Pennsylvania Act 2006-60 — PRIVACY OF SOCIAL SECURITY NUMBERS LAW

Act text

PRIVACY OF SOCIAL SECURITY NUMBERS LAW
                  Act of Jun. 29, 2006, P.L. 281, No. 60              Cl. 29
                                  AN ACT

     Relating to confidentiality of Social Security numbers; and
        making a related repeal.

        The General Assembly of the Commonwealth of Pennsylvania
     hereby enacts as follows:

     Section 1.  Privacy of Social Security numbers.
        (a)  General rule.--A person or entity or State agency or
     political subdivision shall not do any of the following:
            (1)  Publicly post or publicly display in any manner an
        individual's Social Security number. "Publicly post" or
        "publicly display" means to intentionally communicate or
        otherwise make available to the general public.
            (2)  Print an individual's Social Security number on any
        card required for the individual to access products or
        services provided by the person, entity or State agency or
        political subdivision.
            (3)  Require an individual to transmit his or her Social
        Security number over the Internet unless the connection is
        secure or the Social Security number is encrypted.
            (4)  Require an individual to use his or her Social
        Security number to access an Internet website unless a
        password or unique personal identification number or other
        authentication device is also required to access the website.
            (5)  Print an individual's Social Security number on any
        materials that are mailed to the individual unless Federal or
        State law requires the Social Security number to be on the
        document to be mailed. Notwithstanding this provision, Social
        Security numbers may be included in applications and forms
        sent by mail, including documents sent as part of an
        application or enrollment process or to establish, amend or
        terminate an account, contract or policy or to confirm the
        accuracy of the Social Security number. A Social Security
        number that is permitted to be mailed under this section may
        not be printed, in whole or in part, on a postcard or other
        mailer not requiring an envelope, or visible on the envelope
        or without the envelope having been opened.
            (6)  Disclose in any manner, except to the agency issuing
        the license, the Social Security number of an individual who
        applies for a recreational license. For the purposes of this
        paragraph, a "recreational license" means a license issued
        pursuant to 30 Pa.C.S. (relating to fish) or 34 Pa.C.S.
        (relating to game).
        (b)  Applicability.--Except as provided in subsection (c),
     subsection (a) applies only to the use of Social Security
     numbers on or after the effective date of this section.
        (c)  Exception.--
            (1)  A person or entity, not including a State agency or
        political subdivision, that has used, prior to the effective
        date of this section, an individual's Social Security number
        in a manner inconsistent with subsection (a) may continue
        using that individual's Social Security number in that manner
        on or after the effective date of this section if all of the
        following conditions are met:
                (i)  The use of the Social Security number is
                continuous. If the use is stopped for any reason,
                subsection (a) shall apply.
                (ii)  The individual is provided an annual
                disclosure, commencing in the year after the
                effective date of this section, that informs the
                individual that he or she has the right to stop the
                use of his or her Social Security number in a manner
                prohibited by subsection (a).
            (2)  An individual who receives an annual disclosure
        under paragraph (1) has the right to stop the use of his or
        her Social Security number in a manner prohibited by
        subsection (a) and must exercise that right by submitting a
        written request to the person or entity. The person or entity
        shall discontinue use of the individual's Social Security
        number within 30 days of the receipt of the request. There
        shall be no fee or charge for complying with the request. A
        person or entity shall not deny services to an individual
        because the individual makes a written request pursuant to
        this subsection.
        (d)  Construction.--This section shall not be construed to
     prevent the collection, use or release of a Social Security
     number as required by Federal or State law or the use of a
     Social Security number for internal verification, administrative
     purposes or for law enforcement investigations.
        (e)  Unified judicial system documents.--This section does
     not apply to a document that originated with or is filed with,
     recorded in or is maintained by any court component or part of
     the unified judicial system.
        (f)  Government documents.--This section does not apply to
     any document that:
            (1)  is required by law to be open to the public; and
            (2)  originates with or is filed, recorded or maintained
        by any government agency, instrumentality or taxing
        authority.
        (g)  Penalty.--Actions in violation of this act shall be
     deemed a summary offense and shall be punishable by a fine of
     not less than $50 and not more than $500 and, for every second
     or subsequent violation, by a fine of not less than $500 and not
     more than $5,000. Fines under this section shall be distributed
     equally between the Crime Victim's Compensation Fund
     administered by the Pennsylvania Commission on Crime and
     Delinquency and the Office of Attorney General for future
     identity theft prevention.
     Section 2.  Criminal enforcement.
        (a)  District attorneys.--The district attorneys of the
     several counties shall have authority to investigate and to
     institute criminal proceedings for any violation of this act.
        (b)  Attorney General.--In addition to the authority
     conferred upon the Attorney General under the act of October 15,
     1980 (P.L.950, No.164), known as the Commonwealth Attorneys Act,
     the Attorney General shall have the authority to investigate and
     institute criminal proceedings for any violation of this act. A
     person charged with a violation of this act by the Attorney
     General shall not have standing to challenge the authority of
     the Attorney General to investigate or prosecute the case, and,
     if any such challenge is made, the challenge shall be dismissed
     and no relief shall be available in the courts of this
     Commonwealth to the person making the challenge.
     Section 3.  Repeal.
        The provisions of 34 Pa.C.S. § 325(d) (relating to limitation
     on disclosure of certain records) are repealed insofar as they
     are inconsistent with section 1(g).
     Section 4.  Applicability.
        The provisions of this act shall not apply to:
            (1)  A financial institution, as defined by section
        509(3) of the Gramm-Leach-Bliley Act (Public Law 106-102, 15
        U.S.C. § 6809(3)) or regulations adopted by agencies as
        designated by section 504(a) of the Gramm-Leach-Bliley Act,
        subject to Title V of the Gramm-Leach-Bliley Act or a
        "licensee" as defined by 31 Pa. Code § 146a.2 (relating to
        definitions).
            (2)  A covered entity, as defined by regulations
        promulgated at 45 CFR Pts. 160 (relating to general
        administrative requirements) and 164 (relating to security
        and privacy) pursuant to Subtitle F of the Health Insurance
        Portability and Accountability Act of 1996 (Public Law 104-
        191, 110 Stat. 1936).
            (3)  An entity subject to the Fair Credit Reporting Act
        (Public Law 91-508, 15 U.S.C. § 1681 et seq.).
     Section 5.  Effective date.
        This act shall take effect in 180 days.