Restricts the requirement that a person disclose their social security number

Summary of specific provisions

This bill tracks the intent of the federal Privacy Act of 1974 by stipulating that every person, firm, partnership or corporation which requests a social security number from an individual must reveal in writing or orally when the request is made orally of the authority for the solicitation of the information, whether disclosure is mandatory pursuant to federal law or regulation and the purpose of the information. Where there is no legal basis for the request, a person may refuse to provide his/her social security number. In such cases, the person shall not be denied any service. The bill further provides for enforcement by the Attorney General. Whenever the court shall determine that a violation involving disclosure has occurred, the court may impose a civil penalty of not more than five hundred dollars. The second or subsequent violation shall be punishable by a civil penalty of not more than one thousand dollars. Moreover, as provided in other statutes, the bill provides for damages, where appro- priate.

Effects of present law which this bill would alter

The General Busi- ness Law is amended by adding a new section 394-f.

Justification

Increasing demands are being placed on individuals to furnish a Social Security Number in circumstances when the use of the SSN is neither required by the federal government for federal program- matic purposes or necessary. For example, some stores and supermarkets demand Social Security Numbers for check cashing and other unknown purposes, and utilities, and cable companies request Social Security Numbers to grant service. Finally, some companies request Social Secu- rity Numbers on contest entry forms. Consumers are frequently given the impression that such information is required. In some instances, the disclosure of one's SSN has been made a condition for obtaining services.

The SSN is increasingly being used as a password or an authenticator of identity. The Social Security Number is becoming a de facto identifica- tion number. Credit records are indexed by SSN; some banks and credit unions even use it as an individual's account number. Several universi- ties use the number for both student and faculty ID numbers and many health plans use the SSN to identify their subscribers. Such use is not necessary, just convenient and can be risky, since the widespread circu- lation of SSNs makes them increasingly ascertainable by anyone wishing to impersonate another and invade personal privacy. In application fraud, for example, someone simply files bogus credit card applications

using the person's name and SSN. The thief then runs up large bills on someone else's account and, of course, does not pay them. Most consum- ers who have been victims of this form of fraud are not aware of the problem until months later, frequently when they begin receiving dunning letters from creditors. By that time, their credit history has been damaged. It has also become common for illegal aliens to provide false Social Security Numbers when they seek employment. The scrambled earn- ings records create a nightmare for the rightful owner. Unemployment compensation claims have been rejected because other individuals were already collecting unemployment benefits on the rightful owners' numbers.

The proliferation of the use of the SSN makes it easier for large organ- izations and institutions to compare their databases. While government is prohibited from computer matching, private organizations are not. Thus, by providing a Social Security Number for a non-governmental or non-mandated purpose, individuals are providing organizations with the means to access other data about them in disparate data banks without the knowledge or consent of the data subject to manipulate personal information and create detailed profiles and dossiers.

In addition to data matching by large institutions, the SSN allows curi- ous individuals, people you might not want, to snoop into private records hopping from database to database consisting of various insur- ance, business and medical records to draw out a profile. As stated by a computer security expert, once someone has a person's Social Security Number, he or she can get somebody's life history.

The SSN in its present form is not a satisfactory identifier. There is no real security for institutions in relying on the SSN. SSNs are too often transposed to create accidental inaccuracies. Moreover, individ- uals often secure or create multiple SSNs. Furthermore, the Social Security Administration adheres to a policy of responding to requests for the verification of numbers from only those institutions that are authorized to maintain and record such data.

Finally, the federal Privacy Act of 1974 requires federal, state and local governmental agencies requesting SSNs to cite its formal legal authority, reveal whether disclosure is mandatory or voluntary and explain how the number will be used. Enactment of the proposed law would extend this needed protection to the private sector. In addition, the bill is consistent with the recommendations of the report, Records, Computers, and the Rights of Citizens, issued by the U.S. Department of Health, Education and Welfare.

Prior legislative history

A.334 of 2008, A/638 of 2006, A.532 of 2004, A.722 of 2002, A.700 of 2000.

Fiscal implications for state and local governments

None.

Effective date

This act shall take effect on the one hundred twentieth day after it shall have become law.