NY Gen Bus L § 399-DDD-2 (2021)
2021 New York Laws GBS - General Business Article 26 - Miscellaneous 399-DDD*2 - Disclosure of Social Security Number.

* §  399-ddd. Disclosure of social security number. 1. As used in this section, "social security  account  number"  shall  include  the  number issued  by  the  federal  social  security administration and any number derived from such number. Such term shall not include  any  number  that has been encrypted.   2.  No  person,  firm,  partnership,  association  or corporation, not including the state or its  political  subdivisions,  shall  require  an individual  to  disclose  or  furnish his or her social security account number, for any purpose in connection with any activity,  or  to  refuse any  service,  privilege  or  right  to  an  individual wholly or partly because such individual refuses to  disclose  or  furnish  such  number, unless  one  of  the  exceptions enumerated in subdivision three of this section applies.   3. The provisions of this section shall not  apply  in  the  following instances:  (a)  The  individual  consents to the acquisition or use of his or her social security account number.  (b) The social  security  account  number  is  expressly  required  by federal, state, or local law or regulation.  (c)  The  social  security  account  number is to be used for internal verification or fraud investigation.  (d) The social security account number is to be used for any  business function  permitted  or  allowed  under the Gramm Leach Bliley Act, P.L. 106-102 (1999).  (e) The social security account number is requested in connection with a request for credit or a credit transaction initiated by  the  consumer or  in  connection  with  a  lawful  request  for  a  consumer report or investigative consumer report, as such  terms  are  defined  in  section three hundred eighty-a of this chapter.  (f) The social security account number is requested in connection with a deposit account or an investment.  (g)  The  social  security account number is requested for purposes of employment, including in the course of the administration  of  a  claim, benefit,  or  procedure  related  to  the individual's employment by the person,  including  the  individual's   termination   from   employment, retirement  from  employment,  injury  suffered  during  the  course  of employment, or to check  on  an  unemployment  insurance  claim  of  the individual.  (h)  The  social  security account number is requested for purposes of tax compliance.  (i) The social security account number is requested  for  the  purpose of:   i. the collection of child or spousal support;   ii. determining whether an individual has a criminal record; or   iii. blood or organ donation.  (j) The social security account number is requested in connection with any interaction with a governmental law enforcement agency or is used in conjunction  with  the enforcement of a judgment of a court of competent jurisdiction by a sheriff or marshal.  (k) The social security account number is requested for the purpose of verifying an individual's  identity  or  age  in  order  to  allow  such individual  to  obtain access to, or enroll in, a marketing program that is restricted to individuals of a certain age.  (l)  i.  The  social  security  account  number  is  requested  by  an individual,  firm,  corporation, or other entity doing business pursuant to a franchise issued by a political  subdivision  of  the  state  or  a license, franchise, certificate or other authorization issued by the New York state public service commission.    ii.  The social security account number is requested by an individual, firm, corporation, or other entity  regulated  by  the  New  York  state public service commission, the federal communications commission, or the federal energy regulatory commission.   iii.  The  social  security  account  number is requested by a banking institution, as defined in section nine-f of the banking law, or one  of its affiliates.  (m)  The  social security account number is requested by an authorized insurer, as defined in section one hundred seven of the  insurance  law, for  the  purpose  of furnishing information to the Centers for Medicare and Medicaid Services within the United States Department of Health  and Human Services.   4.  Whenever  there  shall be a violation of this section, application may be made by the attorney general in the name of  the  people  of  the state of New York to a court or justice having jurisdiction by a special proceeding  to  issue an injunction, and upon notice to the defendant of not less than five days, to enjoin and restrain the continuance of  such violation;  and  if  it shall appear to the satisfaction of the court or justice that the defendant has,  in  fact,  violated  this  section,  an injunction  may  be  issued  by  such  court  or  justice, enjoining and restraining any further violation,  without  requiring  proof  that  any person  has,  in  fact,  been  injured  or  damaged thereby. In any such proceeding, the court may make allowances to  the  attorney  general  as provided  in  paragraph  six  of subdivision (a) of section eighty-three hundred  three  of  the  civil  practice  law  and  rules,  and   direct restitution.  In  connection  with  any  such  proposed application, the attorney general is authorized to take proof and make a determination of the relevant facts and to issue subpoenas in accordance with  the  civil practice  law  and  rules.  Whenever  the  court  shall determine that a violation of subdivision two of this section  has  occurred,  the  court shall  impose a civil penalty of not more than five hundred dollars. The second offense and any offense committed thereafter shall be  punishable by a civil penalty of not more than one thousand dollars.   5.  No  person, firm, partnership, association or corporation shall be deemed to have violated the provisions of this section if  such  person, firm,  partnership, association or corporation shows, by a preponderance of the evidence, that the violation was  not  intentional  and  resulted from   a  bona  fide  error  made  notwithstanding  the  maintenance  of procedures reasonably adopted to avoid such error.   * NB There are 2 § 399-ddd's