§ 399-DDD — Confidentiality of social security account number

* § 399-ddd. Confidentiality of social security account number.\nBeginning on and after January first, two thousand eight:\n 1. (a) As used in this section "social security account number" shall\ninclude the number issued by the federal social security administration\nand any number derived from such number. Such term shall not include any\nnumber that has been encrypted.\n (b) For purposes of this section, the term "incarcerated individual"\nmeans a person confined in any local correctional facility as defined in\nsubdivision sixteen of section two of the correction law or in any\ncorrectional facility as defined in paragraph (a) of subdivision four of\nsection two of the correction law pursuant to such person's conviction\nof a criminal offense.\n 2. No person, firm, partnership, association or corporation, not\nincluding the state or its political subdivisions, shall do any of the\nfollowing:\n (a) Intentionally communicate to the general public or otherwise make\navailable to the general public in any manner an individual's social\nsecurity account number. This paragraph shall not apply to any\nindividual intentionally communicating to the general public or\notherwise making available to the general public his or her social\nsecurity account number.\n (b) Print an individual's social security account number on any card\nor tag required for the individual to access products, services or\nbenefits provided by the person, firm, partnership, association or\ncorporation.\n (c) Require an individual to transmit his or her social security\naccount number over the internet, unless the connection is secure or the\nsocial security account number is encrypted.\n (d) Require an individual to use his or her social security account\nnumber to access an internet web site, unless a password or unique\npersonal identification number or other authentication device is also\nrequired to access the internet website.\n (e) Print an individual's social security account number on any\nmaterials that are mailed to the individual, unless state or federal law\nrequires the social security account number to be on the document to be\nmailed. Notwithstanding this paragraph, social security account numbers\nmay be included in applications and forms sent by mail, including\ndocuments sent as part of an application or enrollment process, or to\nestablish, amend or terminate an account, contract or policy, or to\nconfirm the accuracy of the social security account number. A social\nsecurity account number that is permitted to be mailed under this\nsection may not be printed, in whole or part, on a postcard or other\nmailer not requiring an envelope, or visible on the envelope or without\nthe envelope having been opened.\n (f) Encode or embed a social security number in or on a card or\ndocument, including, but not limited to, using a bar code, chip,\nmagnetic strip, or other technology, in place of removing the social\nsecurity number as required by this section.\n (g) Knowingly use the labor or time of or employ any incarcerated\nindividual in this state, or in any other jurisdiction, in any capacity\nthat involves obtaining access to, collecting or processing social\nsecurity account numbers of other individuals.\n 3. This section does not prevent the collection, use, or release of a\nsocial security account number as required by state or federal law, the\nuse of a social security account number for internal verification, fraud\ninvestigation or administrative purposes or for any business function\nspecifically authorized by 15 U.S.C. 6802.\n 4. Any person, firm, partnership, association or corporation having\npossession of the social security account number of any individual\nshall, to the extent that such number is maintained for the conduct of\nbusiness or trade, take reasonable measures to ensure that no officer or\nemployee has access to such number for any purpose other than for a\nlegitimate or necessary purpose related to the conduct of such business\nor trade and provide safeguards necessary or appropriate to preclude\nunauthorized access to the social security account number and to protect\nthe confidentiality of such number.\n 5. Any waiver of the provisions of this section is contrary to public\npolicy, and is void and unenforceable.\n 6. No person may file any document available for public inspection\nwith any state agency, political subdivision, or in any court of this\nstate that contains a social security account number of any other\nperson, unless such other person is a dependent child, or has consented\nto such filing, except as required by federal or state law or\nregulation, or by court rule.\n 7. Whenever there shall be a violation of this section, application\nmay be made by the attorney general in the name of the people of the\nstate of New York to a court or justice having jurisdiction by a special\nproceeding to issue an injunction, and upon notice to the defendant of\nnot less than five days, to enjoin and restrain the continuance of such\nviolations; and if it shall appear to the satisfaction of the court or\njustice that the defendant has, in fact, violated this section, an\ninjunction may be issued by such court or justice, enjoining and\nrestraining any further violation, without requiring proof that any\nperson has, in fact, been injured or damaged thereby. In any such\nproceeding, the court may make allowances to the attorney general as\nprovided in paragraph six of subdivision (a) of section eighty-three\nhundred three of the civil practice law and rules, and direct\nrestitution. In connection with any such proposed application, the\nattorney general is authorized to take proof and make a determination of\nthe relevant facts and to issue subpoenas in accordance with the civil\npractice law and rules. Whenever the court shall determine that a\nviolation of subdivision two of this section has occurred, the court may\nimpose a civil penalty of not more than one thousand dollars for a\nsingle violation and not more than one hundred thousand dollars for\nmultiple violations resulting from a single act or incident. The second\nviolation and any violation committed thereafter shall be punishable by\na civil penalty of not more than five thousand dollars for a single\nviolation and not more than two hundred fifty thousand dollars for\nmultiple violations resulting from a single act or incident. No person,\nfirm, partnership, association or corporation shall be deemed to have\nviolated the provisions of this section if such person, firm,\npartnership, association or corporation shows, by a preponderance of the\nevidence, that the violation was not intentional and resulted from a\nbona fide error made notwithstanding the maintenance of procedures\nreasonably adopted to avoid such error.\n * NB There are 2 § 399-ddd's\n