The State of Michigan has recently enacted a new law designed to ensure the privacy of its residents’ social security numbers. Specifically, the State has made the following actions a misdemeanor punishable by up to 90 days in jail and/or a fine of up to $1,000:

• publicly displaying more than 4 sequential digits of a person’s social security number;
• using all or more than 4 sequential digits of a social security number as a primary account number for an individual [unless the use began before the new act was effective (i.e. March 1, 2005) and the use is ongoing, continuous and in the ordinary course of business (if the use stops for any reason, it may not begin again)];
• visibly printing all or more than 4 sequential digits of a social security number on any ID card or badge, membership card, permit or license;
• including all or more than 4 sequential digits of a social security number in or on any document mailed or sent to an individual if the number is visible from the outside of the envelope or packaging;
• After January 1, 2006, mailing any document that includes a person’s social security number unless a federal or state law permits or requires that the document contain a social security number, the document is sent as a part of an application or open enrollment process started by an individual, or the document is sent to establish, confirm the status of, service, amend, or terminate an account, contract, policy, or employee or health insurance benefit or to confirm the accuracy of a social security number of an individual who has an account, contract, policy, or employee or health insurance benefit.

For persons who are damaged by the violation of the new privacy laws, the State has also created a private cause of action allowing the injured person to recover their actual damages. For example, if someone intentionally publishes your social security number and your identity is stolen and you are held liable for any false charges made in your name, you can sue the person who made your social security number public.

There are certain exceptions to the new social security number privacy laws, most notably the administrative “ordinary course of business” exception. This exception means that if it is being used in the ordinary course of business, a social security number may be used to verify an individual’s identity, or to identify an individual (for example, if you were to call in to verify your bank account balance, it would not be illegal for the bank to ask you to give them your social security number to verify that you are the person you claim to be). Your social security number may also be used to investigate your claim, credit, criminal or driving history, and to investigate or enforce child support obligations.

Similarly, your social security number may be used to detect, prevent or deter identity theft or any other crime, and may be used to help enforce your rights, including audits, collection or tax transfers, employee benefits, or debts, claims, etc.

Lastly, your social security number may be used to “provide or administer employee or health insurance or membership benefits, claims, or retirement programs or to administer the ownership of shares of stock or other investments.” However, any social security number that becomes part of the public record for any reason is exempt from disclosure under the freedom of information act.

For a business owner whose business deals regularly with people’s social security numbers, this law also affects you. This is because, if your business obtains one or more social security numbers in the ordinary course of its business, you are now required to create a privacy policy that:

• ensures, as much as practicable, the confidentiality of those numbers;
• prohibits the unlawful disclosure of those numbers;
• limits access to those numbers;
• implements a destruction policy for documents containing those numbers; and
• establishes penalties for those violating the policy.

For more information on the new social security number privacy laws, please contact either Shannon N. Scheloske at 248.619.2599 or click here to send an email or Thomas L. Boyer at 248.740.5666 or click here to send an email.