I. INTRODUCTION
With identity theft in the workplace becoming more prevalent, the Nebraska Legislature enacted a law in 2007 that places restrictions on the ability of employers to use social security numbers. The new law (Neb.Rev.Stat. § 48-237), which took effect on September 1, 2008, is designed to limit access to social security numbers by individuals who do not have a legitimate need for such information. The bill does provide for the use of full social security numbers by an employer to comply with federal or state laws, rules or regulations, for internal administrative services, such as personnel benefit programs and employment screening and staffing, and for commercial transactions freely and voluntarily entered into by the employee with the employer for the purchase of goods or services.
II. PROHIBITED USE OF SOCIAL SECURITY NUMBERS BY EMPLOYERS
Under the new law, employers are prohibited from:
A. publicly posting or publicly displaying in any manner more than the last four digits of an employee’s social security number, including intentional communication of more than the last four digits of the social security number or otherwise making more than the last four digits of the social security number available to the general public or to an employee’s coworkers (these provisions may preclude an employer from leaving documents containing an employee’s social security number in unsecured files);
B. requiring an employee to transmit more than the last four digits of his or her social security number over the Internet unless the connection is secure or the information is encrypted;
C. requiring an employee to use more than the last four digits of his or her social security number to access an Internet web site unless a password, unique personal identification number, or other authentication device is also required to access the Internet web site; or
D. requiring an employee to use more than the last four digits of his or her social security number as an employee ID number for any type of employment-related activity.
III. PERMISSIBLE USE OF SOCIAL SECURITY NUMBERS BY EMPLOYERS
Employers are permitted to use more than the last four digits of an employee’s social security number in the following instances:
A. for compliance with state or federal laws, rules or regulations;
B. for internal administrative purposes, including provision of more than the last four digits of social security numbers to third parties for such purposes as administration of personnel benefit provisions for the employer and employment screening and staffing;
C. for commercial transactions freely and voluntarily entered into by the employee with the employer for the purchase of goods or services.
While greater flexibility is provided to employees in utilizing full social security numbers for “internal administrative purposes,” the law provides the following examples for when the use of full social security numbers is not permitted for internal administrative purposes:
A. as an identification number for occupational licensing;
B. as an identification number for drug-testing purposes except when required by state or federal law;
C. as an identification number for company meetings;
D. in files with unrestricted access within the company;
E. in files accessible by any temporary employee unless the temporary employee is bonded or insured under a blanket corporate surety bond or equivalent commercial insurance; or
F. for posting any type of company information;
IV. PENALTY PROVISIONS
Any employer violating the law relating to improper use of social security numbers is guilty of a Class V misdemeanor. In addition, evidence of a conviction under the law is admissible as evidence at a civil trial as evidence of the employer’s negligence.
V. CONCLUSION
Employers should only collect and retain social security numbers if they have a legitimate business need for the information. Policies should be in place to restrict access of any document containing employee social security numbers. Steps should be taken to protect the confidentiality of employee’s social security numbers to the greatest extent possible, and access to documents containing social security numbers should be prohibited, except as otherwise permitted under the new law.