Your SSN on the employee ID: prohibited, and the waiver cannot be required

It is a short workplace privacy law with teeth. Its statement of motives explains the reasoning: the Social Security Number is, in its origin and purpose, **a taxpayer account number**, designed for Social Security transactions, tax transactions and employment benefits, and **was never designed as a universal identification number or a citizen’s ID card**. And it adds the distinction underpinning the whole law: that requiring the number to verify a person’s identity is permitted **does not mean there is an obligation or a freedom to use it as a public identification, employee, case or record number**. The law exists because many entities kept using it as everyday identification despite the recommendations of the Social Security Administration and the Federal Trade Commission.

Every employee of a private company or of a public corporation of the Commonwealth of Puerto Rico, **regardless of the nature of their position or appointment**. That phrase is in the law and avoids the argument over whether it applies to temporary, irregular or trust employees. There is no prior procedure: the prohibition falls on the employer and applies by law.

• Being an employee of a private company or of a Commonwealth public corporation, regardless of the nature of the position or appointment.Verified against the official source
• That the number appears on the ID card, somewhere visible to the general public, in a general-circulation document, or in a personnel directory or similar list available to anyone without need or authority of access.Verified against the official source

• The ID card, directory or document where the number appears. The law requires no form from the employee: the obligation is the employer’s.

1. 1

   Step 1: Where your number may not appear

   Article 1 sets four forbidden places in two sentences. First: **no employer, private or of Commonwealth public corporations, may show or display an employee’s Social Security Number, regardless of the nature of their position or appointment, on their identification card**. Second, in the same sentence: **nor may they show or display this data anywhere visible to the general public or in a general-circulation document**. And third, in a separate sentence: **the Social Security Number may not be included in personnel directories or any similar list made available to people who have no need or authority of access to this data**. Note that third rule’s yardstick: it is not that the list be public, it suffices that it reach someone without need or authority of access.

2. 2

   Step 2: The waiver they cannot require of you

   It is the law’s most useful sentence and worth knowing by heart: **these protections may be waived, voluntarily and in writing, by the employee, but that waiver may not be imposed as a condition of employment**. The two locks work together. The first sets the form: the waiver must come from the employee, be voluntary and written — a verbal consent or a box ticked by someone else will not do. The second sets the limit: **it may not be a condition of employment**, so an employer may not condition hiring, continued employment or a promotion on your waiving. If the waiver is put in front of you alongside the contract as part of the package, that second lock is the text to cite.

3. 3

   Step 3: The exceptions, and their condition

   The law does not aim to erase the number from the workplace. Article 1 says the prohibition **shall not apply to the use of the Social Security Number in those cases and for those purposes where it is specifically compulsory by special legal provision or has been authorized or regulated by federal law or regulation, nor to its use for internal purposes of identity verification, taxes, contracting and payroll**. But that exception comes with a condition attached in the same sentence: **subject to the employer taking due safeguards to maintain its confidentiality**. It is not an open licence: legitimate internal use still requires protecting the data, and Article 2 turns a failure in that protection into a sanctionable violation in itself.

4. 4

   Step 4: Redacting the number is not altering the document

   This rule pre-empts the "we cannot modify the document" answer. Article 1 closes: **when a document containing a worker’s Social Security Number must be made public for a purpose that does not require that data, it shall be edited so that the data is partly or fully illegible, without that being considered an alteration of the document’s content**. Three pieces: the trigger is that the document must be made public **for a purpose that does not require the number**; the remedy is editing it until partly or fully illegible; and the final clause removes the argument that redacting amounts to tampering.

5. 5

   Step 5: The fine and who enforces

   Article 2 is short and gives the two facts needed: **violation of this Act’s provisions, including failing to protect the Social Security Number’s confidentiality, shall carry a fine of not less than five hundred (500) up to five thousand (5,000) dollars per case. The Department of Labor and Human Resources of the Commonwealth of Puerto Rico shall be the agency charged with enforcing compliance with this Act**. Two details worth noting. The fine has a **floor**, not just a ceiling: not less than five hundred dollars. And "including failing to protect confidentiality" means the number need not appear displayed on a card: failing to safeguard it is already a violation.

6. 6

   Step 6: What the law left to regulation and to agreements

   Article 4 gave DTRH **six (6) months after this Act takes effect to establish the necessary regulation** to comply with Article 2, and ordered that regulation to **grant employers a term of no less than six (6) months to certify to the Department the implementation of these provisions or a work plan with a fixed date to achieve it**. That regulation is not in the law’s text and we do not publish it. Article 5 adds a protective floor clause: **no provision of this Act shall be understood as diminishing any employer organizational policy, or any collective bargaining agreement, already in force that provides protections for the Social Security Number’s confidentiality and sanctions for non-compliance**. That is, if your collective agreement or your company’s policy protects more, this law does not lower them.

Before the Department of Labor and Human Resources, which Article 2 expressly designates as the agency charged with enforcing compliance with this Act. What we do not publish: the complaint form, address, phone, resolution deadline or the content of the regulation Article 4 ordered the Department to adopt, because Act 207-2006 does not set them. That is why processing time stays unverified.

• Signing the waiver because it came with the contract: the law prohibits imposing it as a condition of employment.
• Accepting a verbal waiver or a box ticked by someone else: it must be voluntary and in writing by the employee.
• Believing the prohibition covers only the ID card: it also reaches anywhere visible to the public and general-circulation documents.
• Overlooking the personnel directory: the law prohibits it when made available to anyone without need or authority of access.
• Accepting "it is for payroll" as the final answer: that exception is subject to the employer taking due confidentiality safeguards.
• Accepting that the number cannot be redacted in a public document: the law says editing it is not considered altering the content.
• Assuming the fine is discretionary from zero: the law sets a $500 floor and a $5,000 ceiling per case.
• Giving up a stronger protection in the collective agreement: the law expressly says it does not diminish existing ones.

These are the government pages this guide is based on.

• Departamento del Trabajo y Recursos Humanos (DTRH)

  Departamento del Trabajo

  bvirtualogp.pr.gov

• Department of Labor and Human Resources (DTRH)

  DTRH

  www.trabajo.pr.gov