S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                 8375--A

                       2011-2012 Regular Sessions

                          I N  A S S E M B L Y

                              June 15, 2011
                               ___________

Introduced  by  M.  of  A.  DINOWITZ, MAISEL, REILLY, M. MILLER, HIKIND,
  MILLMAN, ZEBROWSKI, P. RIVERA, GALEF, HOOPER -- Multi-Sponsored by  --
  M.  of A.   ABBATE, CRESPO, GABRYSZAK, GLICK, V. LOPEZ, McENENY, SCHI-
  MEL, SWEENEY, WEISENBERG -- read once and referred to the Committee on
  Consumer Affairs and Protection -- recommitted  to  the  Committee  on
  Consumer  Affairs  and  Protection in accordance with Assembly Rule 3,
  sec. 2 -- committee discharged, bill  amended,  ordered  reprinted  as
  amended and recommitted to said committee

AN  ACT  to  amend  the  general business law and the correction law, in
  relation to the processing of personal identifying information

  THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section  1.  Section  399-dd  of the general business law, as added by
chapter 676 of the laws of 2006, paragraph  (f)  of  subdivision  2  and
subdivision 6 as added and subdivision 7 as renumbered by chapter 279 of
the laws of 2008, is amended to read as follows:
  S [399-dd] 399-DDD. Confidentiality of social security account number.
Beginning on and after January first, two thousand eight:
  1.  (A) As used in this section "social security account number" shall
include the number issued by the federal social security  administration
and any number derived from such number. Such term shall not include any
number that has been encrypted.
  (B)  FOR  PURPOSES  OF  THIS SECTION, THE TERM "INMATE" MEANS A PERSON
CONFINED IN ANY LOCAL CORRECTIONAL FACILITY AS  DEFINED  IN  SUBDIVISION
SIXTEEN  OF  SECTION  TWO  OF  THE CORRECTION LAW OR IN ANY CORRECTIONAL
FACILITY AS DEFINED IN PARAGRAPH (A) OF SUBDIVISION FOUR OF SECTION  TWO
OF THE CORRECTION LAW PURSUANT TO SUCH PERSON'S CONVICTION OF A CRIMINAL
OFFENSE.
  2.  No  person,  firm,  partnership,  association  or corporation, not
including the state or its political subdivisions, shall do any  of  the
following:

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.
                                                           LBD13110-03-2
              

A. 8375--A                          2

  (a)  Intentionally communicate to the general public or otherwise make
available to the general public in any  manner  an  individual's  social
security  account number. This paragraph shall not apply to any individ-
ual intentionally communicating  to  the  general  public  or  otherwise
making  available  to  the  general  public  his  or her social security
account number.
  (b) Print an individual's social security account number on  any  card
or tag required for the individual to access products, services or bene-
fits  provided  by  the person, firm, partnership, association or corpo-
ration.
  (c) Require an individual to  transmit  his  or  her  social  security
account number over the internet, unless the connection is secure or the
social security account number is encrypted.
  (d)  Require  an  individual to use his or her social security account
number to access an internet web  site,  unless  a  password  or  unique
personal  identification  number  or other authentication device is also
required to access the internet website.
  (e) Print an individual's social security account number on any  mate-
rials  that  are  mailed  to the individual, unless state or federal law
requires the social security account number to be on the document to  be
mailed.  Notwithstanding this paragraph, social security account numbers
may be included in applications and forms sent by mail, including  docu-
ments sent as part of an application or enrollment process, or to estab-
lish,  amend  or terminate an account, contract or policy, or to confirm
the accuracy of the social security account number.  A  social  security
account number that is permitted to be mailed under this section may not
be  printed, in whole or part, on a postcard or other mailer not requir-
ing an envelope, or visible on the  envelope  or  without  the  envelope
having been opened.
  (f)  Encode or embed a social security number in or on a card or docu-
ment, including, but not limited to, using a bar  code,  chip,  magnetic
strip,  or  other  technology,  in place of removing the social security
number as required by this section.
  (G) KNOWINGLY USE THE LABOR OR TIME OF OR EMPLOY ANY  INMATE  IN  THIS
STATE,  OR  IN  ANY  OTHER  JURISDICTION,  IN ANY CAPACITY THAT INVOLVES
OBTAINING ACCESS TO, COLLECTING OR PROCESSING  SOCIAL  SECURITY  ACCOUNT
NUMBERS OF OTHER INDIVIDUALS.
  3.  This section does not prevent the collection, use, or release of a
social security account number as required by state or federal law,  the
use of a social security account number for internal verification, fraud
investigation  or  administrative  purposes or for any business function
specifically authorized by 15 U.S.C. 6802.
  4. Any person, firm, partnership, association  or  corporation  having
possession  of  the  social  security  account  number of any individual
shall, to the extent that such number is maintained for the  conduct  of
business or trade, take reasonable measures to ensure that no officer or
employee  has  access  to  such  number for any purpose other than for a
legitimate or necessary purpose related to the conduct of such  business
or  trade  and  provide  safeguards necessary or appropriate to preclude
unauthorized access to the social security account number and to protect
the confidentiality of such number.
  5. Any waiver of the provisions of this section is contrary to  public
policy, and is void and unenforceable.
  6.  No  person  may  file any document available for public inspection
with any state agency, political subdivision, or in any  court  of  this
state  that  contains  a  social  security  account  number of any other

A. 8375--A                          3

person, unless such other person is a dependent child, or has  consented
to  such  filing,  except  as  required by federal or state law or regu-
lation, or by court rule.
  7.  Whenever  there  shall be a violation of this section, application
may be made by the attorney general in the name of  the  people  of  the
state of New York to a court or justice having jurisdiction by a special
proceeding  to  issue an injunction, and upon notice to the defendant of
not less than five days, to enjoin and restrain the continuance of  such
violations;  and  if it shall appear to the satisfaction of the court or
justice that the defendant has,  in  fact,  violated  this  section,  an
injunction  may  be  issued  by  such  court  or  justice, enjoining and
restraining any further violation,  without  requiring  proof  that  any
person  has,  in  fact,  been  injured  or  damaged thereby. In any such
proceeding, the court may make allowances to  the  attorney  general  as
provided  in  paragraph  six  of subdivision (a) of section eighty-three
hundred three of the civil practice law and rules, and  direct  restitu-
tion.  In  connection  with  any such proposed application, the attorney
general is authorized to take proof and  make  a  determination  of  the
relevant facts and to issue subpoenas in accordance with the civil prac-
tice  law and rules. Whenever the court shall determine that a violation
of subdivision two of this section has occurred, the court may impose  a
civil  penalty  of  not  more  than  one  thousand  dollars for a single
violation and not more than one hundred thousand  dollars  for  multiple
violations resulting from a single act or incident. The second violation
and  any  violation  committed thereafter shall be punishable by a civil
penalty of not more than five thousand dollars for  a  single  violation
and  not  more  than  two  hundred  fifty  thousand dollars for multiple
violations resulting from a single act or  incident.  No  person,  firm,
partnership, association or corporation shall be deemed to have violated
the  provisions of this section if such person, firm, partnership, asso-
ciation or corporation shows, by a preponderance of the  evidence,  that
the  violation  was  not intentional and resulted from a bona fide error
made notwithstanding the maintenance of procedures reasonably adopted to
avoid such error.
  S 2. Subdivision 1 of section 170 of the correction law, as amended by
section 23 of subpart A of part C of chapter 62 of the laws of 2011,  is
amended to read as follows:
  1. The commissioner shall not, nor shall any other authority whatsoev-
er,  make  any  contract by which the labor or time of any inmate in any
state or local correctional facility in this state, or  the  product  or
profit  of his work, shall be contracted, let, farmed out, given or sold
to any person, firm, association or corporation; except that the inmates
in said correctional institutions may work  for,  and  the  products  of
their  labor  may be disposed of to, the state or any political subdivi-
sion thereof, any public institution owned or managed and controlled  by
the state, or any political subdivision thereof, PROVIDED THAT NO INMATE
SHALL  BE  EMPLOYED  OR ASSIGNED TO ENGAGE IN ANY ACTIVITY THAT INVOLVES
OBTAINING ACCESS TO, COLLECTING OR PROCESSING  SOCIAL  SECURITY  ACCOUNT
NUMBERS OF OTHER INDIVIDUALS.
  S  3.  This  act shall take effect on the ninetieth day after it shall
have become a law.