2012 New York Consolidated Laws
PBO - Public Officers
Article 6-A - (91 - 99) PERSONAL PRIVACY PROTECTION LAW
96-A - Prohibited conduct.

 
    §  96-a.  Prohibited  conduct.  1.  Beginning  on  January  first, two
  thousand ten the state and its political subdivisions shall not  do  any
  of the following, unless required by law:
    (a)  Intentionally communicate to the general public or otherwise make
  available to the general public in any  manner  an  individual's  social
  security   account  number.  This  paragraph  shall  not  apply  to  any
  individual  intentionally  communicating  to  the  general   public   or
  otherwise  making  available  to  the  general  public his or her social
  security account number.
    (b) Print an individual's social security account number on  any  card
  or  tag  required  for  the  individual  to access products, services or
  benefits provided by the state and its political subdivisions.
    (c) Require an individual to  transmit  his  or  her  social  security
  account number over the internet, unless the connection is secure or the
  social security account number is encrypted.
    (d)  Require  an  individual to use his or her social security account
  number to access an internet web  site,  unless  a  password  or  unique
  personal  identification  number  or other authentication device is also
  required to access the internet website.
    (e) Include an individual's social security account number, except the
  last four digits thereof, on  any  materials  that  are  mailed  to  the
  individual,  or  in any electronic mail that is copied to third parties,
  unless state or federal law requires the social security account  number
  to  be  on  the  document  to be mailed. Notwithstanding this paragraph,
  social security account numbers may  be  included  in  applications  and
  forms  sent  by mail, including documents sent as part of an application
  or enrollment process, or to establish, amend or terminate  an  account,
  contract  or  policy,  or to confirm the accuracy of the social security
  account number. A social security account number that is permitted to be
  mailed under this section may not be printed, in whole or in part, on  a
  postcard  or  other  mailer not requiring an envelope, or visible on the
  envelope or without the envelope having been opened.
    (f) Encode or embed a social security  number  in  or  on  a  card  or
  document,  including,  but  not  limited  to,  using  a  bar code, chip,
  magnetic strip, or other technology, in place  of  removing  the  social
  security number as required by this section.
    (g)  Nothing  in  this  section shall prohibit a county clerk or court
  from making available a document publicly recorded or filed prior to the
  effective date of this section, provided that if any individual requests
  redaction of a social security number from a publicly recorded  document
  available  to  the public online, such number shall be promptly redacted
  by the county clerk. Nothing in this section shall limit  disclosure  of
  criminal history record information currently permitted.
    2.  As  used  in  this  section "social security account number" shall
  include the nine digit account  number  issued  by  the  federal  social
  security  administration  and  any  number  derived therefrom. Such term
  shall not include any number that has been encrypted.
    3. This section does not prevent the collection, use or release  of  a
  social  security  account number as required by state or federal law, or
  the use of a social security account number for  internal  verification,
  fraud investigation or administrative purposes.