Can I Sue My Employer for Giving Out My Social Security Number?

You can sue your employer for giving out your Social Security number, but a disclosure by itself is rarely enough. You generally need to show the disclosure caused you real, documentable harm, and the legal route depends on who your employer is. Federal workers have the Privacy Act of 1974. Everyone else relies on state privacy statutes, negligence claims, and breach of contract theories, with data breach notification laws sometimes adding leverage.

Who Your Employer Is Decides Your Options

The Privacy Act of 1974 is the statute people most often assume protects them. It doesn’t, for most workers. The Privacy Act applies only to federal agencies and governs how those agencies collect, maintain, use, and disclose records about individuals.¹ Private businesses, nonprofits, and state and local governments are not covered.²

If you work for a federal agency and it disclosed your SSN without your consent, and no statutory exception applied, you can sue under the Privacy Act for actual damages. Agencies may only share records with employees who need them for their duties, in response to a court order, or under roughly a dozen other narrow exceptions.²

If your employer is private, look to your state. More than twenty states have laws that specifically regulate how organizations collect, display, transmit, and disclose Social Security numbers. These laws typically prohibit publicly posting SSNs, printing them on ID cards, mailing them where the number is visible through the envelope, or requiring them unnecessarily as a condition of service. Some restrict communicating SSNs to the public.

Enforcement varies. Some states impose civil penalties, some let affected individuals sue directly for damages, and others rely on the attorney general. Because the details depend entirely on your state, checking your state’s specific SSN protection statute is the first practical step. Many state attorney general websites publish plain-language summaries.

The Legal Theories You Can Sue Under

Setting aside the federal-employee route, three general theories carry most SSN disclosure lawsuits: negligence, statutory violations, and breach of contract.

Negligence

A negligence claim requires four elements: your employer had a duty to protect your SSN, the employer breached that duty, the breach caused you harm, and the harm produced actual damages. Courts have recognized that employers who collect sensitive employee data as a condition of employment owe a duty to protect it from foreseeable threats. Storing unencrypted SSNs on an internet-accessible server, for example, may breach that duty.

The Federal Trade Commission’s guidance to businesses on encrypting sensitive data, restricting access to those with a legitimate need, training staff, and vetting third-party providers acts as a practical yardstick for reasonable care.³ Falling well short of that standard strengthens a negligence claim.

Causation and damages are where negligence cases get hard. You have to connect the employer’s specific failure to your specific loss. Someone opening a fraudulent credit card in your name two months after your employer emailed your SSN to the wrong vendor is a stronger causal chain than a theft two years later with no clear link.

Statutory Violations

Where a state statute specifically governs SSN protection or data privacy, a violation can create a direct cause of action. Some of these laws provide statutory damages, meaning a set dollar amount per violation even when itemizing exact losses is difficult. Illinois’s Biometric Information Privacy Act allows $1,000 to $5,000 per violation for biometric data mishandling. California’s Consumer Privacy Act allows individuals to seek between $107 and $799 per consumer per incident (as adjusted for 2025), or actual damages if higher.⁴ Not every state privacy statute includes a private right of action; some are enforced only by the attorney general or another government body.

Breach of Contract

If your employment agreement, employee handbook, or company privacy policy specifically promises to protect your personal data, failure to do so may be a breach of contract. Courts look for a clear promise and a direct connection to your damages. A vague line about valuing employee privacy generally won’t support the claim. A written policy stating that SSNs will be stored in encrypted systems with access limited to HR gives you much stronger footing if the employer instead kept them in a shared spreadsheet.

The Concrete Harm Hurdle

This is where most SSN and data breach cases stall. Federal courts require what lawyers call standing, and the Supreme Court has raised the bar. To sue in federal court, you must show an actual or imminent concrete injury that was caused by the defendant and can be fixed by a court ruling.⁵

In Spokeo, Inc. v. Robins, the Court held that a bare procedural violation of a statute, without a resulting concrete harm, is not enough. In TransUnion LLC v. Ramirez, the Court reinforced that merely having inaccurate information in a file, without that information being shared or causing real-world consequences, doesn’t satisfy the injury requirement.⁵

In practical terms, if your employer disclosed your SSN but nothing bad has happened yet, a federal court may dismiss your case. You’re in a much stronger position if you can document actual identity theft, fraudulent charges, time spent resolving problems, or out-of-pocket costs like credit monitoring. State courts often apply different, sometimes more lenient standing rules, and some recognize the risk of future harm as a sufficient injury. Filing in state court rather than federal court may be the better move depending on where you are.

What You Can Recover

Damages depend on your theory and jurisdiction, but they generally fall into four buckets.

Actual damages cover out-of-pocket losses directly caused by the disclosure: fraudulent charges, credit repair costs, credit monitoring fees, lost wages from time spent resolving the problem, and similar expenses. Clear documentation is essential. Save every receipt, statement, and record.

Statutory damages, where a state privacy statute provides them, give you a fixed amount per violation without having to itemize every dollar of loss. California’s CCPA provides $107 to $799 per consumer per incident.⁴ Illinois’s BIPA allows $1,000 to $5,000 per violation. Modest per person, potentially enormous across a class of employees.

Emotional distress damages are available in many jurisdictions when your SSN exposure caused real anxiety. Judges typically want supporting evidence: records of therapy or counseling, a documented diagnosis, or testimony from family about the effect on your daily life. A one-line claim of stress rarely holds up.

Punitive damages are reserved for the worst employer conduct. You won’t get them for an honest mistake or ordinary negligence. Courts require evidence of willful misconduct, malicious intent, or reckless indifference. An employer that knowingly ignored security vulnerabilities for years, or deliberately shared SSNs with an unauthorized party knowing the risk, could face them.

Check Your Employment Agreement First

Before planning a lawsuit, pull out your employment agreement. Many employers include mandatory arbitration clauses that require private arbitration instead of court. The Supreme Court upheld these clauses in Epic Systems Corp. v. Lewis, ruling that the Federal Arbitration Act requires enforcement of arbitration agreements as written, including those that waive class or collective actions.⁶

A mandatory arbitration clause combined with a class action waiver usually means individual arbitration: no jury, limited discovery, typically confidential. That’s not fatal to your case, but it changes the calculation. Some plaintiffs’ attorneys have used class waivers against employers by filing dozens or hundreds of individual arbitration demands at once, since the employer often has to pay the arbitrator’s fees for each.

If you signed an arbitration agreement without receiving anything in return, or the terms are extremely one-sided, an attorney may argue the clause is unconscionable under your state’s contract law. These challenges succeed occasionally, though federal courts have generally trended toward enforcement.

Statute of Limitations

Every lawsuit has a filing deadline, and missing it ends your right to sue. For negligence-based claims, the relevant deadline is generally your state’s personal injury or general tort limitations period. Two years is the largest group of states, three years is another significant group, and the range runs to four to six years in a smaller number of states.

When the clock starts matters just as much. Many states apply a discovery rule that starts the period when you discover, or reasonably should have discovered, the breach, not when it occurred. If your employer lost your SSN in January but didn’t tell you until September, the clock may not start until September. That distinction can preserve your claim after what looks like a long gap.

Statutory claims under state privacy laws may have their own deadlines, sometimes shorter than the general negligence period. Check both before assuming you have time.

Steps to Take Now

Whether or not you sue, quick protective action limits your exposure and builds the paper trail you’ll need if you do file.

Place a credit freeze. Federal law requires all three major credit bureaus (Equifax, Experian, TransUnion) to freeze your file for free. A freeze prevents new creditors from pulling your report.
Set a fraud alert. An initial alert lasts one year; an extended alert for confirmed identity theft victims lasts seven years.⁷
File an identity theft report at IdentityTheft.gov. The site generates a recovery plan and produces documents you can send to creditors and debt collectors.
Request an IRS Identity Protection PIN. The six-digit PIN prevents anyone else from filing a tax return using your SSN. If IRS records already show you as an identity theft victim, you’ll be enrolled automatically.⁸
File IRS Form 14039 if you see signs of tax-related identity theft, such as an IRS notice about wages from an employer you never worked for. Don’t file this form for non-tax identity theft.⁹
Report to the SSA Office of the Inspector General if the disclosure involves potential Social Security benefits fraud. You can report confidentially or anonymously.¹⁰
Document everything: the employer’s breach notification, related correspondence, credit reports showing new inquiries or accounts, receipts for monitoring, and a log of hours spent handling the aftermath. This becomes your evidence.

Defenses Your Employer Will Raise

Employers facing these claims run a few standard defenses, and knowing them helps you gauge your case.

The most common is that the employer took reasonable steps to protect your data. If it used encryption, limited access to authorized personnel, ran regular security audits, and trained employees on data handling, a court may find no breach of duty. The employer may argue the disclosure resulted from an unforeseeable event like a sophisticated cyberattack that defeated industry-standard defenses. Reasonableness is the standard, not perfection.³

Employers also challenge causation and damages. Expect arguments that your identity theft came from a different source, that your claimed losses are speculative, or that you failed to mitigate by not freezing your credit promptly. If the employer offered free credit monitoring after the breach and you didn’t use it, that will come up. Employers who responded quickly and offered protective services put themselves in a stronger defensive position.

Complaints Beyond the Courtroom

A lawsuit isn’t always the practical remedy, especially when provable damages are small. Regulatory complaints can trigger investigations and penalties that hold your employer accountable when litigation doesn’t make financial sense for you individually.

Your state attorney general’s office handles consumer protection and data breach complaints. Most have an online complaint form, and the office can investigate patterns, impose fines, and require security improvements. The Federal Trade Commission takes enforcement action against companies that fail to reasonably protect personal data, using its Section 5 authority over unfair or deceptive practices.¹¹ The FTC doesn’t resolve individual disputes, but it uses complaints to identify companies and patterns worth investigating.

1
U.S. Department of Justice. Privacy Act of 1974
2
Office of the Law Revision Counsel. 5 U.S. Code 552a – Records Maintained on Individuals
3
Federal Trade Commission. Protecting Personal Information: A Guide for Business
4
California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties
5
Congressional Research Service. Article III Standing in Data Breach Cases
6
Supreme Court of the United States. Epic Systems Corp. v. Lewis
7
Federal Trade Commission. Data Breach Response: A Guide for Business
8
Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)
9
Internal Revenue Service. When to File an Identity Theft Affidavit
10
Office of the Inspector General. Report Fraud
11
Federal Trade Commission. Privacy and Security Enforcement