It depends on the state. You should google your state, privacy law and social security number. In MD, anyone who obtains a piece of legally protected from someone is held responsible for maintaining its security and/or destroying it.

What obligations do nanny agencies have to safeguard a nanny's personal identity information, most critically her social security number?