Before a nonprofit corporation in the regular course of business or in the provision of services requests that a volunteer provide the volunteer's social security number, the corporation shall adopt a privacy protection policy that sets forth the manner in which the corporation intends to secure and protect any social security numbers in its possession or in the possession of a third party with whom the corporation shares or will share the numbers. The policy must specify measures that limit access to social security numbers and processes and procedures that mitigate against the improper disclosure of social security numbers. The corporation shall:
(1) Provide the policy to any volunteer who has been requested to provide the volunteer's social security number to the nonprofit corporation; and
(2) Make the policy available in printed form, upon request.