[NOTE: This blog post replaces an earlier entry and provides a more detailed discussion of the new New York law.]

On August 14, 2012, New York Governor Andrew Cuomo signed into law a bill intended to reduce the risk of identity theft by generally prohibiting private entities from requesting or requiring an individual to provide the SSN in connection with almost any activity. The law, General Business Law section 399-ddd, contains several exceptions to this general prohibition, including exceptions where the request is “for purposes of employment” or “a lawful request for a consumer report or investigative consumer report.” However, these exceptions do not appear to encompass the entire hiring process.

By its plain terms, the “employment purposes” exception includes requests during “the course of administration of a claim, benefit, or procedure related to the individual’s employment by the [employer], including the individual’s termination from employment, retirement from employment, injury suffered during the course of employment, or to check on an unemployment claim of the individual.” All of the activities listed in the exception presuppose an existing or pre-existing employment relationship between the employer and the person who is being asked to disclose his or her SSN. In other words, this exception does not appear to address the hiring process at all.

The exception for consumer and investigative consumer reports covers the various types of pre-employment background checks — such as criminal history, motor vehicle records, and educational and prior employment checks — that most employers now conduct through a pre-employment screening firm. Significantly, the terms “consumer report” and “investigative consumer report” apply only to background checks conducted by a third-party consumer reporting agency. Consequently, the new law appears to prohibit employers from requesting an applicant’s SSN so that the employer can conduct its own background check. This exception’s narrow scope means that an employer cannot rely on it to justify a request for an applicant’s SSN on any form besides a background check authorization form or at any other point in the hiring process.

It is possible that additional legislative materials to be published several weeks after the new law takes effect on December 12, 2012, will clarify this issue. (Note: There are two different sections numbered 399-ddd that take effect this year. Section 399-ddd – Confidentiality of Social Security Numbers (emphasis added) – is a distinct statute on the confidentiality of Social Security numbers; amendments to this statute take effect on November 12, 2012. These amendments are directed at restricting access by inmates to SSNs and are not relevant to employers. The statute that is discussed herein refers to section 399-ddd – Disclosure of Social Security Numbers (emphasis added) – which takes effect on December 12, 2012.)

However, if the apparent meaning of the statute reflects the legislature’s actual intention, many New York employers likely would be required to materially revise their hiring process. For example, the box or field seeking an applicant’s SSN would have to be removed from the job application. Moreover, any request for an applicant’s SSN on any form besides the authorization form for the employer to procure a background check from a background check vendor would need to be eliminated. Oral requests for applicants’ SSNs would be prohibited. While these changes already have been adopted by many employers seeking to avoid unnecessary collection of the SSN, these practices are not universal.

Unsuspecting employers face potentially substantial penalties for violating this law. Although there is no private right of action, the New York Attorney General can recover a civil penalty of up to $500 for each infraction. Given that a job application which requests the SSN could, for a large employer, result in thousands of violations, the potential exposure is significant.

New York employers will need to scrutinize their organization’s collection of the SSN in the hiring process. Employers who request the SSN in the job application process or conduct background checks outside requesting a consumer or investigative consumer report before making a conditional offer of employment will need to carefully consider whether to revamp those procedures to avoid the risk of potentially large penalties that could be imposed under new section 399-ddd.

Photo credit: Kameleon007