On March 21, 2023, Virginia’s governor approved Senate Bill 1040, which prohibits an employer from using an employee’s social security number or any derivative as an employee’s identification number. The bill also prohibits including an employee’s social security number or any number derived from the social security number on any identification card or badge.

An employer who knowingly violates the new law may be subject to a civil penalty not to exceed $100 for each violation. However, the employer shall be provided notice of the violation by the state Commissioner and the employer can request an informal conference regarding the violation.

The bill takes effect on July 1, 2023.

Virginia joins other states with similar prohibitions such as in New York and under federal law.  

If you have questions about Virginia’s bill or the protection of employees’ social security numbers, contact a Jackson Lewis attorney to discuss.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Jason C. Gavejian Jason C. Gavejian

Jason C. Gavejian is the office managing principal of the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. and a member of the firm’s Board of Directors. He is also a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy…

Jason C. Gavejian is the office managing principal of the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. and a member of the firm’s Board of Directors. He is also a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy Professionals.

As a Certified Information Privacy Professional (CIPP/US), Jason focuses on the matrix of laws governing privacy, security, and management of data. Jason is co-editor of, and a regular contributor to, the firm’s Privacy blog.

Jason’s work in the area of privacy and data security includes counseling international, national, and regional companies on the vast array of privacy and security mandates, preventive measures, policies, procedures, and best practices. This includes, but is not limited to, the privacy and security requirements under state, federal, and international law (e.g., HIPAA/HITECH, GDPR, California Consumer Privacy Act (CCPA), FTC Act, ECPA, SCA, GLBA etc.). Jason helps companies in all industries to assess information risk and security as part of the development and implementation of comprehensive data security safeguards including written information security programs (WISP). Additionally, Jason assists companies in analyzing issues related to: electronic communications, social media, electronic signatures (ESIGN/UETA), monitoring and recording (GPS, video, audio, etc.), biometrics, and bring your own device (BYOD) and company owned personally enabled device (COPE) programs, including policies and procedures to address same. He regularly advises clients on compliance issues under the Telephone Consumer Protection Act (TCPA) and has represented clients in suits, including class actions, brought in various jurisdictions throughout the country under the TCPA.

Photo of Joseph J. Lazzarotti Joseph J. Lazzarotti

Joe has had the honor of being a part of the AmLaw 100, nationwide law firm, Jackson Lewis, which has 60+ offices around the country, for nearly 25 years. After practicing in the northeast for most of his career, Joe is resident in…

Joe has had the honor of being a part of the AmLaw 100, nationwide law firm, Jackson Lewis, which has 60+ offices around the country, for nearly 25 years. After practicing in the northeast for most of his career, Joe is resident in the firm’s growing Tampa office.

In 2005, as an associate, Joe founded and currently co-leads the firm’s national privacy, cybersecurity, and AI practice groups, which touts 25+ attorneys navigating complex and emerging challenges, particularly around the collection, use, disclosure, and retention of personal information, the deployment of artificial intelligence, and overall governance, risk and compliance in these areas, including FTCA, HIPAA, NIST, CCPA, CPRA, BIPA, GIPA, NY SHIELD, CIPA, etc. Joe has handled hundreds of data breaches, stood up cybersecurity compliance programs, and established AI governance programs.