(1) For the purposes of preventing fraud and protecting personal privacy, the department shall examine its current practices in which it discloses the full social security numbers of persons in its correspondence with nongovernmental third parties.

(2) If the disclosure of full social security numbers in its correspondence with nongovernmental third parties is not required for compliance with any state or federal law, the department shall:

(a) Institute procedures to replace the use of full social security numbers with other forms of personal identifiers in its correspondence with nongovernmental third parties; and

(b) By July 1, 2023, cease disclosing the full social security numbers of persons in its correspondence with nongovernmental third parties.

(3) The definitions in this subsection apply throughout this section:

(a) "Correspondence" means written communications, emails, or other similar communications. "Correspondence" does not include financial transactions or communications sent via secured or encrypted methods.

(b) "Nongovernmental third party" means an individual, corporation, business trust, estate, trust, partnership, association, joint venture, or other legal commercial entity. The term does not include a government or governmental subdivision, agency, or instrumentality.