Unless an exception applies, New York General Business Law § 399-ddd, effective Dec. 12, 2012, mandates that most employers in New York refrain from requiring that employees disclose their full or partial social security numbers, and from denying to employees “any service, privilege or right†due to nondisclosure.
Two statutory exceptions are potentially quite broad, and the courts will need to clarify their scope. First, the restrictions do not apply if the employee “consents to the acquisition or use of his or her social security account number.†Because an employer typically would need to ask an employee for his or her social security number before the employee could consent, it is uncertain whether a court would deem that an employer that has merely requested a social security number has “required†it for purposes of the statute.
Second, employers may compel the disclosure of social security numbers “for purposes of employment,†which include claims and benefits administration as well as the administration of any “procedure related to the individual’s employment . . . including the individual’s termination from employment, retirement from employment, [or] injury suffered during the course of employment.†This exception also allows an employer to procure a social security number “to check on an unemployment insurance claim of the individual.†Guidance from the courts will be necessary to clarify precisely what the terms “purposes of employment†and “procedure related to . . . employment†cover. This exception does not address explicitly the use of social security numbers in hiring and promotion decisions.
Other statutory exceptions permit employers to obtain the social security numbers of employees and applicants for one or more of the following purposes:
- Disclosures of social security numbers explicitly mandated by federal, state or local law, such as disclosure on a Form I-9 or to comply with New York reporting requirements
- Fraud investigations or internal verifications;
- Any business function that the federal Gramm-Leach-Bliley Act authorizes;
- Consumer reports or investigative consumer reports authorized by law and credit dealings between the employer and the employee initiated by the employee;
- Direct deposit or investment services on the employee’s behalf;
- Tax compliance;
- Blood or organ donations, collection of child support or alimony, or criminal record verification;
- “[A]ny interaction with a governmental law enforcement agency or . . . the enforcement of a judgment . . . by a sheriff or marshalâ€; or
- Confirmation of a current or prospective employee’s eligibility for a marketing program targeted exclusively at certain age groups.
In addition to the purpose-specific exceptions above, the statute also categorically exempts certain types of employers, such as banks and their affiliates, from these restrictions.
Although there is no private right of action under § 399-ddd, the Attorney General may prosecute violators. The first violation carries a $500 maximum civil penalty, while each subsequent violation carries a civil penalty up to $1,000. The statute, however, provides a safe harbor for employers that implement procedures reasonably designed to prevent violations of the statute, so long as such violations were not intentional. These procedures should supplement the procedures that New York employers should already have in place to comply with extant restrictions on social security number use, such as restrictions on publishing, printing or electronically transmitting an employee’s social security number under certain circumstances.
Employers that wish to obtain and use their prospective and current employees’ social security numbers should develop and implement procedures to…
To read more, please visit http://www.lexology.com/library/detail.aspx?g=349ccb63-6004-411c-8b32-17a54ecd129f
