Cooper Walinski, LPA

Michigan's Social Security Number Privacy Act applies to employers and other persons who obtain and use social security numbers in the conduct of their business. "Persons" includes individuals, business enterprises and entities, educational institutions at all levels, and governmental units and agencies, both state and local, as well as other legal entities.

The Act prohibits the use of all or more than 4 sequential digits of social security numbers as a primary account number or on an identification badge or membership card. There can't be public displays of more than 4 sequential digits, or more than 4 sequential digits on mailed documents where the numbers are visible. Employers cannot require an individual to use more than 4 sequential digits to gain access to a computer system or network unless encryption or other security measures are in place. Nor can employers include the full number on mailings to an individual unless the mailing is initiated by the individual as an application or enrollment, the document is sent to establish health insurance or employment benefits, or the inclusion of a social security number is permitted or required by law:

Permissible uses of a full social security number include identifying individuals seeking employment, investigating credit, criminal or driving histories, preventing identify theft and other crimes, collecting employee benefits or accounts, and collecting child or spousal support or tax liability. The full number can be used in administrating employee health insurance, claims, retirement programs, and investment accounts.

Employers in Michigan who obtain social security numbers in the ordinary course of business must have a privacy policy that:

Ensures to the extent practicable the confidentiality of the social security numbers;
Prohibits unlawful disclosure of the social security numbers;
Limits who has access to information or documents that contain the social security numbers;
Describes how to properly dispose of documents that contain social security numbers; and
Establishes penalties for violation of the privacy policy.

The privacy policy must be in an employee handbook or procedures manual, and may be available electronically. Privacy policies have been required since January 1, 2006.

A knowing violation of the Act is a misdemeanor punishable by imprisonment for up to 93 days or a fine up to $1,000.00, or both. Individuals may sue for actual damages up to $1000 plus reasonable attorney fees for knowing violations.

For the complete Act, see Michigan Compiled Laws Sections 445.81 through 445.87.

DISCLAIMER: Cooper & Walinski publishes this bulletin to provide information about new developments in the labor and employment industry. It is not intended as legal advice, nor is it a solicitation for prospective clients. If you are seeking legal advice, you should consult an attorney who is familiar with your particular circumstances. Use of the information contained in this bulletin will not establish an attorney-client relationship. Such a relationship can only be established to the extent an attorney at Cooper & Walinski expressly agrees to undertake the relationship. All rights reserved.