Wiki Various State Laws Regarding Use of SSN's

[sheilacpc]

This is a Public Service Announcement regarding information that I recently learned about various state laws that have been mandated in order to provide safeguards that an employer, prospective employer or other business MUST use when requesting, storing and transmitting an individual's Social Security Number (SSN) and other Sensitive Personal Information (SPI) in order to help protect the SSN' s confidentiality and security. Disclaimer: this post serves as no legal advice. If additional clarification is needed regarding the information posted here, please contact the office of the Attorney General in your particular state or a licensed attorney in your particular state.

There have been various posts on the subject of (prospective) employee's SSN's being requested by recruiters or other organizations for IT access, candidate tracking or other recruiting/on boarding functions that are NOT related payroll, taxes, background checks, etc. It may be helpful to know that there are about 30 different states in the USA that have enacted various laws that specifically regulate the use, transmittal, storage and privacy of a person's Social Security Numbers (SSN's) or other Sensitive Personal Information (SPI) such as an individual's Date of Birth.

In addition, The various states' Privacy Laws were created in order to require companies take the appropriate measures in order to protect the confidentiality and security of the SSN's that they seek to possess or possess regarding (prospective) employees and consumers that they conduct business with. Some of the state laws specifically prohibit the use of person's SSN (or even a partial use of the SSN) to be used as a Unique Identifier such as using the SSN for IT access or as an ID number for a candidate tracking system such as a Vendor Management Systems (VMS). A wise recommendation is to check to see if there is a particular SSN Privacy law that is in effect for the state in which you either reside in or where your organization conducts business in order to see how it may apply to you or your organization.

It is my understanding that some of the penalties for violation of the state's SSN Privacy Laws can range from $500 to $500,000 per violation. In essence, just because a recruiter, organization and/or their client ask for a (prospective) employee's SSN or other SPI so that the information can be used for IT access, candidate tracking purposes, or other on recruiting/on boarding processes (that is not related to payroll, I-9 forms, taxes, background check, etc.) does not mean they have a legal right to do so in the manner that information is being requested and/or used.

 

[Mayzoo]

Knowing our rights is very important. Unfortunately, the effects of our decisions related to acting on our rights can frequently be negative or simply vague.

You are rarely "required" to give out your social security number. However, the places that request it are not required to provide a service if you do not provide it to them; for example, electricity, phone, gas, etc..... In other words, you are not required to provide your SS #, and they are not required to provide you electricity/phone/gas etc if you choose to not give it.

Much like it used to be illegal to ask about your age, gender, disabilities, or race on job applications; now it common practice. We are usually not required to answer these questions, but none of us knows the affect of when either you choose to answer or not answer these questions. I have also been asked mandatory questions about income, and/or if I have received state/federal assistance within the past six months prior to applying. Again, I have no idea how these answers to these questions affect if I get hired or not, but I do know not answering them guarantees I will not obtain that job since the application cannot be completed without answering them.

 

[sheilacpc]

Mayzoo wrote:
"...the places that request it are not required to provide a service if you do not provide it to them; for example, electricity, phone, gas, etc...In other words, you are not required to provide your SS#, and they are not required to provide you electricity/phone/gas etc. if you choose to not provide it".

My Response:
Please be advised the above statement is not entirely true as there are, in fact, various states in the USA that have laws in place that either restrict the solicitation of SSNs or prohibit denying goods and services to an individual who declines to give an SSN.

Whether a person chooses to provide or not provide certain information on an job application because they are concerned about whether or not they will get a job is not what my original post is about.

The purpose of my original post is to advise others who may not know that there are laws in place in many states that specifically govern (restrict) how a person's SSN and other Sensitive Personal Information (SPI) is collected, used, transmitted and/or stored. In addition, there are various state laws that state that employers and other businesses must have policies in place regarding how that information is stored secured and kept confidential.

Those who violate the various state SSN Privacy laws are subject to various fines and penalties.

Mazoo wrote:
"Again, I have no idea how these answers to these questions affect if I get hired or not, but I do know not answering them guarantees I will not obtain that job since the application cannot be completed without answering them."

My Response:

If a job application asks questions that a person believes are of a discriminatory nature based on the LAW or are in violation of other laws, then that person may want to contact the U.S. Equal Employment Opportunity Commission (EEOC) or the Attorney General Office in his or her state. Just because a prospective employer ask certain questions on a job application does not mean that they have the legal right to do so.

One has to make a decision as to which is most important to him or her---taking the necessary steps to help protect their Sensitive Personal Information (such as a SSN, etc.) and other rights based on the applicable laws or just going ahead and answering all the questions on the job application just so the application can be completed.

The information contained in this post is not legal advice and is not a substitute for such advice.

 

[Mayzoo]

The FTC seems to feel asking for SS for utilities is perfectly normal and fine: https://www.consumer.ftc.gov/articles/0220-utility-services . Five states restrict utility companies from asking. I certainly hope more go in this direction.

The race, age, gender, disability etc question I am referring to are endorsed by EEOC, and I believe collected by them supposedly as a means of affirmative action. The responses are used to pay employers for hiring certain class' of employees. https://www.findmyprofession.com/career-advice/eeo-questions-everything-you-need-to-know.

"When you see EEO questions
According to the EEOC website, companies that meet certain criteria must file an EEO-1 report annually to show data for their “employment practices” ie. “data for those paid employees”. Therefore, job applicants will see EEO questions on applications when a company has the following:

• Subject to Title VII of the Civil Rights Act of 1964, with 100 or more employees; or...
• Subject to Title VII of the Civil Rights Act of 1964, with fewer than 100 employees, if the company is under the ownership or has a corporate affiliation with another company and the entire enterprise employs a total of 100 or more employees; or...
• Federal government prime contractors or first-tier subcontractors subject to Executive Order 11246, with 50 or more employees and a prime contract or first-tier subcontract amounting to $50,000 or more.

If you are applying and do not get asked the EEO questions, the company may not meet the above criteria. Most of the time, large companies ask applicants to fill out EEOC surveys." https://www.findmyprofession.com/career-advice/eeo-questions-everything-you-need-to-know.

Unfortunately, as the applicant, we simply would not know if our answers led to discrimination either from answering or not answering the questions.


Knowing our rights is critical. Knowing the possible outcome of enforcing our rights is very important, but very difficult to discern.

 

[sheilacpc]

My original post concerned advising those who may not know that know that there are currently more than 25 STATE laws which govern the collection, use, transmitting and/or storage of an individual's social security number (SSN) and other sensitive personal information (SPI's) in order to protect the privacy and security of an individual's SSN.

Generally, these state laws are applicable to all commercial entities, including employers and prospective employers. In addition to the SSN disclosure laws, other state laws, also, may regulate the collection, use or disclosure of SSN data.

If an individual has questions or concerns regarding discerning how the various STATE laws concerning the regulation and/or prohibition of the use of SSN's are applicable or the outcomes of enforcing those rights in a particular state, that person should contact the Attorney General's office in his or state or a licensed attorney in his or her state for assistance in addressing those relevant questions or concerns.