Of greatest significance for employers doing business in New York, state law now expressly limits the use and dissemination of social security numbers. Specifically, effective January 1, 2008, with limited exceptions including where use or dissemination is mandated by federal or state law, no person, firm, partnership, association or corporation may:
intentionally communicate or otherwise make available to the general public an individual's social security number;
print an individual's social security number on mailings or on any card or tag required to access products, services, or benefits;
require an individual to transmit his or her encrypted social security number over the Internet unless the connection is secure or the social security number is encrypted;
require an individual to use his or her social security number to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the internet website; and/or
print an individual's social security number on any materials that are mailed to the individual, unless state or federal law requires the social security number to be on the document to be mailed. (Social security numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process, or to establish, amend or terminate an account, contract or policy, or to confirm the accuracy of the social security number as long as such information is not printed, in whole or part, on a postcard or other mailer not requiring an envelope.)
Employers must take reasonable measures to ensure the confidentiality of these numbers. Penalties can be as high as $250,000 for multiple violations.