New York’s Social Security Number Protection Law became effective on January 1, 2008. (N.Y. Gen. Bus. Law 399-dd). This law requires companies to implement safeguards preventing unauthorized access to social security numbers and limiting the publication and dissemination of social security numbers. The law requires companies to take reasonable measures to ensure that no officer or employee has access to social security numbers that are maintained in the ordinary course of business unless the access is necessary for a legitimate business purpose.

The law also prohibits companies from:

1. making an individual’s social security number available to the general public;

2. printing an individual’s social security number on any card or tag required for an individual to access products, services or benefits provided by the company;

3. requiring an individual to transmit his or her social security number over the Internet, unless the connection is secure or the number is encrypted;

4. requiring an individual to transmit his or her social security number to access an Internet website, unless a password, PIN number, or other type of authenticating device is also required for the individual to access the website;

5. printing an individual’s social security number on anything that is mailed to the individual, unless a state or federal law requires the number to be on the document being mailed. (There are a few exceptions to this prohibition, including printing an individual’s social security number on an application or enrollment form.)

There are serious penalties for non-compliance with this law. A company may be fined up to $100,000 for its first violation and up to $250,000 for additional violations.

This law must be read in tandem with the New York Data Breach and Notification Law (NY Gen. Bus. Law § 899-aa), which requires companies to notify individuals if their personal information (including their social security numbers) has been compromised. Accordingly, companies must notify the affected individuals if their efforts to safeguard social security numbers have been unsuccessful.