Maryland Social Security Number Privacy Act

[stephen]

According to http://www.wtplaw.com/News/articles.asp?NewsID=287

BEWARE OF TRANSMITTING SOCIAL SECURITY NUMBERS – HOW MARYLAND’S NEW SOCIAL SECURITY NUMBER PRIVACY ACT MAY AFFECT YOU AND YOUR BUSINESS

01/25/2006

Jennifer Ryan Lazenby

Maryland’s new Social Security Number Privacy Act became effective January 1, 2006. The Act prohibits, among other things, the public posting of an individual’s Social Security number or the public display of an individual’s Social Security number. Very few employers or businesses actually contemplate posting Social Security numbers for the public to see, so at first blush the Act may not seem relevant to your company.

The Act, however, is also directed at normally private actions that may become “public” through a breach of security. Transmitting an individual’s Social Security number by mail, facsimile or over the Internet is also prohibited.

Practically, the Act will have a huge impact on Maryland businesses, probably far greater than ever expected by the legislature and the general public. The use of Social Security numbers is prevalent in today’s society. Social Security numbers appear on insurance cards, credit reports, tax returns and employment applications.

There are some exceptions to the Act, including the use of an individual’s Social Security number if required by State or Federal law. Moreover, continuous use of an individual’s Social Security number may be permitted under certain circumstances if the user provides an annual disclosure informing the individual of his/her right to order, in writing, that the use of his/her Social Security number stop.

Although the Act does not specifically define how violators will be punished, precautions should be taken to avoid civil liability and to protect the identity of your clients, employees, etc.

If you use Social Security numbers in your business, provide the holders of the numbers written notice of the Act and inform them of their right to opt out of such use.

Evaluate the effectiveness of your internal procedures.

Make employees aware of the new law and regularly verify that your internet connection is secure.

If possible, recode your records to use only the last four digits of Social Security numbers.

Require an individual to complete a waiver if he/she asks you to forward information containing his/her Social Security number to third parties.

The above outline is intended only as a broad overview of The Social Security Number Privacy Act applicability and does not constitute legal advice.

I remember laws being passed that kept firms from printing Social Security Numbers on statements etc. However, it seems to me that this goes way beyond that. Do Maryland clients need to start using employee identification numbers when sending information via fax or internet?

Our clients send in census data, contributions, etc. using the SSN as the identifier.

Thanks,

Stephen

[Guest mjb]

The statute appears to be preempted as to ERISA plans since it would interfere with communciations among the plan administrator, participants, the employer and the funding entities. Could be a problem for IRAs, SEPs non ERISA 403(b) plans and govt plans. It would also be preempted as to the federal govt, e.g. social security, IRS, etc. SS numbers are required to appear on tax returns under the IRC and IRS requires SS numbers on payroll withholding forms.

[stephen]

MANY THANKS!

[david rigby]

A few previous discussion threads on this topic, and we see that mjb is consistent in his opinion that such state statutes are pre-empted by ERISA. (My opinion on that is irrelevant.) What is relevant is the strong trend on the part of employers/plan sponsors to make sure they are not part of the "identity theft problem", and many are voluntarily finding ways to "mask" the social security number. This is a good thing, and should be encouraged.

[E as in ERISA]

I think that there are exceptions in the law where SSNs are used by retirement plans (e.g, for statements, etc.) consistent with federal privacy rules. But also agree that many are moving to masking due to all the complexities of privacy laws and what exceptions apply.