Look at NY law.
they have one.
It addresses a multitude of entities and how you are not allowed to reveal social security numbers.
Employees, customers, and other individuals in situations where the number is revealed in whole or in part.
Go find an exemption to it if you think it is legal
I think you could stand to have a refresher course on Bartnicki v. Vopper.