§487J-2  Social security number protection. 
(a)  Except as otherwise provided in subsection (b), a business or
government agency may not do any of the following:



(1)  Intentionally communicate or otherwise make
available to the general public an individual's entire social security number;



(2)  Intentionally print or imbed an individual's
entire social security number on any card required for the individual to access
products or services provided by the business or government agency;



(3)  Require an individual to transmit the
individual's entire social security number over the Internet, unless the
connection is secure or the social security number is encrypted.  For purposes
of this paragraph, "encrypted" means that an algorithmic process has
been used to transform data into a form in which the data is rendered
unreadable or unusable without the use of a confidential process or key;



(4)  Require an individual to use the individual's
entire social security number to access an internet website, unless a password
or unique personal identification number or other authentication device is also
required to access the internet website; or



(5)  Print an individual's entire social security
number on any materials that are mailed to the individual, unless the materials
are employer-to-employee communications, or where specifically requested by the
individual.



(b)  Subsection (a) shall not apply to:



(1)  The inclusion of a social security number in
documents that are mailed and:



(A)  Are specifically requested by the individual
identified by the social security number;



(B)  Required by state or federal law to be on
the document to be mailed;



(C)  Required as part of an application or
enrollment process;



(D)  Used to establish, amend, or terminate an
account, contract, or policy; or



(E)  Used to confirm the accuracy of the social
security number for the purpose of obtaining a credit report pursuant to 15
U.S.C. section 1681(b).



A social security number that is permitted
to be mailed under this paragraph may not be printed, in whole or in part, on a
postcard or other mailer not requiring an envelope, or visible on the envelope
or without the envelope having been opened;



(2)  The opening of an account or the provision of or
payment for a product or service authorized by an individual;



(3)  The collection, use, or release of a social
security number to investigate or prevent fraud; conduct background checks;
conduct social or scientific research; collect a debt; obtain a credit report
from or furnish data to a consumer reporting agency pursuant to the Fair Credit
Reporting Act, 15 U.S.C. sections 1681 to 1681x, as amended; undertake a
permissible purpose enumerated under the federal Gramm Leach Bliley Act, 15
U.S.C. sections 6801 to 6809, as amended; locate an individual who is missing
or due a benefit, such as a pension, insurance, or unclaimed property benefit;
or locate a lost relative;



(4)  A business or government agency acting pursuant
to a court order, warrant, subpoena, or when otherwise required by law;



(5)  A business or government agency providing the
social security number to a federal, state, or local government entity
including a law enforcement agency or court, or their agents or assigns;



(6)  The collection, use, or release of a social
security number in the course of administering a claim, benefit, or procedure
relating to an individual's employment, including an individual's termination
from employment, retirement from employment, injuries suffered during the
course of employment, and other related claims, benefits, or procedures;



(7)  The collection, use, or release of a social
security number as required by state or federal law;



(8)  The sharing of the social security number by
business affiliates;



(9)  The use of a social security number for internal
verification or administrative purposes;



(10)  A social security number that has been redacted;
and



(11)  Documents or records that are recorded or
required to be open to the public pursuant to the constitution or laws of the
State or court rule or order.



(c)  A business or government agency covered by
this section shall make reasonable efforts to cooperate, through systems
testing and other means, to ensure that the requirements of this chapter are
complied with. [L 2006, c 137, pt of §2; am L 2008, c 19, §68]