Connecticut Governor M. Jodi Rell last week signed a law aimed at combating identity theft by limiting the collection of Social Security numbers and requiring merchants to secure personally identifiable information.
The law has implications for any firm with customers in Connecticut.
Dubbed Public Act 08-167, An Act Concerning the Confidentiality of Social Security Numbers, the law prohibits most private organizations from requiring people to provide their Social Security numbers as a condition of leasing or buying goods and services.
The bill exempts insurance companies, state or federally licensed financial services institutions, utility companies, health care or pharmaceutical-related services and credit card applications.
Those who do collect Social Security numbers are required to create and publicly display a privacy policy, prohibit unlawful disclosure of Social Security numbers, and limit access to them.
The act will also require that “any person in possession of personal information of another person” safeguard the information from misuse by third parties and destroy, erase or make unreadable the information prior to disposing of it.
The act defines personal information as any information capable of being associated with an individual, including Social Security numbers, driver’s license numbers, state identification card numbers, account numbers, credit or debit card numbers, passport numbers, alien registration numbers and health insurance identification numbers.
The penalty for breaking the law—which takes effect on January 1, 2009—is a fine of up to $100 for the first offense; up to $500 for the second offense; and up to $1,000, six months in prison or both for each subsequent offense.
