October 29, 2006 | Posted By Diane Pfadenhauer | print this article

New New York Law Protects Privacy of Social Security Numbers

The new Consumer Communication Records Privacy Act places limits on the use and disclosure of Social Security account numbers, and clarifies what is considered a computer crime.
The new law is actually comprised of three different laws and protects consumers by:

  • prohibiting the sale, fraudulent transfer, or solicitation of a consumers telephone records without consent from the consumer.
  • placing limits on the use and dissemination of this Social Security numbers – it,

  • prohibits the intentional communication of an individual’s SSN to the general public;
  • restricts businesses’ ability to print an individual’s SSN on mailings or on any card or tag required to access products, services, or benefits; 
  • prohibits businesses from requiring an individual to transmit his or her encrypted SSN over the Internet; and
  • requires businesses that possess Social Security Numbers to implement appropriate safeguards and limit unnecessary employee access to them.

  • New York State’s Penal Law has been revised as it pertains to the unauthorized use of computers. This law strengthens existing law to allow for the prosecution of those who intentionally disrupt, steal personal information, and plant malicious programs on consumer’s computers without authorization.
Additional New York Laws relating to the protection of confidential information include:
  • The Security Freeze Law - which allows consumers, who are either identity theft victims or are concerned that they might be at risk of having their identities stolen, to cut off an identity thief's access to credit, loans, leases, goods and services by placing a “freeze” on their consumer credit report.
  • The Disposal of Personal Records Law - requires any business to properly dispose of records containing personal information through one of the following means: shredding, destruction, modification, or other reasonable action to ensure that no unauthorized person will have access to the personal information.
  • The Anti-Phishing Act of 2006 - prohibits the deceptive solicitation of personal information through electronic communications. “Phishing” accounts for nearly 25% of all Internet fraud.
While not all of these are specifically related to the workplace, employers often use social security numbers as identifiers of employees. In addition, employers, as we have previously stated, need to ensure that their disposal practices are up to snuff.

For the actual text of the new law, go here.