On June 10, 2008, Connecticut Governor M. Jodi Rell signed into law “An Act Concerning the Confidentiality of Social Security Numbers,” Public Act No. 08-167 (the “Act”). The Act, which becomes effective October 1, 2008, requires any person who collects Social Security numbers in the course of business to create a privacy protection policy. The policy, which must be published or publicly displayed, must: (1) protect the confidentiality of Social Security numbers; (2) prohibit unlawful disclosure of Social Security numbers; and (3) limit access to Social Security numbers. The policy may be posted on an Internet website to satisfy the public display requirement.
Under the Act, any person in possession of personal information of another person must safeguard the data, computer files and documents containing the information from misuse by third parties and destroy, erase or make unreadable the data, computer files and documents prior to disposal. The Act defines “personal information” as information capable of being associated with a particular individual through one or more identifiers, including, but not limited to, a Social Security number, a driver’s license number, a state identification card number, an account number, a credit or debit card number, a passport number, an alien registration number or a health insurance identification number.
Although the Act does not provide a private right of action, anyone who intentionally violates the Act is subject to a civil penalty of $500.00 for each violation.