In general, a more specific law trumps a more general law, and a later law trumps an earlier enacted law. So the more specific rule of "States may ask for SSN'

In general, a more specific law trumps a more general law, and a later law trumps an earlier enacted law. So the more specific rule of "States may ask for SSN's for tax purposes" would override the general rule of "States may not ask for SSN's". And the exception was presumably enacted after the general rule, since otherwise there would have been no need to make an exception.