New York Enacts Social Security Number Protection Law

Consistent with the New York state government’s attempt to counteract the growing threat of identity theft, on September 26, 2006, Governor Pataki enacted legislation placing limits on the use and dissemination of Social Security account numbers (the “NY Social Security Number Protection Law”). Enacted alongside two other measures aimed at thwarting identity theft, the NY Social Security Number Protection Law will impose harsh penalties on companies that fail to protect the confidentiality of Social Security numbers in their possession. These obligations become effective January 1, 2008. This Commentary provides a brief overview of the NY Social Security Number Protection Law.

Social Security Number Protection Statute

The NY Social Security Number Protection Law applies to all nongovernmental bodies, including individuals, corporations, and partnerships. Generally, the legislation restricts the use and communication of Social Security numbers in order to maintain their confidentiality and make it more difficult for criminals to acquire the nine-digit number that uniquely identifies almost all Americans. The statute defines “Social Security number” as the unique number issued to citizens and residents of the United States by the federal Social Security Administration. The statutory definition also encompasses any number derived from an individual’s Social Security number.

The impact of this broad definition is far-reaching. For example, records containing only part of the nine-digit Social Security number also fall under the law’s scope. A great number of businesses currently use the last four digits of a Social Security number. These businesses will have to implement new policies in order to ensure compliance. Generally, the statute regulates two activities: (i) the communication of Social Security numbers; and (ii) the maintenance of records containing Social Security numbers.

Read the rest