§ 96-a. Prohibited conduct. 1. Beginning on January first, two
thousand ten the state and its political subdivisions shall not do any
of the following, unless required by law:

(a) Intentionally communicate to the general public or otherwise make
available to the general public in any manner an individual's social
security account number. This paragraph shall not apply to any
individual intentionally communicating to the general public or
otherwise making available to the general public his or her social
security account number.

(b) Print an individual's social security account number on any card
or tag required for the individual to access products, services or
benefits provided by the state and its political subdivisions.

(c) Require an individual to transmit his or her social security
account number over the internet, unless the connection is secure or the
social security account number is encrypted.

(d) Require an individual to use his or her social security account
number to access an internet web site, unless a password or unique
personal identification number or other authentication device is also
required to access the internet website.

(e) Include an individual's social security account number, except the
last four digits thereof, on any materials that are mailed to the
individual, or in any electronic mail that is copied to third parties,
unless state or federal law requires the social security account number
to be on the document to be mailed. Notwithstanding this paragraph,
social security account numbers may be included in applications and
forms sent by mail, including documents sent as part of an application
or enrollment process, or to establish, amend or terminate an account,
contract or policy, or to confirm the accuracy of the social security
account number. A social security account number that is permitted to be
mailed under this section may not be printed, in whole or in part, on a
postcard or other mailer not requiring an envelope, or visible on the
envelope or without the envelope having been opened.

(f) Encode or embed a social security number in or on a card or
document, including, but not limited to, using a bar code, chip,
magnetic strip, or other technology, in place of removing the social
security number as required by this section.

(g) Nothing in this section shall prohibit a county clerk or court
from making available a document publicly recorded or filed prior to the
effective date of this section, provided that if any individual requests
redaction of a social security number from a publicly recorded document
available to the public online, such number shall be promptly redacted
by the county clerk. Nothing in this section shall limit disclosure of
criminal history record information currently permitted.

2. As used in this section "social security account number" shall
include the nine digit account number issued by the federal social
security administration and any number derived therefrom. Such term
shall not include any number that has been encrypted.

3. This section does not prevent the collection, use or release of a
social security account number as required by state or federal law, or
the use of a social security account number for internal verification,
fraud investigation or administrative purposes.