MEYERSON v. PRIME REALTY SERVICES LLC LLC (2005)

 This motion poses a question of nationwide first impression as to whether, as between two private citizens or entities and where no statute nor governmental regulation requires disclosure, a state consumer protection statute may be utilized to assert a claim that a social security number be protected from disclosure as confidential information.   In the face of a motion to dismiss by entities which insist on their right to demand plaintiff's social security number, this question must be answered in favor of permitting the claim for protection to proceed.

Because the confidentiality of a social security number has been the subject of sharply different legal analyses, no single legal theory has emerged from prior judicial decisions considering this subject in various different fact patterns.   For reasons explained below, in relation to a private transaction, this court may well adopt a bright line standard that a social security number is prima facie privileged information, with the privilege to be asserted only after the demanding party demonstrates entitlement to confidential information.   While the privilege must give way as required by statute, regulation or court order, in ordinary circumstances, the person who holds the social security number appears to be free to decline disclosure.

This legal issue is posed by the straightforward facts present here.   Petitioner's landlord and its agents have demanded that she reveal her social security number as she completes a form regarding the number of occupants of her apartment.   A local law permits the landlord to inquire about apartment occupants, but does not authorize a demand for social security numbers (Administrative Code of the City of New York § 27-2075[c] ).  For reasons not relevant here, the landlord is not currently in possession of petitioner's social security number.   Additional facts are added in the second section of this decision addressing the applicability of state consumer protection laws.

Plaintiff's complaint seeks declaratory relief (CPLR 3017[b] ), as well as injunctive and monetary relief under the New York consumer protection statute, General Business Law (“GBL”) § 349(h).  The defendants' motion seeks dismissal of the complaint (CPLR 3211[a][1], [7] ).   Both parties request an award of costs, sanctions and attorneys fees (22 NYCRR 130-1.1).

Plaintiff fears disclosure of her social security number (“SSN”) may make her subject to identity theft, which has been a peril recognized for over a decade (Greidinger v. Davis, 988 F.2d 1344, 1354 [4th Cir.1993], “an individual's concern over his SSN's confidentiality and misuse ․ [is] compelling.   For example, armed with one's SSN, an unscrupulous individual could obtain a person's welfare benefits or Social Security benefits, order new checks at a new address on that person's checking account, obtain credit cards, or even obtain the person's paycheck”).   Misuse of a social security number can lead to identity theft, sometimes called “data rape” (Latasha D. McDade, Data Rape:  Assault by an Unknown Predator The Supreme Court Went Wrong In TRW, Inc. v. Andrews, 45 S. Tex. L.Rev. 395, 396 [2005], reporting that one instance of identity theft occurs every seventy-nine seconds, stating such theft is particularly likely to be done by office workers who have access to a social security number in business records, and citing an instance of a victim left with bills from banks, credit card companies, and retailers in excess of one hundred thousand dollars).   To give one striking example of the degree of sophistication now used by identity thieves:  there is already a reported significant problem of such thieves seeking bankruptcy protection to forestall eviction or foreclosure to protect their ill-gotten property interests (Magdalena Reyes Bordeaux, Debtors in Pretension:  In Light of the Growing Incidence of Identity Theft, Practitioners Need to Understand How to Expunge a Fraudulent Bankruptcy, 27-SEP L.A. Law. 24 [2004] ).

Social Security Numbers:  A Legal Background

Social security numbers were first adopted in 1936, when nine-digit account numbers were assigned to persons by the Secretary of Health and Human Services for the purpose of administering the Social Security laws (42 U.S.C. § 405[c][2][B] ).  Federal law provides that social security account numbers and related records that are obtained or maintained by “authorized persons” shall be confidential, and no “authorized person” shall disclose any such social security account number or related record (42 U.S.C. § 405[c] [2] [c][viii] [I] ).¹

 It is beyond doubt that governmental officials of every stripe may demand disclosure of a social security number, subject to certain restrictions.   The primary limitation is contained in the federal 1974 Privacy Act, which requires that any agency requesting disclosure of a SSN must “inform that individual whether that disclosure is mandatory or voluntary, by what statutory authority such number is solicited, and what uses will be made of it” (5 U.S.C. § 552a[7][a][b][7] ).²  It is noteworthy that, even when government demands the information, a citizen may assert a claim that the government lacks sufficient need to justify seeking the private information (see, for example, Russell v. Board of Plumbing Examiners of County of Westchester, 74 F.Supp.2d 339 [S.D.N.Y.1999], rearg. denied 74 F.Supp.2d 349, 45 Fed.R.Serv.3d 624 [S.D.N.Y.1999], affirmed 1 Fed.Appx. 38, 2001 WL 15628 [2d Cir.2001], master plumber application requirements imposed by a county;  see also, Dittman v. California, 191 F.3d 1020 [9th Cir.1999], cert. denied, 530 U.S. 1261, 120 S.Ct. 2717, 147 L.Ed.2d 982 [2000], state requirement acupuncturist provide social security number upon applying for license renewal).   The Privacy Act does permit injunctive relief by individuals against the government, albeit there must be proof of some actual damages to achieve even nominal damages (Doe v. Chao, 540 U.S. 614, 124 S.Ct. 1204, 157 L.Ed.2d 1122 [2004], social security number revealed when plaintiff's Black Lung claim forms distributed).

There is a broad federal policy against the government revealing individuals' social security numbers.   There are a variety of federal statutory restrictions on dissemination of such information, such as the federal Driver's Privacy Protection Act of 1994 (18 U.S.C. §§ 2721-2725;  see Reno v. Condon, 528 U.S. 141, 151, 120 S.Ct. 666, 145 L.Ed.2d 587 [2000], act restricting states' ability to sell private data, which included social security numbers on driver license applications, was proper governmental exercise because it “regulates the States as the owners of data bases” being sold in interstate commerce).³  Additionally, where there is a demand for disclosure of social security numbers under federal or state freedom of information laws, such numbers are universally held to be confidential (see Sherman v. U.S. Dept. of Army, 244 F.3d 357 [5th Cir.2001], social security numbers are protected by concept of “informational privacy” and disclosure would be “ unwarranted invasion of personal privacy” under 5 U.S.C. § 552[b][7][C];  State ex rel. Beacon Journal Publishing Co. v. City of Akron, 70 Ohio St.3d 605, 640 N.E.2d 164 [1994], under state open records law social security numbers of public employees subject to employees' legitimate expectation of privacy and “a federal right to privacy ․ protects against governmental disclosure of the private details of one's life”).⁴

The foregoing authorities reflect a broad recognition of the confidential nature of a social security number.   This result is not inconsistent generally with common law view of private information, described in U.S. Dept. of Justice v. Reporters Committee For Freedom of Press, 489 U.S. 749, 763-764, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989), a case involving the confidentiality of individual criminal history records, as follows:

“To begin with, both the common law and the literal understandings of privacy encompass the individual's control of information concerning his or her person.   In an organized society, there are few facts that are not at one time or another divulged to another.  * * * * According to Webster's initial definition, information may be classified as ‘private’ if it is ‘intended for or restricted to the use of a particular person or group or class of persons:  not freely available to the public.’ ”

As the Supreme Court concluded, the fact that the information resides in a governmental or other scattered record does not automatically defeat a privacy claim.

The Supreme Court also addressed the privacy tort theories which have achieved recognition in many jurisdictions:

“[A right to control private information was first enunciated in] Warren & Brandeis, The Right to Privacy, 4 Harv.L.Rev. 193, 198 (1890-1891) (‘The common law secures to each individual the right of determining, ordinarily, to what extent his thoughts, sentiments, and emotions shall be communicated to others․ [E]ven if he has chosen to give them expression, he generally retains the power to fix the limits of the publicity which shall be given them’).   The common law recognized that one did not necessarily forfeit a privacy interest in matters made part of the public record, albeit the privacy interest was diminished and another who obtained the facts from the public record might be privileged to publish it.   See * * * Restatement (Second) of Torts § 652D, pp. 385-386 (1977) (‘[T]here is no liability for giving publicity to facts about the plaintiff's life that are matters of public record, such as the date of his birth․ On the other hand, if the record is one not open to public inspection, as in the case of income tax returns, it is not public and there is an invasion of privacy when it is made so’);  W. Keeton, D. Dobbs, R. Keeton, & D. Owens, Prosser & Keeton on Law of Torts § 117, p. 859 (5th ed. 1984) (‘[M]erely because [a fact] can be found in a public recor[d] does not mean that it should receive widespread publicity if it does not involve a matter of public concern’).”  (489 U.S. at 764, fn. 15, 109 S.Ct. 1468.)  5

It is also observed that New York generally follows the same principles set forth above.   For instance, in relation to freedom of information requests, social security numbers are redacted (Beyah v. Goord, 309 A.D.2d 1049, 1052, 766 N.Y.S.2d 222 [3d Dept.2003], prisoner request for guards' social security numbers;  Parker v. State of New York, 269 A.D.2d 255, 702 N.Y.S.2d 821 [1st Dept.2000], same;  Bibeau v. Cantiague Figure Skating Club, Inc., 294 A.D.2d 525, 742 N.Y.S.2d 864 [2d Dept. 2002], social security number to be redacted from plaintiff's proof of earnings tendered in discovery;  Adler v. Jackson, 185 Misc.2d 45, 712 N.Y.S.2d 240 [Sup.Ct. Queens Co.2000], Department of Motor Vehicles could properly require disclosure of social security number on license application under Privacy Act provisions).

 Concluding this broad review of the treatment of social security numbers, it is clear that the weight of authority favors treating a social security number as private and confidential information.   In casting for a proper legal characterization, the law appears to support a conclusion that a social security number is protected by something akin to a privilege against disclosure, which privilege is to be asserted only after legal authority for the demand is demonstrated.

Consumer Protection Statutory Claim

 Plaintiff seeks relief upon the claim that her landlord's request for her social security number constitutes a violation of New York's consumer protection statute (GBL § 349[h] ), upon the allegation that her landlord deceptively represented that she was required by law to provide personal and confidential information, including her birth date and social security number, in order to secure a renewal lease and to avoid eviction.   A prima facie case of deceptive practices pursuant to GBL § 349 requires a showing that defendants' acts are directed to consumers, that they are deceptive or misleading in a material way and that plaintiff has been injured thereby (Zurakov v. Register.Com, Inc., 304 A.D.2d 176, 760 N.Y.S.2d 13 [1st Dept.2003], citing Oswego Laborers' Local 214 Pension Fund v. Marine Midland Bank, 85 N.Y.2d 20, 25-26, 623 N.Y.S.2d 529, 647 N.E.2d 741 [1995] ).

To elaborate upon the facts, in September of 2003, the landlord sent a renewal lease with a letter directing her to complete and execute a form which required such information in relation to each occupant of plaintiff's apartment.   The form stated it was “In accordance with New York City Administrative Code, Section 27-2075(c)” and that “Failure to reply is grounds for eviction.”   The included “Lease Renewal Instructions” stated that all enclosed forms “must be signed if you would like to renew your lease for your apartment.   You must completely sign and enter all information requested.”   Plaintiff alleges that the landlord routinely sends the same forms to all rent-regulated tenants in the buildings it owns or manages.

Upon receiving the lease renewal packet, plaintiff sought legal advice as to whether she was required to complete the affidavit and provide all information demanded.   The landlord refused to withdraw the demand for information.

 The landlord baldly asserts that it is entitled to demand disclosure of the plaintiff's social security number, urging such demand is specifically authorized by applicable laws.   Landlord relies on Administrative Code of the City of New York § 27-2075(c), which relates to maximum permitted occupancy of an apartment.   The provision states, in relevant part, that “[o]n written demand ․ by the owner when he or she rents a dwelling unit or any time thereafter, the tenant shall submit an affidavit setting forth the names and relationship of all occupants within the dwelling unit and the ages of any minors.”   By its plain language, the Code provision relied upon by defendants does not authorize a demand for social security numbers of apartment occupants, or for the birth dates of all adult occupants.

 Further, to the extent landlord's forms could be understood as threatening eviction for noncompliance, such threat must also be viewed as inaccurate since courts have held that a tenant cannot be evicted for noncompliance with section 27-2075 of the Administrative Code (Tabak v. Pinzon, N.Y.L.J., 3/18/99, p. 30, col. 4 [Civ.Ct. N.Y. Co.], “mere non-response to a Demand Notice alone is an insufficient basis to evict a rent controlled tenant”;  338 West 17th St. Assoc. v. Katehis, N.Y.L.J., 10/5/94, p. 22, col. 2 [Civ.Ct. N.Y. Co.], noting that “Housing Maintenance Code was enacted to protect tenants from substandard tenements and housing conditions which were clearly a threat to the very lives and health of the occupants,” and “ [w]hile landlords have an affirmative duty to investigate conditions at their buildings and ensure that the buildings meet the legal standards, the Code was never intended to be used as a sword by a landlord who seeks to evict low rent tenants who have not been proven to be a danger to the building”).   Despite defendants' protests, a plain English reading of the form tendered leads to a reader's reasonable conclusion that failure to provide the information demanded is grounds for eviction and non-renewal of a lease.

Nor do defendants advance any other showing of a right to obtain social security numbers of occupants of the apartments.   This unit is not one in which the tenant receives governmental benefits (see, e.g., Waterside Redevelopment Co. LP v. Department of Housing Preservation and Development, 270 A.D.2d 87, 704 N.Y.S.2d 63 [1st Dept.2000], lv. app. denied 95 N.Y.2d 765, 716 N.Y.S.2d 39, 739 N.E.2d 295 [2000], income inquiry for tenants of City-Aided Limited Profit Housing Companies under Article 2 of the Private Housing Finance Law).   The landlord has not initiated a luxury decontrol inquiry under the Rent Stabilization Law, which would not entitle it to social security information in any event (Administrative Code of the City of New York § 26-504.1;  Shapiro v. New York State Div. of Housing and Community Renewal, N.Y.L.J., p. 28, col. 4, 4/8/98 [Sup.Ct. N.Y. Co., Tolub J.], aff'd, 262 A.D.2d 18, 690 N.Y.S.2d 583 [1st Dept.1999], aff'd as modified sub nom. Elkin v. Roldan, 94 N.Y.2d 853, 704 N.Y.S.2d 201, 725 N.E.2d 622 [1999] ), “As the tax department advised the Governor in his July 7, 1993 letter, ‘the Tax Law prohibits use of tax return information for nontax purposes' and ‘[u]nder federal law, social security numbers cannot be used for the purpose of denying rent control to high-income tenants through the matching program envisioned by the bill’ (Commissioner's letter in Governor's Bill Jacket, Laws of 1993, Chapter 253)”, which means verification is by name and address only.   It can also be noted that this same confidential treatment of social security numbers is respected in the course of summary landlord-tenant proceedings (see Cambridge Development, LLC. v. McCarthy, 2003 WL 22798957 [N.Y. City Civ.Ct., Lebovits, J.], permitting tenant to redact social security numbers from documents produced in nonprimary-residence summary proceedings).

 Accordingly, there is no legal support for the form's instructions that tenants “must” complete the affidavit nor to the claim the defendants' demands were authorized by law.   Because a “deceptive act or practice” under the consumer protection statute is a representation or omission “likely to mislead a reasonable consumer acting reasonably under the circumstances” (Oswego Laborers' Local 214 Pension Fund v. Marine Midland Bank, supra, 85 N.Y.2d at 26, 623 N.Y.S.2d 529, 647 N.E.2d 741, the landlord's form clearly is deceptive).

 Defendants then maintain that plaintiff has not shown injury, which is required by GBL § 349(h), which permits “any person injured by reason of a violation” of the statute to bring an action to enjoin the unlawful act or practice and/or an action to recover actual damages or $50.00.   Defendants argue plaintiff alleges no actual damages, other than anxiety and distress, as well as pre-litigation attorney's fees which appear to be an item of pecuniary damage separate and apart from the costs of litigation.   The court determines the pleading is proper in form and sufficient under the statute.   As stated in relation to another consumer fraud claim, Goshen v. Mutual Life Insurance Company of New York, 98 N.Y.2d 314, 326, 746 N.Y.S.2d 858, 774 N.E.2d 1190 (2002), on this motion to dismiss, “the pleadings are necessarily afforded a liberal construction” and a plaintiff accorded “the benefit of every possible favorable inference” (citation omitted).   Accordingly, this branch of the motion is denied with leave to renew after amplification of the pleading or discovery.

 Further, it cannot be doubted that a privacy invasion claim and an accompanying request for attorney's fees may be stated under GBL § 349 based on non-pecuniary injury, such as deprivation of the right to maintain the privacy of medical records (see Anonymous v. CVS Corp., 188 Misc.2d 616, 728 N.Y.S.2d 333 [Sup.Ct. N.Y. Co.2001], grant of class certification affirmed 293 A.D.2d 285, 739 N.Y.S.2d 565 [1st Dept.2002];  see also Remsburg v. Docusearch, Inc., 149 N.H. 148, 816 A.2d 1001 [2003], under New Hampshire consumer fraud statute, invasion of privacy claim against investigator was proper).   Declaratory relief may well be appropriate for a case such as this one, which presents an instance of an actual and justiciable case or controversy, affecting the rights of the parties on both sides (see 43 N.Y.Jur.2d Declaratory Judgments and Agreed Case § 18;  Bartley v. Walentas, 78 A.D.2d 310, 434 N.Y.S.2d 379 [1st Dept.1980], purpose of declaratory action “is to serve a practical end ‘in quieting or stabilizing an uncertain or disputed jural relation either as to present or prospective obligations' ”;  see also Martinez v. Classic Realty LLC, N.Y.L.J., 5/21/2003, p. 18, col. 1, [Sup.Ct. N.Y. Co., Abdus-Salaam, J.], landlord demand similar to that in instant case withdrawn, tenant's claim for declaratory relief could proceed).

 The belated objection that plaintiff lacks a proper claim under GBL § 349 because the defendants' activity was not directed to the “public at large,” is not properly before the court because raised only in reply papers(see Dannasch v. Bifulco, 184 A.D.2d 415, 417, 585 N.Y.S.2d 360 [1st Dept.1992] ).   The court observes that plaintiff pleads that defendants own and manage a substantial number of rent-regulated apartments, and use the challenged forms for all lease renewals, so that the dispute is not simply a private contract dispute and generally claims involving residential rental units are a type of claim recognized under the statute (see Lozano v. Grunberg, 195 A.D.2d 308, 600 N.Y.S.2d 43 [1st Dept.1993], tenant stated claim under GBL § 349, based on landlord's issuance of deceptive dispossess notices based on late rent payments;  23 Realty Associates v. Teigman, 213 A.D.2d 306, 624 N.Y.S.2d 155 [1st Dept.1995], Department of Consumer Affairs has given notice that the offering of rental housing is a legitimate area of interest for consumer protection against deceptive advertising and misrepresentation;  Frazier v. Priest, 141 Misc.2d 775, 534 N.Y.S.2d 846 [City Ct. Jefferson Co.1988], GBL § 349 applies to the landlord-tenant relationship).   The defendants' point to no legislative intent indicated that those engaged in the residential real estate business are exempt from compliance with the consumer protection laws (see Karlin v. IVF America, Inc., 93 N.Y.2d 282, 690 N.Y.S.2d 495, 712 N.E.2d 662 [1999], a “blanket exemption for providers of medical services and products is contrary to the plain language of the statutes”).

Accordingly, the motion to dismiss is denied.

Conclusion

Given that this debate raises an issue of first impression, the requests for sanctions raised by both parties are denied.

Defendants' motion to dismiss is denied.   As to defendant Greystar, such denial is without prejudice to renewal following discovery.⁶  In relation to the monetary damages cause of action, such motion is denied without prejudice to renewal following amplification of the pleadings or discovery.   The court can proceed no further on the merits of the claim given that defendants have not yet answered.

This decision constitutes the order of the court.

FOOTNOTES

1.   The term “authorized person” means an officer or employee of any political subdivision of a State, or agency of a political subdivision of a State, and any other person, officer or employee thereof, who has or had access to social security account numbers or related records, as defined by 42 U.S.C. § 405(c)(2)(c)(viii)(III).

2.   The Privacy Act also provides “[i]t shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose [the individual's] social security account number” (5 U.S.C. § 552a[7][a][b][11];  see McKay v. Altobello, 1997 WL 266717 [E.D. La.1997], voter registration denied after refusal to provide mother's maiden name and Social Security number, determinated to violate section 7 of the Privacy Act).

3.   In Arakawa v. Sakata, 133 F.Supp.2d 1223, 1229-1230 (D.Haw.2001), the court reviewed the lower court decisions preceding the 2000 decision in Reno v. Condon, supra, and the few scattered decisions finding social security numbers were not confidential in the face of certain governmental interests.   The court concluded “that there is a constitutional right to privacy in the information released about Plaintiff in this case, specifically his SSN” (133 F.Supp.2d at 1229).   See also (Flavio L. Komuves, We've Got Your Number:  An Overview of Legislation and Decisions to Control the Use of Social Security Numbers as Personal Identifiers, 16 J. Marshall J. Computer & Info. L. 529, 561-65 (1998), A. Michael Froomkin, The Death of Privacy?, 52 Stan.L.Rev. 1461 [2000], Elbert Lin, Prioritizing Privacy:  A Constitutional Response to the Internet, 17 Berkeley Tech. L.J. 1085 [2002], and Clifford S. Fishman, Technology and the Internet:  The Impending Destruction of Privacy by Betrayers, Grudgers, Snoops, Spammers, Corporations, and the Media, 72 Geo. Wash. L.Rev. 1503 [2004] ).

4.   There are rare cases in which the government determines that disclosure is appropriate and such situations must be justified by a clear government interest which prevails in a balancing test.   For example, in In re Crawford, 194 F.3d 954 (9th Cir.1999), cert. denied sub nom. Ferm v. U.S. Trustee, 528 U.S. 1189, 120 S.Ct. 1244, 146 L.Ed.2d 102 (2000), a lay preparer of bankruptcy petitions objected to a statutory requirement of 11 U.S.C.A. § 110(c)(1) that he place his identifying social security number on court papers.   The Ninth Circuit recognized a right of informational privacy in relation to a social security number, which was a conditional right to weighed against the governmental interest (194 F.3d at 959).   It opined that the threat of identity theft was not an immediate harm, but one remote in time and place and to be undertaken by a non-governmental actor and that unlike disclosure of HIV status, sexual orientation, or genetic makeup a social security number “is not inherently sensitive or intimate information, and its disclosure does not lead directly to injury, embarrassment or stigma” (194 F.3d at 959-960).   It held a sufficient justification for the requirement could be found in the legislative purpose and bankruptcy's special interest in public access to judicial proceedings (194 F.3d at 960).

5.   In relation to the Restatement standard quoted, tort claims relating to social security numbers notwithstanding that social security numbers are found to be private information and confidential generally are found insufficient because either there is a failure of proof of distribution to the public at large or the information is not regarded as derogatory (Bodah v. Lakeville Motor Express, Inc., 649 N.W.2d 859, 862-63 [Minn.App.2002], rev'd on other grounds 663 N.W.2d 550 [Minn.2003], social security numbers are confidential and private, but “are not on their face revealing, compromising[ ] or embarrassing”;  Phillips v. Grendahl, 312 F.3d 357 [8th Cir.2002];  Busse v. Motorola, Inc., 351 Ill.App.3d 67, 813 N.E.2d 1013, 286 Ill.Dec. 320 [Ill.App. 1st Dist.2004];  see also Lora M. Jennings, Paying the Price for Privacy:  Using the Private Facts Tort to Control Social Security Number Dissemination and the Risk of Identity Theft [Bodah v. Lakeville Motor Express, Inc.], 663 N.W.2d 550 [Minn.2003], 43 Washburn L.J. 725 [Spring 2004] ).

6.   Defendant Greystar-Prime Management (“Greystar”), seeks dismissal on the grounds that it is not a proper party, based on documentary evidence showing it has no contractual relationship to plaintiff, and is not the owner or manager of the premises (motion, exhibits B and C).  Plaintiff responds that dismissal is premature prior to discovery, arguing that Greystar is the entity that issues rent invoice demands, and with which she communicates concerning the apartment.   Greystar's motion to dismiss is denied at this time.

DIANE A. LEBEDEFF, J.