Connecticut Data Disposal Law
Conn. Gen. Stat. § 42-471
Connecticut General Statutes
Title 42 - Business, Selling, Trading and Collection Practices
Sec. 42-471. Safeguarding of personal information. Social Security numbers. Privacy protection policy. Civil penalty.
Sec. 42-471. Safeguarding of personal information. Social Security numbers. Privacy protection policy. Civil penalty. (a) Any person in possession of personal information of another person shall safeguard the data, computer files and documents containing the information from misuse by third parties, and shall destroy, erase or make unreadable such data, computer files and documents prior to disposal.
(b) Any person who collects Social Security numbers in the course of business shall create a privacy protection policy which shall be published or publicly displayed. For purposes of this subsection, “publicly displayed” includes, but is not limited to, posting on an Internet web page. Such policy shall: (1) Protect the confidentiality of Social Security numbers, (2) prohibit unlawful disclosure of Social Security numbers, and (3) limit access to Social Security numbers.
(c) As used in this section, (1) “personal information” means information capable of being associated with a particular individual through one or more identifiers, including, but not limited to, a Social Security number, a driver's license number, a state identification card number, an account number, a credit or debit card number, a passport number, an alien registration number, a health insurance identification number or any military identification information, and does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media, and (2) “military identification information” means information identifying a person as a member of the armed forces, as defined in section 27-103, or a veteran, as defined in said section, including, but not limited to, a selective service number, military identification number, discharge document, military identification card or military retiree identification card.
(d) For persons who hold a license, registration or certificate issued by, or a charter subject to the supervision of, a state agency other than the Department of Consumer Protection, this section shall be enforceable only by such other state agency pursuant to such other state agency's existing statutory and regulatory authority.
(e) Any person or entity that violates the provisions of this section shall be subject to a civil penalty of five hundred dollars for each violation, provided such civil penalty shall not exceed five hundred thousand dollars for any single event. It shall not be a violation of this section if such violation was unintentional.
(f) The provisions of this section shall not apply to any agency or political subdivision of the state.
(g) If a financial institution has adopted safeguards that comply with the standards established pursuant to Section 501(b) of the Gramm-Leach-Bliley Act of 1999, 15 USC 6801, then such compliance shall constitute compliance with the provisions of this section.
(h) Any civil penalties received pursuant to this section shall be deposited into the privacy protection guaranty and enforcement account established pursuant to section 42-472a.
(P.A. 08-167, S. 1; P.A. 09-71, S. 1; 09-239, S. 13; P.A. 17-137, S. 1.)
History: P.A. 09-71 amended Subsec. (d) by adding “or a charter subject to the supervision of”, deleted former Subsec. (g) re civil penalties and added new Subsec. (g) re safeguards that comply with Gramm-Leach-Bliley Act; P.A. 09-239 added Subsec. (h) re deposit of civil penalties into privacy protection guaranty and enforcement account, effective July 9, 2009; P.A. 17-137 amended Subsec. (c) to designate existing provision re definition of “personal information” as Subdiv. (1), redefine “personal information”, add Subdiv. (2) re definition of “military identification information”, and make technical changes.
Sec. 42-470. Restriction on posting, display, transmission and use of Social Security numbers. Exceptions. Penalties. (a) For the purposes of this section, “person” means any individual, firm, partnership, association, corporation, limited liability company, organization or other entity, but does not include the state or any political subdivision of the state, or any agency thereof.
(b) Except as provided in subsection (c) of this section, no person shall:
(1) Publicly post or publicly display in any manner an individual's Social Security number. For the purposes of this subdivision, “publicly post” or “publicly display” means to intentionally communicate or otherwise make available to the general public;
(2) Print an individual's Social Security number on any card required for the individual to access products or services provided by such person;
(3) Require an individual to transmit such individual's Social Security number over the Internet, unless the connection is secure or the Social Security number is encrypted; or
(4) Require an individual to use such individual's Social Security number to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site.
(c) The provisions of subsection (b) of this section shall apply with respect to group and individual health insurance policies providing coverage of the type specified in subdivisions (1), (2), (4), (6), (10) and (12) of section 38a-469 that are delivered, issued for delivery, amended, renewed or continued on and after July 1, 2005.
(d) This section does not prevent the collection, use or release of a Social Security number as required by state or federal law or the use of a Social Security number for internal verification or administrative purposes.
(e) Any person who wilfully violates the provisions of subsection (b) of this section shall be fined not more than one hundred dollars for a first offense and not more than five hundred dollars for a second offense, and shall be fined not more than one thousand dollars or be imprisoned not more than six months, or both, for each subsequent offense.
(f) Any person who wilfully violates the provisions of subsection (b) of this section shall be subject to a civil penalty of five hundred dollars for each such violation, provided such civil penalty shall not exceed five hundred thousand dollars for any single event.
(g) All civil penalties received pursuant to subsection (f) of this section shall be deposited into the privacy protection guaranty and enforcement account established under section 42-472a.
(P.A. 03-156, S. 13; P.A. 09-239, S. 14.)
History: P.A. 09-239 removed “on and after January 1, 2005,” in Subsec. (b), added Subsec. (f) re civil penalty and added Subsec. (g) re deposit of civil penalties into privacy protection guaranty and enforcement account.
For more information, see here: https://www.cga.ct.gov/current/pub/chap_743dd.htm#sec_42-471
These materials were obtained directly from the State Legislative websites and are posted here for your review and reference only. No Claim to Original State Government Works. This may not be the most recent version. The State may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.