A new law that takes effect on January 1, 2008 is designed to combat the growing problem of identity theft by restricting the use of social security numbers (“SSNs”). Whether the “New York Social Security Protection Law” (“SSPL”) law accomplishes its goal remains to be seen, but our immediate concern is to ensure that our clients are mindful of their new obligations.

The SSPL will make it unlawful to disseminate SSNs in communications to the public; to require a SSN as a password to receive services, benefits or products (such as on an employer ID card) or to transmit a SSN over the internet absent certain encryption protections. The use of SSNs in mail correspondence will now be expressly forbidden unless an exception to the law applies (such as a federal law requiring that a mailing contain a SSN – like on your tax return). Most significantly, the SSPL requires companies to implement measures to safeguard SSNs by storing them securely and limiting access to only those employees with a legitimate business reason for viewing or utilizing them.

More importantly, given the “high profile” nature of identity theft, as the effective date of the new law nears it may be widely reported in the media. Disgruntled employees (or former employees) who learn of the law, and who are aware of violations by current or former employers (such as failing to safeguard SSNs), may view this as an opportunity to file an anonymous complaint, triggering an investigation by the New York State Attorney General’s office. Compliance is important because strict penalties apply – ranging from $1,000 to $250,000.

This article is intended only as a summary of the law, and clients seeking more information should contact our labor and employment practice group.