Introduced by Representatives Chen of Mendon, Ancel of Calais, Fallar of Tinmouth, Hube of Londonderry, Hunt of Essex, Keogh of Burlington, Kiss of Burlington, Komline of Dorset, Marek of Newfane, Peterson of Williston, Shand of Weathersfield and Smith of Morristown
Subject: Government operations; public records; Social Security numbers
Statement of purpose: This bill proposes to prohibit the following uses of Social Security numbers (SSNs): publicly posting or displaying SSNs; printing an SSN on an identification card used by a consumer to access goods or services; requiring the transmission of an SSN over the internet, unless the internet connection is secure; requiring the use of an SSN to access an internet website, unless a password or unique identification number is also required; printing an individual’s SSN on any materials mailed to the individual unless state or federal law requires the document to include an SSN, or the SSN is included in an application for or revocation of an enrollment process; and embedding or encoding an SSN on a magnetic strip of an identification card. A person or entity using an SSN in a manner prohibited by the bill may continue to use the SSN if certain conditions are met. The bill does not prohibit the collection, use, or release of an SSN as authorized by state or federal law or for internal administrative or verification purposes. In addition, the bill provides that if a federal law requires implementation of a national unique patient identifier program, any person who complies with the federal law shall be deemed in compliance with the state requirements for the use of an SSN. The bill does not apply to the collection, use, or release of SSNs by the state, a subdivision of the state, or in connection with the official duties of an individual in the employ of the state. However, state agencies must examine their use and collection of SSNs and, to the extent possible, limit or not require the use or collection of SSNs. A violation of the prohibitions on the use of SSNs shall be deemed a violation of the state’s consumer protection requirements, and the attorney general’s office may investigate and prosecute an alleged violation as consumer fraud. In addition, the bill requires the continuation of an agency of administration study regarding the collection and use of Social Security numbers by state agencies.
AN ACT RELATING TO THE USE OF SOCIAL SECURITY NUMBERS
It is hereby enacted by the General Assembly of the State of Vermont:
Sec. 1. 9 V.S.A. § 2480m is amended to read:
§ 2480m. USE OF SOCIAL SECURITY NUMBERS
(a) Except as otherwise provided in this section, a person may not:
(1) Publicly post or publicly display in any manner an individual’s Social Security number. As used in this section, “publicly post” or “publicly display” means to intentionally communicate or otherwise make available to the general public.
(2) Print an individual’s Social Security number on any card required for the individual to access products or services provided by the person or entity.
(3) Require an individual to transmit his or her Social Security number over the internet, unless the connection is secure or the Social Security number is encrypted.
(4) Require an individual to use his or her Social Security number to access an internet website, unless a password or unique personal identification number or other authentication device is also required to access the internet website.
(5) Print an individual's Social Security number on any materials that are mailed to the individual, unless state or federal law requires the Social Security number to be on the document to be mailed. Notwithstanding any provision in this section to the contrary, Social Security numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process, or to establish, amend, or terminate an account, contract, or policy, or to confirm the accuracy of the Social Security number. A Social Security number that is permitted to be mailed under this section may not be printed, in whole or in part, on a postcard or visible on an envelope or without the envelope having been opened.
(b) Except as provided in subsection (e) of this section, a person or entity that has used an individual’s Social Security number prior to July 1, 2005 in a manner inconsistent with subsection (a) of this section may continue using that individual’s Social Security number in that manner on or after July 1, 2005, if all of the following conditions are met:
(1) The use of the Social Security number is continuous. If the use is stopped for any reason, subsection (a) of this section shall apply.
(2) The individual is provided an annual notice of disclosure that informs the individual that he or she has the right to stop the use of his or her Social Security number in the manner prohibited by subsection (a) of this section.
(3) A written request by an individual to stop the use of his or her Social Security number in the manner prohibited by subsection (a) of this section must be implemented within 30 days of the receipt of the request. There may not be a fee or charge for implementing the request. The person or entity shall not deny services to an individual because the individual makes a written request pursuant to this subsection.
(c) This section does not apply to:
(1) The collection, use, or release of Social Security numbers by the state, a subdivision of the state, or an individual in the employ of the state or of a subdivision of the state in connection with his or her official duties, except as provided in subsections (f) and (g) of this section.
(2) Documents that are recorded or required to be open to the public under state or federal law, except as provided in subdivision (a)(1) and subsection (g) of this section.
(d) This section does not prevent the collection, use, or release of a Social Security number as authorized by state or federal law or the use of a Social Security number for internal verification or administrative purposes.
(e) If a federal law takes effect requiring the United States Department of Health and Human Services to establish a national unique patient health identifier program, any person who complies with the federal law shall be deemed to be in compliance with this section with respect to the use of a national unique patient health identifier.
(f) State agencies shall examine their use and collection of Social Security numbers and, to the extent possible, limit or not require such use or collection if not necessary to the administration of the program.
(g) Prior to posting or requiring the posting of a document in a place of general public circulation, an agency, board, department, commission, committee, branch, instrumentality, or authority of the state or an agency, board, committee, department, branch, instrumentality, commission, or authority of any political subdivision of the state shall take all reasonable steps to redact any Social Security numbers from the document. Files and records made available to the public in accordance with and pursuant to 24 V.S.A. § 1165 are not considered posted in a place of general public circulation for the purposes of this section.
(h) A person or entity may not encode or embed a Social Security number in or on a card or document, including, but not limited to, using a bar code, chip, magnetic strip, or other technology in place of removing the Social Security number, as required by this section.
(i) Any person who violates this section shall be deemed to be in violation of section 2453 of this title. The attorney general may investigate and prosecute alleged violations of this section pursuant to chapter 63 of this title.
Sec. 2. CONTINUANCE OF STUDY
The agency of administration with the cooperation of the attorney general’s office, the department of health, the agency of human services, and the agency of commerce and community development and with solicited participation from the Vermont League of Cities and Towns and any other interested affected parties shall continue the study required by Sec. 5 of No. 155 of the Acts of the 2003 Adj. Sess. (2004) until June 30, 2006. The study shall address issues related to: the collection and use of Social Security numbers by state agencies; the costs associated with the elimination of such collection and use of Social Security numbers by state agencies and, to the extent that the state is required to implement changes in the use of Social Security numbers, the potential financial impact upon private employers; and the benefits and costs to public and private entities of a requirement relating to the destruction of documents containing Social Security numbers. The agency of administration shall report to the general assembly and the senate committees on judiciary and finance and the house committees on commerce and judiciary on or before January 15, 2007.
Sec. 3. EFFECTIVE DATE
This act shall take effect on July 1, 2006.
The Vermont General Assembly
115 State Street