Law / United States / 
Maryland
Social Security Number Privacy Act
Officially Social Security Number Privacy Act: public display, transmission and use limits
Md. Code Ann., Com. Law §§ 14-3401, 14-3402 (Title 14, Subtitle 34)
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Security
As of .
What it requires
- Whether you are a business or an employer, do not publicly post or display an individual's Social Security number, and do not print it on a card the individual must use to access products or services you provide (Com. Law 14-3402(a)(1)-(2)).
- Do not require an individual to transmit, or initiate the transmission of, the individual's Social Security number over the Internet unless the connection is secure or the number is encrypted (Com. Law 14-3402(a)(3)-(4)).
- Do not require an individual to use the individual's Social Security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required (Com. Law 14-3402(a)(5)).
- Unless State or federal law requires it, do not print an individual's Social Security number on material you mail to the individual, do not include it in material you transmit electronically to the individual unless the connection is secure or the number is encrypted, and do not include it in material you send to the individual by facsimile (Com. Law 14-3402(a)(6)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 13-411 of the Commercial Law Article makes a violation of any provision of Title 13 a misdemeanor punishable by a fine not exceeding $1,000 or imprisonment not exceeding one year or both, unless another criminal penalty is specifically provided elsewhere, in addition to civil penalties.
Penalty structure
Section 13-410 subjects a merchant who violates Title 13 to a fine not exceeding $10,000 for each violation and, after a finding of a violation, to a fine not exceeding $25,000 for each subsequent repeat of the same violation. The fines are civil penalties recoverable by the State in a civil action or an administrative cease and desist action.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Maryland Attorney General, Consumer Protection Division, under the enforcement and penalty provisions of Title 13 of the Commercial Law Article; an individual who sustains injury or loss may sue under section 13-408.
Settledness
- As of
- Open questions
- Does the exception for use of a Social Security number 'for internal verification or administrative purposes' in section 14-3402(b)(3) extend to sending the number to a third-party identity verification vendor?
What this law does
A person includes an individual, corporation, business trust, statutory trust, estate, trust, partnership, association, two or more persons having a joint or common interest, or any other commercial entity, and does not include a unit of State or local government. A person may not publicly post or display an individual's Social Security number. A person may not print an individual's Social Security number on a card required for the individual to access products or services the person provides.
A person may not require an individual to transmit, or initiate the transmission of, the individual's Social Security number over the Internet unless the connection is secure or the number is encrypted. A person may not require an individual to use the individual's Social Security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required.
Unless State or federal law requires it, a person may not print an individual's Social Security number on material mailed to the individual, include it in electronically transmitted material unless the connection is secure or the number is encrypted, or include it in material transmitted to the individual by facsimile.
Section 14-3402 does not apply to the collection, release or use of a number as required by State or federal law, to its inclusion in an application, form or document sent as part of an application or enrollment process, to establish, amend or terminate an account, contract or policy, or to confirm its accuracy, or to its use for internal verification or administrative purposes.
An interactive computer service provider's or telecommunications provider's transmission, routing, or intermediate temporary storage or caching of a number is outside section 14-3402, and section 14-3402 imposes no duty on such a provider to monitor its service or seek evidence of the transmission of numbers. Title 13 of the Commercial Law Article lists a violation of Title 14, Subtitle 34, the Social Security Number Privacy Act, among its unfair, abusive or deceptive trade practices. The Social Security Number Privacy Act took effect on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.