2003] [under New Hampshire consumer fraud statute, invasion of privacy claim against investigator was proper]). Declaratory relief may well be appropriate for a case such as this one, which presents an instance of an actual and justiciable case or controversy, affecting the rights of the parties on both sides (see 43 NY Jur 2d, Declaratory Judgments and Agreed Case § 18; Bartley v Walentas, 78 AD2d 310, 312 [1st Dept 1980] [purpose of declaratory action “is to serve a practical end ‘in quieting or stabilizing an uncertain or disputed jural relation either as to present or prospective obligations’ ”]; see also Martinez v Classic Realty LLC, NYLJ, May 21, 2003, at 18, col 1 [Sup Ct, NY County, AbdusSalaam, J.] [landlord demand similar to that in instant case withdrawn, tenant’s claim for declaratory relief could proceed]).

The belated objection that plaintiff lacks a proper claim under General Business Law § 349 because the defendants’ activity was not directed to the “public at large” is not properly before the court because it was raised only in reply papers (see Dannasch v Bifulco, 184 AD2d 415, 417 [1st Dept 1992]). The court observes that plaintiff pleads that defendants own and manage a substantial number of rent-regulated apartments, and use the challenged forms for all lease renewals, so that the dispute is not simply a private contract dispute and generally claims involving residential rental units are a type of claim recognized under the statute (see Lozano v Grunberg, 195 AD2d 308 [1st Dept 1993] [tenant stated claim under General Business Law § 349, based on landlord’s issuance of deceptive dispossess notices based on late rent payments]; 23 Realty Assoc. v Teigman, 213 AD2d 306 [1st Dept 1995] [Department of Consumer Affairs has given notice that the offering of rental housing is a legitimate area of interest for consumer protection against deceptive advertising and misrepresentation]; Frazier v Priest, 141 Misc 2d 775 [Watertown City Ct 1988] [General Business Law § 349 applies to the landlord-tenant relationship]). The defendants point to no legislative intent indicating that those engaged in the residential real estate business are exempt from compliance with the consumer protection laws (see Karlin v IVF Am., 93 NY2d 282, 291 [1999] [a “blanket exemption for providers of medical services and products is contrary to the plain language of the statutes”]).

Accordingly, the motion to dismiss is denied.

Conclusion

Given that this debate raises an issue of first impression, the requests for sanctions raised by both parties are denied.

Defendants’ motion to dismiss is denied. As to defendant Greystar, such denial is without prejudice to renewal following discovery.⁶ In relation to the monetary damages cause of action, such motion is denied without prejudice to renewal following amplification of the pleadings or discovery. The court can proceed no further on the merits of the claim given that defendants have not yet answered.

1 . The term “authorized person” means an officer or employee of any political subdivision of a state, or agency of a political subdivision of a state, and any other person, officer or employee thereof, who has or had access to Social Security account numbers or related records, as defined by 42 USC § 405 (c) (2) (C) (viii) (III).

2 . The Privacy Act also provides “[i]t shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose [the individual’s] social security account number” (Pub L 93-579, § 7, 88 Stat 1909; see McKay v Altobello, 1997 WL 266717, 1997 US Dist LEXIS 7162 [ED La, May 16, 1997] [voter registration denial after refusal to provide mother’s maiden name and Social Security number determined to violate section 7 of the Privacy Act]).

3 . In Arakawa v Sakata (133 F Supp 2d 1223, 1229-1230 [D Haw 2001]), the court reviewed the lower court decisions preceding the 2000 decision in Reno v Condon (supra), and the few scattered decisions finding Social Security numbers were not confidential in the face of certain governmental interests. The court concluded “that there is a constitutional right to privacy in the information released about Plaintiff in this case, specifically his SSN” (133 F Supp 2d at 1229; see also Flavio L. Komuves, We’ve Got Your Number: An Overview of Legislation and Decisions to Control the Use of Social Security Numbers as Personal Identifiers, 16 J Marshall J Computer & Info L 529, 561-565 [1998]; A. Michael Froomkin, The Death of Privacy?, 52 Stan L Rev 1461 [2000]; Elbert Lin, Prioritizing Privacy: A Constitutional Response to the Internet, 17 Berkeley Tech LJ 1085 [2002]; Clifford S. Fishman, Technology and the Internet: The Impending Destruction of Privacy by Betrayers, Grudgers, Snoops, Spammers, Corporations, and the Media, 72 Geo Wash L Rev 1503 [2004]).

4 . There are rare cases in which the government determines that disclosure is appropriate and such situations must be justified by a clear government interest which prevails in a balancing test. For example, in In re Crawford (194 F3d 954 [9th Cir 1999], cert denied sub nom. Ferm v United States Trustee, 528 US 1189 [2000]), a lay preparer of bankruptcy petitions objected to a statutory requirement of 11 USC § 110 (c) that he place his identifying Social Security number on court papers. The Ninth Circuit recognized a right of informational privacy in relation to a Social Security number, which was a conditional right to be weighed against the governmental interest (194 F3d at 959). It opined that the threat of identity theft was not an immediate harm, but one remote in time and place and to be undertaken by a nongovernmental actor and that — unlike disclosure of HIV status, sexual orientation, or genetic makeup — a Social Security number “is not inherently sensitive or intimate information, and its disclosure does not lead directly to injury, embarrassment or stigma” (194 F3d at 959-960). It held a sufficient justification for the requirement could be found in the legislative purpose and bankruptcy’s special interest in public access to judicial proceedings (194 F3d at 960).

5 . In relation to the Restatement standard quoted, tort claims relating to Social Security numbers — notwithstanding that Social Security numbers are found to be private information and confidential — generally are found insufficient because either there is a failure of proof of distribution to the public at large or the information is not regarded as derogatory (Bodah v Lakeville Motor Express, Inc., 649 NW2d 859, 862-863 [Minn Ct App 2002] [Social Security numbers are confidential and private, but “are not on their face revealing, compromising() or embarrassing”], revd on other grounds 663 NW2d 550 [Minn 2003]; Phillips v Grendahl, 312 F3d 357 [8th Cir 2002]; Basse v Motorola, Inc., 351 Ill App 3d 67, 813 NE2d 1013 [1st Dist 2004]; see also Lora M. Jennings, Paying the Price for Privacy: Using the Private Facts Tort to Control Social Security Number Dissemination and the Risk of Identity Theft [Bodah v Lakeville Motor Express, Inc., 663 NW2d 550 (Minn 2003)], 43 Wash-burn LJ 725 [Spring 2004]).

6 . Defendant Greystar-Prime Management seeks dismissal on the grounds that it is not a proper party, based on documentary evidence showing it has no contractual relationship to plaintiff, and is not the owner or manager of the premises (motion, exhibits B, C). Plaintiff responds that dismissal is premature prior to discovery, arguing that Greystar is the entity that issues rent invoice demands, and with which she communicates concerning the apartment. Grey-star’s motion to dismiss is denied at this time.