N.Y. Comp. Codes R. & Regs. tit. 9 § 525.21

Current through Register Vol. 46, No. 45, November 2, 2024

Section 525.21 - Prohibited use of personal identifying information

(a) The office shall not do any of the following, unless otherwise required by law:

(1) Intentionally communicate to the general public or otherwise make available to the general public in any manner an individual's social security account number. This paragraph shall not apply to any individual intentionally communicating to the general public or otherwise making available to the general public his or her social security account number.

(2) Print an individual's social security account number on any card or tag required for the individual to access products, services or benefits provided by the office.

(3) Require an individual to transmit his or her social security account number over the internet, unless the connection is secure or the social security account number is encrypted.

(4) Require an individual to use his or her social security account number to access an internet website, unless a password or unique personal identification number or other authentication device is also required to access the internet website.

(5) Include an individual's social security account number, except the last four digits thereof, on any materials that are mailed to the individual, or in any electronic mail that is copied to third parties, unless State or Federal law requires the social security account number to be on the document to be mailed. Notwithstanding this paragraph, social security account numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process, or to establish, amend or terminate a claim, account, contract or policy, or to confirm the accuracy of the social security account number. A social security account number that is permitted to be mailed under this section may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or visible on the envelope or without the envelope having been opened.

(6) Encode or embed a social security number in or on a card or document, including, but not limited to, using a bar code, chip, magnetic strip, or other technology, in place of removing the social security number as required by this section.

(7) No person may file any document available for public inspection with the office that contains a social security account number of any other person, except as required by Federal or State law or regulation, or by court rule.

(b) As used in this section, social security account number shall include the nine-digit account number issued by the Federal Social Security Administration and any number derived therefrom. Such term shall not include any number that has been encrypted.

(c) This section shall not prevent the collection, use or release of a social security account number as required by State or Federal law, or the use of a social security account number for internal verification, fraud investigation or administrative purposes.

N.Y. Comp. Codes R. & Regs. Tit. 9 § 525.21